update oauth

2026-06-25 14:40:05 +03:00
parent 1796008a28
commit 6c63343fc7
19 changed files with 623 additions and 200 deletions
--- a/apps/api-gateway/src/app.module.ts
+++ b/apps/api-gateway/src/app.module.ts
@@ -14,6 +14,7 @@ import { ProfileController } from './controllers/profile.controller';
 import { DocumentsController } from './controllers/documents.controller';
 import { AddressesController } from './controllers/addresses.controller';
 import { OAuthController } from './controllers/oauth.controller';
+import { WellKnownController, OAuthAuthorizeDiscoveryController } from './controllers/well-known.controller';
 import { AdvancedAuthController } from './controllers/advanced-auth.controller';
 import { FamilyController } from './controllers/family.controller';
 import { ChatController } from './controllers/chat.controller';
@@ -54,7 +55,7 @@ import { AdminGuard, SuperAdminGuard } from './guards/admin.guard';
      }
    ])
  ],
-  controllers: [AuthController, AdminController, RbacController, SecurityController, SettingsController, PublicSettingsController, HealthController, ProfileController, DocumentsController, AddressesController, OAuthController, AdvancedAuthController, FamilyController, ChatController, NotificationsController, MediaController],
+  controllers: [AuthController, AdminController, RbacController, SecurityController, SettingsController, PublicSettingsController, HealthController, ProfileController, DocumentsController, AddressesController, OAuthController, WellKnownController, OAuthAuthorizeDiscoveryController, AdvancedAuthController, FamilyController, ChatController, NotificationsController, MediaController],
  providers: [CoreGrpcService, AdminGuard, SuperAdminGuard]
 })
 export class AppModule {}
--- a/apps/api-gateway/src/controllers/well-known.controller.ts
+++ b/apps/api-gateway/src/controllers/well-known.controller.ts
@@ -0,0 +1,45 @@
+import { Controller, Get } from '@nestjs/common';
+import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import { CoreGrpcService } from '../core-grpc.service';
+import { buildOpenIdConfiguration, resolveOAuthIssuer } from '../lib/oauth-issuer';
+
+@ApiTags('OpenID Connect')
+@Controller('.well-known')
+export class WellKnownController {
+  constructor(private readonly core: CoreGrpcService) {}
+
+  @Get('openid-configuration')
+  @ApiOperation({
+    summary: 'OpenID Connect Discovery',
+    description: 'Метаданные OIDC-провайдера. Issuer и endpoints берутся из PUBLIC_API_URL в настройках.'
+  })
+  async openIdConfiguration() {
+    const issuer = await resolveOAuthIssuer(this.core);
+    return buildOpenIdConfiguration(issuer);
+  }
+
+  @Get('jwks.json')
+  @ApiOperation({
+    summary: 'JWKS',
+    description: 'Пустой набор ключей: токены подписываются HS256 на стороне IdP. Для проверки id_token используйте userinfo.'
+  })
+  jwks() {
+    return { keys: [] };
+  }
+}
+
+@ApiTags('OpenID Connect')
+@Controller('oauth/authorize')
+export class OAuthAuthorizeDiscoveryController {
+  constructor(private readonly core: CoreGrpcService) {}
+
+  @Get('.well-known/openid-configuration')
+  @ApiOperation({
+    summary: 'OpenID Discovery (alias)',
+    description: 'Совместимость с клиентами, ошибочно использующими authorization endpoint как issuer.'
+  })
+  async openIdConfigurationAlias() {
+    const issuer = await resolveOAuthIssuer(this.core);
+    return buildOpenIdConfiguration(issuer);
+  }
+}
--- a/apps/api-gateway/src/lib/oauth-issuer.ts
+++ b/apps/api-gateway/src/lib/oauth-issuer.ts
@@ -0,0 +1,56 @@
+import { firstValueFrom } from 'rxjs';
+import { CoreGrpcService } from '../core-grpc.service';
+
+function normalizeBaseUrl(url: string) {
+  return url.trim().replace(/\/+$/, '');
+}
+
+export async function resolveOAuthIssuer(core: CoreGrpcService, fallback = 'http://localhost:3000'): Promise<string> {
+  const envIssuer = process.env.PUBLIC_API_URL?.trim();
+  try {
+    const response = (await firstValueFrom(core.settings.GetSetting({ key: 'PUBLIC_API_URL' }))) as { value?: string };
+    const fromDb = response.value?.trim();
+    if (fromDb) {
+      return normalizeBaseUrl(fromDb);
+    }
+  } catch {
+    // fallback ниже
+  }
+
+  if (envIssuer) {
+    return normalizeBaseUrl(envIssuer);
+  }
+
+  try {
+    const response = (await firstValueFrom(core.settings.GetSetting({ key: 'PROJECT_DOMAIN' }))) as { value?: string };
+    const domain = response.value?.trim();
+    if (domain) {
+      if (domain.startsWith('http://') || domain.startsWith('https://')) {
+        return normalizeBaseUrl(domain);
+      }
+      return `https://${domain.replace(/^\/+/, '')}`;
+    }
+  } catch {
+    // fallback ниже
+  }
+
+  return normalizeBaseUrl(fallback);
+}
+
+export function buildOpenIdConfiguration(issuer: string) {
+  const base = normalizeBaseUrl(issuer);
+  return {
+    issuer: base,
+    authorization_endpoint: `${base}/oauth/authorize`,
+    token_endpoint: `${base}/oauth/token`,
+    userinfo_endpoint: `${base}/oauth/userinfo`,
+    jwks_uri: `${base}/.well-known/jwks.json`,
+    response_types_supported: ['code'],
+    subject_types_supported: ['public'],
+    id_token_signing_alg_values_supported: ['HS256'],
+    scopes_supported: ['openid', 'profile', 'email', 'phone', 'address', 'documents'],
+    token_endpoint_auth_methods_supported: ['client_secret_post'],
+    grant_types_supported: ['authorization_code', 'refresh_token'],
+    claims_supported: ['sub', 'email', 'phone', 'name', 'picture']
+  };
+}
--- a/apps/docs/components/oauth-code-tabs.tsx
+++ b/apps/docs/components/oauth-code-tabs.tsx
@@ -1,8 +1,30 @@
 'use client';

-import { oauthExamples } from '@/lib/oauth-examples';
+import { useEffect, useMemo, useState } from 'react';
+import { buildOAuthExamples } from '@/lib/oauth-examples';
+import { fetchPublicSettingsClient } from '@/lib/api';
+import { resolveOAuthApiBase } from '@/lib/oauth-url';
 import { CodeExampleTabs } from '@/components/code-example-tabs';

 export function OAuthCodeTabs() {
-  return <CodeExampleTabs examples={oauthExamples} />;
+  const [apiBase, setApiBase] = useState('http://localhost:3000');
+
+  useEffect(() => {
+    void fetchPublicSettingsClient()
+      .then((settings) => setApiBase(resolveOAuthApiBase(settings)))
+      .catch(() => undefined);
+  }, []);
+
+  const examples = useMemo(() => buildOAuthExamples(apiBase), [apiBase]);
+
+  return (
+    <div className="space-y-3">
+      <p className="text-sm text-zinc-500 dark:text-zinc-400">
+        Базовый URL API (issuer): <code className="rounded bg-zinc-100 px-1.5 py-0.5 dark:bg-zinc-800">{apiBase}</code>
+        {' — '}
+        берётся из настройки <strong>PUBLIC_API_URL</strong> или <strong>Домен IdP</strong> в админ-панели.
+      </p>
+      <CodeExampleTabs examples={examples} />
+    </div>
+  );
 }
--- a/apps/docs/lib/api-endpoints.ts
+++ b/apps/docs/lib/api-endpoints.ts
@@ -33,6 +33,7 @@ export const apiReference: ApiTagGroup[] = [
  {
    tag: 'OAuth 2.0',
    endpoints: [
+      { method: 'GET', path: '/.well-known/openid-configuration', summary: 'OpenID Connect Discovery' },
      { method: 'GET', path: '/oauth/authorize', summary: 'Создать authorization code' },
      { method: 'POST', path: '/oauth/token', summary: 'Выдать OAuth токены (code / refresh_token)' },
      { method: 'GET', path: '/oauth/userinfo', summary: 'Профиль по OAuth access token', auth: true }
--- a/apps/docs/lib/docs-pages.ts
+++ b/apps/docs/lib/docs-pages.ts
@@ -40,7 +40,7 @@ export const docPages: DocPage[] = [
            type: 'callout',
            variant: 'info',
            title: 'Домен',
-            text: 'Production-домен: id.lendry.ru. Локально API доступен на порту 3000, frontend — 3002, документация — 3003.'
+            text: 'Production-домен задаётся в админке (PROJECT_DOMAIN и PUBLIC_API_URL). Локально API — порт 3000, frontend — 3002, документация — 3003. При same-origin деплое PUBLIC_API_URL обычно https://ваш-домен/idp-api.'
          }
        ]
      },
@@ -767,7 +767,13 @@ curl -X POST http://localhost:3000/auth/otp/verify \\
        blocks: [
          {
            type: 'paragraph',
-            text: '1) Пользователь авторизуется в Lendry ID. 2) Ваше приложение перенаправляет на GET /oauth/authorize с clientId, redirectUri, scope, userId. 3) IdP возвращает redirectUrl с authorization code. 4) Backend обменивает code на токены через POST /oauth/token. 5) GET /oauth/userinfo возвращает профиль.'
+            text: '1) Пользователь авторизуется в IdP. 2) Ваше приложение перенаправляет на GET /oauth/authorize с clientId, redirectUri, scope, userId. 3) IdP возвращает redirectUrl с authorization code. 4) Backend обменивает code на токены через POST /oauth/token. 5) GET /oauth/userinfo возвращает профиль. Базовый URL (issuer) берётся из настройки PUBLIC_API_URL в админ-панели — примеры кода ниже подставляют его автоматически.'
+          },
+          {
+            type: 'callout',
+            variant: 'info',
+            title: 'OpenID Connect Discovery',
+            text: 'Метаданные провайдера: GET {PUBLIC_API_URL}/.well-known/openid-configuration. В стороннем сервисе укажите issuer = PUBLIC_API_URL (например https://sso.example.ru/idp-api), а не URL authorization endpoint. Если API доступен через /idp-api на домене frontend, issuer тоже должен включать этот путь.'
          },
          {
            type: 'callout',
--- a/apps/docs/lib/oauth-examples.ts
+++ b/apps/docs/lib/oauth-examples.ts
@@ -5,14 +5,15 @@ export interface OAuthExample {
  code: string;
 }

-const API_BASE = 'https://id.lendry.ru';
+export function buildOAuthExamples(apiBase: string): OAuthExample[] {
+  const API_BASE = apiBase.replace(/\/+$/, '');

-export const oauthExamples: OAuthExample[] = [
-  {
-    id: 'javascript',
-    label: 'JavaScript',
-    language: 'javascript',
-    code: `// Authorization Code Flow (Node.js / браузер)
+  return [
+    {
+      id: 'javascript',
+      label: 'JavaScript',
+      language: 'javascript',
+      code: `// Authorization Code Flow (Node.js / браузер)
 const clientId = 'YOUR_CLIENT_ID';
 const redirectUri = 'https://app.example.com/oauth/callback';
 const scope = 'openid profile email';
@@ -27,6 +28,9 @@ authorizeUrl.searchParams.set('scope', scope);
 authorizeUrl.searchParams.set('state', state);
 window.location.href = authorizeUrl.toString();

+// OIDC Discovery (issuer = PUBLIC_API_URL из настроек админки)
+// GET ${API_BASE}/.well-known/openid-configuration
+
 // Шаг 2: обменять code на токены (на backend!)
 const tokenResponse = await fetch('${API_BASE}/oauth/token', {
  method: 'POST',
@@ -45,20 +49,21 @@ const tokens = await tokenResponse.json();
 const profile = await fetch('${API_BASE}/oauth/userinfo', {
  headers: { Authorization: \`Bearer \${tokens.accessToken}\` }
 }).then((r) => r.json());`
-  },
-  {
-    id: 'typescript-next',
-    label: 'Next.js',
-    language: 'typescript',
-    code: `// app/api/oauth/callback/route.ts
+    },
+    {
+      id: 'typescript-next',
+      label: 'Next.js',
+      language: 'typescript',
+      code: `// app/api/oauth/callback/route.ts
 import { NextRequest, NextResponse } from 'next/server';

+const ISSUER = '${API_BASE}';
+
 export async function GET(request: NextRequest) {
  const code = request.nextUrl.searchParams.get('code');
-  const state = request.nextUrl.searchParams.get('state');
  if (!code) return NextResponse.redirect('/login?error=oauth');

-  const tokenRes = await fetch('${API_BASE}/oauth/token', {
+  const tokenRes = await fetch(\`\${ISSUER}/oauth/token\`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
@@ -75,12 +80,12 @@ export async function GET(request: NextRequest) {
  response.cookies.set('access_token', tokens.accessToken, { httpOnly: true, secure: true });
  return response;
 }`
-  },
-  {
-    id: 'python',
-    label: 'Python',
-    language: 'python',
-    code: `import requests
+    },
+    {
+      id: 'python',
+      label: 'Python',
+      language: 'python',
+      code: `import requests
 from urllib.parse import urlencode

 API_BASE = '${API_BASE}'
@@ -88,7 +93,9 @@ CLIENT_ID = 'YOUR_CLIENT_ID'
 CLIENT_SECRET = 'YOUR_CLIENT_SECRET'
 REDIRECT_URI = 'https://app.example.com/oauth/callback'

-# Ссылка для входа пользователя
+# OIDC Discovery
+discovery = requests.get(f'{API_BASE}/.well-known/openid-configuration', timeout=15).json()
+
 params = urlencode({
    'userId': 'USER_ID',
    'clientId': CLIENT_ID,
@@ -98,7 +105,6 @@ params = urlencode({
 })
 authorize_url = f'{API_BASE}/oauth/authorize?{params}'

-# Обмен authorization code на токены
 token_response = requests.post(f'{API_BASE}/oauth/token', json={
    'grantType': 'authorization_code',
    'code': 'AUTHORIZATION_CODE',
@@ -108,24 +114,25 @@ token_response = requests.post(f'{API_BASE}/oauth/token', json={
 }, timeout=15)
 tokens = token_response.json()

-# UserInfo
 profile = requests.get(
    f'{API_BASE}/oauth/userinfo',
    headers={'Authorization': f"Bearer {tokens['accessToken']}"},
    timeout=15
 ).json()`
-  },
-  {
-    id: 'php',
-    label: 'PHP',
-    language: 'php',
-    code: `<?php
-$apiBase = '${API_BASE}';
+    },
+    {
+      id: 'php',
+      label: 'PHP',
+      language: 'php',
+      code: `<?php
+$apiBase = '${API_BASE}'; // issuer = PUBLIC_API_URL из админки
 $clientId = getenv('OAUTH_CLIENT_ID');
 $clientSecret = getenv('OAUTH_CLIENT_SECRET');
 $redirectUri = 'https://app.example.com/oauth/callback';

-// Redirect пользователя
+// OIDC Discovery — используйте issuer, а не authorization endpoint
+$discovery = json_decode(file_get_contents($apiBase . '/.well-known/openid-configuration'), true);
+
 $params = http_build_query([
    'userId' => 'USER_ID',
    'clientId' => $clientId,
@@ -134,41 +141,13 @@ $params = http_build_query([
    'state' => bin2hex(random_bytes(16)),
 ]);
 header('Location: ' . $apiBase . '/oauth/authorize?' . $params);
-exit;
-
-// Callback: обмен code -> token
-$payload = json_encode([
-    'grantType' => 'authorization_code',
-    'code' => $_GET['code'],
-    'clientId' => $clientId,
-    'clientSecret' => $clientSecret,
-    'redirectUri' => $redirectUri,
-]);
-
-$ch = curl_init($apiBase . '/oauth/token');
-curl_setopt_array($ch, [
-    CURLOPT_POST => true,
-    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
-    CURLOPT_POSTFIELDS => $payload,
-    CURLOPT_RETURNTRANSFER => true,
-]);
-$tokens = json_decode(curl_exec($ch), true);
-curl_close($ch);
-
-// UserInfo
-$ch = curl_init($apiBase . '/oauth/userinfo');
-curl_setopt_array($ch, [
-    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $tokens['accessToken']],
-    CURLOPT_RETURNTRANSFER => true,
-]);
-$profile = json_decode(curl_exec($ch), true);
-curl_close($ch);`
-  },
-  {
-    id: 'go',
-    label: 'Go',
-    language: 'go',
-    code: `package main
+exit;`
+    },
+    {
+      id: 'go',
+      label: 'Go',
+      language: 'go',
+      code: `package main

 import (
    "bytes"
@@ -187,63 +166,33 @@ func buildAuthorizeURL(userID, clientID, redirectURI, scope, state string) strin
    q.Set("scope", scope)
    q.Set("state", state)
    return apiBase + "/oauth/authorize?" + q.Encode()
-}
-
-func exchangeCode(code, clientID, clientSecret, redirectURI string) (map[string]any, error) {
-    body, _ := json.Marshal(map[string]string{
-        "grantType":    "authorization_code",
-        "code":         code,
-        "clientId":     clientID,
-        "clientSecret": clientSecret,
-        "redirectUri":  redirectURI,
-    })
-    resp, err := http.Post(apiBase+"/oauth/token", "application/json", bytes.NewReader(body))
-    if err != nil {
-        return nil, err
-    }
-    defer resp.Body.Close()
-    var tokens map[string]any
-    return tokens, json.NewDecoder(resp.Body).Decode(&tokens)
 }`
-  },
-  {
-    id: 'csharp',
-    label: 'C#',
-    language: 'csharp',
-    code: `using System.Net.Http.Json;
+    },
+    {
+      id: 'csharp',
+      label: 'C#',
+      language: 'csharp',
+      code: `using System.Net.Http.Json;

 var apiBase = "${API_BASE}";
 var clientId = Environment.GetEnvironmentVariable("OAUTH_CLIENT_ID");
-var clientSecret = Environment.GetEnvironmentVariable("OAUTH_CLIENT_SECRET");
 var redirectUri = "https://app.example.com/oauth/callback";

-// Authorization URL
+var discovery = await new HttpClient().GetFromJsonAsync<Dictionary<string, object>>(
+    $"{apiBase}/.well-known/openid-configuration");
+
 var authorizeUrl =
    $"{apiBase}/oauth/authorize?userId=USER_ID&clientId={clientId}" +
-    $"&redirectUri={Uri.EscapeDataString(redirectUri)}&scope=openid profile email&state=xyz";
+    $"&redirectUri={Uri.EscapeDataString(redirectUri)}&scope=openid profile email&state=xyz";`
+    },
+    {
+      id: 'curl',
+      label: 'cURL',
+      language: 'bash',
+      code: `# OIDC Discovery (issuer = ${API_BASE})
+curl ${API_BASE}/.well-known/openid-configuration

-using var http = new HttpClient();
-
-// Token exchange
-var tokenResponse = await http.PostAsJsonAsync($"{apiBase}/oauth/token", new {
-    grantType = "authorization_code",
-    code = "AUTHORIZATION_CODE",
-    clientId,
-    clientSecret,
-    redirectUri
-});
-var tokens = await tokenResponse.Content.ReadFromJsonAsync<Dictionary<string, object>>();
-
-// UserInfo
-http.DefaultRequestHeaders.Authorization =
-    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", tokens!["accessToken"].ToString());
-var profile = await http.GetFromJsonAsync<object>($"{apiBase}/oauth/userinfo");`
-  },
-  {
-    id: 'curl',
-    label: 'cURL',
-    language: 'bash',
-    code: `# Authorization (браузер пользователя)
+# Authorization (браузер пользователя)
 open "${API_BASE}/oauth/authorize?userId=USER_ID&clientId=CLIENT_ID&redirectUri=https%3A%2F%2Fapp.example.com%2Fcallback&scope=openid%20profile%20email&state=xyz"

 # Обмен code на токены
@@ -259,15 +208,10 @@ curl -X POST ${API_BASE}/oauth/token \\

 # UserInfo
 curl ${API_BASE}/oauth/userinfo \\
-  -H "Authorization: Bearer ACCESS_TOKEN"
+  -H "Authorization: Bearer ACCESS_TOKEN"`
+    }
+  ];
+}

-# Refresh token
-curl -X POST ${API_BASE}/oauth/token \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "grantType": "refresh_token",
-    "refreshToken": "REFRESH_TOKEN",
-    "clientId": "CLIENT_ID"
-  }'`
-  }
-];
+/** @deprecated Используйте buildOAuthExamples(apiBase) */
+export const oauthExamples = buildOAuthExamples('http://localhost:3000');
--- a/apps/docs/lib/oauth-url.ts
+++ b/apps/docs/lib/oauth-url.ts
@@ -0,0 +1,41 @@
+export function normalizeBaseUrl(url: string) {
+  return url.trim().replace(/\/+$/, '');
+}
+
+export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3000') {
+  const publicApi = settings.PUBLIC_API_URL?.trim();
+  if (publicApi) {
+    return normalizeBaseUrl(publicApi);
+  }
+
+  const domain = settings.PROJECT_DOMAIN?.trim();
+  if (domain) {
+    if (domain.startsWith('http://') || domain.startsWith('https://')) {
+      return normalizeBaseUrl(domain);
+    }
+    return `https://${domain.replace(/^\/+/, '')}`;
+  }
+
+  return normalizeBaseUrl(fallback);
+}
+
+export interface OAuthEndpoints {
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  userInfoEndpoint: string;
+  openIdConfigurationUrl: string;
+  jwksUrl: string;
+}
+
+export function buildOAuthEndpoints(apiBase: string): OAuthEndpoints {
+  const base = normalizeBaseUrl(apiBase);
+  return {
+    issuer: base,
+    authorizationEndpoint: `${base}/oauth/authorize`,
+    tokenEndpoint: `${base}/oauth/token`,
+    userInfoEndpoint: `${base}/oauth/userinfo`,
+    openIdConfigurationUrl: `${base}/.well-known/openid-configuration`,
+    jwksUrl: `${base}/.well-known/jwks.json`
+  };
+}
--- a/apps/docs/next.config.ts
+++ b/apps/docs/next.config.ts
@@ -1,5 +1,28 @@
 import type { NextConfig } from 'next';

-const nextConfig: NextConfig = {};
+const internalApiUrl = (
+  process.env.INTERNAL_API_URL ??
+  process.env.NEXT_PUBLIC_API_URL ??
+  'http://localhost:3000'
+).replace(/\/$/, '');
+
+const nextConfig: NextConfig = {
+  async rewrites() {
+    return [
+      {
+        source: '/idp-api/:path*',
+        destination: `${internalApiUrl}/:path*`
+      },
+      {
+        source: '/oauth/:path*',
+        destination: `${internalApiUrl}/oauth/:path*`
+      },
+      {
+        source: '/.well-known/:path*',
+        destination: `${internalApiUrl}/.well-known/:path*`
+      }
+    ];
+  }
+};

 export default nextConfig;
--- a/apps/frontend/app/admin/oauth/page.tsx
+++ b/apps/frontend/app/admin/oauth/page.tsx
@@ -1,9 +1,10 @@
 'use client';

-import { useCallback, useEffect, useState } from 'react';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 import { useRouter } from 'next/navigation';
-import { Copy, KeyRound, Loader2, LockKeyhole, Plus, RefreshCw, UserRound } from 'lucide-react';
+import { Copy, ExternalLink, Loader2, LockKeyhole, Plus, UserRound } from 'lucide-react';
 import { AdminShell } from '@/components/id/admin-shell';
+import { OAuthClientDetailDialog } from '@/components/id/oauth-client-detail-dialog';
 import { useAuth } from '@/components/id/auth-provider';
 import { useToast } from '@/components/id/toast-provider';
 import { Button } from '@/components/ui/button';
@@ -12,6 +13,7 @@ import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/u
 import { Input } from '@/components/ui/input';
 import { OAuthClient, OAuthScope, apiFetch } from '@/lib/api';
 import { getAdminLandingPath } from '@/lib/admin-access';
+import { buildAuthorizeUrl, buildOAuthEndpoints, resolveOAuthApiBase } from '@/lib/oauth-url';

 export default function AdminOAuthPage() {
  const router = useRouter();
@@ -22,9 +24,23 @@ export default function AdminOAuthPage() {
  const [loading, setLoading] = useState(true);
  const [creating, setCreating] = useState(false);
  const [dialogOpen, setDialogOpen] = useState(false);
+  const [selectedClient, setSelectedClient] = useState<OAuthClient | null>(null);
  const [secretDialog, setSecretDialog] = useState<{ clientId: string; clientSecret: string } | null>(null);
+  const [oauthApiBase, setOauthApiBase] = useState('http://localhost:3000');
  const [form, setForm] = useState({ name: '', redirectUris: '', type: 'CONFIDENTIAL', selectedScopes: ['openid', 'profile', 'email'] as string[] });

+  const oauthEndpoints = useMemo(() => buildOAuthEndpoints(oauthApiBase), [oauthApiBase]);
+
+  const loadPublicSettings = useCallback(async () => {
+    try {
+      const response = await apiFetch<{ settings: Array<{ key: string; value: string }> }>('/settings/public');
+      const settings = Object.fromEntries((response.settings ?? []).map((item) => [item.key, item.value]));
+      setOauthApiBase(resolveOAuthApiBase(settings));
+    } catch {
+      // оставляем fallback
+    }
+  }, []);
+
  const loadData = useCallback(async () => {
    if (!token || !user?.canViewOAuth) return;
    setLoading(true);
@@ -42,6 +58,10 @@ export default function AdminOAuthPage() {
    }
  }, [showToast, token, user?.canManageOAuth, user?.canViewOAuth]);

+  useEffect(() => {
+    void loadPublicSettings();
+  }, [loadPublicSettings]);
+
  useEffect(() => {
    if (!user) return;
    if (!user.canViewOAuth && !user.canManageOAuth) {
@@ -106,6 +126,7 @@ export default function AdminOAuthPage() {
        body: JSON.stringify({ isActive: !client.isActive })
      }, token);
      showToast(client.isActive ? 'Приложение отключено' : 'Приложение включено');
+      setSelectedClient((current) => (current?.id === client.id ? { ...client, isActive: !client.isActive } : current));
      await loadData();
    } catch (error) {
      showToast(error instanceof Error ? error.message : 'Не удалось обновить приложение');
@@ -122,7 +143,14 @@ export default function AdminOAuthPage() {
      <div className="mb-6 flex items-center justify-between gap-4">
        <div>
          <h2 className="text-2xl font-medium">OAuth-приложения</h2>
-          <p className="text-sm text-[#667085]">Создание клиентов как на oauth.yandex.ru: client_id, secret, redirect URI и scopes</p>
+          <p className="text-sm text-[#667085]">
+            Issuer: <code className="rounded bg-[#f4f5f8] px-1.5 py-0.5 text-xs">{oauthEndpoints.issuer}</code>
+            {' · '}
+            <a href={oauthEndpoints.openIdConfigurationUrl} target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-[#1d4ed8] hover:underline">
+              OpenID Configuration
+              <ExternalLink className="h-3.5 w-3.5" />
+            </a>
+          </p>
        </div>
        <Button onClick={() => setDialogOpen(true)} disabled={!user?.canManageOAuth}>
          <Plus className="h-4 w-4" />
@@ -137,70 +165,56 @@ export default function AdminOAuthPage() {
        </div>
      ) : (
        <div className="grid gap-4 md:grid-cols-2">
-          {clients.map((client) => (
-            <Card key={client.id} className={client.isActive ? '' : 'opacity-70'}>
-              <CardHeader>
-                <LockKeyhole className="h-6 w-6" />
-                <CardTitle>{client.name}</CardTitle>
-                <CardDescription>
-                  {client.type === 'PUBLIC' ? 'Публичное приложение' : 'Confidential приложение'}
-                  {client.createdByDisplayName ? (
-                    <span className="mt-1 flex items-center gap-1.5 text-xs text-[#667085]">
-                      <UserRound className="h-3.5 w-3.5" />
-                      Создал: {client.createdByDisplayName}
-                    </span>
-                  ) : client.createdById ? null : (
-                    <span className="mt-1 block text-xs text-[#667085]">Создатель не указан</span>
-                  )}
-                </CardDescription>
-              </CardHeader>
-              <CardContent className="space-y-3">
-                <div className="rounded-2xl bg-[#f4f5f8] p-4 text-sm">
-                  <div className="mb-2 flex items-center justify-between gap-2">
-                    <span className="font-medium">Client ID</span>
-                    <Button variant="ghost" size="icon" aria-label="Скопировать client id" onClick={() => copyText(client.clientId, 'Client ID')}>
-                      <Copy className="h-4 w-4" />
-                    </Button>
-                  </div>
-                  <code className="break-all text-xs">{client.clientId}</code>
-                </div>
-                <div className="rounded-2xl bg-[#f4f5f8] p-4 text-sm">
-                  <div className="mb-2 font-medium">Redirect URI</div>
-                  {client.redirectUris.map((uri) => (
-                    <div key={uri} className="break-all text-xs text-[#667085]">
-                      {uri}
-                    </div>
-                  ))}
-                </div>
-                <div className="rounded-2xl bg-[#f4f5f8] p-4 text-sm">
-                  <div className="mb-2 flex items-center gap-2 font-medium">
-                    <KeyRound className="h-4 w-4" />
-                    Scopes
-                  </div>
-                  <p>{client.scopes.join(', ')}</p>
-                </div>
-                {client.canManage ? (
-                  <div className="flex flex-wrap gap-2">
-                    {client.type !== 'PUBLIC' ? (
-                      <Button variant="secondary" size="sm" onClick={() => void handleRotateSecret(client.clientId)}>
-                        <RefreshCw className="h-4 w-4" />
-                        Новый secret
-                      </Button>
+          {clients.map((client) => {
+            const authorizePreview = buildAuthorizeUrl(oauthEndpoints.issuer, {
+              clientId: client.clientId,
+              redirectUri: client.redirectUris[0] ?? 'https://app.example.com/oauth/callback',
+              scope: client.scopes.join(' ')
+            });
+
+            return (
+              <Card
+                key={client.id}
+                className={`cursor-pointer transition hover:shadow-md ${client.isActive ? '' : 'opacity-70'}`}
+                onClick={() => setSelectedClient(client)}
+              >
+                <CardHeader>
+                  <LockKeyhole className="h-6 w-6" />
+                  <CardTitle>{client.name}</CardTitle>
+                  <CardDescription>
+                    {client.type === 'PUBLIC' ? 'Публичное приложение' : 'Confidential приложение'}
+                    {client.createdByDisplayName ? (
+                      <span className="mt-1 flex items-center gap-1.5 text-xs text-[#667085]">
+                        <UserRound className="h-3.5 w-3.5" />
+                        Создал: {client.createdByDisplayName}
+                      </span>
                    ) : null}
-                    <Button variant="secondary" size="sm" onClick={() => void handleToggleActive(client)}>
-                      {client.isActive ? 'Отключить' : 'Включить'}
-                    </Button>
+                  </CardDescription>
+                </CardHeader>
+                <CardContent className="space-y-3">
+                  <div className="rounded-2xl bg-[#f4f5f8] p-4 text-sm">
+                    <div className="mb-1 font-medium">Authorization URL</div>
+                    <code className="line-clamp-2 break-all text-xs text-[#667085]">{authorizePreview}</code>
                  </div>
-                ) : (
-                  <p className="text-xs text-[#667085]">Только просмотр — управление доступно создателю или администратору с полными правами</p>
-                )}
-              </CardContent>
-            </Card>
-          ))}
+                  <p className="text-xs text-[#667085]">Нажмите на карточку — все endpoints и данные для интеграции</p>
+                </CardContent>
+              </Card>
+            );
+          })}
          {!clients.length ? <p className="text-[#667085]">OAuth-приложения ещё не созданы</p> : null}
        </div>
      )}

+      <OAuthClientDetailDialog
+        client={selectedClient}
+        endpoints={oauthEndpoints}
+        open={Boolean(selectedClient)}
+        onOpenChange={(open) => !open && setSelectedClient(null)}
+        onCopy={copyText}
+        onRotateSecret={(clientId) => void handleRotateSecret(clientId)}
+        onToggleActive={(client) => void handleToggleActive(client)}
+      />
+
      <Dialog open={dialogOpen} onOpenChange={setDialogOpen}>
        <DialogContent className="max-h-[90vh] overflow-y-auto">
          <DialogHeader>
--- a/apps/frontend/components/id/oauth-client-detail-dialog.tsx
+++ b/apps/frontend/components/id/oauth-client-detail-dialog.tsx
@@ -0,0 +1,134 @@
+'use client';
+
+import { Copy, ExternalLink, KeyRound, RefreshCw } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@/components/ui/dialog';
+import { OAuthClient } from '@/lib/api';
+import { OAuthEndpoints, buildAuthorizeUrl } from '@/lib/oauth-url';
+
+function CopyRow({ label, value, onCopy }: { label: string; value: string; onCopy: (value: string, label: string) => void }) {
+  return (
+    <div className="rounded-2xl bg-[#f4f5f8] p-4 text-sm">
+      <div className="mb-2 flex items-center justify-between gap-2">
+        <span className="font-medium">{label}</span>
+        <Button variant="ghost" size="icon" aria-label={`Скопировать ${label}`} onClick={() => onCopy(value, label)}>
+          <Copy className="h-4 w-4" />
+        </Button>
+      </div>
+      <code className="block break-all text-xs">{value}</code>
+    </div>
+  );
+}
+
+export function OAuthClientDetailDialog({
+  client,
+  endpoints,
+  open,
+  onOpenChange,
+  onCopy,
+  onRotateSecret,
+  onToggleActive
+}: {
+  client: OAuthClient | null;
+  endpoints: OAuthEndpoints;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  onCopy: (value: string, label: string) => void;
+  onRotateSecret: (clientId: string) => void;
+  onToggleActive: (client: OAuthClient) => void;
+}) {
+  if (!client) return null;
+
+  const primaryRedirect = client.redirectUris[0] ?? 'https://app.example.com/oauth/callback';
+  const scope = client.scopes.join(' ');
+  const sampleAuthorizeUrl = buildAuthorizeUrl(endpoints.issuer, {
+    clientId: client.clientId,
+    redirectUri: primaryRedirect,
+    scope
+  });
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-h-[90vh] overflow-y-auto sm:max-w-2xl">
+        <DialogHeader>
+          <DialogTitle>{client.name}</DialogTitle>
+        </DialogHeader>
+
+        <div className="space-y-4 text-sm">
+          <div className="flex flex-wrap gap-2">
+            <span className="rounded-full bg-[#eef4ff] px-3 py-1 text-xs font-medium text-[#1d4ed8]">
+              {client.type === 'PUBLIC' ? 'Public' : 'Confidential'}
+            </span>
+            <span className={`rounded-full px-3 py-1 text-xs font-medium ${client.isActive ? 'bg-emerald-50 text-emerald-700' : 'bg-zinc-100 text-zinc-600'}`}>
+              {client.isActive ? 'Активно' : 'Отключено'}
+            </span>
+            {client.createdByDisplayName ? (
+              <span className="rounded-full bg-zinc-100 px-3 py-1 text-xs text-zinc-600">Создал: {client.createdByDisplayName}</span>
+            ) : null}
+          </div>
+
+          <section className="space-y-3">
+            <h3 className="font-medium">Данные клиента</h3>
+            <CopyRow label="Client ID" value={client.clientId} onCopy={onCopy} />
+            {client.type !== 'PUBLIC' ? (
+              <p className="text-xs text-[#667085]">
+                Client Secret выдаётся один раз при создании или после «Новый secret». Храните только на backend.
+              </p>
+            ) : null}
+            <CopyRow label="Redirect URI" value={client.redirectUris.join('\n')} onCopy={onCopy} />
+            <CopyRow label="Scopes" value={scope} onCopy={onCopy} />
+          </section>
+
+          <section className="space-y-3">
+            <h3 className="font-medium">Подключение OAuth 2.0 / OpenID Connect</h3>
+            <p className="text-xs text-[#667085]">
+              Issuer и endpoints берутся из настройки <strong>PUBLIC_API_URL</strong> в админке. В стороннем сервисе укажите issuer = базовый URL API, не authorization endpoint.
+            </p>
+            <CopyRow label="Issuer (PUBLIC_API_URL)" value={endpoints.issuer} onCopy={onCopy} />
+            <CopyRow label="Authorization endpoint" value={endpoints.authorizationEndpoint} onCopy={onCopy} />
+            <CopyRow label="Token endpoint" value={endpoints.tokenEndpoint} onCopy={onCopy} />
+            <CopyRow label="UserInfo endpoint" value={endpoints.userInfoEndpoint} onCopy={onCopy} />
+            <CopyRow label="OIDC Discovery" value={endpoints.openIdConfigurationUrl} onCopy={onCopy} />
+            <CopyRow label="Пример authorize URL" value={sampleAuthorizeUrl} onCopy={onCopy} />
+          </section>
+
+          <section className="rounded-2xl border border-[#eceef4] p-4">
+            <div className="mb-2 flex items-center gap-2 font-medium">
+              <KeyRound className="h-4 w-4" />
+              Быстрый старт
+            </div>
+            <ol className="list-decimal space-y-1 pl-5 text-xs text-[#667085]">
+              <li>Авторизуйте пользователя в IdP и получите userId.</li>
+              <li>Перенаправьте на authorization endpoint с clientId, redirectUri, scope, userId.</li>
+              <li>На backend обменяйте code через POST /oauth/token с client_secret.</li>
+              <li>Запросите профиль через GET /oauth/userinfo с access token.</li>
+            </ol>
+            <a
+              href={endpoints.openIdConfigurationUrl}
+              target="_blank"
+              rel="noreferrer"
+              className="mt-2 inline-flex items-center gap-1 text-xs text-[#1d4ed8] hover:underline"
+            >
+              Открыть OpenID Configuration
+              <ExternalLink className="h-3.5 w-3.5" />
+            </a>
+          </section>
+
+          {client.canManage ? (
+            <div className="flex flex-wrap gap-2 border-t border-[#eceef4] pt-4">
+              {client.type !== 'PUBLIC' ? (
+                <Button variant="secondary" size="sm" onClick={() => onRotateSecret(client.clientId)}>
+                  <RefreshCw className="h-4 w-4" />
+                  Новый secret
+                </Button>
+              ) : null}
+              <Button variant="secondary" size="sm" onClick={() => onToggleActive(client)}>
+                {client.isActive ? 'Отключить' : 'Включить'}
+              </Button>
+            </div>
+          ) : null}
+        </div>
+      </DialogContent>
+    </Dialog>
+  );
+}
--- a/apps/frontend/lib/oauth-url.ts
+++ b/apps/frontend/lib/oauth-url.ts
@@ -0,0 +1,56 @@
+export function normalizeBaseUrl(url: string) {
+  return url.trim().replace(/\/+$/, '');
+}
+
+export function resolveOAuthApiBase(settings: Record<string, string>, fallback = 'http://localhost:3000') {
+  const publicApi = settings.PUBLIC_API_URL?.trim();
+  if (publicApi) {
+    return normalizeBaseUrl(publicApi);
+  }
+
+  const domain = settings.PROJECT_DOMAIN?.trim();
+  if (domain) {
+    if (domain.startsWith('http://') || domain.startsWith('https://')) {
+      return normalizeBaseUrl(domain);
+    }
+    return `https://${domain.replace(/^\/+/, '')}`;
+  }
+
+  return normalizeBaseUrl(fallback);
+}
+
+export interface OAuthEndpoints {
+  issuer: string;
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  userInfoEndpoint: string;
+  openIdConfigurationUrl: string;
+  jwksUrl: string;
+}
+
+export function buildOAuthEndpoints(apiBase: string): OAuthEndpoints {
+  const base = normalizeBaseUrl(apiBase);
+  return {
+    issuer: base,
+    authorizationEndpoint: `${base}/oauth/authorize`,
+    tokenEndpoint: `${base}/oauth/token`,
+    userInfoEndpoint: `${base}/oauth/userinfo`,
+    openIdConfigurationUrl: `${base}/.well-known/openid-configuration`,
+    jwksUrl: `${base}/.well-known/jwks.json`
+  };
+}
+
+export function buildAuthorizeUrl(
+  apiBase: string,
+  params: { clientId: string; redirectUri: string; scope: string; userId?: string; state?: string }
+) {
+  const url = new URL(`${normalizeBaseUrl(apiBase)}/oauth/authorize`);
+  url.searchParams.set('clientId', params.clientId);
+  url.searchParams.set('redirectUri', params.redirectUri);
+  url.searchParams.set('scope', params.scope);
+  url.searchParams.set('userId', params.userId ?? 'USER_ID_AFTER_LOGIN');
+  if (params.state) {
+    url.searchParams.set('state', params.state);
+  }
+  return url.toString();
+}
--- a/apps/frontend/lib/system-settings-catalog.ts
+++ b/apps/frontend/lib/system-settings-catalog.ts
@@ -24,7 +24,14 @@ export const SYSTEM_SETTING_GROUPS: Record<string, string> = {
 export const SYSTEM_SETTING_CATALOG: SystemSettingMeta[] = [
  { key: 'PROJECT_NAME', label: 'Название проекта', group: 'general', type: 'text', hint: 'Отображается в меню, заголовке и боковой панели' },
  { key: 'PROJECT_TAGLINE', label: 'Слоган проекта', group: 'general', type: 'text' },
-  { key: 'PROJECT_DOMAIN', label: 'Домен IdP', group: 'general', type: 'text' },
+  { key: 'PROJECT_DOMAIN', label: 'Домен IdP', group: 'general', type: 'text', hint: 'Домен без пути, например sso.example.ru' },
+  {
+    key: 'PUBLIC_API_URL',
+    label: 'URL API (OAuth issuer)',
+    group: 'general',
+    type: 'text',
+    hint: 'Базовый URL API для OAuth/OIDC. Пример: https://sso.example.ru/idp-api или https://api.example.ru'
+  },
  { key: 'PIN_LOCK_TIMEOUT_MINUTES', label: 'Таймаут блокировки PIN', group: 'pin', type: 'number', unit: 'мин' },
  { key: 'PIN_DELETE_GRACE_MINUTES', label: 'Задержка удаления PIN', group: 'pin', type: 'number', unit: 'мин', hint: 'Сколько ждать после запроса удаления PIN-кода' },
  { key: 'PIN_REQUIRE_ON_DELETE', label: 'Требовать PIN при удалении', group: 'pin', type: 'boolean' },
--- a/apps/frontend/next.config.ts
+++ b/apps/frontend/next.config.ts
@@ -19,6 +19,14 @@ const nextConfig: NextConfig = {
      {
        source: '/idp-api/:path*',
        destination: `${internalApiUrl}/:path*`
+      },
+      {
+        source: '/oauth/:path*',
+        destination: `${internalApiUrl}/oauth/:path*`
+      },
+      {
+        source: '/.well-known/:path*',
+        destination: `${internalApiUrl}/.well-known/:path*`
      }
    ];
  }
--- a/apps/sso-core/src/app.module.ts
+++ b/apps/sso-core/src/app.module.ts
@@ -20,6 +20,7 @@ import { ProfileService } from './domain/profile.service';
 import { DocumentsService } from './domain/documents.service';
 import { AddressesService } from './domain/addresses.service';
 import { OAuthCoreService } from './domain/oauth-core.service';
+import { OAuthIssuerService } from './domain/oauth-issuer.service';
 import { OtpService } from './domain/otp.service';
 import { AdvancedAuthService } from './domain/advanced-auth.service';
 import { FamilyService } from './domain/family.service';
@@ -59,6 +60,7 @@ import { MaintenanceSchedulerService } from './domain/maintenance-scheduler.serv
    DocumentsService,
    AddressesService,
    OAuthCoreService,
+    OAuthIssuerService,
    OtpService,
    AdvancedAuthService,
    TotpService,
--- a/apps/sso-core/src/domain/oauth-core.service.ts
+++ b/apps/sso-core/src/domain/oauth-core.service.ts
@@ -1,16 +1,17 @@
 import { BadRequestException, Injectable, UnauthorizedException } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { JwtService } from '@nestjs/jwt';
-import * as bcrypt from 'bcryptjs';
 import { randomBytes } from 'node:crypto';
 import { PrismaService } from '../infra/prisma.service';
+import { OAuthIssuerService } from './oauth-issuer.service';

@Injectable()
 export class OAuthCoreService {
  constructor(
    private readonly prisma: PrismaService,
    private readonly jwt: JwtService,
-    private readonly config: ConfigService
+    private readonly config: ConfigService,
+    private readonly oauthIssuer: OAuthIssuerService
  ) {}

  async authorize(command: { userId: string; clientId: string; redirectUri: string; scope: string; state?: string }) {
@@ -70,9 +71,10 @@ export class OAuthCoreService {
  }

  private async issueOAuthTokens(userId: string, clientId: string, scopes: string[]) {
-    const accessToken = await this.jwt.signAsync({ sub: userId, aud: clientId, scopes, typ: 'access_token' }, { secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'), expiresIn: '15m', issuer: 'id.lendry.ru' });
-    const refreshToken = await this.jwt.signAsync({ sub: userId, aud: clientId, scopes, typ: 'refresh_token' }, { secret: this.config.getOrThrow<string>('JWT_REFRESH_SECRET'), expiresIn: '30d', issuer: 'id.lendry.ru' });
-    const idToken = await this.jwt.signAsync({ sub: userId, aud: clientId }, { secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'), expiresIn: '15m', issuer: 'id.lendry.ru' });
+    const issuer = await this.oauthIssuer.resolveIssuer();
+    const accessToken = await this.jwt.signAsync({ sub: userId, aud: clientId, scopes, typ: 'access_token' }, { secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'), expiresIn: '15m', issuer });
+    const refreshToken = await this.jwt.signAsync({ sub: userId, aud: clientId, scopes, typ: 'refresh_token' }, { secret: this.config.getOrThrow<string>('JWT_REFRESH_SECRET'), expiresIn: '30d', issuer });
+    const idToken = await this.jwt.signAsync({ sub: userId, aud: clientId }, { secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'), expiresIn: '15m', issuer });
    return { accessToken, tokenType: 'Bearer', expiresIn: 900, refreshToken, idToken };
  }
 }
--- a/apps/sso-core/src/domain/oauth-issuer.service.ts
+++ b/apps/sso-core/src/domain/oauth-issuer.service.ts
@@ -0,0 +1,30 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { SettingsService } from './settings.service';
+
+@Injectable()
+export class OAuthIssuerService {
+  constructor(
+    private readonly settings: SettingsService,
+    private readonly config: ConfigService
+  ) {}
+
+  async resolveIssuer(): Promise<string> {
+    const fromDb = (await this.settings.getValue('PUBLIC_API_URL', '')).trim();
+    if (fromDb) {
+      return fromDb.replace(/\/+$/, '');
+    }
+
+    const fromEnv = this.config.get<string>('PUBLIC_API_URL')?.trim();
+    if (fromEnv) {
+      return fromEnv.replace(/\/+$/, '');
+    }
+
+    const domain = (await this.settings.getValue('PROJECT_DOMAIN', 'id.lendry.ru')).trim();
+    if (domain.startsWith('http://') || domain.startsWith('https://')) {
+      return domain.replace(/\/+$/, '');
+    }
+
+    return `https://${domain.replace(/^\/+/, '')}`;
+  }
+}
--- a/apps/sso-core/src/domain/system-settings.seed.ts
+++ b/apps/sso-core/src/domain/system-settings.seed.ts
@@ -4,7 +4,12 @@ import { PrismaService } from '../infra/prisma.service';
 export const DEFAULT_SYSTEM_SETTINGS = [
  { key: 'PROJECT_NAME', value: 'MVK ID', description: 'Название проекта в интерфейсе и заголовке страницы' },
  { key: 'PROJECT_TAGLINE', value: 'Единый аккаунт для сервисов Lendry', description: 'Краткий слоган под названием проекта' },
-  { key: 'PROJECT_DOMAIN', value: 'id.lendry.ru', description: 'Основной домен IdP' },
+  { key: 'PROJECT_DOMAIN', value: 'id.lendry.ru', description: 'Основной домен IdP (без пути)' },
+  {
+    key: 'PUBLIC_API_URL',
+    value: 'http://localhost:3000',
+    description: 'Публичный базовый URL API для OAuth и OpenID Connect (issuer). Пример: https://sso.example.ru/idp-api'
+  },
  { key: 'PIN_LOCK_TIMEOUT_MINUTES', value: '15', description: 'Через сколько минут неактивности сессия блокируется PIN-кодом' },
  { key: 'PIN_DELETE_GRACE_MINUTES', value: '1440', description: 'Задержка перед окончательным удалением PIN-кода после запроса (минуты)' },
  { key: 'PIN_REQUIRE_ON_DELETE', value: 'true', description: 'Требовать текущий PIN-код при запросе удаления защиты' },
@@ -91,6 +96,7 @@ export const PUBLIC_SETTING_KEYS = [
  'PROJECT_NAME',
  'PROJECT_TAGLINE',
  'PROJECT_DOMAIN',
+  'PUBLIC_API_URL',
  'REGISTRATION_ENABLED',
  'MAINTENANCE_MODE',
  'LDAP_ENABLED',
@@ -109,5 +115,18 @@ export class SystemSettingsSeedService implements OnModuleInit {
        update: { description: setting.description, isSecret: SECRET_SETTING_KEYS.has(setting.key) }
      });
    }
+
+    const envPublicApiUrl = process.env.PUBLIC_API_URL?.trim();
+    if (envPublicApiUrl) {
+      await this.prisma.systemSetting.upsert({
+        where: { key: 'PUBLIC_API_URL' },
+        create: {
+          key: 'PUBLIC_API_URL',
+          value: envPublicApiUrl,
+          description: 'Публичный базовый URL API для OAuth и OpenID Connect (issuer). Пример: https://sso.example.ru/idp-api'
+        },
+        update: { value: envPublicApiUrl }
+      });
+    }
  }
 }