From ebe6b6039e9e90f914e80be2911da8d9a0d0f35f Mon Sep 17 00:00:00 2001
From: myoffice-sync <myoffice-sync@local>
Date: Thu, 6 Aug 2026 12:05:38 +0000
Subject: [PATCH] sync build tree from private myoffice

---
 MyOffice.SPA/src/app/config.oidc.ts                      | 3 ++-
 MyOffice.SPA/src/environments/environment.proxmox.ts     | 7 ++++---
 .../OpenIddict/OpenIddictServiceCollectionExtensions.cs  | 9 +++++++++
 proxmox/README.md                                        | 3 ++-
 4 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/MyOffice.SPA/src/app/config.oidc.ts b/MyOffice.SPA/src/app/config.oidc.ts
index 292097b..a98bdca 100644
--- a/MyOffice.SPA/src/app/config.oidc.ts
+++ b/MyOffice.SPA/src/app/config.oidc.ts
@@ -23,7 +23,8 @@ function resolveAllowedUrls(): string[] {
 	}
 	const origin = publicOrigin();
 	const api = (environment.apiUrl ?? '').trim().replace(/\/$/, '');
-	return api ? [origin, api] : [origin];
+	// Relative ApiRoutes (`/api/...`) need '/api' in allowedUrls or the Bearer is never sent.
+	return api ? [origin, api, '/api'] : [origin, '/api'];
 }
 
 export const AuthCodeFlowConfig: AuthConfig = {
diff --git a/MyOffice.SPA/src/environments/environment.proxmox.ts b/MyOffice.SPA/src/environments/environment.proxmox.ts
index 943991a..36a9a89 100644
--- a/MyOffice.SPA/src/environments/environment.proxmox.ts
+++ b/MyOffice.SPA/src/environments/environment.proxmox.ts
@@ -1,11 +1,12 @@
 // Same-origin Proxmox deploy: API serves SPA from wwwroot (one public URL).
-// Empty apiUrl / identityServer / allowedUrls → resolved at runtime from window.location.origin.
+// Empty apiUrl / identityServer → resolved at runtime from window.location.origin.
+// allowedUrls '/api' so angular-oauth2-oidc attaches Bearer to relative /api/... calls.
 export const environment = {
 	production: true,
 	apiUrl: '',
 	identityServer: '',
-	allowedUrls: [] as string[],
-	requireHttps: false,
+	allowedUrls: ['/api'] as string[],
+	requireHttps: true,
 	externalLogins: {
 		google: {
 			clientId: ''
diff --git a/MyOffice.Web/Identity/OpenIddict/OpenIddictServiceCollectionExtensions.cs b/MyOffice.Web/Identity/OpenIddict/OpenIddictServiceCollectionExtensions.cs
index 44942fd..f69ff17 100644
--- a/MyOffice.Web/Identity/OpenIddict/OpenIddictServiceCollectionExtensions.cs
+++ b/MyOffice.Web/Identity/OpenIddict/OpenIddictServiceCollectionExtensions.cs
@@ -49,6 +49,15 @@ public static class OpenIddictServiceCollectionExtensions
 
 				ConfigureCryptography(options, configuration, environment);
 
+				// Public URL behind nginx — discovery issuer must match SPA window.location.origin,
+				// not the CT LAN address Kestrel sees on the wire.
+				var publicHost = configuration.GetValue<string>("FrontEnd:Host")?.Trim().TrimEnd('/');
+				if (!string.IsNullOrWhiteSpace(publicHost)
+					&& Uri.TryCreate(publicHost + "/", UriKind.Absolute, out var issuerUri))
+				{
+					options.SetIssuer(issuerUri);
+				}
+
 				var aspNetCoreBuilder = options.UseAspNetCore()
 					.EnableAuthorizationEndpointPassthrough()
 					.EnableUserInfoEndpointPassthrough()
diff --git a/proxmox/README.md b/proxmox/README.md
index 7143bef..f4d1c1b 100644
--- a/proxmox/README.md
+++ b/proxmox/README.md
@@ -90,12 +90,13 @@ location / {
     proxy_pass http://<myoffice-ct-ip>:9100;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
 }
 ```
 
-In Advanced install, set **Public URL** to the browser URL so CORS / `FrontEnd:Host` match.
+In Advanced install, set **Public URL** to the exact browser URL (e.g. `https://office.ase.com.ua`) so CORS / OpenIddict issuer / `FrontEnd:Host` match.
 
 ## Update later