fix and update

apps/api-gateway/src/controllers/fedcm.controller.ts

@@ -31,7 +31,7 @@ import {
   resolveFedcmEndpoints
 } from '../lib/fedcm-config';
 import { resolveFedcmSessionFromRequest, setFedcmSessionCookie } from '../lib/fedcm-cookie';
-import { assertSessionUnlocked, verifyAccessToken } from '../session-auth';
+import { verifyAccessToken } from '../session-auth';
 
 type FedcmAccountsResponse = {
   accounts: Array<{
@@ -212,14 +212,22 @@ export class FedcmController {
     if (!payload.sessionId) {
       throw new UnauthorizedException('Сессия не найдена');
     }
-    await assertSessionUnlocked(this.core, payload);
+
+    const validation = (await firstValueFrom(
+      this.core.auth.ValidateSession({
+        userId: payload.sub,
+        sessionId: payload.sessionId,
+        touchActivity: false
+      })
+    )) as { requiresPin: boolean; sessionId: string; pinVerified: boolean };
+
     await setFedcmSessionCookie(res, this.jwt, {
       sub: payload.sub,
       sessionId: payload.sessionId,
-      pinVerified: true
+      pinVerified: !validation.requiresPin
     });
     applyFedcmLoginStatus(res, true);
-    return { synced: true };
+    return { synced: true, requiresPin: validation.requiresPin };
   }
 
   @Post('session/sync')
@@ -248,6 +256,41 @@ export class FedcmController {
     return this.syncFedcmSessionFromAuthorization(authorization, res);
   }
 
+  @Get('session/status')
+  @HttpCode(200)
+  @ApiOperation({
+    summary: 'Состояние FedCM-сессии',
+    description: 'Для login_url на API-домене: проверяет cookie и PIN-блокировку без Bearer token.'
+  })
+  async sessionStatus(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+
+    const session = await resolveFedcmSessionFromRequest(this.jwt, req.headers.cookie);
+    if (!session) {
+      applyFedcmLoginStatus(res, false);
+      return { active: false, requiresPin: false, sessionId: null, userId: null };
+    }
+
+    const validation = (await firstValueFrom(
+      this.core.auth.ValidateSession({
+        userId: session.sub,
+        sessionId: session.sessionId,
+        touchActivity: false
+      })
+    )) as { requiresPin: boolean; sessionId: string; pinVerified: boolean };
+
+    const requiresPin = validation.requiresPin || !session.pinVerified;
+    applyFedcmLoginStatus(res, true);
+
+    return {
+      active: true,
+      requiresPin,
+      sessionId: validation.sessionId,
+      userId: session.sub
+    };
+  }
+
   @Get('login-status')
   @ApiOperation({
     summary: 'FedCM Login Status (API origin)',