sync build tree from private myoffice

MyOffice.Web/Identity/OpenIddict/OpenIddictServiceCollectionExtensions.cs

@@ -49,6 +49,15 @@ public static class OpenIddictServiceCollectionExtensions
 
 				ConfigureCryptography(options, configuration, environment);
 
+				// Public URL behind nginx — discovery issuer must match SPA window.location.origin,
+				// not the CT LAN address Kestrel sees on the wire.
+				var publicHost = configuration.GetValue<string>("FrontEnd:Host")?.Trim().TrimEnd('/');
+				if (!string.IsNullOrWhiteSpace(publicHost)
+					&& Uri.TryCreate(publicHost + "/", UriKind.Absolute, out var issuerUri))
+				{
+					options.SetIssuer(issuerUri);
+				}
+
 				var aspNetCoreBuilder = options.UseAspNetCore()
 					.EnableAuthorizationEndpointPassthrough()
 					.EnableUserInfoEndpointPassthrough()