fix and update

apps/api-gateway/src/lib/oauth-issuer.ts

@@ -1,6 +1,6 @@
 import { firstValueFrom } from 'rxjs';
 import { CoreGrpcService } from '../core-grpc.service';
-import { normalizePublicBaseUrl, pickBestPublicBase, isInternalHostname } from './public-url';
+import { normalizePublicBaseUrl, pickBestPublicBase, isInternalHostname, normalizeDedicatedApiIssuer } from './public-url';
 
 function normalizeBaseUrl(url: string) {
   return normalizePublicBaseUrl(url);
@@ -52,7 +52,8 @@ export async function resolveOAuthIssuer(core: CoreGrpcService, fallback = 'http
 
   const fromDomain = await resolveProjectDomainUrl(core, true);
   // env первым: в Docker .env перекрывает seed localhost в БД после первого деплоя.
-  return pickBestPublicBase([envIssuer, fromDb, fromDomain], fallback);
+  const picked = pickBestPublicBase([envIssuer, fromDb, fromDomain], fallback);
+  return normalizeDedicatedApiIssuer(picked);
 }
 
 export async function resolveFrontendUrl(core: CoreGrpcService, fallback = 'http://localhost:3002'): Promise<string> {

apps/api-gateway/src/lib/public-url.ts

@@ -17,6 +17,25 @@ export function normalizePublicBaseUrl(url: string) {
   return url.trim().replace(/\/+$/, '');
 }
 
+/**
+ * На выделенном API-домене (api.example.com) gateway слушает в корне (/fedcm, /oauth).
+ * Префикс /idp-api нужен только на SSO-домене. Убираем лишний суффикс из PUBLIC_API_URL.
+ */
+export function normalizeDedicatedApiIssuer(url: string) {
+  const normalized = normalizePublicBaseUrl(url);
+  try {
+    const parsed = new URL(normalized);
+    const host = parsed.hostname.toLowerCase();
+    const path = parsed.pathname.replace(/\/+$/, '') || '/';
+    if (host.startsWith('api.') && (path === '/idp-api' || path.endsWith('/idp-api'))) {
+      return `${parsed.protocol}//${parsed.host}`;
+    }
+  } catch {
+    return normalized;
+  }
+  return normalized;
+}
+
 export function isInternalHostname(hostname: string) {
   const host = hostname.trim().toLowerCase();
   if (!host) {