@djangocfg/api 2.1.426 → 2.1.428

package/dist/auth.mjs

@@ -15,6 +15,8 @@ var AUTH_CONSTANTS = {
 // src/auth/utils/env.ts
 var isDev = process.env.NODE_ENV === "development";
 var isBrowser = typeof window !== "undefined";
+var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
+var dpopEnabled = process.env.NEXT_PUBLIC_DPOP_ENABLED === "true";
 
 // src/auth/context/AuthContext.tsx
 import { usePathname as usePathname3 } from "next/navigation";
@@ -218,12 +220,52 @@ import { useCallback as useCallback5, useEffect as useEffect4, useRef as useRef3
 
 // src/auth/utils/logger.ts
 import { createConsola } from "consola";
-var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
-var showLogs = isDev || isStaticBuild;
+
+// src/log-control.ts
+var verboseByDefault = isDev || isStaticBuild;
+var DEFAULT_LEVEL = verboseByDefault ? 4 : 1;
+var _level = DEFAULT_LEVEL;
+var _subscribers = /* @__PURE__ */ new Set();
+function getLogLevel() {
+  return _level;
+}
+__name(getLogLevel, "getLogLevel");
+function setLogLevel(level) {
+  _level = level;
+  for (const fn of _subscribers) {
+    try {
+      fn(level);
+    } catch {
+    }
+  }
+}
+__name(setLogLevel, "setLogLevel");
+function onLogLevelChange(fn) {
+  _subscribers.add(fn);
+  try {
+    fn(_level);
+  } catch {
+  }
+  return () => _subscribers.delete(fn);
+}
+__name(onLogLevelChange, "onLogLevelChange");
+function applyRoleLogPolicy(opts) {
+  const devMode = opts.isDev ?? verboseByDefault;
+  if (opts.isAdmin || devMode) {
+    setLogLevel(4);
+  } else {
+    setLogLevel(1);
+  }
+}
+__name(applyRoleLogPolicy, "applyRoleLogPolicy");
+
+// src/auth/utils/logger.ts
 var logger = createConsola({
-  level: showLogs ? 4 : 1
-  // dev: debug, production: errors only
+  level: getLogLevel()
 }).withTag("api");
+onLogLevelChange((level) => {
+  logger.level = level;
+});
 var authLogger = logger.withTag("auth");
 
 // src/auth/hooks/useAutoAuth.ts
@@ -565,6 +607,99 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
+function dpopEnabled2() {
+  try {
+    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
+  } catch {
+    return false;
+  }
+}
+__name(dpopEnabled2, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
+function _idbOpen() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(_DPOP_DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+__name(_idbOpen, "_idbOpen");
+function _idbGet(key) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readonly");
+    const req = tx.objectStore(_DPOP_STORE).get(key);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  }));
+}
+__name(_idbGet, "_idbGet");
+function _idbPut(key, value) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readwrite");
+    tx.objectStore(_DPOP_STORE).put(value, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error);
+  }));
+}
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
+function _getDpopKeyPair() {
+  if (_dpopKeyPromise) return _dpopKeyPromise;
+  _dpopKeyPromise = (async () => {
+    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
+    if (existing) return existing;
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      // extractable:false — JS can sign but never export the private key
+      ["sign"]
+    );
+    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
+    });
+    return pair;
+  })();
+  return _dpopKeyPromise;
+}
+__name(_getDpopKeyPair, "_getDpopKeyPair");
+function _b64urlFromBytes(bytes) {
+  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+__name(_b64urlFromBytes, "_b64urlFromBytes");
+function _b64urlFromString(str) {
+  return _b64urlFromBytes(new TextEncoder().encode(str));
+}
+__name(_b64urlFromString, "_b64urlFromString");
+async function _publicJwk(pub) {
+  const jwk = await crypto.subtle.exportKey("jwk", pub);
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+__name(_publicJwk, "_publicJwk");
+async function _makeDpopProof(method, url) {
+  try {
+    const pair = await _getDpopKeyPair();
+    const jwk = await _publicJwk(pair.publicKey);
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+    const htu = url.split("#")[0].split("?")[0];
+    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
+    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
+    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
+    const sig = await crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      pair.privateKey,
+      new TextEncoder().encode(signingInput)
+    );
+    return `${signingInput}.${_b64urlFromBytes(sig)}`;
+  } catch {
+    return null;
+  }
+}
+__name(_makeDpopProof, "_makeDpopProof");
 function installAuthOnClient(client2) {
   if (_client) return;
   _client = client2;
@@ -572,7 +707,7 @@ function installAuthOnClient(client2) {
     baseUrl: auth.getBaseUrl(),
     credentials: _withCredentials ? "include" : "same-origin"
   });
-  client2.interceptors.request.use((request) => {
+  client2.interceptors.request.use(async (request) => {
     const token = auth.getToken();
     if (token) request.headers.set("Authorization", `Bearer ${token}`);
     const locale = auth.getLocale();
@@ -585,6 +720,10 @@ function installAuthOnClient(client2) {
     } catch {
     }
     request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
+    if (dpopEnabled2() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(request.method, request.url);
+      if (proof) request.headers.set("DPoP", proof);
+    }
     return request;
   });
   client2.interceptors.error.use((err, res, req) => {
@@ -618,6 +757,10 @@ function installAuthOnClient(client2) {
     const retry = request.clone();
     retry.headers.set("Authorization", `Bearer ${newToken}`);
     retry.headers.set(RETRY_MARKER, "1");
+    if (dpopEnabled2() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(retry.method, retry.url);
+      if (proof) retry.headers.set("DPoP", proof);
+    }
     try {
       const retried = await fetch(retry);
       if (retried.status === 401 && _onUnauthorized) {
@@ -1567,7 +1710,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRetrieve(options) {
     return (options?.client ?? client).get({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1587,7 +1734,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRegenerateCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1611,7 +1762,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyTestCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1639,7 +1794,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1651,7 +1810,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1708,7 +1871,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1729,7 +1896,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1750,7 +1921,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1767,7 +1942,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -1793,7 +1972,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileDeleteCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1809,7 +1992,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialPartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1829,7 +2016,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1849,7 +2040,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdatePartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1869,7 +2064,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdateUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1912,7 +2111,11 @@ var CfgCentrifugo = class {
    */
   static cfgCentrifugoAuthTokenRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/centrifugo/auth/token/",
       ...options
     });
@@ -1927,7 +2130,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/",
       ...options
     });
@@ -1940,7 +2147,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/regenerate/",
       ...options,
       headers: {
@@ -1959,7 +2170,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -1971,7 +2186,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -1983,7 +2202,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -2004,7 +2227,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/",
       ...options,
       headers: {
@@ -2020,7 +2247,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupConfirmCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/confirm/",
       ...options,
       headers: {
@@ -2041,7 +2272,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/",
       ...options,
       headers: {
@@ -2057,7 +2292,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyBackupCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/backup/",
       ...options,
       headers: {
@@ -4758,6 +4997,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const isAdminUser = useMemo3(() => {
     return Boolean(user?.is_staff || user?.is_superuser);
   }, [user]);
+  useEffect9(() => {
+    applyRoleLogPolicy({ isAdmin: isAdminUser });
+  }, [isAdminUser]);
   const updateProfile = useCallback12(
     async (data) => {
       const result = await accounts.partialUpdateProfile(data);