sync build tree from private myoffice

MyOffice.SPA/src/app/config.oidc.ts

@@ -23,7 +23,8 @@ function resolveAllowedUrls(): string[] {
 	}
 	const origin = publicOrigin();
 	const api = (environment.apiUrl ?? '').trim().replace(/\/$/, '');
-	return api ? [origin, api] : [origin];
+	// Relative ApiRoutes (`/api/...`) need '/api' in allowedUrls or the Bearer is never sent.
+	return api ? [origin, api, '/api'] : [origin, '/api'];
 }
 
 export const AuthCodeFlowConfig: AuthConfig = {

MyOffice.SPA/src/environments/environment.proxmox.ts

@@ -1,11 +1,12 @@
 // Same-origin Proxmox deploy: API serves SPA from wwwroot (one public URL).
-// Empty apiUrl / identityServer / allowedUrls → resolved at runtime from window.location.origin.
+// Empty apiUrl / identityServer → resolved at runtime from window.location.origin.
+// allowedUrls '/api' so angular-oauth2-oidc attaches Bearer to relative /api/... calls.
 export const environment = {
 	production: true,
 	apiUrl: '',
 	identityServer: '',
-	allowedUrls: [] as string[],
-	requireHttps: false,
+	allowedUrls: ['/api'] as string[],
+	requireHttps: true,
 	externalLogins: {
 		google: {
 			clientId: ''

MyOffice.Web/Identity/OpenIddict/OpenIddictServiceCollectionExtensions.cs

@@ -49,6 +49,15 @@ public static class OpenIddictServiceCollectionExtensions
 
 				ConfigureCryptography(options, configuration, environment);
 
+				// Public URL behind nginx — discovery issuer must match SPA window.location.origin,
+				// not the CT LAN address Kestrel sees on the wire.
+				var publicHost = configuration.GetValue<string>("FrontEnd:Host")?.Trim().TrimEnd('/');
+				if (!string.IsNullOrWhiteSpace(publicHost)
+					&& Uri.TryCreate(publicHost + "/", UriKind.Absolute, out var issuerUri))
+				{
+					options.SetIssuer(issuerUri);
+				}
+
 				var aspNetCoreBuilder = options.UseAspNetCore()
 					.EnableAuthorizationEndpointPassthrough()
 					.EnableUserInfoEndpointPassthrough()

proxmox/README.md

@@ -90,12 +90,13 @@ location / {
     proxy_pass http://<myoffice-ct-ip>:9100;
     proxy_http_version 1.1;
     proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
 }
 ```
 
-In Advanced install, set **Public URL** to the browser URL so CORS / `FrontEnd:Host` match.
+In Advanced install, set **Public URL** to the exact browser URL (e.g. `https://office.ase.com.ua`) so CORS / OpenIddict issuer / `FrontEnd:Host` match.
 
 ## Update later