Route CMS OIDC through Authentik host alias

server/admin-server.mjs

@@ -368,12 +368,14 @@ function oidcInternalFetchUrl(rawUrl) {
 
 async function fetchOidc(rawUrl, options = {}) {
   return fetch(oidcInternalFetchUrl(rawUrl), {
+    redirect: "manual",
     ...options,
     headers: options.headers,
   });
 }
 
 async function fetchOidcJson(rawUrl, options = {}) {
+  const fetchUrl = oidcInternalFetchUrl(rawUrl);
   const response = await fetchOidc(rawUrl, {
     ...options,
     headers: {
@@ -381,8 +383,31 @@ async function fetchOidcJson(rawUrl, options = {}) {
       ...(options.headers || {}),
     },
   });
-  const payload = await response.json().catch(() => null);
-  return { response, payload };
+  const body = await response.text().catch(() => "");
+  let payload = null;
+  try {
+    payload = body ? JSON.parse(body) : null;
+  } catch {
+    payload = null;
+  }
+  return { response, payload, body, fetchUrl };
+}
+
+function oidcJsonError(label, response, body, fetchUrl) {
+  const contentType = response.headers.get("content-type") || "";
+  const location = response.headers.get("location") || "";
+  const bodyPreview = String(body || "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 180);
+  const parts = [
+    `${label}: ${response.status}`,
+    `url=${fetchUrl}`,
+    contentType ? `content-type=${contentType}` : "",
+    location ? `location=${location}` : "",
+    bodyPreview ? `body=${bodyPreview}` : "",
+  ].filter(Boolean);
+  return parts.join("; ");
 }
 
 function publicOidcUrl(rawUrl) {
@@ -416,9 +441,9 @@ async function loadOidcDiscovery() {
   if (!discoveryPromise) {
     discoveryPromise = (async () => {
       const wellKnownUrl = new URL(".well-known/openid-configuration", authConfig.issuer);
-      const { response, payload } = await fetchOidcJson(wellKnownUrl);
+      const { response, payload, body, fetchUrl } = await fetchOidcJson(wellKnownUrl);
       if (!response.ok || !payload) {
-        throw new Error(`Не удалось загрузить OIDC discovery: ${response.status}`);
+        throw new Error(oidcJsonError("Не удалось загрузить OIDC discovery", response, body, fetchUrl));
       }
       discoveryCache = normalizeDiscovery(payload);
       return discoveryCache;
@@ -435,9 +460,9 @@ async function jwksForDiscovery(discovery) {
   if (!jwksPromise || jwksUriCache !== discovery.jwks_uri) {
     jwksUriCache = discovery.jwks_uri;
     jwksPromise = (async () => {
-      const { response, payload } = await fetchOidcJson(discovery.jwks_uri);
+      const { response, payload, body, fetchUrl } = await fetchOidcJson(discovery.jwks_uri);
       if (!response.ok || !payload) {
-        throw new Error(`Не удалось загрузить OIDC JWKS: ${response.status}`);
+        throw new Error(oidcJsonError("Не удалось загрузить OIDC JWKS", response, body, fetchUrl));
       }
       jwksCache = createLocalJWKSet(payload);
       return jwksCache;