fix and update

apps/api-gateway/src/controllers/fedcm.controller.ts

@@ -31,7 +31,7 @@ import {
   resolveFedcmEndpoints
 } from '../lib/fedcm-config';
 import { resolveFedcmSessionFromRequest, setFedcmSessionCookie } from '../lib/fedcm-cookie';
-import { assertSessionUnlocked, verifyAccessToken } from '../session-auth';
+import { verifyAccessToken } from '../session-auth';
 
 type FedcmAccountsResponse = {
   accounts: Array<{
@@ -212,14 +212,22 @@ export class FedcmController {
     if (!payload.sessionId) {
       throw new UnauthorizedException('Сессия не найдена');
     }
-    await assertSessionUnlocked(this.core, payload);
+
+    const validation = (await firstValueFrom(
+      this.core.auth.ValidateSession({
+        userId: payload.sub,
+        sessionId: payload.sessionId,
+        touchActivity: false
+      })
+    )) as { requiresPin: boolean; sessionId: string; pinVerified: boolean };
+
     await setFedcmSessionCookie(res, this.jwt, {
       sub: payload.sub,
       sessionId: payload.sessionId,
-      pinVerified: true
+      pinVerified: !validation.requiresPin
     });
     applyFedcmLoginStatus(res, true);
-    return { synced: true };
+    return { synced: true, requiresPin: validation.requiresPin };
   }
 
   @Post('session/sync')
@@ -248,6 +256,41 @@ export class FedcmController {
     return this.syncFedcmSessionFromAuthorization(authorization, res);
   }
 
+  @Get('session/status')
+  @HttpCode(200)
+  @ApiOperation({
+    summary: 'Состояние FedCM-сессии',
+    description: 'Для login_url на API-домене: проверяет cookie и PIN-блокировку без Bearer token.'
+  })
+  async sessionStatus(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+
+    const session = await resolveFedcmSessionFromRequest(this.jwt, req.headers.cookie);
+    if (!session) {
+      applyFedcmLoginStatus(res, false);
+      return { active: false, requiresPin: false, sessionId: null, userId: null };
+    }
+
+    const validation = (await firstValueFrom(
+      this.core.auth.ValidateSession({
+        userId: session.sub,
+        sessionId: session.sessionId,
+        touchActivity: false
+      })
+    )) as { requiresPin: boolean; sessionId: string; pinVerified: boolean };
+
+    const requiresPin = validation.requiresPin || !session.pinVerified;
+    applyFedcmLoginStatus(res, true);
+
+    return {
+      active: true,
+      requiresPin,
+      sessionId: validation.sessionId,
+      userId: session.sub
+    };
+  }
+
   @Get('login-status')
   @ApiOperation({
     summary: 'FedCM Login Status (API origin)',

apps/api-gateway/src/lib/fedcm-cookie.ts

@@ -91,17 +91,18 @@ export async function verifyFedcmSessionToken(jwt: JwtService, token: string): P
     if (payload.typ !== 'fedcm_session' || !payload.sub || !payload.sessionId) {
       return null;
     }
-    if (payload.pinVerified === false) {
-      return null;
-    }
-    return { sub: payload.sub, sessionId: payload.sessionId, pinVerified: true };
+    return {
+      sub: payload.sub,
+      sessionId: payload.sessionId,
+      pinVerified: payload.pinVerified !== false
+    };
   } catch {
     return null;
   }
 }
 
 export async function setFedcmSessionCookie(res: Response, jwt: JwtService, payload: FedcmSessionPayload) {
-  if (!payload.sub || !payload.sessionId || payload.pinVerified === false) {
+  if (!payload.sub || !payload.sessionId) {
     return;
   }
   if (res.headersSent) {
@@ -159,8 +160,21 @@ export async function attachFedcmCookieFromAuthResult(
     user?: { id?: string };
   };
 
-  if (data.requiresPin || data.pinVerified === false || !data.sessionId) {
-    clearFedcmSessionCookie(res);
+  if (data.requiresPin || data.pinVerified === false) {
+    let userId = data.user?.id;
+    if (!userId && data.accessToken) {
+      const decoded = jwt.decode(data.accessToken) as { sub?: string } | null;
+      userId = decoded?.sub;
+    }
+    if (userId && data.sessionId) {
+      await setFedcmSessionCookie(res, jwt, {
+        sub: userId,
+        sessionId: data.sessionId,
+        pinVerified: false
+      });
+    } else {
+      clearFedcmSessionCookie(res);
+    }
     return;
   }