@djangocfg/api 2.1.426 → 2.1.428

package/dist/auth-server.mjs

@@ -313,6 +313,99 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
+function dpopEnabled() {
+  try {
+    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
+  } catch {
+    return false;
+  }
+}
+__name(dpopEnabled, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
+function _idbOpen() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(_DPOP_DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+__name(_idbOpen, "_idbOpen");
+function _idbGet(key) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readonly");
+    const req = tx.objectStore(_DPOP_STORE).get(key);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  }));
+}
+__name(_idbGet, "_idbGet");
+function _idbPut(key, value) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readwrite");
+    tx.objectStore(_DPOP_STORE).put(value, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error);
+  }));
+}
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
+function _getDpopKeyPair() {
+  if (_dpopKeyPromise) return _dpopKeyPromise;
+  _dpopKeyPromise = (async () => {
+    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
+    if (existing) return existing;
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      // extractable:false — JS can sign but never export the private key
+      ["sign"]
+    );
+    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
+    });
+    return pair;
+  })();
+  return _dpopKeyPromise;
+}
+__name(_getDpopKeyPair, "_getDpopKeyPair");
+function _b64urlFromBytes(bytes) {
+  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+__name(_b64urlFromBytes, "_b64urlFromBytes");
+function _b64urlFromString(str) {
+  return _b64urlFromBytes(new TextEncoder().encode(str));
+}
+__name(_b64urlFromString, "_b64urlFromString");
+async function _publicJwk(pub) {
+  const jwk = await crypto.subtle.exportKey("jwk", pub);
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+__name(_publicJwk, "_publicJwk");
+async function _makeDpopProof(method, url) {
+  try {
+    const pair = await _getDpopKeyPair();
+    const jwk = await _publicJwk(pair.publicKey);
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+    const htu = url.split("#")[0].split("?")[0];
+    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
+    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
+    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
+    const sig = await crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      pair.privateKey,
+      new TextEncoder().encode(signingInput)
+    );
+    return `${signingInput}.${_b64urlFromBytes(sig)}`;
+  } catch {
+    return null;
+  }
+}
+__name(_makeDpopProof, "_makeDpopProof");
 function installAuthOnClient(client2) {
   if (_client) return;
   _client = client2;
@@ -320,7 +413,7 @@ function installAuthOnClient(client2) {
     baseUrl: auth.getBaseUrl(),
     credentials: _withCredentials ? "include" : "same-origin"
   });
-  client2.interceptors.request.use((request) => {
+  client2.interceptors.request.use(async (request) => {
     const token = auth.getToken();
     if (token) request.headers.set("Authorization", `Bearer ${token}`);
     const locale = auth.getLocale();
@@ -333,6 +426,10 @@ function installAuthOnClient(client2) {
     } catch {
     }
     request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(request.method, request.url);
+      if (proof) request.headers.set("DPoP", proof);
+    }
     return request;
   });
   client2.interceptors.error.use((err, res, req) => {
@@ -366,6 +463,10 @@ function installAuthOnClient(client2) {
     const retry = request.clone();
     retry.headers.set("Authorization", `Bearer ${newToken}`);
     retry.headers.set(RETRY_MARKER, "1");
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(retry.method, retry.url);
+      if (proof) retry.headers.set("DPoP", proof);
+    }
     try {
       const retried = await fetch(retry);
       if (retried.status === 401 && _onUnauthorized) {
@@ -1315,7 +1416,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRetrieve(options) {
     return (options?.client ?? client).get({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1335,7 +1440,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRegenerateCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1359,7 +1468,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyTestCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1387,7 +1500,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1399,7 +1516,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1456,7 +1577,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1477,7 +1602,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1498,7 +1627,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1515,7 +1648,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -1541,7 +1678,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileDeleteCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1557,7 +1698,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialPartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1577,7 +1722,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1597,7 +1746,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdatePartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1617,7 +1770,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdateUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1660,7 +1817,11 @@ var CfgCentrifugo = class {
    */
   static cfgCentrifugoAuthTokenRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/centrifugo/auth/token/",
       ...options
     });
@@ -1675,7 +1836,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/",
       ...options
     });
@@ -1688,7 +1853,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/regenerate/",
       ...options,
       headers: {
@@ -1707,7 +1876,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -1719,7 +1892,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -1731,7 +1908,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -1752,7 +1933,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/",
       ...options,
       headers: {
@@ -1768,7 +1953,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupConfirmCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/confirm/",
       ...options,
       headers: {
@@ -1789,7 +1978,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/",
       ...options,
       headers: {
@@ -1805,7 +1998,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyBackupCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/backup/",
       ...options,
       headers: {
@@ -2020,19 +2217,38 @@ var CfgAccountsApi = new API();
 var CfgCentrifugoApi = new API2();
 var CfgTotpApi = new API3();
 
-// src/auth/utils/logger.ts
-import { createConsola as createConsola2 } from "consola";
-
 // src/auth/utils/env.ts
 var isDev = process.env.NODE_ENV === "development";
+var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
+var dpopEnabled2 = process.env.NEXT_PUBLIC_DPOP_ENABLED === "true";
+
+// src/log-control.ts
+var verboseByDefault = isDev || isStaticBuild;
+var DEFAULT_LEVEL = verboseByDefault ? 4 : 1;
+var _level = DEFAULT_LEVEL;
+var _subscribers = /* @__PURE__ */ new Set();
+function getLogLevel() {
+  return _level;
+}
+__name(getLogLevel, "getLogLevel");
+function onLogLevelChange(fn) {
+  _subscribers.add(fn);
+  try {
+    fn(_level);
+  } catch {
+  }
+  return () => _subscribers.delete(fn);
+}
+__name(onLogLevelChange, "onLogLevelChange");
 
 // src/auth/utils/logger.ts
-var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
-var showLogs = isDev || isStaticBuild;
+import { createConsola as createConsola2 } from "consola";
 var logger = createConsola2({
-  level: showLogs ? 4 : 1
-  // dev: debug, production: errors only
+  level: getLogLevel()
 }).withTag("api");
+onLogLevelChange((level) => {
+  logger.level = level;
+});
 var authLogger = logger.withTag("auth");
 
 // src/auth/middlewares/tokenRefresh.ts