@djangocfg/api 2.1.427 → 2.1.428

package/dist/clients.mjs

@@ -294,6 +294,99 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
+function dpopEnabled() {
+  try {
+    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
+  } catch {
+    return false;
+  }
+}
+__name(dpopEnabled, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
+function _idbOpen() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(_DPOP_DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+__name(_idbOpen, "_idbOpen");
+function _idbGet(key) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readonly");
+    const req = tx.objectStore(_DPOP_STORE).get(key);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  }));
+}
+__name(_idbGet, "_idbGet");
+function _idbPut(key, value) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readwrite");
+    tx.objectStore(_DPOP_STORE).put(value, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error);
+  }));
+}
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
+function _getDpopKeyPair() {
+  if (_dpopKeyPromise) return _dpopKeyPromise;
+  _dpopKeyPromise = (async () => {
+    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
+    if (existing) return existing;
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      // extractable:false — JS can sign but never export the private key
+      ["sign"]
+    );
+    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
+    });
+    return pair;
+  })();
+  return _dpopKeyPromise;
+}
+__name(_getDpopKeyPair, "_getDpopKeyPair");
+function _b64urlFromBytes(bytes) {
+  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+__name(_b64urlFromBytes, "_b64urlFromBytes");
+function _b64urlFromString(str) {
+  return _b64urlFromBytes(new TextEncoder().encode(str));
+}
+__name(_b64urlFromString, "_b64urlFromString");
+async function _publicJwk(pub) {
+  const jwk = await crypto.subtle.exportKey("jwk", pub);
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+__name(_publicJwk, "_publicJwk");
+async function _makeDpopProof(method, url) {
+  try {
+    const pair = await _getDpopKeyPair();
+    const jwk = await _publicJwk(pair.publicKey);
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+    const htu = url.split("#")[0].split("?")[0];
+    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
+    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
+    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
+    const sig = await crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      pair.privateKey,
+      new TextEncoder().encode(signingInput)
+    );
+    return `${signingInput}.${_b64urlFromBytes(sig)}`;
+  } catch {
+    return null;
+  }
+}
+__name(_makeDpopProof, "_makeDpopProof");
 function installAuthOnClient(client2) {
   if (_client) return;
   _client = client2;
@@ -301,7 +394,7 @@ function installAuthOnClient(client2) {
     baseUrl: auth.getBaseUrl(),
     credentials: _withCredentials ? "include" : "same-origin"
   });
-  client2.interceptors.request.use((request) => {
+  client2.interceptors.request.use(async (request) => {
     const token = auth.getToken();
     if (token) request.headers.set("Authorization", `Bearer ${token}`);
     const locale = auth.getLocale();
@@ -314,6 +407,10 @@ function installAuthOnClient(client2) {
     } catch {
     }
     request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(request.method, request.url);
+      if (proof) request.headers.set("DPoP", proof);
+    }
     return request;
   });
   client2.interceptors.error.use((err, res, req) => {
@@ -347,6 +444,10 @@ function installAuthOnClient(client2) {
     const retry = request.clone();
     retry.headers.set("Authorization", `Bearer ${newToken}`);
     retry.headers.set(RETRY_MARKER, "1");
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(retry.method, retry.url);
+      if (proof) retry.headers.set("DPoP", proof);
+    }
     try {
       const retried = await fetch(retry);
       if (retried.status === 401 && _onUnauthorized) {
@@ -1296,7 +1397,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRetrieve(options) {
     return (options?.client ?? client).get({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1316,7 +1421,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRegenerateCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1340,7 +1449,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyTestCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1368,7 +1481,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1380,7 +1497,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1437,7 +1558,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1458,7 +1583,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1479,7 +1608,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1496,7 +1629,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -1522,7 +1659,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileDeleteCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1538,7 +1679,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialPartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1558,7 +1703,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1578,7 +1727,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdatePartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1598,7 +1751,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdateUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1641,7 +1798,11 @@ var CfgCentrifugo = class {
    */
   static cfgCentrifugoAuthTokenRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/centrifugo/auth/token/",
       ...options
     });
@@ -1656,7 +1817,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/",
       ...options
     });
@@ -1669,7 +1834,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/regenerate/",
       ...options,
       headers: {
@@ -1688,7 +1857,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -1700,7 +1873,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -1712,7 +1889,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -1733,7 +1914,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/",
       ...options,
       headers: {
@@ -1749,7 +1934,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupConfirmCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/confirm/",
       ...options,
       headers: {
@@ -1770,7 +1959,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/",
       ...options,
       headers: {
@@ -1786,7 +1979,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyBackupCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/backup/",
       ...options,
       headers: {