fix: infinite reload loop on login when Telegram widget unavailable

When the Telegram OIDC widget fails to load (ad blockers, DNS, CSP),
the deep link polling fallback caused an infinite page reload:

1. pollDeepLinkToken received 202 (pending) which axios treated as success
2. loginWithDeepLink stored undefined tokens with isAuthenticated=true
3. checkAdminStatus() fired with invalid token → 401
4. Response interceptor called safeRedirectToLogin() → page reload → loop

Fixes:
- pollDeepLinkToken: validateStatus rejects non-200 (202 now caught in poll loop)
- AUTH_ENDPOINTS: add /cabinet/auth/deeplink/ and /cabinet/auth/login/auto
- safeRedirectToLogin: guard against redirect when already on /login
- loginWithDeepLink: validate response tokens before storing
- setTokens: validate tokens in store method (protects AutoLogin, VerifyEmail, etc.)

src/api/auth.ts

@@ -291,7 +291,17 @@ export const authApi = {
   },
 
   pollDeepLinkToken: async (token: string): Promise<AuthResponse> => {
-    const response = await apiClient.post<AuthResponse>('/cabinet/auth/deeplink/poll', { token });
+    // validateStatus: only treat 200 as success.
+    // Server returns 202 for "pending" and 410 for "expired" —
+    // these must reject so the polling catch-block can handle them.
+    // Without this, axios resolves on 202 (it's 2xx), causing
+    // loginWithDeepLink to set undefined tokens + isAuthenticated=true,
+    // which triggers checkAdminStatus() → 401 → safeRedirectToLogin() → infinite reload.
+    const response = await apiClient.post<AuthResponse>(
+      '/cabinet/auth/deeplink/poll',
+      { token },
+      { validateStatus: (status) => status === 200 },
+    );
     return response.data;
   },
 

src/api/client.ts

@@ -71,6 +71,8 @@ const AUTH_ENDPOINTS = [
   '/cabinet/auth/oauth/',
   '/cabinet/auth/merge/',
   '/cabinet/auth/account/link/server-complete',
+  '/cabinet/auth/deeplink/',
+  '/cabinet/auth/login/auto',
   '/cabinet/landing/',
 ];
 

src/store/auth.ts

@@ -74,6 +74,9 @@ export const useAuthStore = create<AuthState>()(
       clearCampaignBonus: () => set({ pendingCampaignBonus: null }),
 
       setTokens: (accessToken, refreshToken) => {
+        if (!accessToken || !refreshToken) {
+          throw new Error('Invalid tokens: cannot store empty credentials');
+        }
         tokenStorage.setTokens(accessToken, refreshToken);
         set({
           accessToken,
@@ -321,6 +324,9 @@ export const useAuthStore = create<AuthState>()(
 
       loginWithDeepLink: async (token) => {
         const response = await authApi.pollDeepLinkToken(token);
+        if (!response.access_token || !response.refresh_token) {
+          throw new Error('Invalid auth response: missing tokens');
+        }
         tokenStorage.setTokens(response.access_token, response.refresh_token);
         set({
           accessToken: response.access_token,

src/utils/token.ts

@@ -258,6 +258,8 @@ export function getAndClearReturnUrl(): string | null {
 
 export function safeRedirectToLogin(): void {
   if (typeof window !== 'undefined') {
+    // Guard: don't redirect if already on /login to prevent infinite reload loops
+    if (window.location.pathname === '/login') return;
     saveReturnUrl();
     window.location.href = '/login';
   }