feat(auth): refactor authentication routes and enhance JWT handling

- Removed unused permission and app retrieval logic from the login process.
- Introduced a new endpoint for reissuing access tokens to handle role changes and account switches.
- Updated JWT payload handling to improve clarity and maintainability.
- Enhanced the readJwtPayload function for better decoding of JWT claims.

apps/web/src/lib/auth.ts

@@ -1,4 +1,11 @@
-import { isJwtExpired } from '@authportal/shared'
+import {
+  buildSsoRedirectUrl,
+  isJwtExpired,
+  isReturnToAllowed,
+  readJwtPayload,
+  type LoginResponse,
+  type MeResponse,
+} from '@authportal/shared'
 
 const TOKEN_KEY = 'authportal_token'
 
@@ -55,3 +62,71 @@ export function setToken(token: string) {
 export function clearToken() {
   localStorage.removeItem(TOKEN_KEY)
 }
+
+/** True when stored JWT claims disagree with live /me (DB). */
+export function jwtClaimsStaleVsMe(token: string, me: MeResponse): boolean {
+  const payload = readJwtPayload(token)
+  if (!payload) return true
+  if (Boolean(payload.is_admin) !== Boolean(me.is_admin)) return true
+  const claimApps = Array.isArray(payload.apps)
+    ? payload.apps.map(String).sort().join(',')
+    : ''
+  const meApps = [...me.apps].map(String).sort().join(',')
+  if (claimApps !== meApps) return true
+  const claimPerms = Array.isArray(payload.permissions)
+    ? payload.permissions.map(String).sort().join(',')
+    : ''
+  const mePerms = [...me.permissions].map(String).sort().join(',')
+  if (claimPerms !== mePerms) return true
+  return false
+}
+
+/**
+ * Re-mint access token from API (current DB rights) and store it.
+ * Always use before SSO handoff so apps never get a stale user JWT.
+ */
+export async function reissueAccessToken(): Promise<LoginResponse> {
+  const token = getToken()
+  if (!token) {
+    throw new Error('Нет сессии')
+  }
+  const res = await fetch('/api/v1/auth/reissue', {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+    },
+  })
+  if (!res.ok) {
+    clearToken()
+    throw new Error('Не удалось обновить сессию')
+  }
+  const body = (await res.json()) as LoginResponse
+  setToken(body.access_token)
+  return body
+}
+
+/** SSO open: fresh JWT → app /auth/callback. */
+export async function ssoOpenApp(appBaseUrl: string): Promise<void> {
+  const base = appBaseUrl.replace(/\/$/, '')
+  const issued = await reissueAccessToken()
+  const callback = `${base}/auth/callback`
+  window.location.href = buildSsoRedirectUrl(
+    callback,
+    issued.access_token,
+    issued.expires_at,
+  )
+}
+
+/** SSO return_to handoff with fresh JWT. */
+export async function ssoHandoffReturnTo(returnTo: string): Promise<boolean> {
+  const allowlist = await ensureReturnToAllowlist()
+  if (!isReturnToAllowed(returnTo, allowlist)) return false
+  const issued = await reissueAccessToken()
+  window.location.href = buildSsoRedirectUrl(
+    returnTo,
+    issued.access_token,
+    issued.expires_at,
+  )
+  return true
+}