From dcb74603adcfae1a740dcaa184419cb155841418 Mon Sep 17 00:00:00 2001
From: mahmood <mahmood5221lotfi@gmail.com>
Date: Thu, 8 Oct 2026 00:10:10 +0330
Subject: [PATCH] feat add some for users in iam

---
 apps/api/release/app.js                 | 15 +++++++++++--
 apps/api/src/modules/iam/iam.service.ts | 29 ++++++++++++++++++++++---
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/apps/api/release/app.js b/apps/api/release/app.js
index 8929712..01cdf1f 100644
--- a/apps/api/release/app.js
+++ b/apps/api/release/app.js
@@ -83506,7 +83506,7 @@ var require_iam_service = __commonJS({
           body.tenant_slug = tenantSlug;
         if (clientIp)
           body.client_ip = clientIp;
-        const returnTo = (0, env_12.envOrNull)("IAM_ADMIN_BROWSER_RETURN_URL") || (0, env_12.envOrNull)("IAM_BROWSER_RETURN_URL");
+        const returnTo = this.adminBrowserReturnUrl();
         if (returnTo)
           body.return_to = returnTo;
         const timeout = Number((0, env_12.envOr)("IAM_HTTP_TIMEOUT_MS", "8000"));
@@ -83579,7 +83579,7 @@ var require_iam_service = __commonJS({
           body.client_ip = clientIp;
         if (factorReference)
           body.factor_reference = factorReference;
-        const returnTo = (0, env_12.envOrNull)("IAM_BROWSER_RETURN_URL");
+        const returnTo = this.customerBrowserReturnUrl();
         if (returnTo)
           body.return_to = returnTo;
         const timeout = Number((0, env_12.envOr)("IAM_HTTP_TIMEOUT_MS", "8000"));
@@ -83620,6 +83620,17 @@ var require_iam_service = __commonJS({
         this.logger.warn(`identity service returned ${response.status} for an OTP attestation`);
         throw new IamUnavailableError(`identity service returned ${response.status}`);
       }
+      /**
+       * مقصد بلیت مرورگر. خروج از فهرست گسترده‌تری استفاده می‌کند؛ اگر ورود فقط
+       * `IAM_BROWSER_RETURN_URL` را ببیند و آن خالی باشد، کوکی مشترک گذاشته نمی‌شود
+       * و فقط خروج به IAM می‌رود.
+       */
+      customerBrowserReturnUrl() {
+        return (0, env_12.envOrNull)("IAM_BROWSER_RETURN_URL") || (0, env_12.envOrNull)("IAM_POST_LOGOUT_REDIRECT_URI") || (0, env_12.envList)("IAM_ALLOWED_RETURN_URLS")[0] || null;
+      }
+      adminBrowserReturnUrl() {
+        return (0, env_12.envOrNull)("IAM_ADMIN_BROWSER_RETURN_URL") || (0, env_12.envOrNull)("IAM_ADMIN_POST_LOGOUT_REDIRECT_URI") || (0, env_12.envList)("IAM_ADMIN_ALLOWED_RETURN_URLS")[0] || this.customerBrowserReturnUrl();
+      }
       browserBootstrapUrl(ticket) {
         if (!ticket || !this.issuer)
           return null;
diff --git a/apps/api/src/modules/iam/iam.service.ts b/apps/api/src/modules/iam/iam.service.ts
index 00e135b..66be9f9 100644
--- a/apps/api/src/modules/iam/iam.service.ts
+++ b/apps/api/src/modules/iam/iam.service.ts
@@ -1,5 +1,5 @@
 import { Injectable, Logger } from '@nestjs/common';
-import { envOr, envOrNull } from '../../common/env';
+import { envList, envOr, envOrNull } from '../../common/env';
 
 /**
  * Credential delegation to the central identity service (Central IAM).
@@ -115,7 +115,7 @@ export class IamService {
     if (tenantId) body.tenant_id = tenantId;
     else if (tenantSlug) body.tenant_slug = tenantSlug;
     if (clientIp) body.client_ip = clientIp;
-    const returnTo = envOrNull('IAM_ADMIN_BROWSER_RETURN_URL') || envOrNull('IAM_BROWSER_RETURN_URL');
+    const returnTo = this.adminBrowserReturnUrl();
     if (returnTo) body.return_to = returnTo;
 
     const timeout = Number(envOr('IAM_HTTP_TIMEOUT_MS', '8000'));
@@ -203,7 +203,7 @@ export class IamService {
     else if (tenantSlug) body.tenant_slug = tenantSlug;
     if (clientIp) body.client_ip = clientIp;
     if (factorReference) body.factor_reference = factorReference;
-    const returnTo = envOrNull('IAM_BROWSER_RETURN_URL');
+    const returnTo = this.customerBrowserReturnUrl();
     if (returnTo) body.return_to = returnTo;
 
     const timeout = Number(envOr('IAM_HTTP_TIMEOUT_MS', '8000'));
@@ -254,6 +254,29 @@ export class IamService {
     throw new IamUnavailableError(`identity service returned ${response.status}`);
   }
 
+  /**
+   * مقصد بلیت مرورگر. خروج از فهرست گسترده‌تری استفاده می‌کند؛ اگر ورود فقط
+   * `IAM_BROWSER_RETURN_URL` را ببیند و آن خالی باشد، کوکی مشترک گذاشته نمی‌شود
+   * و فقط خروج به IAM می‌رود.
+   */
+  private customerBrowserReturnUrl(): string | null {
+    return (
+      envOrNull('IAM_BROWSER_RETURN_URL') ||
+      envOrNull('IAM_POST_LOGOUT_REDIRECT_URI') ||
+      envList('IAM_ALLOWED_RETURN_URLS')[0] ||
+      null
+    );
+  }
+
+  private adminBrowserReturnUrl(): string | null {
+    return (
+      envOrNull('IAM_ADMIN_BROWSER_RETURN_URL') ||
+      envOrNull('IAM_ADMIN_POST_LOGOUT_REDIRECT_URI') ||
+      envList('IAM_ADMIN_ALLOWED_RETURN_URLS')[0] ||
+      this.customerBrowserReturnUrl()
+    );
+  }
+
   browserBootstrapUrl(ticket: string | null | undefined): string | null {
     if (!ticket || !this.issuer) return null;
     return `${this.issuer}/auth/bootstrap?ticket=${encodeURIComponent(ticket)}`;