fix(auth): runtime allowlist return_to с private для LAN SSO

Co-authored-by: Cursor <[email protected]>

apps/api/src/config.ts

@@ -14,7 +14,7 @@ export const configSchema = z.object({
   adminEmail: z.string().email().default('[email protected]'),
   adminPassword: z.string().default('admin'),
   adminName: z.string().default('Admin'),
-  returnToAllowlist: z.string().default('.shnt.top,localhost'),
+  returnToAllowlist: z.string().default('.shnt.top,localhost,private'),
   serverPort: z.coerce.number().int().positive().default(8080),
   staticDir: z.string().optional(),
   logLevel: z.string().default('info'),
@@ -36,7 +36,8 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
     adminEmail: env.ADMIN_EMAIL ?? '[email protected]',
     adminPassword: env.ADMIN_PASSWORD ?? 'admin',
     adminName: env.ADMIN_NAME ?? 'Admin',
-    returnToAllowlist: env.RETURN_TO_ALLOWLIST ?? '.shnt.top,localhost',
+    returnToAllowlist:
+      env.RETURN_TO_ALLOWLIST ?? '.shnt.top,localhost,private',
     serverPort: env.SERVER_PORT ?? 8080,
     staticDir: env.STATIC_DIR || undefined,
     logLevel: env.LOG_LEVEL ?? 'info',

apps/api/src/routes/auth.ts

@@ -19,6 +19,12 @@ import { requireAuth, toMe } from '../plugins/auth-guards.js'
 const REFRESH_COOKIE = 'refresh_token'
 
 export async function authRoutes(app: FastifyInstance): Promise<void> {
+  /** Public — SPA reads allowlist at runtime (Docker-friendly). */
+  app.get('/api/v1/auth/config', async () => ({
+    return_to_allowlist: app.config.returnToAllowlist,
+    issuer: app.config.issuer,
+  }))
+
   app.post('/api/v1/auth/login', {
     config: { rateLimit: { max: 20, timeWindow: '1 minute' } },
     handler: async (request, reply) => {