fix: open install guide deeplinks via external app gateway

tests/test_webapp_route_contract.py

@@ -51,6 +51,7 @@ class WebAppRouteContractTests(unittest.TestCase):
             ("GET", "/login/password"): "index_route",
             ("GET", "/home"): "index_route",
             ("GET", "/install"): "index_route",
+            ("GET", "/open-app"): "app_deeplink_route",
             ("GET", "/s/{share_token}"): "index_route",
             ("GET", "/invite"): "index_route",
             ("GET", "/devices"): "index_route",
@@ -195,6 +196,27 @@ class WebAppRouteContractTests(unittest.TestCase):
 
         self.assertEqual(match_info.handler.__name__, "webapp_favicon_route")
 
+    def test_app_deeplink_gateway_keeps_target_in_fragment(self):
+        request = _Request(
+            app={
+                "settings": SimpleNamespace(
+                    WEBAPP_ENABLED=True,
+                    WEBAPP_TITLE="/minishop",
+                )
+            }
+        )
+        request["csp_nonce"] = "nonce-value"
+
+        response = asyncio.run(subscription_webapp.app_deeplink_route(request))
+
+        self.assertEqual(response.status, 200)
+        self.assertEqual(response.headers["Cache-Control"], "no-store")
+        self.assertIn('nonce="nonce-value"', response.text)
+        self.assertIn("window.location.hash", response.text)
+        self.assertIn("URLSearchParams", response.text)
+        self.assertIn("The app link is unavailable.", response.text)
+        self.assertIn(r"/^(?:javascript|data|vbscript|https?):/i", response.text)
+
 
 class AdminApiAuthContractTests(unittest.IsolatedAsyncioTestCase):
     def _settings(self):

tests/test_webapp_telegram_logout.py

@@ -33,3 +33,27 @@ def test_logout_handler_is_noop_inside_telegram_mini_app():
     mark_logout_pos = source.index("markManualLogout();")
 
     assert guard_pos < mark_logout_pos
+
+
+def test_open_app_route_skips_bootstrap_and_auth_flow():
+    main_source = _read("frontend/src/main.js")
+    app_source = _read("frontend/src/App.svelte")
+
+    assert "skipBootstrap = isExternalAppLaunchPath(window.location.pathname)" in main_source
+    assert 'mode = isAppLaunchRoute ? "appLaunch"' in app_source
+
+    launch_guard_pos = app_source.index("if (isAppLaunchRoute) {")
+    boot_pos = app_source.index("boot();", launch_guard_pos)
+
+    assert launch_guard_pos < boot_pos
+
+
+def test_frontend_nginx_proxies_open_app_gateway_to_backend():
+    source = _read("deploy/docker/frontend/nginx.conf")
+
+    open_app_pos = source.index("location = /open-app")
+    fallback_pos = source.index("location / {")
+    block = source[open_app_pos:fallback_pos]
+
+    assert open_app_pos < fallback_pos
+    assert "proxy_pass http://backend:8081;" in block