From 453e25e40fd6b6014a052ec6a6223702ef0b9ea4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Tue, 2 Jun 2026 17:31:21 +0300
Subject: [PATCH] =?UTF-8?q?ui:=20=D1=83=D0=B1=D1=80=D0=B0=D1=82=D1=8C=20?=
 =?UTF-8?q?=D0=B2=D1=85=D0=BE=D0=B4=20=D0=BF=D0=BE=20Bearer=20=D1=82=D0=BE?=
 =?UTF-8?q?=D0=BA=D0=B5=D0=BD=D1=83,=20=D0=B4=D0=BE=D0=B1=D0=B0=D0=B2?=
 =?UTF-8?q?=D0=B8=D1=82=D1=8C=20=D1=80=D1=83=D1=87=D0=BD=D0=BE=D0=B9=20?=
 =?UTF-8?q?=D0=B2=D0=B2=D0=BE=D0=B4=20clientId=20(=D0=BE=D1=82=D0=BB=D0=B0?=
 =?UTF-8?q?=D0=B4=D0=BA=D0=B0)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ui/routes/auth.js  | 34 ++++++++++++++++++++++++++++------
 views/ui-login.ejs | 10 +++++-----
 2 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/ui/routes/auth.js b/ui/routes/auth.js
index fba14d6..84207ab 100644
--- a/ui/routes/auth.js
+++ b/ui/routes/auth.js
@@ -64,13 +64,35 @@ function createRouter({ auth, MOCK_USERS, authLimiter }) {
     res.redirect(returnTo || '/');
   });
 
-  // POST /login-token — вставить реальный Bearer токен
-  router.post('/login-token', authLimiter, (req, res) => {
-    const { token, returnTo } = req.body;
-    if (!token || !token.trim()) return res.redirect('/login?error=Токен+не+может+быть+пустым');
+  // GET /login-token — редирект на /login (форма вставки токена там же)
+  router.get('/login-token', (req, res) => res.redirect('/login'));
 
-    req.session.token = token.trim();
-    req.session.user  = null; // заполнится при первом запросе к API
+  // POST /login-token — ручной вход по clientId (отладка)
+  router.post('/login-token', authLimiter, (req, res) => {
+    const { clientId, returnTo } = req.body;
+    if (!clientId || !clientId.trim()) return res.redirect('/login?error=Введите+clientId');
+
+    const trimmed = clientId.trim();
+    const allClientIds = trimmed.split(',').map(s => s.trim()).filter(Boolean);
+    const activeClientId = allClientIds[0];
+
+    const token = auth.issueMockToken({
+      clientId:    trimmed,
+      companyId:   '00000000-0000-0000-0000-000000000001',
+      companyName: activeClientId,
+      email:       activeClientId + '@debug.local',
+    });
+
+    req.session.token = token;
+    req.session.user  = {
+      clientId:       trimmed,
+      allClientIds,
+      activeClientId,
+      email:          activeClientId + '@debug.local',
+      companyId:      '00000000-0000-0000-0000-000000000001',
+      companyName:    activeClientId,
+      isAdmin:        activeClientId === (process.env.ADMIN_CLIENT_ID || 'WZ01112'),
+    };
     res.redirect(returnTo || '/');
   });
 
diff --git a/views/ui-login.ejs b/views/ui-login.ejs
index 5222326..2936380 100644
--- a/views/ui-login.ejs
+++ b/views/ui-login.ejs
@@ -84,15 +84,15 @@
   <hr>
   <% } %>
 
-  <%# ── Блок вставки Bearer токена (всегда виден) ── %>
-  <p class="section-title">Войти с Bearer токеном</p>
+  <%# ── Блок ручного ввода clientId (отладка) ── %>
+  <p class="section-title">Ручной вход (clientId)</p>
   <form method="POST" action="/login-token">
     <input type="hidden" name="returnTo" value="<%= returnTo || '/' %>">
     <div class="field">
-      <label>Bearer токен</label>
-      <textarea name="token" placeholder="eyJ..." rows="3" autocomplete="off"></textarea>
+      <label>Client ID (через запятую для нескольких компаний)</label>
+      <input type="text" name="clientId" placeholder="WZ88888,WZ77777" autocomplete="off">
     </div>
-    <button class="btn" type="submit">Войти по токену</button>
+    <button class="btn" type="submit">Войти</button>
   </form>
 </div>