work-license-server 1.0.16 → 1.0.18

package/assets/admin.js

@@ -16,28 +16,48 @@
     let activeTab = 'servers';
     let admCountdownTimer = null;
 
+    function readCookieSession() {
+        try {
+            const m = String(document.cookie || '').match(/(?:^|;\s*)odant_work_session=([^;]+)/);
+            return m?.[1] ? decodeURIComponent(m[1].trim()) : '';
+        }
+        catch { return ''; }
+    }
+
     function getStoredToken() {
         try {
-            return sessionStorage.getItem(TOKEN_KEY)
+            return localStorage.getItem('odant_work_session')
                 || localStorage.getItem(TOKEN_KEY)
-                || localStorage.getItem('odant_work_session')
+                || sessionStorage.getItem(TOKEN_KEY)
+                || sessionStorage.getItem('odant_work_session')
+                || readCookieSession()
                 || '';
         }
-        catch { return ''; }
+        catch { return readCookieSession(); }
     }
-    function setStoredToken(tok) {
+    function setStoredToken(tok, email = '', userObj = null) {
         adminToken = tok || '';
         try {
             if (tok) {
                 sessionStorage.setItem(TOKEN_KEY, tok);
                 localStorage.setItem(TOKEN_KEY, tok);
-                if (tok.startsWith('wks_')) {
-                    localStorage.setItem('odant_work_session', tok);
-                }
+                localStorage.setItem('odant_work_session', tok);
+                sessionStorage.setItem('odant_work_session', tok);
+                document.cookie = `odant_work_session=${encodeURIComponent(tok)}; path=/; max-age=31536000; SameSite=Lax`;
             }
             else {
                 sessionStorage.removeItem(TOKEN_KEY);
                 localStorage.removeItem(TOKEN_KEY);
+                localStorage.removeItem('odant_work_session');
+                localStorage.removeItem('odant_work_user_cache');
+                sessionStorage.removeItem('odant_work_session');
+                document.cookie = 'odant_work_session=; path=/; max-age=0; SameSite=Lax';
+            }
+            if (email) {
+                localStorage.setItem('odant_work_email', email);
+            }
+            if (userObj && typeof userObj === 'object') {
+                localStorage.setItem('odant_work_user_cache', JSON.stringify(userObj));
             }
         }
         catch { /* приватный режим */ }
@@ -78,6 +98,13 @@
         $('#adminLoginScreen').style.display = '';
         $('#adminAppShell').style.display = 'none';
         if ($('#admLoginError')) $('#admLoginError').textContent = errMsg;
+        try {
+            const savedEmail = localStorage.getItem('odant_work_email') || '';
+            if (savedEmail && $('#admLoginEmail') && !$('#admLoginEmail').value) {
+                $('#admLoginEmail').value = savedEmail;
+            }
+        }
+        catch { /* ignore */ }
         setTimeout(() => $('#admLoginEmail')?.focus(), 50);
     }
 
@@ -102,6 +129,7 @@
         $('#adminLoginScreen').style.display = 'none';
         $('#adminAppShell').style.display = '';
         if ($('#admUserLabel')) $('#admUserLabel').textContent = login;
+        if ($('#admProfileEmail')) $('#admProfileEmail').textContent = login;
         requestAnimationFrame(moveIndicator);
     }
 
@@ -165,7 +193,7 @@
             if (!user.isAdmin) {
                 throw new Error(`Аккаунт ${user.email} не обладает правами администратора (BOSS) сервера лицензирования.`);
             }
-            setStoredToken(user.sessionKey);
+            setStoredToken(user.sessionKey, user.email, user);
             resetAdmStep();
             showAdminApp(user.email);
             await refreshRegistry();
@@ -179,9 +207,9 @@
     }
 
     async function logoutAdmin() {
+        $('#admProfileModal')?.classList.remove('open');
         try { await api('/api/admin/logout', {}); } catch { /* ignore */ }
         setStoredToken('');
-        try { localStorage.removeItem('odant_work_session'); } catch { /* ignore */ }
         resetAdmStep();
         showLoginGate('');
     }
@@ -196,6 +224,7 @@
         try {
             const me = await api('/api/admin/me');
             if (me.authenticated) {
+                setStoredToken(saved, me.email || me.login || '');
                 showAdminApp(me.login || 'admin');
                 await refreshRegistry();
             }
@@ -900,6 +929,8 @@
                 case 'adm-send-code': sendAdminOtpCode(); break;
                 case 'adm-verify-code': verifyAdminOtpCode(); break;
                 case 'adm-reset-step': resetAdmStep(); break;
+                case 'open-adm-profile': $('#admProfileModal')?.classList.add('open'); break;
+                case 'close-adm-profile': $('#admProfileModal')?.classList.remove('open'); break;
                 case 'admin-logout': logoutAdmin(); break;
                 case 'registry': refreshRegistry(); break;
                 case 'open-create-server-modal': $('#admCreateServerModal')?.classList.add('open'); break;

package/assets/landing.js

@@ -14,6 +14,7 @@
     let REGIONS = (D.regions || []).slice();
     let currentUser = null;
     let currentStage = 'product';
+    let requestedInitialStage = '';
     let selectedCode = null;
     let pendingAuthAction = null;
 
@@ -129,12 +130,95 @@
         card.style.setProperty('--my', (e.clientY - r.top) + 'px');
     }, { passive: true });
 
-    /* ================= Вход / Регистрация (Email, Мессенджеры, OAuth) ================= */
+    /* ================= Вход / Регистрация и постоянная сессия в браузере ================= */
+    function readCookieSession() {
+        try {
+            const m = String(document.cookie || '').match(/(?:^|;\s*)odant_work_session=([^;]+)/);
+            return m?.[1] ? decodeURIComponent(m[1].trim()) : '';
+        }
+        catch { return ''; }
+    }
+    function persistSessionInBrowser(sessionKey = '', email = '', isAdmin = false, userObj = null) {
+        try {
+            if (sessionKey) {
+                localStorage.setItem('odant_work_session', sessionKey);
+                sessionStorage.setItem('odant_work_session', sessionKey);
+                if (isAdmin) {
+                    localStorage.setItem('odant_work_admin_token', sessionKey);
+                    sessionStorage.setItem('odant_work_admin_token', sessionKey);
+                }
+                document.cookie = `odant_work_session=${encodeURIComponent(sessionKey)}; path=/; max-age=31536000; SameSite=Lax`;
+            }
+            if (email) {
+                localStorage.setItem('odant_work_email', email);
+            }
+            if (userObj && typeof userObj === 'object') {
+                localStorage.setItem('odant_work_user_cache', JSON.stringify(userObj));
+            }
+        }
+        catch { /* приватный режим */ }
+    }
+    function clearSessionFromBrowser() {
+        try {
+            localStorage.removeItem('odant_work_session');
+            localStorage.removeItem('odant_work_admin_token');
+            localStorage.removeItem('odant_work_user_cache');
+            sessionStorage.removeItem('odant_work_session');
+            sessionStorage.removeItem('odant_work_admin_token');
+            document.cookie = 'odant_work_session=; path=/; max-age=0; SameSite=Lax';
+        }
+        catch { /* ignore */ }
+    }
+    function hydrateCachedUser() {
+        try {
+            const key = localStorage.getItem('odant_work_session')
+                || sessionStorage.getItem('odant_work_session')
+                || localStorage.getItem('odant_work_admin_token')
+                || readCookieSession()
+                || '';
+            if (!key) return;
+            const raw = localStorage.getItem('odant_work_user_cache');
+            if (raw) {
+                const cached = JSON.parse(raw);
+                if (cached?.email) {
+                    currentUser = { ...cached, sessionKey: key, ofertaAccepted: cached.ofertaAccepted !== false };
+                    onAuthenticated();
+                    return;
+                }
+            }
+            // Если есть подписанный токен wks_1.<payload>.<sig>, декодируем payload синхронно до ответа /api/auth/me
+            if (key.startsWith('wks_1.')) {
+                const parts = key.split('.');
+                if (parts[1]) {
+                    const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+                    const json = decodeURIComponent(escape(atob(b64)));
+                    const payload = JSON.parse(json);
+                    if (payload?.email) {
+                        currentUser = {
+                            userId: payload.userId || '',
+                            email: payload.email,
+                            name: payload.name || payload.email,
+                            companyName: payload.companyName || '',
+                            inn: payload.inn || '',
+                            isAdmin: Boolean(payload.isAdmin),
+                            ofertaAccepted: true,
+                            sessionKey: key,
+                            servers: [],
+                            franchises: [],
+                        };
+                        onAuthenticated();
+                    }
+                }
+            }
+        }
+        catch { /* ignore */ }
+    }
+
     function openAuth(hintMsg = '', intentTitle = '') {
         if ($('#authErrorMsg')) $('#authErrorMsg').textContent = hintMsg || '';
         const intentBox = $('#authIntentNotice');
         if (intentBox) {
-            if (intentTitle) {
+            if (intentTitle && !currentUser) {
                 intentBox.style.display = '';
                 intentBox.innerHTML = `Выбранная позиция: <b>${esc(intentTitle)}</b>.<br>После входа она автоматически появится как заказ в вашем Личном кабинете.`;
             }
@@ -143,9 +227,36 @@
                 intentBox.textContent = '';
             }
         }
-        if ($('#btnLogoutModal')) $('#btnLogoutModal').style.display = currentUser ? '' : 'none';
+        if (currentUser) {
+            if ($('#authTitle')) $('#authTitle').textContent = 'Ваш аккаунт';
+            if ($('#authSub')) $('#authSub').textContent = 'Сессия сохранена в браузере';
+            if ($('#authStepLoggedIn')) $('#authStepLoggedIn').style.display = '';
+            if ($('#authStepEmail')) $('#authStepEmail').style.display = 'none';
+            if ($('#authStepCode')) $('#authStepCode').style.display = 'none';
+            if ($('#authLoggedEmail')) $('#authLoggedEmail').textContent = currentUser.email || '';
+            if ($('#authLoggedRoleBadge')) {
+                $('#authLoggedRoleBadge').innerHTML = currentUser.isAdmin
+                    ? '<span class="tag ok">BOSS · Главный администратор</span>'
+                    : '<span class="tag">Клиент ODANT-WORK</span>';
+            }
+            if ($('#btnGoAdminModal')) $('#btnGoAdminModal').style.display = currentUser.isAdmin ? '' : 'none';
+        }
+        else {
+            if ($('#authTitle')) $('#authTitle').textContent = 'Вход / Регистрация';
+            if ($('#authSub')) $('#authSub').textContent = 'На ваш Email придёт одноразовый 6-значный код подтверждения';
+            if ($('#authStepLoggedIn')) $('#authStepLoggedIn').style.display = 'none';
+            if ($('#authStepEmail')) $('#authStepEmail').style.display = '';
+            if ($('#authStepCode')) $('#authStepCode').style.display = 'none';
+            try {
+                const savedEmail = localStorage.getItem('odant_work_email') || '';
+                if (savedEmail && $('#authEmail') && !$('#authEmail').value) {
+                    $('#authEmail').value = savedEmail;
+                }
+            }
+            catch { /* ignore */ }
+            setTimeout(() => $('#authEmail')?.focus(), 50);
+        }
         $('#authModal')?.classList.add('open');
-        setTimeout(() => $('#authEmail')?.focus(), 50);
     }
     function closeAuth() {
         $('#authModal')?.classList.remove('open');
@@ -224,7 +335,7 @@
         try {
             const data = await api('/api/auth/verify-code', { email, code });
             currentUser = data;
-            try { localStorage.setItem('odant_work_session', data.sessionKey); } catch { /* приватный режим */ }
+            persistSessionInBrowser(data.sessionKey, data.email, data.isAdmin, data);
             resetAuthStep();
             onAuthenticated();
             closeAuth();
@@ -245,18 +356,14 @@
         }
     }
 
-    function performLogout() {
+    async function performLogout() {
+        try { await api('/api/auth/logout', {}); } catch { /* ignore */ }
         currentUser = null;
         pendingAuthAction = null;
-        try {
-            localStorage.removeItem('odant_work_session');
-            localStorage.removeItem('odant_work_admin_token');
-            sessionStorage.removeItem('odant_work_admin_token');
-        } catch { /* ignore */ }
+        clearSessionFromBrowser();
         if ($('#tileAddons')) $('#tileAddons').style.display = 'none';
         if ($('#tileAdmin')) $('#tileAdmin').style.display = 'none';
         if ($('#btnAuthText')) $('#btnAuthText').textContent = 'Войти / Регистрация';
-        if ($('#btnLogoutModal')) $('#btnLogoutModal').style.display = 'none';
         closeAuth();
         if (currentStage === 'addons') switchStage('product');
         moveIndicator();
@@ -264,17 +371,28 @@
 
     async function restoreSession() {
         let key = '';
-        try { key = localStorage.getItem('odant_work_session') || ''; } catch { /* приватный режим */ }
+        try {
+            key = localStorage.getItem('odant_work_session')
+                || sessionStorage.getItem('odant_work_session')
+                || localStorage.getItem('odant_work_admin_token')
+                || readCookieSession()
+                || '';
+        }
+        catch { key = readCookieSession(); }
         if (!key) return;
         try {
             const data = await api('/api/auth/me?sessionKey=' + encodeURIComponent(key));
             if (data.authenticated && data.user) {
-                currentUser = { ...data.user, sessionKey: key };
+                currentUser = { ...data.user, sessionKey: data.user.sessionKey || key };
+                persistSessionInBrowser(currentUser.sessionKey, currentUser.email, currentUser.isAdmin, currentUser);
                 onAuthenticated();
-                if (location.hash === '#addons' && isUserReadyForOrders()) switchStage('addons', { scroll: false });
+                if ((requestedInitialStage === 'addons' || location.hash === '#addons') && isUserReadyForOrders()) {
+                    requestedInitialStage = '';
+                    switchStage('addons', { scroll: false });
+                }
             }
         }
-        catch { /* сессия устарела */ }
+        catch { /* сессия отозвана */ }
     }
 
     let franchiseCountdownTimer = null;
@@ -1688,14 +1806,12 @@
             if (el.dataset.stage && el !== document.body) { e.preventDefault(); switchStage(el.dataset.stage); return; }
             switch (el.dataset.action) {
                 case 'auth':
-                    if (isUserReadyForOrders() && currentStage !== 'addons') {
-                        switchStage('addons');
-                    }
-                    else {
-                        pendingAuthAction = null;
-                        resetAuthStep();
-                        openAuth();
-                    }
+                    pendingAuthAction = null;
+                    openAuth();
+                    break;
+                case 'go-cabinet':
+                    closeAuth();
+                    switchStage('addons');
                     break;
                 case 'auth-close': closeAuth(); break;
                 case 'send-code': sendAuthCode(); break;
@@ -1770,14 +1886,18 @@
 
     function start() {
         applyTheme(document.documentElement.getAttribute('data-theme') || 'dark');
+        requestedInitialStage = D.initialStage || location.hash.slice(1);
+        hydrateCachedUser();
         bind();
         renderOrbit();
         recalcBaseOrder();
         recalcPartner();
         renderRegionsTable();
         initBackdrop();
-        const initial = D.initialStage || location.hash.slice(1);
-        switchStage(initial && initial !== 'addons' && initial !== 'admin' ? initial : 'product', { scroll: false });
+        const targetStage = (requestedInitialStage === 'addons' && isUserReadyForOrders())
+            ? 'addons'
+            : (requestedInitialStage && requestedInitialStage !== 'addons' && requestedInitialStage !== 'admin' ? requestedInitialStage : 'product');
+        switchStage(targetStage, { scroll: false });
         if (document.fonts?.ready) document.fonts.ready.then(moveIndicator);
         initMap().then(() => selectRegion(selectedCode || 'RU-SVE'));
         restoreSession();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "work-license-server",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "description": "Лицензионный сервер, биллинг ЮKassa, боты поддержки (MAX, Telegram, VK) и лендинг ПАК WORK (work.odant.org)",
   "type": "module",
   "main": "src/index.js",

package/src/admin.js

@@ -115,7 +115,7 @@ export function renderAdminPage({ publicKey = '', assetVersion = '' } = {}) {
 
             <div class="top-actions">
                 <button class="icon-btn" id="btnTheme" title="Светлая / тёмная тема" aria-label="Переключить тему">${icon('sun')}</button>
-                <button class="btn btn-primary btn-sm" data-action="admin-logout" title="Нажмите, чтобы выйти из сессии">${icon('user')}<span id="admUserLabel">BOSS</span></button>
+                <button class="btn btn-primary btn-sm" data-action="open-adm-profile" title="Аккаунт администратора">${icon('user')}<span id="admUserLabel">BOSS</span></button>
             </div>
         </header>
 
@@ -402,6 +402,30 @@ export function renderAdminPage({ publicKey = '', assetVersion = '' } = {}) {
         </div>
     </div>
 
+    <!-- Модальное окно: Аккаунт администратора (защита от случайного выхода) -->
+    <div class="modal" id="admProfileModal" role="dialog" aria-modal="true">
+        <div class="card" style="max-width:440px">
+            <div class="modal-head">
+                <img src="/assets/odant-logo.png" alt="">
+                <div>
+                    <h3 class="h3" style="margin:0">Аккаунт администратора</h3>
+                    <div class="small muted">Сессия активна и сохранена в браузере</div>
+                </div>
+                <button class="icon-btn" data-action="close-adm-profile" aria-label="Закрыть">${icon('close')}</button>
+            </div>
+            <div style="padding:14px 16px;border-radius:12px;border:1px solid var(--line-strong);background:var(--field);margin-bottom:14px">
+                <div class="small muted">Вы вошли как</div>
+                <div style="font-size:16px;font-weight:700;margin-top:2px" id="admProfileEmail">—</div>
+                <div style="margin-top:6px"><span class="tag ok">BOSS · Главный администратор</span></div>
+            </div>
+            <div style="display:flex;flex-direction:column;gap:8px">
+                <a class="btn btn-primary" href="/#addons" style="width:100%;text-decoration:none">Перейти в Личный кабинет</a>
+                <button type="button" class="btn btn-ghost" style="width:100%;color:var(--danger)" data-action="admin-logout">Выйти из аккаунта</button>
+                <button type="button" class="btn btn-ghost btn-sm" style="width:100%" data-action="close-adm-profile">Закрыть</button>
+            </div>
+        </div>
+    </div>
+
     <script>window.__ODANT_ADMIN__ = ${jsonForScript(adminData)};</script>
     <script src="/assets/admin.js${v}" defer></script>
 </body>

package/src/crypto.js

@@ -381,3 +381,75 @@ export function verifyOwnerAccessToken(tokenStr = '', trustedPublicKeyB64 = '')
         return false;
     }
 }
+
+export const SESSION_TOKEN_PREFIX = 'wks_1';
+
+/**
+ * Сгенерировать бессрочный подписанный токен сессии браузера (wks_1.<payload_b64url>.<sig_b64url>),
+ * который не сбрасывается при перезапуске/обновлении контейнера сервера, пока пользователь сам не нажал «Выйти».
+ */
+export function createSessionToken({
+    userId = '',
+    email = '',
+    name = '',
+    companyName = '',
+    inn = '',
+    isAdmin = false,
+    issuedAt = Date.now(),
+} = {}, authorityKeys) {
+    const payloadObj = {
+        v: 1,
+        userId: String(userId || ''),
+        email: String(email || '').toLowerCase(),
+        ...(name ? { name: String(name) } : {}),
+        ...(companyName ? { companyName: String(companyName) } : {}),
+        ...(inn ? { inn: String(inn) } : {}),
+        isAdmin: Boolean(isAdmin),
+        issuedAt: Number(issuedAt || Date.now()),
+    };
+    const payloadB64 = Buffer.from(JSON.stringify(payloadObj), 'utf8').toString('base64url');
+    let sigB64 = '';
+    if (authorityKeys?.privateKey) {
+        const priv = crypto.createPrivateKey({
+            key: Buffer.from(String(authorityKeys.privateKey), 'base64'),
+            format: 'der',
+            type: 'pkcs8',
+        });
+        sigB64 = crypto.sign(null, Buffer.from(`${SESSION_TOKEN_PREFIX}.${payloadB64}`, 'utf8'), priv).toString('base64url');
+    }
+    return `${SESSION_TOKEN_PREFIX}.${payloadB64}.${sigB64}`;
+}
+
+/**
+ * Проверить подпись Ed25519 сессионного токена (wks_1.<payload>.<sig>) и вернуть payload.
+ */
+export function verifySessionToken(tokenStr = '', trustedPublicKeyB64 = '') {
+    try {
+        const raw = String(tokenStr || '').trim();
+        const parts = raw.split('.');
+        if (parts.length !== 3 || parts[0] !== SESSION_TOKEN_PREFIX || !parts[2])
+            return null;
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        if (!payload?.email)
+            return null;
+        const trustedKeys = resolveTrustedAuthorityKeys(trustedPublicKeyB64);
+        const signedData = Buffer.from(`${SESSION_TOKEN_PREFIX}.${parts[1]}`, 'utf8');
+        const sigBuf = Buffer.from(parts[2], 'base64url');
+        for (const keyB64 of trustedKeys) {
+            try {
+                const pub = crypto.createPublicKey({
+                    key: Buffer.from(String(keyB64), 'base64'),
+                    format: 'der',
+                    type: 'spki',
+                });
+                if (crypto.verify(null, signedData, pub, sigBuf))
+                    return payload;
+            }
+            catch { /* try next */ }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/src/landing.js

@@ -498,6 +498,20 @@ export function renderLandingPage({ publicKey = '', regions = null, assetVersion
 
             <div id="authIntentNotice" class="small" style="display:none;padding:10px 12px;border-radius:10px;background:rgba(0,163,224,.12);border:1px solid rgba(0,163,224,.35);margin-bottom:4px"></div>
 
+            <!-- Карточка активной сессии (показывается, когда пользователь уже вошёл) -->
+            <div id="authStepLoggedIn" style="display:none">
+                <div style="padding:14px 16px;border-radius:12px;border:1px solid var(--line-strong);background:var(--field);margin-bottom:14px">
+                    <div class="small muted">Активная сессия в браузере</div>
+                    <div style="font-size:16px;font-weight:700;margin-top:2px" id="authLoggedEmail">—</div>
+                    <div style="margin-top:6px" id="authLoggedRoleBadge"></div>
+                </div>
+                <div style="display:flex;flex-direction:column;gap:8px">
+                    <button type="button" class="btn btn-primary" style="width:100%" data-action="go-cabinet">Перейти в Личный кабинет</button>
+                    <a class="btn btn-ghost" id="btnGoAdminModal" href="/admin" style="width:100%;display:none;text-decoration:none">Открыть Админ-панель</a>
+                    <button type="button" class="btn btn-ghost" style="width:100%;color:var(--danger)" data-action="logout">Выйти из аккаунта</button>
+                </div>
+            </div>
+
             <div id="authStepEmail">
                 <div class="field">
                     <label for="authEmail">Ваш Email *</label>
@@ -531,7 +545,6 @@ export function renderLandingPage({ publicKey = '', regions = null, assetVersion
 
             <div class="status" id="authErrorMsg" style="color:var(--danger);min-height:18px;margin-top:6px"></div>
             <div style="display:flex;gap:10px;margin-top:6px;justify-content:flex-end;flex-wrap:wrap">
-                <button class="btn btn-ghost btn-sm" id="btnLogoutModal" data-action="logout" style="display:none">Выйти из аккаунта</button>
                 <button class="btn btn-ghost btn-sm" data-action="auth-close">Закрыть</button>
             </div>
         </div>

package/src/server.js

@@ -316,7 +316,15 @@ export function createLicenseServerApp(options = {}) {
     function extractBearerToken(req, body = null, url = null) {
         const authHeader = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '').trim();
         const xAdmin = String(req.headers['x-admin-token'] || req.headers['x-admin-key'] || '').trim();
-        return authHeader || xAdmin || body?.adminToken || body?.sessionKey || url?.searchParams?.get('sessionKey') || '';
+        let cookieTok = '';
+        const cookieHdr = String(req.headers.cookie || '');
+        if (cookieHdr) {
+            const m = cookieHdr.match(/(?:^|;\s*)odant_work_session=([^;]+)/);
+            if (m?.[1]) {
+                try { cookieTok = decodeURIComponent(m[1].trim()); } catch { cookieTok = m[1].trim(); }
+            }
+        }
+        return authHeader || xAdmin || body?.adminToken || body?.sessionKey || url?.searchParams?.get('sessionKey') || cookieTok || '';
     }
 
     function ensureCustomerOferta(req, body = {}) {
@@ -466,6 +474,7 @@ export function createLicenseServerApp(options = {}) {
                     ofertaAccepted: true,
                     hubUrl: body.hubUrl || reqOrigin,
                 });
+                res.setHeader('Set-Cookie', `odant_work_session=${encodeURIComponent(user.sessionKey)}; Path=/; Max-Age=31536000; SameSite=Lax`);
                 return sendJson(res, 200, user);
             }
 
@@ -476,9 +485,18 @@ export function createLicenseServerApp(options = {}) {
                     ...body,
                     hubUrl: body.hubUrl || reqOrigin,
                 });
+                res.setHeader('Set-Cookie', `odant_work_session=${encodeURIComponent(user.sessionKey)}; Path=/; Max-Age=31536000; SameSite=Lax`);
                 return sendJson(res, 200, user);
             }
 
+            if (req.method === 'POST' && pathname === '/api/auth/logout') {
+                const body = await readJsonBody(req);
+                const tok = extractBearerToken(req, body, url);
+                store.logoutAdmin(tok);
+                res.setHeader('Set-Cookie', 'odant_work_session=; Path=/; Max-Age=0; SameSite=Lax');
+                return sendJson(res, 200, { ok: true });
+            }
+
             // 2.0.1 Генерация или перевыпуск токена владельца/сервера (с зашитым URL сервера поддержки и licenseId) в личном кабинете
             if (req.method === 'POST' && pathname === '/api/cabinet/token') {
                 const body = await readJsonBody(req);
@@ -906,6 +924,7 @@ export function createLicenseServerApp(options = {}) {
             if (req.method === 'POST' && pathname === '/api/admin/logout') {
                 const body = await readJsonBody(req);
                 const tok = extractBearerToken(req, body, url);
+                res.setHeader('Set-Cookie', 'odant_work_session=; Path=/; Max-Age=0; SameSite=Lax');
                 return sendJson(res, 200, store.logoutAdmin(tok));
             }
 

package/src/store.js

@@ -29,6 +29,8 @@ import {
     createOwnerAccessToken,
     parseOwnerAccessToken,
     verifyOwnerAccessToken,
+    createSessionToken,
+    verifySessionToken,
 } from './crypto.js';
 
 const ONE_YEAR_MS = 365 * 24 * 3600_000;
@@ -82,6 +84,7 @@ export class LicenseStore {
         this.adminLogin = String(adminLogin || process.env.WORK_ADMIN_LOGIN || 'admin').trim();
         this.adminPassword = String(adminPassword || process.env.WORK_ADMIN_PASSWORD || process.env.WORK_ADMIN_KEY || 'odant-admin');
         this.adminSessions = new Map();
+        this.revokedSessions = new Set();
 
         this.state = {
             licenses: {},
@@ -124,7 +127,10 @@ export class LicenseStore {
 
     logoutAdmin(token = '') {
         const clean = String(token || '').trim();
-        if (clean) this.adminSessions.delete(clean);
+        if (clean) {
+            this.adminSessions.delete(clean);
+            this.revokedSessions.add(clean);
+        }
         return { ok: true };
     }
 
@@ -134,15 +140,15 @@ export class LicenseStore {
 
     getAdminIdentity(token = '') {
         const clean = String(token || '').trim();
-        if (!clean)
+        if (!clean || this.revokedSessions.has(clean))
             return null;
-        const adminUser = Object.values(this.state.users || {}).find(u => u.sessionKey === clean && u.isAdmin);
-        if (adminUser) {
+        const userFromTok = this._findUser(clean);
+        if (userFromTok && userFromTok.isAdmin) {
             return {
                 authenticated: true,
-                login: adminUser.email,
-                email: adminUser.email,
-                userId: adminUser.userId,
+                login: userFromTok.email,
+                email: userFromTok.email,
+                userId: userFromTok.userId,
                 role: 'BOSS',
             };
         }
@@ -1197,11 +1203,40 @@ export class LicenseStore {
 
     _findUser(sessionKeyOrEmail = '') {
         const key = String(sessionKeyOrEmail || '').trim();
-        if (!key)
+        if (!key || this.revokedSessions.has(key))
             return null;
-        return Object.values(this.state.users || {}).find(
+        let found = Object.values(this.state.users || {}).find(
             u => u.sessionKey === key || u.email === key.toLowerCase() || u.userId === key
         ) || null;
+        if (found)
+            return found;
+
+        // Если контейнер перезапускался, проверяем криптографическую подпись бессрочного токена сессии wks_1...
+        const verifiedPayload = verifySessionToken(key, this.authorityKeys.publicKey);
+        if (verifiedPayload?.email) {
+            const cleanEmail = String(verifiedPayload.email).toLowerCase();
+            let user = this.state.users[cleanEmail];
+            if (!user) {
+                this.registerOrLoginUser({
+                    email: cleanEmail,
+                    name: verifiedPayload.name || '',
+                    companyName: verifiedPayload.companyName || '',
+                    inn: verifiedPayload.inn || '',
+                    ofertaAccepted: true,
+                });
+                user = this.state.users[cleanEmail];
+            }
+            if (user) {
+                if (verifiedPayload.isAdmin) {
+                    user.isAdmin = true;
+                    user.role = 'BOSS';
+                }
+                user.sessionKey = key;
+                try { this._save(); } catch { /* ignore */ }
+                return user;
+            }
+        }
+        return null;
     }
 
     /**
@@ -1558,6 +1593,17 @@ export class LicenseStore {
             user.role = 'BOSS';
         }
 
+        // Выпускаем криптографически подписанный бессрочный токен сессии (wks_1...), устойчивый к перезапускам сервера
+        user.sessionKey = createSessionToken({
+            userId: user.userId,
+            email: user.email,
+            name: user.name,
+            companyName: user.companyName,
+            inn: user.inn,
+            isAdmin: Boolean(user.isAdmin),
+            issuedAt: now,
+        }, this.authorityKeys);
+
         if (ofertaAccepted !== false && !user.ofertaAccepted) {
             user.ofertaAccepted = true;
             user.ofertaAcceptedAt = now;
@@ -1784,7 +1830,7 @@ export class LicenseStore {
         const key = String(sessionKey || '').trim();
         if (!key)
             return null;
-        const user = Object.values(this.state.users).find(u => u.sessionKey === key);
+        const user = this._findUser(key);
         if (!user)
             return null;
         return this._formatUserResponse(user);