@djangocfg/api 2.1.421 → 2.1.423

package/dist/auth.d.cts

@@ -500,7 +500,8 @@ declare const validateIdentifier: (id: string) => boolean;
 declare const useAuthForm: (options: UseAuthFormOptions) => AuthFormReturn;
 
 interface UseAutoAuthOptions {
-    onOTPDetected?: (otp: string) => void;
+    /** Called with the OTP from the URL, plus the optional `email` query param if present. */
+    onOTPDetected?: (otp: string, email?: string) => void;
     cleanupUrl?: boolean;
     /** Paths where auto-auth should be active. Default: ['/auth'] */
     allowedPaths?: string[];

package/dist/auth.d.ts

@@ -500,7 +500,8 @@ declare const validateIdentifier: (id: string) => boolean;
 declare const useAuthForm: (options: UseAuthFormOptions) => AuthFormReturn;
 
 interface UseAutoAuthOptions {
-    onOTPDetected?: (otp: string) => void;
+    /** Called with the OTP from the URL, plus the optional `email` query param if present. */
+    onOTPDetected?: (otp: string, email?: string) => void;
     cleanupUrl?: boolean;
     /** Paths where auto-auth should be active. Default: ['/auth'] */
     allowedPaths?: string[];

package/dist/auth.mjs

@@ -229,24 +229,35 @@ var authLogger = logger.withTag("auth");
 // src/auth/hooks/useAutoAuth.ts
 import { usePathname as usePathname2 } from "next/navigation";
 import { useEffect as useEffect3 } from "react";
+var normalizePath = /* @__PURE__ */ __name((path) => {
+  if (!path) return "";
+  const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, "");
+  const trimmed = withoutLocale.replace(/\/+$/, "");
+  return trimmed || "/";
+}, "normalizePath");
 var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
   const queryParams = useQueryParams();
   const pathname = usePathname2();
   const router = useCfgRouter();
-  const isAllowedPath = allowedPaths.some((path) => pathname === path || pathname?.startsWith(path + "/"));
+  const normalizedPath = normalizePath(pathname);
+  const isAllowedPath = allowedPaths.some(
+    (path) => normalizedPath === path || normalizedPath.startsWith(path + "/")
+  );
   const hasOTP = !!queryParams.get("otp");
   const isReady = !!pathname && hasOTP && isAllowedPath;
   useEffect3(() => {
     if (!isReady) return;
     const queryOtp = queryParams.get("otp");
+    const queryEmail = queryParams.get("email") || void 0;
     if (queryOtp && typeof queryOtp === "string" && queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
       authLogger.info("OTP detected in URL on auth page:", queryOtp);
-      onOTPDetected?.(queryOtp);
+      onOTPDetected?.(queryOtp, queryEmail);
     }
     if (cleanupUrl && queryOtp) {
       const cleanQuery = Object.fromEntries(queryParams.entries());
       delete cleanQuery.otp;
+      delete cleanQuery.email;
       const queryString = new URLSearchParams(cleanQuery).toString();
       const realPathname = typeof window !== "undefined" ? window.location.pathname : pathname;
       router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);
@@ -389,6 +400,18 @@ function detectLocale() {
 }
 __name(detectLocale, "detectLocale");
 function defaultBaseUrl() {
+  if (typeof window !== "undefined") {
+    try {
+      if (typeof process !== "undefined" && process.env) {
+        if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
+        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== void 0)
+          return process.env.NEXT_PUBLIC_API_PROXY_URL;
+        return process.env.NEXT_PUBLIC_API_URL || "";
+      }
+    } catch {
+    }
+    return "";
+  }
   try {
     if (typeof process !== "undefined" && process.env) {
       if (process.env.NEXT_PUBLIC_STATIC_BUILD === "true") return "";
@@ -400,7 +423,6 @@ function defaultBaseUrl() {
 }
 __name(defaultBaseUrl, "defaultBaseUrl");
 function defaultApiKey() {
-  if (isBrowser2) return null;
   try {
     if (typeof process !== "undefined" && process.env?.NEXT_PUBLIC_API_KEY) {
       return process.env.NEXT_PUBLIC_API_KEY;
@@ -556,7 +578,7 @@ function installAuthOnClient(client2) {
     const locale = auth.getLocale();
     if (locale) request.headers.set("Accept-Language", locale);
     const apiKey = auth.getApiKey();
-    if (apiKey) request.headers.set("X-API-Key", apiKey);
+    if (apiKey && !request.headers.has("X-API-Key")) request.headers.set("X-API-Key", apiKey);
     try {
       const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
       if (tz) request.headers.set("X-Timezone", tz);
@@ -1195,11 +1217,8 @@ var checkForExistence = /* @__PURE__ */ __name((options, name) => {
   }
   return false;
 }, "checkForExistence");
-var setAuthParams = /* @__PURE__ */ __name(async ({
-  security,
-  ...options
-}) => {
-  for (const auth2 of security) {
+async function setAuthParams(options) {
+  for (const auth2 of options.security ?? []) {
     if (checkForExistence(options, auth2.name)) {
       continue;
     }
@@ -1224,7 +1243,8 @@ var setAuthParams = /* @__PURE__ */ __name(async ({
         break;
     }
   }
-}, "setAuthParams");
+}
+__name(setAuthParams, "setAuthParams");
 var buildUrl = /* @__PURE__ */ __name((options) => getUrl({
   baseUrl: options.baseUrl,
   path: options.path,
@@ -1353,10 +1373,7 @@ var createClient = /* @__PURE__ */ __name((config = {}) => {
       serializedBody: void 0
     };
     if (opts.security) {
-      await setAuthParams({
-        ...opts,
-        security: opts.security
-      });
+      await setAuthParams(opts);
     }
     if (opts.requestValidator) {
       await opts.requestValidator(opts);
@@ -1549,11 +1566,15 @@ var CfgAccountsApiKey = class {
    */
   static cfgAccountsApiKeyRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ scheme: "bearer", type: "http" }, {
-        in: "cookie",
-        name: "sessionid",
-        type: "apiKey"
-      }],
+      security: [
+        { scheme: "bearer", type: "http" },
+        {
+          in: "cookie",
+          name: "sessionid",
+          type: "apiKey"
+        },
+        { name: "X-API-Key", type: "apiKey" }
+      ],
       url: "/cfg/accounts/api-key/",
       ...options
     });
@@ -1565,11 +1586,15 @@ var CfgAccountsApiKey = class {
    */
   static cfgAccountsApiKeyRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
-        in: "cookie",
-        name: "sessionid",
-        type: "apiKey"
-      }],
+      security: [
+        { scheme: "bearer", type: "http" },
+        {
+          in: "cookie",
+          name: "sessionid",
+          type: "apiKey"
+        },
+        { name: "X-API-Key", type: "apiKey" }
+      ],
       url: "/cfg/accounts/api-key/regenerate/",
       ...options,
       headers: {
@@ -1585,11 +1610,15 @@ var CfgAccountsApiKey = class {
    */
   static cfgAccountsApiKeyTestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
-        in: "cookie",
-        name: "sessionid",
-        type: "apiKey"
-      }],
+      security: [
+        { scheme: "bearer", type: "http" },
+        {
+          in: "cookie",
+          name: "sessionid",
+          type: "apiKey"
+        },
+        { name: "X-API-Key", type: "apiKey" }
+      ],
       url: "/cfg/accounts/api-key/test/",
       ...options,
       headers: {
@@ -2655,14 +2684,13 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   }, [setUseBackupCode, setTwoFactorCode, clearError]);
   useAutoAuth({
     allowedPaths: [authPath],
-    onOTPDetected: /* @__PURE__ */ __name((detectedOtp) => {
+    onOTPDetected: /* @__PURE__ */ __name((detectedOtp, detectedEmail) => {
       if (isAutoSubmitFromUrlRef.current || isLoading) return;
       isAutoSubmitFromUrlRef.current = true;
       authLogger.info("OTP detected from URL, auto-submitting");
-      const savedEmail = getSavedEmail();
-      const autoIdentifier = savedEmail || "";
+      const autoIdentifier = detectedEmail || getSavedEmail() || "";
       if (!autoIdentifier) {
-        authLogger.warn("No saved identifier found for auto-submit");
+        authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
         isAutoSubmitFromUrlRef.current = false;
         return;
       }