fix and update

apps/api-gateway/src/controllers/fedcm.controller.ts

@@ -31,7 +31,7 @@ import {
   resolveFedcmEndpoints
 } from '../lib/fedcm-config';
 import { resolveFedcmSessionFromRequest, setFedcmSessionCookie } from '../lib/fedcm-cookie';
-import { assertSessionUnlocked, verifyAccessToken } from '../session-auth';
+import { verifyAccessToken } from '../session-auth';
 
 type FedcmAccountsResponse = {
   accounts: Array<{
@@ -212,14 +212,22 @@ export class FedcmController {
     if (!payload.sessionId) {
       throw new UnauthorizedException('Сессия не найдена');
     }
-    await assertSessionUnlocked(this.core, payload);
+
+    const validation = (await firstValueFrom(
+      this.core.auth.ValidateSession({
+        userId: payload.sub,
+        sessionId: payload.sessionId,
+        touchActivity: false
+      })
+    )) as { requiresPin: boolean; sessionId: string; pinVerified: boolean };
+
     await setFedcmSessionCookie(res, this.jwt, {
       sub: payload.sub,
       sessionId: payload.sessionId,
-      pinVerified: true
+      pinVerified: !validation.requiresPin
     });
     applyFedcmLoginStatus(res, true);
-    return { synced: true };
+    return { synced: true, requiresPin: validation.requiresPin };
   }
 
   @Post('session/sync')
@@ -248,6 +256,41 @@ export class FedcmController {
     return this.syncFedcmSessionFromAuthorization(authorization, res);
   }
 
+  @Get('session/status')
+  @HttpCode(200)
+  @ApiOperation({
+    summary: 'Состояние FedCM-сессии',
+    description: 'Для login_url на API-домене: проверяет cookie и PIN-блокировку без Bearer token.'
+  })
+  async sessionStatus(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Cache-Control', 'no-store');
+
+    const session = await resolveFedcmSessionFromRequest(this.jwt, req.headers.cookie);
+    if (!session) {
+      applyFedcmLoginStatus(res, false);
+      return { active: false, requiresPin: false, sessionId: null, userId: null };
+    }
+
+    const validation = (await firstValueFrom(
+      this.core.auth.ValidateSession({
+        userId: session.sub,
+        sessionId: session.sessionId,
+        touchActivity: false
+      })
+    )) as { requiresPin: boolean; sessionId: string; pinVerified: boolean };
+
+    const requiresPin = validation.requiresPin || !session.pinVerified;
+    applyFedcmLoginStatus(res, true);
+
+    return {
+      active: true,
+      requiresPin,
+      sessionId: validation.sessionId,
+      userId: session.sub
+    };
+  }
+
   @Get('login-status')
   @ApiOperation({
     summary: 'FedCM Login Status (API origin)',

apps/api-gateway/src/lib/fedcm-cookie.ts

@@ -91,17 +91,18 @@ export async function verifyFedcmSessionToken(jwt: JwtService, token: string): P
     if (payload.typ !== 'fedcm_session' || !payload.sub || !payload.sessionId) {
       return null;
     }
-    if (payload.pinVerified === false) {
-      return null;
-    }
-    return { sub: payload.sub, sessionId: payload.sessionId, pinVerified: true };
+    return {
+      sub: payload.sub,
+      sessionId: payload.sessionId,
+      pinVerified: payload.pinVerified !== false
+    };
   } catch {
     return null;
   }
 }
 
 export async function setFedcmSessionCookie(res: Response, jwt: JwtService, payload: FedcmSessionPayload) {
-  if (!payload.sub || !payload.sessionId || payload.pinVerified === false) {
+  if (!payload.sub || !payload.sessionId) {
     return;
   }
   if (res.headersSent) {
@@ -159,8 +160,21 @@ export async function attachFedcmCookieFromAuthResult(
     user?: { id?: string };
   };
 
-  if (data.requiresPin || data.pinVerified === false || !data.sessionId) {
-    clearFedcmSessionCookie(res);
+  if (data.requiresPin || data.pinVerified === false) {
+    let userId = data.user?.id;
+    if (!userId && data.accessToken) {
+      const decoded = jwt.decode(data.accessToken) as { sub?: string } | null;
+      userId = decoded?.sub;
+    }
+    if (userId && data.sessionId) {
+      await setFedcmSessionCookie(res, jwt, {
+        sub: userId,
+        sessionId: data.sessionId,
+        pinVerified: false
+      });
+    } else {
+      clearFedcmSessionCookie(res);
+    }
     return;
   }
 

apps/frontend/app/auth/login/page.tsx

@@ -34,7 +34,9 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 
 import type { AuthTokens, LoginMethod, OtpChannel, OtpSendResponse } from '@/lib/api';
 
-import { createQrLoginSession, pollQrLoginSession } from '@/lib/api';
+import { createQrLoginSession, fetchFedcmSessionStatus, pollQrLoginSession } from '@/lib/api';
+
+import { isFedcmLoginPopup } from '@/lib/fedcm-login-bridge';
 
 import {
   clearOtpResendAvailableAt,
@@ -104,7 +106,7 @@ export default function LoginPage() {
 
   const { showToast } = useToast();
 
-  const { ldapEnabled, ldapUseLdaps } = usePublicSettings();
+  const { ldapEnabled, ldapUseLdaps, publicApiUrl } = usePublicSettings();
 
 
 
@@ -261,6 +263,22 @@ export default function LoginPage() {
 
 
 
+  useEffect(() => {
+    if (!isFedcmLoginPopup()) return;
+    let cancelled = false;
+
+    void (async () => {
+      const status = await fetchFedcmSessionStatus(publicApiUrl);
+      if (cancelled || !status?.active || !status.requiresPin || !status.sessionId) return;
+      setPendingSessionId(status.sessionId);
+      setStep('pin');
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [publicApiUrl]);
+
   useEffect(() => {
     if (step !== 'otp' || !recipient) return;
     const saved = readOtpResendAvailableAt(recipient);

apps/frontend/components/id/auth-provider.tsx

@@ -34,7 +34,7 @@ import {
   subscribeApiReady,
   subscribeApiNotReady,
 } from '@/lib/api';
-import { finalizeFedcmLogin, shouldFinalizeFedcmLogin } from '@/lib/fedcm-login-bridge';
+import { finalizeFedcmLogin, isFedcmLoginPopup, shouldFinalizeFedcmLogin } from '@/lib/fedcm-login-bridge';
 import { FedcmApiLoginStatusBridge } from './fedcm-api-login-status';
 import { usePublicSettings } from './public-settings-provider';
 import { useToast } from './toast-provider';
@@ -201,6 +201,10 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     if (cachedUser) {
       setUser(cachedUser);
     }
+    const accessToken = window.localStorage.getItem(AUTH_TOKEN_KEY);
+    if (accessToken) {
+      void syncFedcmSession(accessToken);
+    }
   }, [user?.id]);
 
   const warmUpAndApplySession = React.useCallback(
@@ -678,11 +682,16 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         setIsLoading(false);
       }
 
-      if (pathname.startsWith('/auth/')) {
+      if (pathname.startsWith('/auth/') && !isFedcmLoginPopup()) {
         router.replace('/');
+        return;
+      }
+
+      if (shouldFinalizeFedcmLogin(pathname) || isFedcmLoginPopup()) {
+        await finalizeFedcmLogin(response.accessToken);
       }
     },
-    [clearPinLock, pathname, router, user?.id, warmUpAndApplySession]
+    [pathname, router, user?.id, warmUpAndApplySession]
   );
 
   const handlePinUnlock = React.useCallback(
@@ -783,7 +792,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       )}
       <PinLockModal open={isPinLocked} isSubmitting={pinSubmitting} error={pinError} onSubmit={handlePinUnlock} />
       <FedcmApiLoginStatusBridge
-        active={isSessionReady && hasStoredSession && !isPinLocked}
+        active={isSessionReady && hasStoredSession && Boolean(token)}
         accessToken={token}
         publicApiUrl={publicApiUrl}
       />

apps/frontend/lib/api.ts

@@ -598,6 +598,29 @@ export async function syncFedcmSession(accessToken?: string | null) {
   }
 }
 
+export interface FedcmSessionStatus {
+  active: boolean;
+  requiresPin: boolean;
+  sessionId: string | null;
+  userId: string | null;
+}
+
+export async function fetchFedcmSessionStatus(apiBase: string): Promise<FedcmSessionStatus | null> {
+  if (typeof window === 'undefined' || !apiBase.trim()) return null;
+  const base = apiBase.replace(/\/+$/, '');
+  try {
+    const response = await fetch(`${base}/fedcm/session/status`, {
+      method: 'GET',
+      credentials: 'include',
+      cache: 'no-store'
+    });
+    if (!response.ok) return null;
+    return (await response.json()) as FedcmSessionStatus;
+  } catch {
+    return null;
+  }
+}
+
 let fedcmSyncTimer: ReturnType<typeof setTimeout> | null = null;
 let fedcmSyncInFlight = false;
 

apps/frontend/lib/fedcm-login-bridge.ts

@@ -45,3 +45,11 @@ export async function finalizeFedcmLogin(accessToken: string) {
 export function shouldFinalizeFedcmLogin(pathname: string) {
   return pathname.startsWith('/auth/login');
 }
+
+export function isFedcmLoginPopup() {
+  if (typeof window === 'undefined') return false;
+  if (window.opener) return true;
+  if (window.IdentityProvider?.close) return true;
+  const params = new URLSearchParams(window.location.search);
+  return params.get('fedcm') === '1';
+}

apps/sso-core/src/domain/fedcm.service.ts

@@ -17,7 +17,7 @@ export class FedcmService {
   ) {}
 
   async getAccounts(userId: string, sessionId: string) {
-    await this.assertUnlockedSession(userId, sessionId);
+    await this.assertExistingSession(userId, sessionId);
 
     const user = await this.prisma.user.findFirst({
       where: { id: userId, deletedAt: null, status: 'ACTIVE', ...HUMAN_USER_WHERE }
@@ -104,12 +104,17 @@ export class FedcmService {
     return this.settings.getBoolean('ONE_TAP_ENABLED', true);
   }
 
-  private async assertUnlockedSession(userId: string, sessionId: string) {
+  private async assertExistingSession(userId: string, sessionId: string) {
     const state = await this.session.resolveSessionState(sessionId);
     if (!state || state.userId !== userId) {
       throw new UnauthorizedException('Сессия недействительна или истекла');
     }
-    if (state.requiresPin) {
+  }
+
+  private async assertUnlockedSession(userId: string, sessionId: string) {
+    await this.assertExistingSession(userId, sessionId);
+    const state = await this.session.resolveSessionState(sessionId);
+    if (state?.requiresPin) {
       throw new UnauthorizedException('Требуется подтверждение PIN-кода');
     }
   }

install.sh

@@ -2536,6 +2536,18 @@ ${proxy_frontend}
 ${nginx_proxy_headers}
     }
 
+    location /_next/ {
+${proxy_frontend}
+        proxy_http_version 1.1;
+${nginx_proxy_headers}
+    }
+
+    location = /icon.svg {
+${proxy_frontend}
+        proxy_http_version 1.1;
+${nginx_proxy_headers}
+    }
+
     location = /favicon.ico {
 ${proxy_frontend}
         proxy_http_version 1.1;