From 22282c5f4e67cb04ccd9c17e2d4b848c3fa8466f Mon Sep 17 00:00:00 2001
From: Kirill <mpak8501@yandex.ru>
Date: Fri, 22 May 2026 13:52:48 +0500
Subject: [PATCH] fix: accept token as query param in authenticate, pass token
 to oauth link URL

---
 .../src/pages/me/ui/sections/SettingsPage.tsx |   7 ++++++-
 server/prisma/prisma/dev.db                   | Bin 364544 -> 364544 bytes
 server/src/index.js                           |   3 +++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/client/src/pages/me/ui/sections/SettingsPage.tsx b/client/src/pages/me/ui/sections/SettingsPage.tsx
index 9c88dc1..943f542 100644
--- a/client/src/pages/me/ui/sections/SettingsPage.tsx
+++ b/client/src/pages/me/ui/sections/SettingsPage.tsx
@@ -277,7 +277,12 @@ export function SettingsPage() {
                       </Button>
                     )}
                     {!m.active && m.type !== 'password' && (
-                      <Button size="small" variant="outlined" component="a" href={`/api/auth/oauth/${m.type}/link`}>
+                      <Button
+                        size="small"
+                        variant="outlined"
+                        component="a"
+                        href={`/api/auth/oauth/${m.type}/link?token=${localStorage.getItem('craftshop_auth_token') || ''}`}
+                      >
                         Привязать
                       </Button>
                     )}
diff --git a/server/prisma/prisma/dev.db b/server/prisma/prisma/dev.db
index 6f4fb62be0297c9ddb0298067e54687f168d6430..c83aff765fa853729b0eea5bb0f24c39e259b017 100644
GIT binary patch
delta 1613
zcmah}O>Em_7`EfjP?xq&G&(f2(Fxk2F|D;@XK_H4(_gZxNmI7aPGl=i>ZFN(VmopE
zE@>~j4#XjcNvsE?-56WffV9KJc|!DrxYF)64xG4_@3YgAHK}IF@5PUw_j#Z9XLI}P
z=Jwfd-uDd6etUiz#>Zd(aBl$fVi^4={S$qc{$t0-EYja4AAHidOswD~xmdbt>uOF{
zuCl>ki049~fS>2tuw0ciLzTzV1&zE!EW1cUs&&A)5Z?*&U>_3+%3)Ls*__^iJV7{!
z!Dolue)b?-P|aGIVHl1r$?5f+!m5?5j(;E9KX~E!2#6$=){HC!)insZhCoG|UstqH
z27z9_)e7VL^alui4qPFr_*`uEdhGMH_|&cFT<m5W6UTwk=a_InKiu(!@6*k-BzU{|
z<L~(7a6z@$tV8Zs6k9j7e3?z(-NRdZ9_k|g1p1Yso5rDMI<|;YqVEibk)+sGRYuYa
zHBHS|<djg!sDZM=`Z-5`(v3$*q+dZu!MtXgLBoDZyrN-pvzw#kC0<R8pif;t^&{s{
zH~-!B!NQw=FA@Fy6!4v)oW!j-!8}5wwK_}}Kz7-wOtz9K*v(%KiAzyvlq2g!TUNLC
zChirlP#3UseSJh{trmmC2#Au)bF7w=a}MQ)unDfsr*`To_>Jazit?N%#CC^!@VC4G
zcz*_A&#&}nA^aUN0AGrFkAe?LwzC;&s47!6HY7Qx`%?m6hyL>cq-fuC<B`$b&{h}#
z#vP1ZdKY&34&BT*K=M;G6N*zVoC!fl)k~~pxEXs4i&Oq(H?}s9DNoGWb1*s9lh@e>
z)YAp}(a>K*qfp1YLyawt92B=Ez@WGsLQNmpB9DtMb5I+@LT!p!;uXuzI$LMS+0%Ef
zH$o~)B}tO3;;270$}*$c!k5Ne&_6TVn30%@bt`JdBZ*~uQIF(P_Jq8&I=>NHoFAWw
zPO(-n8%gDbYABLJr5}iHr0-+O%5a(-5LbpB-Edvnz3Lw4)6Y+%<Nn-)N9tIpljVjR
zZ+Hg8Ee;<P6O$(_>d_@9*BcJg|CqJcojgw8_9?cMNLb6&`g~w@VquzFn3}4tYqG+r
z=5=|dsszniG`}IN&hqPiEfdt0VuTZxkm#3VZfxxVaIydBCc&%Z-TaDf-cAClX&r)*
z2HO6vE`tk%h_}t`-dv*NYY{CggO)WAsK|O*l{;6h``$tOz8Lc}>^SE{e%DL>bMHTr
CK?FJg

delta 1463
zcmZ`(OKcle6rC@4LY!wS*vP0MP(q8S(#-RWJswbG<0h>l64!`?G>{U;<FP&Vj6MFu
zv9pP@L1IO!AdL`GlSQR=Ra(**Bo?sgrV>r0N?oyPc5MY47VOM>cH^qpjO4qpj?O*z
z+<RVQ*W1|jZoN)9A6+>SMfLWV*S;B~zykt20FS}f;NhN|p9R~?JMYC8$%<C4jIZVm
zJ)awgk|c{l5JE`^$`P%mn3kcPRSPElF1^q}8ill;e*q|UfnFMJU-@hJHOfOn&a{+V
zD8R!=UCAf4+S$_TkGsF^M9hRz7I~f*)Qlwib)%RqYa#M#>;_z--e$rqr<zvUOk@oO
zgR-T7p$n_!TtzEl(B;3I5%Lju1EYP+8J3Gr$EIdt7gpjQF3nBH=AU8WBx5;9a72J3
zaDC4m`5xFS%goF6%>#1MW17{FjL7|ZRTERXrpQ{t`s$Eu9#Y(!q=mdm0o!U((OC3C
zJh3pRPff3+q}ci3Y>A&reRNJ<j46S_dcyd4t(I6X8?kW}wcVo*Q2pcfpKbm9THK+Z
z0K3tmJWUt<WMZ_hi~$0DE`k70_uXht`{_k`V4x=WL%ayZP_P-N`5!#kLOehKTL{%k
zK@uv^{<%e;nnS)|3*b`6#XeRSNmuv`H$wOv4tkg%ST=lYcnVWu!`I|uxo#<HoAM;`
zyyNOIu4gfKnBRfWR}^)E4tE#Y!{2l<jO!&5+$X^OJ$L*U@PSOe5)Pmr$K&E4IF56$
zEN+}Hz>tIlLQ$#+c_m#<=xQD5x_2aXDk6Ify!~;_2*dE`9`*^a5BAZ5zW{c2gIRtb
z?;wd-MSKdi!dfw{)z{l|_FEuobj!Tjsm(@*viHP(WhUS0%j-m|rNC(d7~u5Kw?kt{
z$E!oGO@VcW7bfxEM>koPwF@oAx1HV@i9d^8JD)gpIz1R(^t6G#jwvW66^P`g5{1lK
zM%N3loUi|Hp6#~|7~jc^QqE{eG{lV+wq2c@0`;PTtqsPv(QW(Ru%Dv_!w{=L-}BvI
z89d&NWd=%WF(h~6pEecUz;6iZcJByw>ZY4?hT#b2Xiwea`NnZDyFA@z<oF+@s#Fw3
zDV4|ki808JeKuF}%cbDV`AgXxZ_SvQMSt~^i?xZ^botYHy^@tv8CAR#<%?=^Iyyfa
z$mhizKA~IYcb)2_9umXE3;`yFq@M;4nSVwHC~z0QA$QR$;%a;j?90mxXO~*csMl2L
k?GOg5#XwFKL@5Y!N!Gr8K%NrtvGy49JPZA9>l(ZDFTj$^4gdfE

diff --git a/server/src/index.js b/server/src/index.js
index 19cd72e..2f1477e 100644
--- a/server/src/index.js
+++ b/server/src/index.js
@@ -75,6 +75,9 @@ await fastify.register(fastifyStatic, {
 
 fastify.decorate('authenticate', async function authenticate(request, reply) {
   try {
+    if (!request.headers.authorization && request.query?.token) {
+      request.headers.authorization = `Bearer ${request.query.token}`
+    }
     await request.jwtVerify()
   } catch {
     return reply.code(401).send({ error: 'Не авторизован' })