fix(ui): AutoComplete и флаги страны как в VPS Tracker

Co-authored-by: Cursor <[email protected]>

apps/web/src/components/auto-complete-input.tsx

@@ -0,0 +1,134 @@
+'use client'
+
+import * as React from 'react'
+import { CheckIcon } from 'lucide-react'
+
+import { cn } from '@cdnmanager/ui/lib/utils'
+import {
+  Autocomplete,
+  AutocompleteContent,
+  AutocompleteEmpty,
+  AutocompleteInput,
+  AutocompleteItem,
+  AutocompleteList,
+} from '@/components/reui/autocomplete'
+import { TruncatedText } from '@/components/truncated-text'
+
+export interface AutoCompleteOption {
+  value: string
+  label: string
+  /** Левый префикс (например флаг страны). */
+  leading?: React.ReactNode
+}
+
+interface AutoCompleteInputProps {
+  id?: string
+  value: string
+  onChange: (value: string) => void
+  options: AutoCompleteOption[]
+  placeholder?: string
+  searchPlaceholder?: string
+  emptyText?: string
+  className?: string
+  /** Показывать ли выбранный leading в поле (например флаг). */
+  showLeadingInInput?: boolean
+  /** Разрешать ли произвольный ввод (не только из списка). По умолчанию true. */
+  allowFreeText?: boolean
+  disabled?: boolean
+}
+
+export function AutoCompleteInput({
+  id,
+  value,
+  onChange,
+  options,
+  placeholder = 'Выбрать…',
+  searchPlaceholder,
+  emptyText = 'Ничего не найдено',
+  className,
+  showLeadingInInput = true,
+  allowFreeText = true,
+  disabled = false,
+}: AutoCompleteInputProps) {
+  const trimmedValue = value.trim()
+
+  const selected = React.useMemo(
+    () => options.find((o) => o.value.toLowerCase() === trimmedValue.toLowerCase()),
+    [options, trimmedValue],
+  )
+  const leading = showLeadingInInput ? selected?.leading : undefined
+
+  const inputPlaceholder = searchPlaceholder ?? placeholder
+
+  const handleValueChange = React.useCallback(
+    (inputVal: string) => {
+      const q = inputVal.trim()
+      const match = options.find(
+        (o) =>
+          o.label.toLowerCase() === q.toLowerCase() ||
+          o.value.toLowerCase() === q.toLowerCase(),
+      )
+      if (match) {
+        onChange(match.value)
+        return
+      }
+      if (allowFreeText) {
+        onChange(inputVal)
+      }
+    },
+    [options, onChange, allowFreeText],
+  )
+
+  return (
+    <Autocomplete
+      items={options}
+      value={value}
+      onValueChange={handleValueChange}
+      itemToStringValue={(item) => item.label}
+      mode="list"
+      autoHighlight
+      openOnInputClick
+      disabled={disabled}
+    >
+      <div className="relative w-full">
+        {leading ? (
+          <span className="pointer-events-none absolute start-2.5 top-1/2 z-10 size-4 -translate-y-1/2 [&_svg]:size-full">
+            {leading}
+          </span>
+        ) : null}
+        <AutocompleteInput
+          id={id}
+          placeholder={trimmedValue ? undefined : inputPlaceholder}
+          showTrigger
+          showClear={Boolean(trimmedValue)}
+          className={cn(leading && 'ps-8', className)}
+        />
+      </div>
+      <AutocompleteContent>
+        <AutocompleteEmpty>{emptyText}</AutocompleteEmpty>
+        <AutocompleteList>
+          {(item) => {
+            const isSelected = item.value.toLowerCase() === trimmedValue.toLowerCase()
+            return (
+              <AutocompleteItem
+                key={item.value}
+                value={item}
+                className="gap-2.5 px-2 py-1.5"
+              >
+                {item.leading ? (
+                  <span className="relative z-1 size-4 shrink-0">{item.leading}</span>
+                ) : null}
+                <span className="relative z-1 min-w-0 flex-1">
+                  <TruncatedText>{item.label}</TruncatedText>
+                </span>
+                {isSelected ? (
+                  <CheckIcon className="relative z-1 size-4 shrink-0 opacity-60" />
+                ) : null}
+              </AutocompleteItem>
+            )
+          }}
+        </AutocompleteList>
+      </AutocompleteContent>
+    </Autocomplete>
+  )
+}

apps/web/src/components/country-flag.tsx

@@ -0,0 +1,22 @@
+import { cn } from '@cdnmanager/ui/lib/utils'
+import { countryCodeFromName, getCountryFlagUrl } from '@/lib/country-labels'
+
+interface CountryFlagProps {
+  code?: string
+  country?: string
+  className?: string
+}
+
+export function CountryFlag({ code, country, className }: CountryFlagProps) {
+  const resolvedCode = code ?? (country ? countryCodeFromName(country) : undefined)
+  const url = getCountryFlagUrl(resolvedCode)
+  if (!url) return null
+
+  return (
+    <img
+      src={url}
+      alt=""
+      className={cn('size-4 shrink-0 rounded-full object-cover', className)}
+    />
+  )
+}

apps/web/src/lib/api-client.ts

@@ -30,6 +30,13 @@ async function handoffOnUnauthorized(): Promise<void> {
     redirectToPortalLogin(`${window.location.origin}/auth/callback`)
     return
   }
+  // Cooldown / recent handoff — stop SSO storm (wrong JWT secret / issuer).
+  if (cfg.required || isAuthEnabled()) {
+    window.location.assign(
+      `${window.location.origin}/auth/callback?error=jwt_rejected`,
+    )
+    return
+  }
   if (!cfg.required && !isAuthEnabled()) {
     window.location.href = '/login'
   }

apps/web/src/lib/app-switcher-config.ts

@@ -62,5 +62,11 @@ export function getAppUrl(
 export function getCurrentApp(
   config: AppSwitcherConfig = DEFAULT_APP_SWITCHER_CONFIG,
 ): AppSwitcherEntry {
-  return config.apps.find((app) => app.id === CURRENT_APP_ID) ?? config.apps[0]!
+  const current = config.apps.find((app) => app.id === CURRENT_APP_ID)
+  if (current) return current
+  if (config.apps[0]) return config.apps[0]
+  return (
+    DEFAULT_APP_SWITCHER_CONFIG.apps.find((a) => a.id === CURRENT_APP_ID) ??
+    DEFAULT_APP_SWITCHER_CONFIG.apps[0]!
+  )
 }

apps/web/src/lib/auth.ts

@@ -255,5 +255,5 @@ export function firstAllowedPath(): string {
     const perm = permissionForPath(path)
     if (!perm || can(perm)) return path
   }
-  return '/'
+  return '/access-denied'
 }

apps/web/src/lib/country-labels.ts

@@ -0,0 +1,29 @@
+/** ISO → русское название (seed fleet locations). */
+const COUNTRY_NAME_BY_CODE: Record<string, string> = {
+  RU: 'Россия',
+  DE: 'Германия',
+  NL: 'Нидерланды',
+  FI: 'Финляндия',
+  FR: 'Франция',
+}
+
+const COUNTRY_CODE_BY_NAME: Record<string, string> = Object.fromEntries(
+  Object.entries(COUNTRY_NAME_BY_CODE).map(([code, name]) => [name.toLowerCase(), code]),
+)
+
+export function countryNameFromCode(code: string | null | undefined): string {
+  if (!code) return ''
+  return COUNTRY_NAME_BY_CODE[code.toUpperCase()] ?? code
+}
+
+export function countryCodeFromName(name: string | null | undefined): string {
+  if (!name?.trim()) return ''
+  const trimmed = name.trim()
+  if (trimmed.length === 2) return trimmed.toUpperCase()
+  return COUNTRY_CODE_BY_NAME[trimmed.toLowerCase()] ?? ''
+}
+
+export function getCountryFlagUrl(code?: string): string | undefined {
+  if (!code || code.length !== 2) return undefined
+  return `https://flagcdn.com/${code.toLowerCase()}.svg`
+}

apps/web/src/routeTree.gen.ts

@@ -10,6 +10,7 @@
 
 import { Route as rootRouteImport } from './routes/__root'
 import { Route as LoginRouteImport } from './routes/login'
+import { Route as AccessDeniedRouteImport } from './routes/access-denied'
 import { Route as AuthRouteImport } from './routes/_auth'
 import { Route as AuthIndexRouteImport } from './routes/_auth/index'
 import { Route as AuthCallbackRouteImport } from './routes/auth.callback'
@@ -28,6 +29,11 @@ const LoginRoute = LoginRouteImport.update({
   path: '/login',
   getParentRoute: () => rootRouteImport,
 } as any)
+const AccessDeniedRoute = AccessDeniedRouteImport.update({
+  id: '/access-denied',
+  path: '/access-denied',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const AuthRoute = AuthRouteImport.update({
   id: '/_auth',
   getParentRoute: () => rootRouteImport,
@@ -91,6 +97,7 @@ const AuthSettingsAppearanceRoute = AuthSettingsAppearanceRouteImport.update({
 
 export interface FileRoutesByFullPath {
   '/': typeof AuthIndexRoute
+  '/access-denied': typeof AccessDeniedRoute
   '/login': typeof LoginRoute
   '/settings': typeof AuthSettingsRouteRouteWithChildren
   '/aliases': typeof AuthAliasesRoute
@@ -104,6 +111,7 @@ export interface FileRoutesByFullPath {
   '/settings/': typeof AuthSettingsIndexRoute
 }
 export interface FileRoutesByTo {
+  '/access-denied': typeof AccessDeniedRoute
   '/login': typeof LoginRoute
   '/aliases': typeof AuthAliasesRoute
   '/nodes': typeof AuthNodesRoute
@@ -119,6 +127,7 @@ export interface FileRoutesByTo {
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/_auth': typeof AuthRouteWithChildren
+  '/access-denied': typeof AccessDeniedRoute
   '/login': typeof LoginRoute
   '/_auth/settings': typeof AuthSettingsRouteRouteWithChildren
   '/_auth/aliases': typeof AuthAliasesRoute
@@ -136,6 +145,7 @@ export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
   fullPaths:
     | '/'
+    | '/access-denied'
     | '/login'
     | '/settings'
     | '/aliases'
@@ -149,6 +159,7 @@ export interface FileRouteTypes {
     | '/settings/'
   fileRoutesByTo: FileRoutesByTo
   to:
+    | '/access-denied'
     | '/login'
     | '/aliases'
     | '/nodes'
@@ -163,6 +174,7 @@ export interface FileRouteTypes {
   id:
     | '__root__'
     | '/_auth'
+    | '/access-denied'
     | '/login'
     | '/_auth/settings'
     | '/_auth/aliases'
@@ -179,6 +191,7 @@ export interface FileRouteTypes {
 }
 export interface RootRouteChildren {
   AuthRoute: typeof AuthRouteWithChildren
+  AccessDeniedRoute: typeof AccessDeniedRoute
   LoginRoute: typeof LoginRoute
   AuthCallbackRoute: typeof AuthCallbackRoute
 }
@@ -192,6 +205,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof LoginRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/access-denied': {
+      id: '/access-denied'
+      path: '/access-denied'
+      fullPath: '/access-denied'
+      preLoaderRoute: typeof AccessDeniedRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/_auth': {
       id: '/_auth'
       path: ''
@@ -318,6 +338,7 @@ const AuthRouteWithChildren = AuthRoute._addFileChildren(AuthRouteChildren)
 
 const rootRouteChildren: RootRouteChildren = {
   AuthRoute: AuthRouteWithChildren,
+  AccessDeniedRoute: AccessDeniedRoute,
   LoginRoute: LoginRoute,
   AuthCallbackRoute: AuthCallbackRoute,
 }

apps/web/src/routes/__root.tsx

@@ -16,7 +16,8 @@ export const Route = createRootRouteWithContext<RouterContext>()({
   beforeLoad: async ({ location }) => {
     const isLogin = location.pathname === '/login'
     const isCallback = location.pathname === '/auth/callback'
-    if (isCallback) return
+    const isAccessDenied = location.pathname === '/access-denied'
+    if (isCallback || isAccessDenied) return
 
     const cfg = await ensureAuthConfig()
     const token = getToken()

apps/web/src/routes/_auth.tsx

@@ -30,16 +30,19 @@ export const Route = createFileRoute('/_auth')({
       await new Promise(() => {})
       return
     }
+    // NEVER redirect to `/` here — `/` is under `_auth` and causes an infinite loop
+    // (browser: «Страница не отвечает»).
     if (!claims.apps.includes('cdn')) {
-      throw redirect({ to: '/' })
+      throw redirect({ to: '/access-denied' })
     }
 
     const perm = permissionForPath(location.pathname)
     if (perm && !can(perm)) {
       const fallback = firstAllowedPath()
-      if (fallback !== location.pathname) {
-        throw redirect({ to: fallback as '/' })
+      if (fallback === '/access-denied' || fallback === location.pathname) {
+        throw redirect({ to: '/access-denied' })
       }
+      throw redirect({ to: fallback as '/' })
     }
   },
   component: () => (

apps/web/src/routes/_auth/nodes.tsx

@@ -25,6 +25,13 @@ import { Button } from '@cdnmanager/ui/components/button'
 import { Input } from '@cdnmanager/ui/components/input'
 import { Label } from '@cdnmanager/ui/components/label'
 import { SelectField } from '@/components/select-field'
+import { AutoCompleteInput } from '@/components/auto-complete-input'
+import { CountryFlag } from '@/components/country-flag'
+import { FormFieldSimple } from '@/components/form-field'
+import {
+  countryCodeFromName,
+  countryNameFromCode,
+} from '@/lib/country-labels'
 import { queryClient } from '@/lib/query-client'
 import {
   createNode,
@@ -80,6 +87,8 @@ function NodesPage() {
   const [editing, setEditing] = useState<Node | null>(null)
   const [deleteId, setDeleteId] = useState<string | null>(null)
   const [preview, setPreview] = useState('')
+  const [countryName, setCountryName] = useState('')
+  const [locationQuery, setLocationQuery] = useState('')
 
   const form = useForm<FormValues>({
     resolver: zodResolver(formSchema),
@@ -102,6 +111,56 @@ function NodesPage() {
   const watchIndex = form.watch('indexNum')
   const watchProvider = form.watch('providerTag')
 
+  const countryCode = countryCodeFromName(countryName)
+
+  const countryOptions = useMemo(() => {
+    const codes = new Set<string>()
+    for (const loc of locations) {
+      if (loc.country) codes.add(loc.country)
+    }
+    return [...codes]
+      .map((code) => {
+        const name = countryNameFromCode(code)
+        return {
+          value: name,
+          label: name,
+          leading: <CountryFlag code={code} country={name} />,
+        }
+      })
+      .sort((a, b) => a.label.localeCompare(b.label, 'ru'))
+  }, [locations])
+
+  const locationOptions = useMemo(() => {
+    if (!countryCode) return []
+    return locations
+      .filter((l) => l.country === countryCode)
+      .map((l) => ({
+        value: `${l.code} — ${l.name}`,
+        label: `${l.code} — ${l.name}`,
+      }))
+  }, [locations, countryCode])
+
+  function locationLabel(locationId: string): string {
+    const loc = locations.find((l) => l.id === locationId)
+    return loc ? `${loc.code} — ${loc.name}` : ''
+  }
+
+  function countryNameForLocationId(locationId: string): string {
+    const code = locations.find((l) => l.id === locationId)?.country
+    return countryNameFromCode(code)
+  }
+
+  function locationIdFromDisplay(display: string): string {
+    const q = display.trim().toLowerCase()
+    if (!q) return ''
+    const match = locations.find((l) => {
+      if (countryCode && l.country !== countryCode) return false
+      const label = `${l.code} — ${l.name}`.toLowerCase()
+      return label === q || l.code.toLowerCase() === q || l.name.toLowerCase() === q
+    })
+    return match?.id ?? ''
+  }
+
   async function refreshPreview() {
     if (!watchZone || !watchLoc || !watchRole) return
     try {
@@ -148,6 +207,8 @@ function NodesPage() {
       toast.success(editing ? 'Нода обновлена' : 'Нода создана')
       setSheetOpen(false)
       setEditing(null)
+      setCountryName('')
+      setLocationQuery('')
       form.reset()
       void qc.invalidateQueries({ queryKey: ['fleet'] })
     },
@@ -267,6 +328,8 @@ function NodesPage() {
             onClick={() => {
               const n = row.original
               setEditing(n)
+              setCountryName(countryNameForLocationId(n.locationId))
+              setLocationQuery(locationLabel(n.locationId))
               form.reset({
                 zoneId: n.zoneId,
                 locationId: n.locationId,
@@ -306,9 +369,12 @@ function NodesPage() {
             size="sm"
             onClick={() => {
               setEditing(null)
+              const firstLoc = locations[0]
+              setCountryName(countryNameFromCode(firstLoc?.country))
+              setLocationQuery(firstLoc ? `${firstLoc.code} — ${firstLoc.name}` : '')
               form.reset({
                 zoneId: zones[0]?.id ?? '',
-                locationId: locations[0]?.id ?? '',
+                locationId: firstLoc?.id ?? '',
                 role: 'gw',
                 indexNum: 1,
                 ipv4: '',
@@ -396,21 +462,47 @@ function NodesPage() {
             </div>
           ) : null}
 
-          <div className="flex flex-col gap-2">
-            <Label>Локация</Label>
-            <SelectField
-              value={form.watch('locationId')}
-              onValueChange={(v) => {
-                form.setValue('locationId', v ?? '')
+          <FormFieldSimple label="Страна" htmlFor="node-country">
+            <AutoCompleteInput
+              id="node-country"
+              placeholder="Любая"
+              value={countryName}
+              onChange={(v) => {
+                setCountryName(v)
+                const nextCode = countryCodeFromName(v)
+                const currentLoc = locations.find((l) => l.id === form.getValues('locationId'))
+                if (!nextCode || !currentLoc || currentLoc.country !== nextCode) {
+                  form.setValue('locationId', '')
+                  setLocationQuery('')
+                  setPreview('')
+                }
                 void refreshPreview()
               }}
-              placeholder="Локация"
-              options={locations.map((l) => ({
-                value: l.id,
-                label: `${l.code} — ${l.name}`,
-              }))}
+              options={countryOptions}
+              searchPlaceholder="Поиск страны…"
+              emptyText="Нет вариантов"
             />
-          </div>
+          </FormFieldSimple>
+          <FormFieldSimple label="Локация" htmlFor="node-location">
+            <AutoCompleteInput
+              id="node-location"
+              placeholder="Любая"
+              value={locationQuery}
+              onChange={(v) => {
+                setLocationQuery(v)
+                const id = locationIdFromDisplay(v)
+                form.setValue('locationId', id)
+                const loc = locations.find((l) => l.id === id)
+                if (loc?.country) setCountryName(countryNameFromCode(loc.country))
+                void refreshPreview()
+              }}
+              options={locationOptions}
+              searchPlaceholder="Поиск локации…"
+              emptyText={countryCode ? 'Нет вариантов' : 'Сначала выберите страну'}
+              showLeadingInInput={false}
+              disabled={!countryCode}
+            />
+          </FormFieldSimple>
 
           <div className="grid grid-cols-2 gap-3">
             <div className="flex flex-col gap-2">

apps/web/src/routes/access-denied.tsx

@@ -0,0 +1,47 @@
+import { createFileRoute } from '@tanstack/react-router'
+import {
+  authPortalUrl,
+  clearToken,
+  ensureAuthConfig,
+  redirectToPortalLogout,
+} from '@/lib/auth'
+import { Button } from '@cdnmanager/ui/components/button'
+
+export const Route = createFileRoute('/access-denied')({
+  beforeLoad: async () => {
+    await ensureAuthConfig()
+  },
+  component: AccessDeniedPage,
+})
+
+function AccessDeniedPage() {
+  return (
+    <div className="flex min-h-svh flex-col items-center justify-center gap-4 p-6 text-center">
+      <h1 className="text-lg font-semibold">Нет доступа к CDN Manager</h1>
+      <p className="text-muted-foreground max-w-md text-sm">
+        В JWT нет приложения <code className="text-xs">cdn</code> или нужных прав{' '}
+        <code className="text-xs">cdn:*</code>. Выдайте доступ в Auth Portal →
+        Админка → пользователи, затем войдите снова.
+      </p>
+      <div className="flex flex-wrap items-center justify-center gap-2">
+        <Button
+          type="button"
+          variant="outline"
+          render={<a href={`${authPortalUrl().replace(/\/$/, '')}/admin`} />}
+        >
+          Открыть портал
+        </Button>
+        <Button
+          type="button"
+          variant="default"
+          onClick={() => {
+            clearToken()
+            redirectToPortalLogout()
+          }}
+        >
+          Выйти
+        </Button>
+      </div>
+    </div>
+  )
+}

apps/web/src/routes/auth.callback.tsx

@@ -7,11 +7,24 @@ import {
   firstAllowedPath,
   getClaims,
   getToken,
+  markPortalHandoff,
   parseHashToken,
   redirectToPortalLogin,
   setToken,
 } from '@/lib/auth'
 
+async function verifyTokenAccepted(token: string): Promise<boolean> {
+  try {
+    const res = await fetch('/api/v1/locations', {
+      headers: { Authorization: `Bearer ${token}` },
+    })
+    // 401 = JWT rejected (secret/issuer). 403 = JWT ok, RBAC — still accepted.
+    return res.status !== 401
+  } catch {
+    return true
+  }
+}
+
 export const Route = createFileRoute('/auth/callback')({
   validateSearch: (search: Record<string, unknown>) => ({
     error: typeof search.error === 'string' ? search.error : undefined,
@@ -19,25 +32,49 @@ export const Route = createFileRoute('/auth/callback')({
   beforeLoad: async ({ search }) => {
     await ensureAuthConfig()
 
-    if (search.error === 'sso_loop') {
+    if (search.error === 'sso_loop' || search.error === 'jwt_rejected') {
       return
     }
 
     const { accessToken } = parseHashToken(window.location.hash)
     if (accessToken) {
       setToken(accessToken)
+      // Start cooldown so a following API 401 cannot re-enter portal SSO storm.
+      markPortalHandoff()
       clearPortalHandoffFlag()
+
       const claims = getClaims()
       if (!claims) {
         clearToken()
-        window.location.assign(authPortalUrl())
-        await new Promise(() => {})
-        return
+        throw redirect({
+          to: '/auth/callback',
+          search: { error: 'jwt_rejected' },
+        })
       }
-      throw redirect({ to: firstAllowedPath() as '/' })
+      if (!claims.apps.includes('cdn')) {
+        throw redirect({ to: '/access-denied' })
+      }
+
+      const ok = await verifyTokenAccepted(accessToken)
+      if (!ok) {
+        clearToken()
+        throw redirect({
+          to: '/auth/callback',
+          search: { error: 'jwt_rejected' },
+        })
+      }
+
+      const next = firstAllowedPath()
+      if (next === '/access-denied') {
+        throw redirect({ to: '/access-denied' })
+      }
+      throw redirect({ to: next as '/' })
     }
     if (getToken() && getClaims()) {
       clearPortalHandoffFlag()
+      if (!getClaims()!.apps.includes('cdn')) {
+        throw redirect({ to: '/access-denied' })
+      }
       throw redirect({ to: firstAllowedPath() as '/' })
     }
     const ok = redirectToPortalLogin(`${window.location.origin}/auth/callback`)
@@ -51,13 +88,14 @@ export const Route = createFileRoute('/auth/callback')({
 
 function AuthCallbackPage() {
   const { error } = Route.useSearch()
-  if (error === 'sso_loop') {
+  if (error === 'sso_loop' || error === 'jwt_rejected') {
     return (
       <div className="flex min-h-svh flex-col items-center justify-center gap-3 p-6 text-center">
         <h1 className="text-lg font-semibold">Сессия не принята</h1>
         <p className="text-muted-foreground max-w-md text-sm">
-          Повторный вход через portal остановлен (защита от цикла редиректов).
-          Обычно это несовпадение JWT_SECRET / ISSUER или просроченный токен.
+          {error === 'jwt_rejected'
+            ? 'API отклонил JWT (обычно разный AUTH_JWT_SECRET / AUTH_ISSUER с portal). Проверьте .env контейнера CDN Manager.'
+            : 'Повторный вход через portal остановлен (защита от цикла редиректов). Обычно это несовпадение JWT_SECRET / ISSUER или просроченный токен.'}{' '}
           Войдите заново на portal, затем откройте CDN Manager.
         </p>
         <a className="text-primary text-sm underline" href={authPortalUrl()}>

docs/deploy-traefik.md

@@ -100,6 +100,8 @@ nano .env   # заполнить секреты
 
 На стороне портала добавьте origin в `RETURN_TO_ALLOWLIST` (`https://cdn.shnt.top`) и выдайте app **`cdn`** + права `cdn:*`. App Switcher URL: тот же origin.
 
+**Важно:** `AUTH_JWT_SECRET` в CDN Manager **должен совпадать** с `JWT_SECRET` auth-portal, `AUTH_ISSUER` — с `ISSUER` портала. Иначе после SSO UI зацикливается / «Страница не отвечает».
+
 ---
 
 ## 3. Запуск