From 71dfeda8730d2bddd677c7741a78b30811e0f144 Mon Sep 17 00:00:00 2001
From: lendry <lendry@lendry1.ru>
Date: Mon, 29 Jun 2026 17:46:50 +0300
Subject: [PATCH] fix and update

---
 apps/api-gateway/src/app.module.ts |  8 ++-
 install.sh                         | 93 ++++++++++++++++++++++++++----
 2 files changed, 90 insertions(+), 11 deletions(-)

diff --git a/apps/api-gateway/src/app.module.ts b/apps/api-gateway/src/app.module.ts
index 108b7b2..90f2b07 100644
--- a/apps/api-gateway/src/app.module.ts
+++ b/apps/api-gateway/src/app.module.ts
@@ -55,7 +55,13 @@ import { FedcmCookieInterceptor } from './interceptors/fedcm-cookie.interceptor'
               join(__dirname, '../../../shared/proto/chat.proto'),
               join(__dirname, '../../../shared/proto/bot.proto')
             ],
-            url: config.get<string>('SSO_CORE_GRPC_URL', 'localhost:50051')
+            url: config.get<string>('SSO_CORE_GRPC_URL', 'localhost:50051'),
+            channelOptions: {
+              'grpc.keepalive_time_ms': 30000,
+              'grpc.keepalive_timeout_ms': 10000,
+              'grpc.keepalive_permit_without_calls': 1,
+              'grpc.http2.max_pings_without_data': 0
+            }
           }
         })
       }
diff --git a/install.sh b/install.sh
index 25df569..2637da5 100644
--- a/install.sh
+++ b/install.sh
@@ -10,7 +10,7 @@
 
 set -euo pipefail
 
-SCRIPT_VERSION="2.3.0"
+SCRIPT_VERSION="2.3.1"
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 cd "$ROOT_DIR"
 
@@ -1924,11 +1924,8 @@ build_nginx_api_location_block() {
   proxy_api="$(render_proxy_root api)"
   cat <<EOF
     location / {
-        set \$cors_origin "";
-        if (\$http_origin) { set \$cors_origin \$http_origin; }
-
         if (\$request_method = OPTIONS) {
-            add_header Access-Control-Allow-Origin \$cors_origin always;
+            add_header Access-Control-Allow-Origin \$http_origin always;
             add_header Access-Control-Allow-Credentials true always;
             add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
             add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, Accept, Origin, X-CSRF-Token" always;
@@ -1939,11 +1936,12 @@ build_nginx_api_location_block() {
 
         proxy_hide_header Access-Control-Allow-Origin;
         proxy_hide_header Access-Control-Allow-Credentials;
-        add_header Access-Control-Allow-Origin \$cors_origin always;
+        add_header Access-Control-Allow-Origin \$http_origin always;
         add_header Access-Control-Allow-Credentials true always;
 
 ${proxy_api}
         proxy_http_version 1.1;
+        proxy_set_header Connection "";
 ${nginx_proxy_headers}
     }
 EOF
@@ -2600,6 +2598,55 @@ check_local_upstream() {
   fi
 }
 
+# Readiness api-gateway → sso-core по gRPC (/health не проверяет gRPC).
+wait_for_api_grpc_ready() {
+  local attempt max="${1:-60}" code
+  for ((attempt = 1; attempt <= max; attempt++)); do
+    code="$(curl -fsS --max-time 3 -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/health/ready 2>/dev/null || echo 000)"
+    if [[ "$code" == "200" ]]; then
+      ok "gRPC api-gateway → sso-core: готов (/health/ready)"
+      return 0
+    fi
+    sleep 2
+  done
+  warn "gRPC api-gateway → sso-core не готов (HTTP ${code:-000} на /health/ready)"
+  return 1
+}
+
+check_https_api_with_origin() {
+  local api_domain frontend_domain origin code
+  api_domain="$(env_get DOMAIN_API "")"
+  frontend_domain="$(env_get DOMAIN_FRONTEND "")"
+  [[ -n "$api_domain" && -n "$frontend_domain" ]] || return 0
+  [[ "$(env_get USE_NGINX_SSL false)" == "true" ]] || return 0
+
+  origin="https://${frontend_domain}"
+  code="$(curl -sk --max-time 5 -o /dev/null -w '%{http_code}' -H "Origin: ${origin}" "https://${api_domain}/health" 2>/dev/null || echo 000)"
+  if [[ "$code" == "200" ]]; then
+    echo -e "  ${GREEN}✔${NC} HTTPS API + Origin: https://${api_domain}/health → 200"
+  elif [[ "$code" == "502" ]]; then
+    echo -e "  ${RED}✘${NC} HTTPS API + Origin → 502 (Nginx не проксирует cross-origin на api-домен)"
+    echo "      Решение: ./install.sh --fix-all (перегенерирует конфиг api-домена)"
+    return 1
+  else
+    echo -e "  ${YELLOW}!${NC} HTTPS API + Origin: https://${api_domain}/health → HTTP ${code}"
+    return 1
+  fi
+
+  code="$(curl -sk --max-time 5 -o /dev/null -w '%{http_code}' -H "Origin: ${origin}" "https://${api_domain}/notifications/unread-count" 2>/dev/null || echo 000)"
+  if [[ "$code" == "401" || "$code" == "403" ]]; then
+    echo -e "  ${GREEN}✔${NC} HTTPS API + Origin (без токена): /notifications/unread-count → ${code}"
+    return 0
+  elif [[ "$code" == "502" ]]; then
+    echo -e "  ${RED}✘${NC} HTTPS API + Origin: /notifications/unread-count → 502 (upstream api-gateway)"
+    echo "      Проверьте: curl -s http://127.0.0.1:3000/health/ready && docker compose logs --tail=50 api-gateway sso-core"
+    return 1
+  else
+    echo -e "  ${YELLOW}!${NC} HTTPS API + Origin: /notifications/unread-count → HTTP ${code} (ожидалось 401)"
+    return 1
+  fi
+}
+
 # Диагностика типичных проблем: 502 на /idp-api, конфликт nginx, порты upstream.
 diagnose_common_issues() {
   load_env
@@ -2663,6 +2710,20 @@ diagnose_common_issues() {
     issues=$((issues + 1))
   elif docker_cmd ps --format '{{.Names}} {{.Status}}' 2>/dev/null | grep -q 'lendry-id-api-gateway.*Up'; then
     echo -e "  ${GREEN}✔${NC} api-gateway: контейнер запущен"
+    local grpc_code
+    grpc_code="$(curl -fsS --max-time 3 -o /dev/null -w '%{http_code}' http://127.0.0.1:3000/health/ready 2>/dev/null || echo 000)"
+    if [[ "$grpc_code" == "200" ]]; then
+      echo -e "  ${GREEN}✔${NC} api-gateway gRPC → sso-core: /health/ready → 200"
+    else
+      echo -e "  ${RED}✘${NC} api-gateway gRPC → sso-core: /health/ready → HTTP ${grpc_code} (без gRPC все API-запросы падают)"
+      echo "      Решение: docker compose restart sso-core api-gateway && ./install.sh --fix-all"
+      issues=$((issues + 1))
+    fi
+  fi
+
+  if [[ "$(env_get USE_NGINX_SSL false)" == "true" ]] \
+    && [[ -n "$(env_get DOMAIN_API "")" && -n "$(env_get DOMAIN_FRONTEND "")" ]]; then
+    check_https_api_with_origin || issues=$((issues + 1))
   fi
 
   local api_domain frontend_domain public_api
@@ -2700,10 +2761,16 @@ show_upstream_health() {
   [[ -n "$(env_get DOMAIN_API "")" ]] || return 0
 
   echo "  Upstream (host Nginx → localhost):"
-  check_local_upstream "API" "http://127.0.0.1:3000/health"
+  check_local_upstream "API /health" "http://127.0.0.1:3000/health"
+  check_local_upstream "API gRPC ready" "http://127.0.0.1:3000/health/ready"
   check_local_upstream "Swagger" "http://127.0.0.1:3000/docs"
   check_local_upstream "Frontend" "http://127.0.0.1:3002"
   check_local_upstream "Docs" "http://127.0.0.1:3003/docs"
+  if [[ "$(env_get USE_NGINX_SSL false)" == "true" ]]; then
+    echo ""
+    echo "  HTTPS (как в браузере, с Origin SSO):"
+    check_https_api_with_origin || true
+  fi
   echo ""
 }
 
@@ -2902,8 +2969,12 @@ action_fix_host_proxy() {
 
   apply_intranet_selfsigned_runtime
 
-  log "Шаг 5/5: пересоздание ldap-auth и sso-core..."
+  log "Шаг 5/5: пересоздание ldap-auth, sso-core и api-gateway..."
   compose_build_and_up ldap-auth sso-core
+  wait_for_service "sso-core" 120
+  compose_build_and_up api-gateway
+  wait_for_service "api-gateway" 90
+  wait_for_api_grpc_ready 60 || true
 
   ok "Прокси исправлен — проверьте: curl -I http://127.0.0.1:3002"
   diagnose_common_issues || true
@@ -2931,10 +3002,12 @@ action_fix_all_errors() {
   write_compose_override
   ensure_split_domain_public_urls
 
-  log "Шаг 3/6: пересборка api-gateway и sso-core..."
-  compose_build_and_up api-gateway sso-core
+  log "Шаг 3/6: пересборка sso-core, затем api-gateway..."
+  compose_build_and_up sso-core
   wait_for_service "sso-core" 120
+  compose_build_and_up api-gateway
   wait_for_service "api-gateway" 90
+  wait_for_api_grpc_ready 90 || compose_build_and_up api-gateway
 
   log "Шаг 4/6: пересоздание edge-сервисов (frontend, docs, media-ws)..."
   compose_build_and_up "${HOST_EDGE_SERVICES[@]}"