fix some for iam

apps/user-app/src/api/client.ts

@@ -294,6 +294,12 @@ export interface ReportBalance {
   arz: string;
   mandeh: string;
 }
+function iamAppUrl(path: string) {
+  const base = import.meta.env.BASE_URL || '/'
+  const prefix = base.endsWith('/') ? base : `${base}/`
+  return `${window.location.origin}${prefix}${path.replace(/^\//, '')}`
+}
+
 export const api = {
   listProducts: () => request<ProductSummary[]>('/catalog/products'),
 
@@ -314,11 +320,27 @@ export const api = {
    * already-used code is a 401.
    */
   verifyOtp: (username: string, password: string) =>
-    request<{ token: string; customer: { id: string; mobile: string } }>(
+    request<{ token: string; customer: { id: string; mobile: string }; iamBootstrapUrl?: string }>(
       '/customer/auth/verify-otp',
       { method: 'POST', body: JSON.stringify({ username, password }) },
     ),
 
+  ssoStart: () =>
+    request<{ enabled: boolean; authorize_url: string | null }>(
+      `/customer/auth/sso/start?redirect_uri=${encodeURIComponent(iamAppUrl('auth/iam/callback'))}`,
+    ),
+
+  ssoCallback: (code: string, state: string) =>
+    request<{ token: string; customer: { id: string; mobile: string } }>('/customer/auth/sso/callback', {
+      method: 'POST',
+      body: JSON.stringify({ code, state }),
+    }),
+
+  ssoLogoutUrl: () =>
+    request<{ logout_url: string | null }>(
+      `/customer/auth/sso/logout-url?return_url=${encodeURIComponent(iamAppUrl(''))}`,
+    ),
+
   // The three reads below identify the customer by TOKEN. They replaced
   // /customers/:id, /:id/orders and /:id/ledger-entries, which took the id from
   // the URL and let anyone read anyone (SEC-08).