@djangocfg/api 2.1.420 → 2.1.422

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.420",
+  "version": "2.1.422",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -84,7 +84,7 @@
   "devDependencies": {
     "@types/node": "^25.2.3",
     "@types/react": "^19.2.15",
-    "@djangocfg/typescript-config": "^2.1.420",
+    "@djangocfg/typescript-config": "^2.1.422",
     "next": "^16.2.2",
     "react": "^19.2.4",
     "tsup": "^8.5.0",

package/src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve.ts

@@ -12,11 +12,20 @@ import { APIKeySchema } from "../schemas/APIKey";
 
 type Result = CfgAccountsApiKeyRetrieveResponses[keyof CfgAccountsApiKeyRetrieveResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgAccountsApiKeyRetrieve(
   args?: Omit<CfgAccountsApiKeyRetrieveData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_accounts_api_key_retrieve", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_accounts_api_key_retrieve", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgAccountsApiKeyRetrieve(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthConnectionsList.ts

@@ -12,11 +12,20 @@ import { cfg_accounts_oauth_connections_response_200_AutoRefSchema } from "../sc
 
 type Result = CfgAccountsOauthConnectionsListResponses[keyof CfgAccountsOauthConnectionsListResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgAccountsOauthConnectionsList(
   args?: Omit<CfgAccountsOauthConnectionsListData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_accounts_oauth_connections_list", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_accounts_oauth_connections_list", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgAccountsOauthConnectionsList(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts

@@ -12,11 +12,20 @@ import { OAuthProvidersResponseSchema } from "../schemas/OAuthProvidersResponse"
 
 type Result = CfgAccountsOauthProvidersRetrieveResponses[keyof CfgAccountsOauthProvidersRetrieveResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgAccountsOauthProvidersRetrieve(
   args?: Omit<CfgAccountsOauthProvidersRetrieveData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_accounts_oauth_providers_retrieve", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_accounts_oauth_providers_retrieve", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgAccountsOauthProvidersRetrieve(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileRetrieve.ts

@@ -12,11 +12,20 @@ import { UserSchema } from "../schemas/User";
 
 type Result = CfgAccountsProfileRetrieveResponses[keyof CfgAccountsProfileRetrieveResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgAccountsProfileRetrieve(
   args?: Omit<CfgAccountsProfileRetrieveData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_accounts_profile_retrieve", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_accounts_profile_retrieve", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgAccountsProfileRetrieve(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/_cfg_accounts/openapi.json

@@ -20,6 +20,9 @@
           },
           {
             "cookieAuth": []
+          },
+          {
+            "apiKeyAuth": []
           }
         ],
         "responses": {
@@ -71,6 +74,9 @@
           },
           {
             "cookieAuth": []
+          },
+          {
+            "apiKeyAuth": []
           }
         ],
         "responses": {
@@ -131,6 +137,9 @@
           },
           {
             "cookieAuth": []
+          },
+          {
+            "apiKeyAuth": []
           }
         ],
         "responses": {

package/src/_api/generated/_cfg_centrifugo/hooks/useCfgCentrifugoAuthTokenRetrieve.ts

@@ -12,11 +12,20 @@ import { ConnectionTokenResponseSchema } from "../schemas/ConnectionTokenRespons
 
 type Result = CfgCentrifugoAuthTokenRetrieveResponses[keyof CfgCentrifugoAuthTokenRetrieveResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgCentrifugoAuthTokenRetrieve(
   args?: Omit<CfgCentrifugoAuthTokenRetrieveData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_centrifugo_auth_token_retrieve", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_centrifugo_auth_token_retrieve", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgCentrifugoAuthTokenRetrieve(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/_cfg_totp/hooks/useCfgTotpBackupCodesRetrieve.ts

@@ -12,11 +12,20 @@ import { BackupCodesStatusSchema } from "../schemas/BackupCodesStatus";
 
 type Result = CfgTotpBackupCodesRetrieveResponses[keyof CfgTotpBackupCodesRetrieveResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgTotpBackupCodesRetrieve(
   args?: Omit<CfgTotpBackupCodesRetrieveData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_totp_backup_codes_retrieve", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_totp_backup_codes_retrieve", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgTotpBackupCodesRetrieve(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/_cfg_totp/hooks/useCfgTotpDevicesRetrieve.ts

@@ -12,11 +12,20 @@ import { DeviceListResponseSchema } from "../schemas/DeviceListResponse";
 
 type Result = CfgTotpDevicesRetrieveResponses[keyof CfgTotpDevicesRetrieveResponses];
 
+/**
+ * Optional `enabled` flag — when `false`, the SWR key becomes `null` and
+ * no request is made. Use for gated endpoints (auth-required, feature
+ * flags, "fetch only when X is selected"). The flag is stripped before
+ * being forwarded to `useSWR` so the underlying SWR config stays pristine.
+ */
+type HookConfig = SWRConfiguration<Result> & { enabled?: boolean };
+
 export function useCfgTotpDevicesRetrieve(
   args?: Omit<CfgTotpDevicesRetrieveData, "url" | "body">,
-  config?: SWRConfiguration<Result>,
+  config?: HookConfig,
 ) {
-  const key = ["cfg_totp_devices_retrieve", args ?? {}] as const;
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_totp_devices_retrieve", args ?? {}] as const : null;
   return useSWR<Result>(
     key,
     async () => {
@@ -60,6 +69,6 @@ export function useCfgTotpDevicesRetrieve(
       }
       return parsed.data as unknown as Result;
     },
-    config,
+    swrConfig,
   );
 }

package/src/_api/generated/client/client.gen.ts

@@ -48,10 +48,7 @@ export const createClient = (config: Config = {}): Client => {
     };
 
     if (opts.security) {
-      await setAuthParams({
-        ...opts,
-        security: opts.security,
-      });
+      await setAuthParams(opts);
     }
 
     if (opts.requestValidator) {

package/src/_api/generated/client/types.gen.ts

@@ -151,12 +151,13 @@ type MethodFn = <
 
 type SseFn = <
   TData = unknown,
-  TError = unknown,
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  _TError = unknown,
   ThrowOnError extends boolean = false,
   TResponseStyle extends ResponseStyle = 'fields',
 >(
   options: Omit<RequestOptions<never, TResponseStyle, ThrowOnError>, 'method'>,
-) => Promise<ServerSentEventsResult<TData, TError>>;
+) => Promise<ServerSentEventsResult<TData>>;
 
 type RequestFn = <
   TData = unknown,

package/src/_api/generated/client/utils.gen.ts

@@ -118,14 +118,12 @@ const checkForExistence = (
   return false;
 };
 
-export const setAuthParams = async ({
-  security,
-  ...options
-}: Pick<Required<RequestOptions>, 'security'> &
-  Pick<RequestOptions, 'auth' | 'query'> & {
+export async function setAuthParams(
+  options: Pick<RequestOptions, 'auth' | 'query' | 'security'> & {
     headers: Headers;
-  }) => {
-  for (const auth of security) {
+  },
+): Promise<void> {
+  for (const auth of options.security ?? []) {
     if (checkForExistence(options, auth.name)) {
       continue;
     }
@@ -154,7 +152,7 @@ export const setAuthParams = async ({
         break;
     }
   }
-};
+}
 
 export const buildUrl: Client['buildUrl'] = (options) =>
   getUrl({

package/src/_api/generated/core/params.gen.ts

@@ -104,10 +104,10 @@ const stripEmptySlots = (params: Params) => {
 
 export const buildClientParams = (args: ReadonlyArray<unknown>, fields: FieldsConfig) => {
   const params: Params = {
-    body: {},
-    headers: {},
-    path: {},
-    query: {},
+    body: Object.create(null),
+    headers: Object.create(null),
+    path: Object.create(null),
+    query: Object.create(null),
   };
 
   const map = buildKeyMap(fields);

package/src/_api/generated/helpers/auth.ts

@@ -79,12 +79,30 @@ function detectLocale(): string | null {
   return null;
 }
 
-/** Default baseUrl from `NEXT_PUBLIC_API_URL`.
+/** Default baseUrl.
  *
- * Both browser and server use NEXT_PUBLIC_API_URL — requests go
- * directly to Django without Next.js proxy.
+ * Browser: uses NEXT_PUBLIC_API_PROXY_URL if set (empty string = same-origin
+ * Next.js proxy), otherwise falls back to NEXT_PUBLIC_API_URL directly.
+ * Set NEXT_PUBLIC_API_PROXY_URL='' in apps that proxy /apix/* via Next.js
+ * Route Handler; leave it unset in apps that hit Django directly.
+ *
+ * Server (SSR / RSC / Edge): use NEXT_PUBLIC_API_URL so server-side fetch
+ * reaches Django directly (proxy is a same-origin HTTP round-trip on server).
  */
 function defaultBaseUrl(): string {
+  if (typeof window !== 'undefined') {
+    try {
+      if (typeof process !== 'undefined' && process.env) {
+        if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return '';
+        // NEXT_PUBLIC_API_PROXY_URL='' means same-origin proxy (e.g. /apix/* route handler).
+        // Next.js inlines defined vars as their value; undefined means the var was not set.
+        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== undefined)
+          return process.env.NEXT_PUBLIC_API_PROXY_URL;
+        return process.env.NEXT_PUBLIC_API_URL || '';
+      }
+    } catch {}
+    return '';
+  }
   try {
     if (typeof process !== 'undefined' && process.env) {
       if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return '';
@@ -96,13 +114,11 @@ function defaultBaseUrl(): string {
 
 /** Default API key fallback from `NEXT_PUBLIC_API_KEY`.
  *
- * In the browser: returns null — requests go through the Next.js rewrite
- * and the key is injected server-side (never exposed in the bundle).
- * On the server: reads NEXT_PUBLIC_API_KEY as a fallback for SSR calls
- * that bypass the rewrite (e.g. server components calling Django directly).
+ * Both browser and server: if NEXT_PUBLIC_API_KEY is set it is used as a
+ * global fallback (e.g. a public demo key). When not set, returns null so
+ * per-request keys passed via options.headers take effect unobstructed.
  */
 function defaultApiKey(): string | null {
-  if (isBrowser) return null;
   try {
     if (typeof process !== 'undefined' && process.env?.NEXT_PUBLIC_API_KEY) {
       return process.env.NEXT_PUBLIC_API_KEY;
@@ -286,6 +302,37 @@ async function tryRefresh(): Promise<string | null> {
  * non-browser environments, so headers populated by the interceptor
  * are simply absent server-side (which is the correct behaviour
  * unless the caller explicitly sets a server-side token).
+ *
+ * ── How API key auth works ────────────────────────────────────────────────
+ *
+ * There are three ways to supply X-API-Key, in priority order:
+ *
+ *   1. Per-request header (highest priority, overrides everything):
+ *        SomeApi.someEndpoint({ headers: { 'X-API-Key': userKey } })
+ *      Use this in playgrounds or any context where the key comes from
+ *      user input rather than app config.
+ *
+ *   2. Global override via auth.setApiKey(key) — applies to every request
+ *      from this client until cleared. Good for single-user sessions.
+ *
+ *   3. NEXT_PUBLIC_API_KEY env var — read by defaultApiKey() on every request.
+ *      Use as a public fallback key (e.g. a shared demo key for unauthenticated
+ *      visitors). When not set, returns null so per-request keys work freely.
+ *
+ * ── baseUrl gotcha with proxy packages ───────────────────────────────────
+ *
+ * If another package (e.g. @carapis/catalog-api/client) calls
+ * `auth.setBaseUrl('')` on import, ALL requests from this shared client
+ * will go to relative paths (Next.js proxy) instead of hitting Django
+ * directly. This is intentional for the public catalog — but breaks any
+ * feature that needs to reach Django with a dynamic API key from the
+ * browser (e.g. a playground).
+ *
+ * Fix: pass `baseUrl` explicitly per-call to override the global setting:
+ *   SomeApi.someEndpoint({
+ *     baseUrl: process.env.NEXT_PUBLIC_API_URL,
+ *     headers: { 'X-API-Key': userKey },
+ *   })
  */
 export function installAuthOnClient(client: HeyClient): void {
   if (_client) return; // idempotent
@@ -303,8 +350,10 @@ export function installAuthOnClient(client: HeyClient): void {
     const locale = auth.getLocale();
     if (locale) request.headers.set('Accept-Language', locale);
 
+    // Only set X-API-Key from global store if NOT already present on the
+    // request — per-request headers (option 1 above) take precedence.
     const apiKey = auth.getApiKey();
-    if (apiKey) request.headers.set('X-API-Key', apiKey);
+    if (apiKey && !request.headers.has('X-API-Key')) request.headers.set('X-API-Key', apiKey);
 
     try {
       const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;

package/src/_api/generated/index.ts

@@ -37,5 +37,11 @@ export { CfgAccountsApiKey, CfgAccountsOauth, CfgAccounts, CfgAccountsProfile, C
 export { CfgCentrifugo } from './_cfg_centrifugo';
 export { CfgTotpBackupCodes, CfgTotp, CfgTotpSetup, CfgTotpVerify } from './_cfg_totp';
 
+// Generated DTO / schema types (Hey API). The per-group barrels each
+// re-export these too; surfacing them at the top level lets consumers
+// `import { FleetSummary } from '<api>'` without reaching into a
+// group subpath.
+export type * from './types.gen';
+
 // Shared utilities (errors, storage adapters, logger).
 export * from './helpers';

package/src/_api/generated/openapi.json

@@ -20,6 +20,9 @@
           },
           {
             "cookieAuth": []
+          },
+          {
+            "apiKeyAuth": []
           }
         ],
         "responses": {
@@ -71,6 +74,9 @@
           },
           {
             "cookieAuth": []
+          },
+          {
+            "apiKeyAuth": []
           }
         ],
         "responses": {
@@ -131,6 +137,9 @@
           },
           {
             "cookieAuth": []
+          },
+          {
+            "apiKeyAuth": []
           }
         ],
         "responses": {

package/src/_api/generated/sdk.gen.ts

@@ -26,11 +26,15 @@ export class CfgAccountsApiKey {
      */
     public static cfgAccountsApiKeyRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsApiKeyRetrieveData, ThrowOnError>) {
         return (options?.client ?? client).get<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError>({
-            security: [{ scheme: 'bearer', type: 'http' }, {
+            security: [
+                { scheme: 'bearer', type: 'http' },
+                {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
-                }],
+                },
+                { name: 'X-API-Key', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/api-key/',
             ...options
         });
@@ -43,11 +47,15 @@ export class CfgAccountsApiKey {
      */
     public static cfgAccountsApiKeyRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRegenerateCreateData, ThrowOnError>) {
         return (options.client ?? client).post<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError>({
-            security: [{ scheme: 'bearer', type: 'http' }, {
+            security: [
+                { scheme: 'bearer', type: 'http' },
+                {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
-                }],
+                },
+                { name: 'X-API-Key', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/api-key/regenerate/',
             ...options,
             headers: {
@@ -64,11 +72,15 @@ export class CfgAccountsApiKey {
      */
     public static cfgAccountsApiKeyTestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyTestCreateData, ThrowOnError>) {
         return (options.client ?? client).post<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError>({
-            security: [{ scheme: 'bearer', type: 'http' }, {
+            security: [
+                { scheme: 'bearer', type: 'http' },
+                {
                     in: 'cookie',
                     name: 'sessionid',
                     type: 'apiKey'
-                }],
+                },
+                { name: 'X-API-Key', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/api-key/test/',
             ...options,
             headers: {

package/src/auth/hooks/useAuthForm.ts

@@ -311,17 +311,18 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
 
   useAutoAuth({
     allowedPaths: [authPath],
-    onOTPDetected: (detectedOtp: string) => {
+    onOTPDetected: (detectedOtp: string, detectedEmail?: string) => {
       if (isAutoSubmitFromUrlRef.current || isLoading) return;
       isAutoSubmitFromUrlRef.current = true;
 
       authLogger.info('OTP detected from URL, auto-submitting');
 
-      const savedEmail = getSavedEmail();
-      const autoIdentifier = savedEmail || '';
+      // Prefer the email from the magic-link URL (works on a fresh browser/device),
+      // fall back to the one saved from a previous request on this browser.
+      const autoIdentifier = detectedEmail || getSavedEmail() || '';
 
       if (!autoIdentifier) {
-        authLogger.warn('No saved identifier found for auto-submit');
+        authLogger.warn('No identifier found for auto-submit (no email in URL or storage)');
         isAutoSubmitFromUrlRef.current = false;
         return;
       }

package/src/auth/hooks/useAutoAuth.ts

@@ -9,12 +9,25 @@ import { useCfgRouter } from './useCfgRouter';
 import { useQueryParams } from './useQueryParams';
 
 export interface UseAutoAuthOptions {
-  onOTPDetected?: (otp: string) => void;
+  /** Called with the OTP from the URL, plus the optional `email` query param if present. */
+  onOTPDetected?: (otp: string, email?: string) => void;
   cleanupUrl?: boolean;
   /** Paths where auto-auth should be active. Default: ['/auth'] */
   allowedPaths?: string[];
 }
 
+/**
+ * Strip a leading 2-letter locale segment and any trailing slash so paths
+ * compare consistently regardless of the next-intl locale prefix.
+ * e.g. '/ru/auth/' -> '/auth', '/auth' -> '/auth', '/' -> '/'
+ */
+const normalizePath = (path: string | null): string => {
+  if (!path) return '';
+  const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, '');
+  const trimmed = withoutLocale.replace(/\/+$/, '');
+  return trimmed || '/';
+};
+
 /**
  * Hook for automatic authentication from URL query parameters
  * Detects OTP from URL and triggers callback
@@ -25,8 +38,12 @@ export const useAutoAuth = (options: UseAutoAuthOptions = {}) => {
   const pathname = usePathname();
   const router = useCfgRouter();
 
-  // Check if current path is in allowed paths
-  const isAllowedPath = allowedPaths.some(path => pathname === path || pathname?.startsWith(path + '/'));
+  // Check if current path is in allowed paths, ignoring the locale prefix
+  // (next-intl may keep it in the URL, e.g. /ru/auth) and trailing slashes.
+  const normalizedPath = normalizePath(pathname);
+  const isAllowedPath = allowedPaths.some(
+    path => normalizedPath === path || normalizedPath.startsWith(path + '/')
+  );
 
   const hasOTP = !!(queryParams.get('otp'));
   const isReady = !!pathname && hasOTP && isAllowedPath;
@@ -35,12 +52,13 @@ export const useAutoAuth = (options: UseAutoAuthOptions = {}) => {
     if (!isReady) return;
 
     const queryOtp = queryParams.get('otp') as string;
+    const queryEmail = queryParams.get('email') || undefined;
 
     // Handle OTP detection - only on allowed paths to avoid conflicts with other pages
     // (e.g., /dashboard/device uses ?otp= for device authorization, not user auth)
     if (queryOtp && typeof queryOtp === 'string' && queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
       authLogger.info('OTP detected in URL on auth page:', queryOtp);
-      onOTPDetected?.(queryOtp);
+      onOTPDetected?.(queryOtp, queryEmail);
     }
 
     // Clean up URL to remove sensitive params for security
@@ -51,6 +69,7 @@ export const useAutoAuth = (options: UseAutoAuthOptions = {}) => {
     if (cleanupUrl && queryOtp) {
       const cleanQuery = Object.fromEntries(queryParams.entries());
       delete cleanQuery.otp;
+      delete cleanQuery.email;
       const queryString = new URLSearchParams(cleanQuery).toString();
       const realPathname = typeof window !== 'undefined' ? window.location.pathname : pathname;
       router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);