fix oauth

apps/api-gateway/src/controllers/oauth.controller.ts

@@ -5,7 +5,7 @@ import { firstValueFrom } from 'rxjs';
 import { CoreGrpcService } from '../core-grpc.service';
 import { OAuthAuthorizeIncomingDto, OAuthTokenIncomingDto } from '../dto/oauth.dto';
 import { extractBearerToken } from '../auth-token';
-import { appendQueryParams, mergeTokenCredentials, mapTokenResponseToStandard, normalizeAuthorizeQuery, normalizeTokenBody } from '../lib/oauth-params';
+import { appendQueryParams, mapUserInfoToOidc, mergeTokenCredentials, mapTokenResponseToStandard, normalizeAuthorizeQuery, normalizeTokenBody } from '../lib/oauth-params';
 import { resolveFrontendUrl } from '../lib/oauth-issuer';
 import { verifyAccessToken } from '../session-auth';
 
@@ -80,7 +80,8 @@ export class OAuthController {
         clientId: normalized.clientId,
         redirectUri: normalized.redirectUri,
         scope: normalized.scope,
-        state: normalized.state
+        state: normalized.state,
+        nonce: normalized.nonce
       })
     )) as { redirectUrl?: string; code?: string; state?: string };
 
@@ -133,7 +134,20 @@ export class OAuthController {
   @ApiBearerAuth()
   @ApiOperation({ summary: 'OAuth userinfo', description: 'Возвращает профиль пользователя по OAuth access token.' })
   @ApiResponse({ status: 200, description: 'Профиль пользователя получен' })
-  userInfo(@Headers('authorization') authorization?: string) {
-    return this.core.oauth.UserInfo({ accessToken: extractBearerToken(authorization) });
+  async userInfo(@Headers('authorization') authorization?: string) {
+    const result = (await firstValueFrom(
+      this.core.oauth.UserInfo({ accessToken: extractBearerToken(authorization) })
+    )) as {
+      sub?: string;
+      email?: string;
+      phone?: string;
+      name?: string;
+      picture?: string;
+      emailVerified?: boolean;
+      preferredUsername?: string;
+      phoneNumber?: string;
+      phoneNumberVerified?: boolean;
+    };
+    return mapUserInfoToOidc(result);
   }
 }

apps/api-gateway/src/lib/oauth-issuer.ts

@@ -84,6 +84,21 @@ export function buildOpenIdConfiguration(issuer: string) {
     token_endpoint_auth_methods_supported: ['client_secret_post', 'client_secret_basic'],
     grant_types_supported: ['authorization_code', 'refresh_token'],
     code_challenge_methods_supported: ['S256', 'plain'],
-    claims_supported: ['sub', 'email', 'phone', 'name', 'picture']
+    claims_supported: [
+      'sub',
+      'iss',
+      'aud',
+      'iat',
+      'exp',
+      'auth_time',
+      'nonce',
+      'email',
+      'email_verified',
+      'phone_number',
+      'phone_number_verified',
+      'name',
+      'preferred_username',
+      'picture'
+    ]
   };
 }

apps/api-gateway/src/lib/oauth-params.ts

@@ -133,6 +133,33 @@ export function mapTokenResponseToStandard(result: {
   };
 }
 
+export function mapUserInfoToOidc(result: {
+  sub?: string;
+  email?: string;
+  phone?: string;
+  name?: string;
+  picture?: string;
+  emailVerified?: boolean;
+  preferredUsername?: string;
+  phoneNumber?: string;
+  phoneNumberVerified?: boolean;
+}) {
+  const claims: Record<string, unknown> = { sub: result.sub };
+  if (result.name) claims.name = result.name;
+  if (result.picture) claims.picture = result.picture;
+  if (result.preferredUsername) claims.preferred_username = result.preferredUsername;
+  if (result.email) {
+    claims.email = result.email;
+    if (result.emailVerified !== undefined) claims.email_verified = result.emailVerified;
+  }
+  const phoneNumber = result.phoneNumber ?? result.phone;
+  if (phoneNumber) {
+    claims.phone_number = phoneNumber;
+    if (result.phoneNumberVerified !== undefined) claims.phone_number_verified = result.phoneNumberVerified;
+  }
+  return claims;
+}
+
 export function mergeTokenCredentials(
   body: NormalizedTokenBody,
   authorization?: string