fix oauth

apps/api-gateway/src/controllers/oauth.controller.ts

@@ -53,20 +53,23 @@ export class OAuthController {
     @Res({ passthrough: true }) res: HttpResponse
   ) {
     const normalized = normalizeAuthorizeQuery(query as Record<string, unknown>);
-    let userId = normalized.userId;
+    let userId: string | undefined;
 
-    if (!userId && authorization) {
+    if (authorization) {
       try {
         const payload = await verifyAccessToken(this.jwt, authorization);
         userId = payload.sub;
       } catch {
-        // handled below
+        // токен недействителен — не доверяем userId из query
       }
     }
 
     if (!userId) {
       const frontendUrl = await resolveFrontendUrl(this.core);
-      const consentUrl = appendQueryParams(`${frontendUrl}/auth/oauth/authorize`, query as Record<string, unknown>);
+      const consentQuery = { ...(query as Record<string, unknown>) };
+      delete consentQuery.userId;
+      delete consentQuery.user_id;
+      const consentUrl = appendQueryParams(`${frontendUrl}/auth/oauth/authorize`, consentQuery);
       res.redirect(302, consentUrl);
       return;
     }