update oauth

apps/docs/lib/oauth-examples.ts

@@ -5,14 +5,15 @@ export interface OAuthExample {
   code: string;
 }
 
-const API_BASE = 'https://id.lendry.ru';
+export function buildOAuthExamples(apiBase: string): OAuthExample[] {
+  const API_BASE = apiBase.replace(/\/+$/, '');
 
-export const oauthExamples: OAuthExample[] = [
-  {
-    id: 'javascript',
-    label: 'JavaScript',
-    language: 'javascript',
-    code: `// Authorization Code Flow (Node.js / браузер)
+  return [
+    {
+      id: 'javascript',
+      label: 'JavaScript',
+      language: 'javascript',
+      code: `// Authorization Code Flow (Node.js / браузер)
 const clientId = 'YOUR_CLIENT_ID';
 const redirectUri = 'https://app.example.com/oauth/callback';
 const scope = 'openid profile email';
@@ -27,6 +28,9 @@ authorizeUrl.searchParams.set('scope', scope);
 authorizeUrl.searchParams.set('state', state);
 window.location.href = authorizeUrl.toString();
 
+// OIDC Discovery (issuer = PUBLIC_API_URL из настроек админки)
+// GET ${API_BASE}/.well-known/openid-configuration
+
 // Шаг 2: обменять code на токены (на backend!)
 const tokenResponse = await fetch('${API_BASE}/oauth/token', {
   method: 'POST',
@@ -45,20 +49,21 @@ const tokens = await tokenResponse.json();
 const profile = await fetch('${API_BASE}/oauth/userinfo', {
   headers: { Authorization: \`Bearer \${tokens.accessToken}\` }
 }).then((r) => r.json());`
-  },
-  {
-    id: 'typescript-next',
-    label: 'Next.js',
-    language: 'typescript',
-    code: `// app/api/oauth/callback/route.ts
+    },
+    {
+      id: 'typescript-next',
+      label: 'Next.js',
+      language: 'typescript',
+      code: `// app/api/oauth/callback/route.ts
 import { NextRequest, NextResponse } from 'next/server';
 
+const ISSUER = '${API_BASE}';
+
 export async function GET(request: NextRequest) {
   const code = request.nextUrl.searchParams.get('code');
-  const state = request.nextUrl.searchParams.get('state');
   if (!code) return NextResponse.redirect('/login?error=oauth');
 
-  const tokenRes = await fetch('${API_BASE}/oauth/token', {
+  const tokenRes = await fetch(\`\${ISSUER}/oauth/token\`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
@@ -75,12 +80,12 @@ export async function GET(request: NextRequest) {
   response.cookies.set('access_token', tokens.accessToken, { httpOnly: true, secure: true });
   return response;
 }`
-  },
-  {
-    id: 'python',
-    label: 'Python',
-    language: 'python',
-    code: `import requests
+    },
+    {
+      id: 'python',
+      label: 'Python',
+      language: 'python',
+      code: `import requests
 from urllib.parse import urlencode
 
 API_BASE = '${API_BASE}'
@@ -88,7 +93,9 @@ CLIENT_ID = 'YOUR_CLIENT_ID'
 CLIENT_SECRET = 'YOUR_CLIENT_SECRET'
 REDIRECT_URI = 'https://app.example.com/oauth/callback'
 
-# Ссылка для входа пользователя
+# OIDC Discovery
+discovery = requests.get(f'{API_BASE}/.well-known/openid-configuration', timeout=15).json()
+
 params = urlencode({
     'userId': 'USER_ID',
     'clientId': CLIENT_ID,
@@ -98,7 +105,6 @@ params = urlencode({
 })
 authorize_url = f'{API_BASE}/oauth/authorize?{params}'
 
-# Обмен authorization code на токены
 token_response = requests.post(f'{API_BASE}/oauth/token', json={
     'grantType': 'authorization_code',
     'code': 'AUTHORIZATION_CODE',
@@ -108,24 +114,25 @@ token_response = requests.post(f'{API_BASE}/oauth/token', json={
 }, timeout=15)
 tokens = token_response.json()
 
-# UserInfo
 profile = requests.get(
     f'{API_BASE}/oauth/userinfo',
     headers={'Authorization': f"Bearer {tokens['accessToken']}"},
     timeout=15
 ).json()`
-  },
-  {
-    id: 'php',
-    label: 'PHP',
-    language: 'php',
-    code: `<?php
-$apiBase = '${API_BASE}';
+    },
+    {
+      id: 'php',
+      label: 'PHP',
+      language: 'php',
+      code: `<?php
+$apiBase = '${API_BASE}'; // issuer = PUBLIC_API_URL из админки
 $clientId = getenv('OAUTH_CLIENT_ID');
 $clientSecret = getenv('OAUTH_CLIENT_SECRET');
 $redirectUri = 'https://app.example.com/oauth/callback';
 
-// Redirect пользователя
+// OIDC Discovery — используйте issuer, а не authorization endpoint
+$discovery = json_decode(file_get_contents($apiBase . '/.well-known/openid-configuration'), true);
+
 $params = http_build_query([
     'userId' => 'USER_ID',
     'clientId' => $clientId,
@@ -134,41 +141,13 @@ $params = http_build_query([
     'state' => bin2hex(random_bytes(16)),
 ]);
 header('Location: ' . $apiBase . '/oauth/authorize?' . $params);
-exit;
-
-// Callback: обмен code -> token
-$payload = json_encode([
-    'grantType' => 'authorization_code',
-    'code' => $_GET['code'],
-    'clientId' => $clientId,
-    'clientSecret' => $clientSecret,
-    'redirectUri' => $redirectUri,
-]);
-
-$ch = curl_init($apiBase . '/oauth/token');
-curl_setopt_array($ch, [
-    CURLOPT_POST => true,
-    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
-    CURLOPT_POSTFIELDS => $payload,
-    CURLOPT_RETURNTRANSFER => true,
-]);
-$tokens = json_decode(curl_exec($ch), true);
-curl_close($ch);
-
-// UserInfo
-$ch = curl_init($apiBase . '/oauth/userinfo');
-curl_setopt_array($ch, [
-    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . $tokens['accessToken']],
-    CURLOPT_RETURNTRANSFER => true,
-]);
-$profile = json_decode(curl_exec($ch), true);
-curl_close($ch);`
-  },
-  {
-    id: 'go',
-    label: 'Go',
-    language: 'go',
-    code: `package main
+exit;`
+    },
+    {
+      id: 'go',
+      label: 'Go',
+      language: 'go',
+      code: `package main
 
 import (
     "bytes"
@@ -187,63 +166,33 @@ func buildAuthorizeURL(userID, clientID, redirectURI, scope, state string) strin
     q.Set("scope", scope)
     q.Set("state", state)
     return apiBase + "/oauth/authorize?" + q.Encode()
-}
-
-func exchangeCode(code, clientID, clientSecret, redirectURI string) (map[string]any, error) {
-    body, _ := json.Marshal(map[string]string{
-        "grantType":    "authorization_code",
-        "code":         code,
-        "clientId":     clientID,
-        "clientSecret": clientSecret,
-        "redirectUri":  redirectURI,
-    })
-    resp, err := http.Post(apiBase+"/oauth/token", "application/json", bytes.NewReader(body))
-    if err != nil {
-        return nil, err
-    }
-    defer resp.Body.Close()
-    var tokens map[string]any
-    return tokens, json.NewDecoder(resp.Body).Decode(&tokens)
 }`
-  },
-  {
-    id: 'csharp',
-    label: 'C#',
-    language: 'csharp',
-    code: `using System.Net.Http.Json;
+    },
+    {
+      id: 'csharp',
+      label: 'C#',
+      language: 'csharp',
+      code: `using System.Net.Http.Json;
 
 var apiBase = "${API_BASE}";
 var clientId = Environment.GetEnvironmentVariable("OAUTH_CLIENT_ID");
-var clientSecret = Environment.GetEnvironmentVariable("OAUTH_CLIENT_SECRET");
 var redirectUri = "https://app.example.com/oauth/callback";
 
-// Authorization URL
+var discovery = await new HttpClient().GetFromJsonAsync<Dictionary<string, object>>(
+    $"{apiBase}/.well-known/openid-configuration");
+
 var authorizeUrl =
     $"{apiBase}/oauth/authorize?userId=USER_ID&clientId={clientId}" +
-    $"&redirectUri={Uri.EscapeDataString(redirectUri)}&scope=openid profile email&state=xyz";
+    $"&redirectUri={Uri.EscapeDataString(redirectUri)}&scope=openid profile email&state=xyz";`
+    },
+    {
+      id: 'curl',
+      label: 'cURL',
+      language: 'bash',
+      code: `# OIDC Discovery (issuer = ${API_BASE})
+curl ${API_BASE}/.well-known/openid-configuration
 
-using var http = new HttpClient();
-
-// Token exchange
-var tokenResponse = await http.PostAsJsonAsync($"{apiBase}/oauth/token", new {
-    grantType = "authorization_code",
-    code = "AUTHORIZATION_CODE",
-    clientId,
-    clientSecret,
-    redirectUri
-});
-var tokens = await tokenResponse.Content.ReadFromJsonAsync<Dictionary<string, object>>();
-
-// UserInfo
-http.DefaultRequestHeaders.Authorization =
-    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", tokens!["accessToken"].ToString());
-var profile = await http.GetFromJsonAsync<object>($"{apiBase}/oauth/userinfo");`
-  },
-  {
-    id: 'curl',
-    label: 'cURL',
-    language: 'bash',
-    code: `# Authorization (браузер пользователя)
+# Authorization (браузер пользователя)
 open "${API_BASE}/oauth/authorize?userId=USER_ID&clientId=CLIENT_ID&redirectUri=https%3A%2F%2Fapp.example.com%2Fcallback&scope=openid%20profile%20email&state=xyz"
 
 # Обмен code на токены
@@ -259,15 +208,10 @@ curl -X POST ${API_BASE}/oauth/token \\
 
 # UserInfo
 curl ${API_BASE}/oauth/userinfo \\
-  -H "Authorization: Bearer ACCESS_TOKEN"
+  -H "Authorization: Bearer ACCESS_TOKEN"`
+    }
+  ];
+}
 
-# Refresh token
-curl -X POST ${API_BASE}/oauth/token \\
-  -H "Content-Type: application/json" \\
-  -d '{
-    "grantType": "refresh_token",
-    "refreshToken": "REFRESH_TOKEN",
-    "clientId": "CLIENT_ID"
-  }'`
-  }
-];
+/** @deprecated Используйте buildOAuthExamples(apiBase) */
+export const oauthExamples = buildOAuthExamples('http://localhost:3000');