fix(auth): runtime allowlist return_to с private для LAN SSO

Co-authored-by: Cursor <[email protected]>

apps/web/src/lib/auth.ts

@@ -1,5 +1,41 @@
 const TOKEN_KEY = 'authportal_token'
 
+/** Fallback if /api/v1/auth/config unavailable (dev). Includes `private` for LAN SSO. */
+export const DEFAULT_RETURN_TO_ALLOWLIST =
+  '.shnt.top,localhost,private,http://localhost:5173'
+
+let returnToAllowlist: string | null = null
+let returnToAllowlistPromise: Promise<string> | null = null
+
+export async function ensureReturnToAllowlist(): Promise<string> {
+  if (returnToAllowlist) return returnToAllowlist
+  if (returnToAllowlistPromise) return returnToAllowlistPromise
+
+  returnToAllowlistPromise = (async () => {
+    const fromVite = import.meta.env.VITE_RETURN_TO_ALLOWLIST as
+      | string
+      | undefined
+    try {
+      const res = await fetch('/api/v1/auth/config')
+      if (res.ok) {
+        const data = (await res.json()) as { return_to_allowlist?: string }
+        if (data.return_to_allowlist) {
+          returnToAllowlist = data.return_to_allowlist
+          return returnToAllowlist
+        }
+      }
+    } catch {
+      /* ignore */
+    }
+    returnToAllowlist = fromVite || DEFAULT_RETURN_TO_ALLOWLIST
+    return returnToAllowlist
+  })().finally(() => {
+    returnToAllowlistPromise = null
+  })
+
+  return returnToAllowlistPromise
+}
+
 export function getToken(): string | null {
   return localStorage.getItem(TOKEN_KEY)
 }