fix bug sms

tests/auth-session.test.cjs

@@ -224,6 +224,36 @@ function customerForm(h, props = {}) {
 const customerOption = name => ({ uuid: name, cuser_role: { sys_ws: { name }, role_type: { role_name_en: 'workspace_customer' } } });
 const settle = () => new Promise(resolve => setImmediate(resolve));
 
+ test('unconfirmed SMS reply opens OTP and the received code completes login', async () => {
+    const h = harness(); const form = customerForm(h); let sends = 0;
+    h.axios.defaults.adapter = config => {
+        if (config.url.endsWith('/auth/login/mobile/')) {
+            sends++;
+            return Promise.resolve(response(config, { result: { mobile: 9123456789, retry_after: 60, delivery_status: 'unconfirmed' } }, 202));
+        }
+        if (config.url.endsWith('/auth/login/mobile/verify/')) {
+            assert.equal(JSON.parse(config.data).opt, '123456');
+            return Promise.resolve(response(config, [customerOption('customer-panel')]));
+        }
+        return Promise.resolve(response(config, { access: 'access.customer', refresh: 'refresh.customer' }));
+    };
+    form.input('09123456789'); await form.submit();
+    assert.equal(elements(form.render(), item => item.props?.autoComplete === 'one-time-code').length, 1);
+    assert.ok(textContent(form.render()).includes('وضعیت ارسال پیامک تأیید نشد'));
+    assert.equal(elements(form.render(), item => item.props?.role === 'alert').length, 0);
+    form.input('123456'); await form.submit();
+    assert.equal(sends, 1); assert.equal(h.auth.getAccessToken(), 'access.customer');
+    assert.deepEqual(h.redirects, ['/shop']);
+ });
+ test('explicit SMS rejection retains the real error and does not open OTP', async () => {
+    const h = harness(); const form = customerForm(h);
+    h.axios.defaults.adapter = config => Promise.reject(failure(config, 503, { detail: 'ارسال پیامک انجام نشد. لطفاً کمی بعد دوباره تلاش کنید.' }));
+    form.input('09123456789'); await form.submit();
+    assert.ok(textContent(form.render()).includes('ارسال پیامک انجام نشد'));
+    assert.equal(elements(form.render(), item => item.props?.autoComplete === 'one-time-code').length, 0);
+    assert.equal(h.auth.getAccessToken(), null);
+ });
+
  test('SMS success displays OTP in the same page even when sessionStorage is blocked', async () => {
     const h = harness(); const form = customerForm(h);
     h.window.sessionStorage.setItem = () => { throw new Error('Storage denied'); };