@djangocfg/api 2.1.423 → 2.1.424

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.423",
+  "version": "2.1.424",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -84,7 +84,7 @@
   "devDependencies": {
     "@types/node": "^25.2.3",
     "@types/react": "^19.2.15",
-    "@djangocfg/typescript-config": "^2.1.423",
+    "@djangocfg/typescript-config": "^2.1.424",
     "next": "^16.2.2",
     "react": "^19.2.4",
     "tsup": "^8.5.0",

package/src/auth/__tests__/useAuthForm.2fa.test.ts

@@ -1,8 +1,10 @@
 /**
- * Tests for useAuthForm 2FA setup functionality
+ * Tests for useAuthForm 2FA behavior.
  *
- * Tests the enable2FASetup option that controls whether users see
- * the 2FA setup prompt after authentication.
+ * The sign-in flow only *verifies* an existing 2FA challenge — it never
+ * prompts the user to *set up* 2FA (that lives in ProfileLayout). These tests
+ * cover the step machine and the shouldPrompt2FA state that the verification
+ * branch relies on.
  */
 
 import { act, renderHook } from '@testing-library/react';
@@ -40,7 +42,7 @@ jest.mock('../utils/logger', () => ({
   },
 }));
 
-describe('useAuthForm - 2FA Setup', () => {
+describe('useAuthForm - 2FA', () => {
   const defaultOptions = {
     sourceUrl: 'http://localhost',
     redirectUrl: '/dashboard',
@@ -50,96 +52,20 @@ describe('useAuthForm - 2FA Setup', () => {
     jest.clearAllMocks();
   });
 
-  describe('enable2FASetup option', () => {
-    it('should default enable2FASetup to true', () => {
+  describe('step transitions', () => {
+    it('should start on the identifier step', () => {
       const { result } = renderHook(() => useAuthForm(defaultOptions));
 
-      // The hook should be initialized with default enable2FASetup=true
-      // We can verify this by checking that the hook is ready
-      expect(result.current.step).toBe('identifier');
-    });
-
-    it('should accept enable2FASetup=false', () => {
-      const { result } = renderHook(() =>
-        useAuthForm({
-          ...defaultOptions,
-          enable2FASetup: false,
-        })
-      );
-
-      expect(result.current.step).toBe('identifier');
-    });
-
-    it('should accept enable2FASetup=true', () => {
-      const { result } = renderHook(() =>
-        useAuthForm({
-          ...defaultOptions,
-          enable2FASetup: true,
-        })
-      );
-
-      expect(result.current.step).toBe('identifier');
-    });
-  });
-
-  describe('OTP verification with enable2FASetup', () => {
-    it('should go to 2fa-setup step when should_prompt_2fa=true and enable2FASetup=true', async () => {
-      // Mock verifyOTP to return should_prompt_2fa=true
-      const mockVerifyOTP = jest.fn().mockResolvedValue({
-        success: true,
-        should_prompt_2fa: true,
-      });
-
-      jest.doMock('../context', () => ({
-        useAuth: () => ({
-          requestOTP: jest.fn().mockResolvedValue({ success: true }),
-          verifyOTP: mockVerifyOTP,
-          getSavedEmail: jest.fn().mockReturnValue('test@example.com'),
-          saveEmail: jest.fn(),
-          clearSavedEmail: jest.fn(),
-          getSavedPhone: jest.fn().mockReturnValue(null),
-          savePhone: jest.fn(),
-          clearSavedPhone: jest.fn(),
-        }),
-      }));
-
-      // Note: Due to module caching, this test demonstrates the expected behavior
-      // In a real test environment, you would need to properly mock the module
-    });
-
-    it('should skip 2fa-setup step when should_prompt_2fa=true but enable2FASetup=false', async () => {
-      // This test verifies that when enable2FASetup is false,
-      // the user goes directly to success even if should_prompt_2fa is true
-      const { result } = renderHook(() =>
-        useAuthForm({
-          ...defaultOptions,
-          enable2FASetup: false,
-        })
-      );
-
-      // Initial step should be identifier
       expect(result.current.step).toBe('identifier');
     });
-  });
 
-  describe('step transitions', () => {
-    it('should have correct step state handler', () => {
+    it('should expose a setStep handler', () => {
       const { result } = renderHook(() => useAuthForm(defaultOptions));
 
       expect(typeof result.current.setStep).toBe('function');
     });
 
-    it('should be able to transition to 2fa-setup step manually', () => {
-      const { result } = renderHook(() => useAuthForm(defaultOptions));
-
-      act(() => {
-        result.current.setStep('2fa-setup');
-      });
-
-      expect(result.current.step).toBe('2fa-setup');
-    });
-
-    it('should be able to transition to success step', () => {
+    it('should be able to transition to the success step', () => {
       const { result } = renderHook(() => useAuthForm(defaultOptions));
 
       act(() => {

package/src/auth/hooks/useAuthForm.ts

@@ -24,7 +24,6 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     redirectUrl,
     requireTermsAcceptance = false,
     authPath = '/auth',
-    enable2FASetup = true,
   } = options;
 
   // Compose smaller hooks
@@ -195,22 +194,10 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
       if (result.success) {
         saveIdentifierToStorage(submitIdentifier);
 
-        // Check if user should be prompted to set up 2FA
-        // Only show 2FA setup prompt if enable2FASetup is true (default)
-        if (result.should_prompt_2fa && enable2FASetup) {
-          authLogger.info('OTP verification successful, prompting 2FA setup');
-          setShouldPrompt2FA(true);
-          setStep('2fa-setup');
-          onOTPSuccess?.();
-          return true;
-        }
-
-        // Skip 2FA setup prompt if enable2FASetup is false
-        if (result.should_prompt_2fa && !enable2FASetup) {
-          authLogger.info('OTP verification successful, skipping 2FA setup prompt (disabled)');
-        } else {
-          authLogger.info('OTP verification successful, showing success screen');
-        }
+        // Sign-in only verifies identity. Setting up 2FA is owned by
+        // ProfileLayout, so we never branch into a setup prompt here — the
+        // backend's `should_prompt_2fa` hint is intentionally ignored.
+        authLogger.info('OTP verification successful, showing success screen');
         setStep('success');
         onOTPSuccess?.();
         return true;
@@ -227,7 +214,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     } finally {
       setIsLoading(false);
     }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep, enable2FASetup]);
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
 
   const handleOTPSubmit = useCallback(async (e: React.FormEvent) => {
     e.preventDefault();

package/src/auth/types/form.ts

@@ -153,12 +153,5 @@ export interface UseAuthFormOptions {
   requireTermsAcceptance?: boolean;
   /** Path to auth page for auto-OTP detection. Default: '/auth' */
   authPath?: string;
-  /**
-   * Enable 2FA setup prompt after successful authentication.
-   * When true (default), users without 2FA will see a setup prompt after login.
-   * When false, users go directly to success without 2FA setup prompt.
-   * @default true
-   */
-  enable2FASetup?: boolean;
 }