fix(auth): редирект на portal по runtime /api/auth/config при 401

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/plugins/auth.test.ts

@@ -23,9 +23,11 @@ describe('auth plugin (AUTH_REQUIRED)', () => {
       AUTH_REQUIRED: 'true',
       AUTH_JWT_SECRET: secret,
       AUTH_ISSUER: issuer,
+      AUTH_PORTAL_URL: 'http://192.168.100.67:8080',
     })
     expect(cfg.required).toBe(true)
     expect(cfg.jwtSecret).toBe(secret)
+    expect(cfg.portalUrl).toBe('http://192.168.100.67:8080')
   })
 
   it('401 without token; 403 without vps app; 403 without permission; 200 with rights', async () => {

apps/api/src/plugins/auth.ts

@@ -11,6 +11,7 @@ export type AuthConfig = {
   required: boolean
   jwtSecret: string
   issuer: string
+  portalUrl: string
 }
 
 declare module 'fastify' {
@@ -61,12 +62,18 @@ export function loadAuthConfig(
       env.JWT_SECRET ??
       (isProd ? '' : 'dev-secret-change-me'),
     issuer: env.AUTH_ISSUER ?? env.ISSUER ?? 'https://auth.shnt.top',
+    portalUrl: (
+      env.AUTH_PORTAL_URL ??
+      env.VITE_AUTH_PORTAL_URL ??
+      'http://localhost:5175'
+    ).replace(/\/$/, ''),
   }
 }
 
 function isPublicPath(url: string): boolean {
   const path = url.split('?')[0] ?? url
   if (path === '/health' || path === '/ready') return true
+  if (path === '/api/auth/config') return true
   if (path.startsWith('/api/integrations/cfdm')) return true
   return false
 }
@@ -75,6 +82,11 @@ export const authPlugin = fp(async (app) => {
   const config = loadAuthConfig()
   app.decorate('authConfig', config)
 
+  app.get('/api/auth/config', async () => ({
+    required: config.required,
+    portal_url: config.portalUrl,
+  }))
+
   if (!config.required) {
     app.log.info('AUTH_REQUIRED=false — portal JWT middleware disabled')
     return