fix some other bugs of iam

apps/user-app/src/api/client.ts

@@ -359,6 +359,9 @@ export const api = {
       `/customer/auth/sso/logout-url?return_url=${encodeURIComponent(iamAppUrl(''))}`,
     ),
 
+  endSharedSession: () =>
+    request<{ ended: number }>('/customer/auth/logout', { method: 'POST', body: '{}' }),
+
   // The three reads below identify the customer by TOKEN. They replaced
   // /customers/:id, /:id/orders and /:id/ledger-entries, which took the id from
   // the URL and let anyone read anyone (SEC-08).

apps/user-app/src/router/index.ts

@@ -122,6 +122,9 @@ router.beforeEach(async (to) => {
     try {
       const started = await api.ssoStart();
       if (started.enabled && started.authorize_url) {
+        if (to.fullPath.startsWith('/') && !to.fullPath.startsWith('//')) {
+          sessionStorage.setItem('gb_iam_return', to.fullPath);
+        }
         window.location.assign(started.authorize_url);
         return false;
       }

apps/user-app/src/views/user/DashboardView.vue

@@ -242,6 +242,11 @@ function goToDetails(id: number) {
 
 async function logOut() {
   data.notify = false
+  try {
+    await api.endSharedSession()
+  } catch {
+    // خروج محلی ادامه پیدا می‌کند
+  }
   let central: string | null = null
   try {
     central = (await api.ssoLogoutUrl()).logout_url

apps/user-app/src/views/user/IamCallback.vue

@@ -7,13 +7,20 @@ import { useSessionStore } from '../../stores/session'
 const router = useRouter()
 const session = useSessionStore()
 
+function backToCaller() {
+  sessionStorage.setItem('gb_iam_sso_skip', '1')
+  const saved = sessionStorage.getItem('gb_iam_return')
+  sessionStorage.removeItem('gb_iam_return')
+  const path = saved && saved.startsWith('/') && !saved.startsWith('//') ? saved : '/'
+  return router.replace(path)
+}
+
 onMounted(async () => {
   const params = new URLSearchParams(window.location.search)
   sessionStorage.removeItem('gb_iam_sso_checked')
 
   if (params.get('error') || !params.get('code') || !params.get('state')) {
-    sessionStorage.setItem('gb_iam_sso_skip', '1')
-    await router.replace({ name: 'login' })
+    await backToCaller()
     return
   }
 
@@ -28,8 +35,7 @@ onMounted(async () => {
     }
     await router.replace({ name: 'home' })
   } catch {
-    sessionStorage.setItem('gb_iam_sso_skip', '1')
-    await router.replace({ name: 'login' })
+    await backToCaller()
   }
 })
 </script>

apps/user-app/src/views/user/LoginView.vue

@@ -162,6 +162,10 @@ const sendToken = async (otpCode: string) => {
     const verified = await api.verifyOtp(String(formModel.username ?? ''), otpCode)
     const { token, customer } = verified
     session.login(token, customer.id, customer.mobile)
+    if (verified.iamBootstrapUrl) {
+      window.location.assign(verified.iamBootstrapUrl)
+      return
+    }
     // D21 — ask the server which kind of principal this token is, so the
     // expert-only entries appear for a sales expert. Failure is non-fatal:
     // the entries simply stay hidden, and the server refuses those routes
@@ -172,10 +176,6 @@ const sendToken = async (otpCode: string) => {
     } catch {
       session.setSalesExpert(false)
     }
-    if (verified.iamBootstrapUrl) {
-      window.location.assign(verified.iamBootstrapUrl)
-      return
-    }
     const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : undefined
     await router.push(redirect ?? { name: 'home' })
     toast.success('با موفقیت وارد شدید')