# Интеграция auth-portal ↔ EvoFirewall

App id: **`fw`**.

## Flow

```
Browser → EvoFirewall UI (нет token)
       → redirect AUTH_PORTAL_URL/?return_to=…/auth/callback
       → login
       → redirect return_to#access_token=…
       → /auth/callback сохраняет token
       → API Authorization: Bearer <JWT>
```

## Permissions

| Permission | UI |
|------------|-----|
| `fw:dashboard:read` | `/` |
| `fw:agents:read` / `write` | `/agents` |
| `fw:lists:read` / `write` | `/lists` |
| `fw:policies:read` / `write` | `/rules`, overrides |
| `fw:stats:read` | `/stats` |
| `fw:settings:admin` | `/settings`, install-context |
| `fw:audit:read` | `GET /api/v1/audit` (локальный журнал) |

## Env

```env
AUTH_REQUIRED=true
AUTH_JWT_SECRET=<тот же JWT_SECRET портала>
AUTH_ISSUER=https://auth.shnt.top
AUTH_PORTAL_URL=https://auth.shnt.top
AUTH_AUDIT_INGEST_SECRET=<AUDIT_INGEST_SECRET портала>
PUBLIC_BASE_URL=https://fw.example.com
EVOFW_ENROLL_SEED=<hex/seed>
```

Dual-write: мутации agents/lists/rules/policy пишут в локальный `audit_log` и асинхронно шлют batch в `POST {AUTH_PORTAL_URL}/api/v1/ingest/audit` с `source_app: fw`.

```env
# apps/web/.env.local
VITE_AUTH_ENABLED=true
VITE_AUTH_PORTAL_URL=https://auth.shnt.top
```

В portal Admin → Apps выдайте app `fw` и нужные `fw:*`. URL в App Switcher: origin EvoFirewall.