Fixed TG login

templates/login.html

@@ -3,6 +3,7 @@
 {% block title %}{{ t.login_heading }} | {{ t.site_name }}{% endblock title %}
 
 {% block head_extra %}
+<script src="https://telegram.org/js/telegram-web-app.js"></script>
 <style>
     * { margin: 0; padding: 0; box-sizing: border-box; }
     body { font-family: system-ui, -apple-system, sans-serif; background: #f5f5f5; color: #333; display: flex; justify-content: center; align-items: center; min-height: 100vh; }
@@ -30,6 +31,7 @@
     {% if !message.is_empty() %}
     <div class="flash">{{ message }}</div>
     {% endif %}
+    <div id="telegram-login-flash" class="flash" style="display: none;"></div>
 
     {% if !auth_password_enabled && !auth_sso_enabled %}
     <p class="message">{{ t.login_disabled }}</p>
@@ -53,4 +55,37 @@
     <a class="sso-btn" href="/auth/oidc/start">{{ oidc_button_text }}</a>
     {% endif %}
 </div>
+
+<script>
+(async () => {
+    const webApp = window.Telegram && window.Telegram.WebApp;
+    if (!webApp || !webApp.initData) return;
+
+    try {
+        webApp.ready();
+        webApp.expand();
+    } catch (_) {}
+
+    try {
+        const response = await fetch('/api/telegram-login/webapp', {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ init_data: webApp.initData }),
+        });
+        const data = await response.json().catch(() => ({}));
+        if (response.ok) {
+            window.location.replace(data.redirect_to || '/configs');
+            return;
+        }
+        const flash = document.getElementById('telegram-login-flash');
+        flash.textContent = data.error || data.detail || '{{ t.login_telegram_failed }}';
+        flash.style.display = 'block';
+    } catch (_) {
+        const flash = document.getElementById('telegram-login-flash');
+        flash.textContent = '{{ t.login_telegram_failed }}';
+        flash.style.display = 'block';
+    }
+})();
+</script>
 {% endblock body %}