@djangocfg/api 2.1.427 → 2.1.428

package/dist/index.cjs

@@ -43,11 +43,20 @@ __export(index_exports, {
   MemoryStorageAdapter: () => MemoryStorageAdapter,
   NetworkError: () => NetworkError,
   api: () => CfgAccountsApi,
+  applyRoleLogPolicy: () => applyRoleLogPolicy,
   auth: () => auth,
   defaultLogger: () => defaultLogger,
   dispatchValidationError: () => dispatchValidationError,
+  dpopEnabled: () => dpopEnabled2,
   formatZodError: () => formatZodError,
-  onValidationError: () => onValidationError
+  getLogLevel: () => getLogLevel,
+  isBrowser: () => isBrowser2,
+  isDev: () => isDev,
+  isProd: () => isProd,
+  isStaticBuild: () => isStaticBuild,
+  onLogLevelChange: () => onLogLevelChange,
+  onValidationError: () => onValidationError,
+  setLogLevel: () => setLogLevel
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -354,6 +363,99 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
+function dpopEnabled() {
+  try {
+    return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
+  } catch {
+    return false;
+  }
+}
+__name(dpopEnabled, "dpopEnabled");
+var _DPOP_DB = "cfg-auth";
+var _DPOP_STORE = "keys";
+var _DPOP_KEY_ID = "dpop-ec-p256";
+function _idbOpen() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(_DPOP_DB, 1);
+    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+__name(_idbOpen, "_idbOpen");
+function _idbGet(key) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readonly");
+    const req = tx.objectStore(_DPOP_STORE).get(key);
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  }));
+}
+__name(_idbGet, "_idbGet");
+function _idbPut(key, value) {
+  return _idbOpen().then((db) => new Promise((resolve, reject) => {
+    const tx = db.transaction(_DPOP_STORE, "readwrite");
+    tx.objectStore(_DPOP_STORE).put(value, key);
+    tx.oncomplete = () => resolve();
+    tx.onerror = () => reject(tx.error);
+  }));
+}
+__name(_idbPut, "_idbPut");
+var _dpopKeyPromise = null;
+function _getDpopKeyPair() {
+  if (_dpopKeyPromise) return _dpopKeyPromise;
+  _dpopKeyPromise = (async () => {
+    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => void 0);
+    if (existing) return existing;
+    const pair = await crypto.subtle.generateKey(
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      // extractable:false — JS can sign but never export the private key
+      ["sign"]
+    );
+    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {
+    });
+    return pair;
+  })();
+  return _dpopKeyPromise;
+}
+__name(_getDpopKeyPair, "_getDpopKeyPair");
+function _b64urlFromBytes(bytes) {
+  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+__name(_b64urlFromBytes, "_b64urlFromBytes");
+function _b64urlFromString(str) {
+  return _b64urlFromBytes(new TextEncoder().encode(str));
+}
+__name(_b64urlFromString, "_b64urlFromString");
+async function _publicJwk(pub) {
+  const jwk = await crypto.subtle.exportKey("jwk", pub);
+  return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+__name(_publicJwk, "_publicJwk");
+async function _makeDpopProof(method, url) {
+  try {
+    const pair = await _getDpopKeyPair();
+    const jwk = await _publicJwk(pair.publicKey);
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk };
+    const htu = url.split("#")[0].split("?")[0];
+    const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
+    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
+    const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
+    const sig = await crypto.subtle.sign(
+      { name: "ECDSA", hash: "SHA-256" },
+      pair.privateKey,
+      new TextEncoder().encode(signingInput)
+    );
+    return `${signingInput}.${_b64urlFromBytes(sig)}`;
+  } catch {
+    return null;
+  }
+}
+__name(_makeDpopProof, "_makeDpopProof");
 function installAuthOnClient(client2) {
   if (_client) return;
   _client = client2;
@@ -361,7 +463,7 @@ function installAuthOnClient(client2) {
     baseUrl: auth.getBaseUrl(),
     credentials: _withCredentials ? "include" : "same-origin"
   });
-  client2.interceptors.request.use((request) => {
+  client2.interceptors.request.use(async (request) => {
     const token = auth.getToken();
     if (token) request.headers.set("Authorization", `Bearer ${token}`);
     const locale = auth.getLocale();
@@ -374,6 +476,10 @@ function installAuthOnClient(client2) {
     } catch {
     }
     request.headers.set("X-Client-Time", (/* @__PURE__ */ new Date()).toISOString());
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(request.method, request.url);
+      if (proof) request.headers.set("DPoP", proof);
+    }
     return request;
   });
   client2.interceptors.error.use((err, res, req) => {
@@ -407,6 +513,10 @@ function installAuthOnClient(client2) {
     const retry = request.clone();
     retry.headers.set("Authorization", `Bearer ${newToken}`);
     retry.headers.set(RETRY_MARKER, "1");
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof(retry.method, retry.url);
+      if (proof) retry.headers.set("DPoP", proof);
+    }
     try {
       const retried = await fetch(retry);
       if (retried.status === 401 && _onUnauthorized) {
@@ -1356,7 +1466,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRetrieve(options) {
     return (options?.client ?? client).get({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1376,7 +1490,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyRegenerateCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1400,7 +1518,11 @@ var CfgAccountsApiKey = class {
   static cfgAccountsApiKeyTestCreate(options) {
     return (options.client ?? client).post({
       security: [
-        { scheme: "bearer", type: "http" },
+        {
+          key: "jwtAuth",
+          scheme: "bearer",
+          type: "http"
+        },
         {
           in: "cookie",
           name: "sessionid",
@@ -1428,7 +1550,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1440,7 +1566,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1497,7 +1627,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1518,7 +1652,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1539,7 +1677,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1556,7 +1698,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -1582,7 +1728,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileDeleteCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1598,7 +1748,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialPartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1618,7 +1772,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfilePartialUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1638,7 +1796,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdatePartialUpdate(options) {
     return (options?.client ?? client).patch({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1658,7 +1820,11 @@ var CfgAccountsProfile = class {
    */
   static cfgAccountsProfileUpdateUpdate(options) {
     return (options?.client ?? client).put({
-      security: [{ scheme: "bearer", type: "http" }, {
+      security: [{
+        key: "jwtAuth",
+        scheme: "bearer",
+        type: "http"
+      }, {
         in: "cookie",
         name: "sessionid",
         type: "apiKey"
@@ -1701,7 +1867,11 @@ var CfgCentrifugo = class {
    */
   static cfgCentrifugoAuthTokenRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/centrifugo/auth/token/",
       ...options
     });
@@ -1716,7 +1886,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/",
       ...options
     });
@@ -1729,7 +1903,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/backup-codes/regenerate/",
       ...options,
       headers: {
@@ -1748,7 +1926,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -1760,7 +1942,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -1772,7 +1958,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -1793,7 +1983,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/",
       ...options,
       headers: {
@@ -1809,7 +2003,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupConfirmCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/setup/confirm/",
       ...options,
       headers: {
@@ -1830,7 +2028,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/",
       ...options,
       headers: {
@@ -1846,7 +2048,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyBackupCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [{ name: "X-API-Key", type: "apiKey" }, {
+        key: "jwtAuthWithLastLogin",
+        scheme: "bearer",
+        type: "http"
+      }],
       url: "/cfg/totp/verify/backup/",
       ...options,
       headers: {
@@ -2187,4 +2393,49 @@ var API3 = class {
 var CfgAccountsApi = new API();
 var CfgCentrifugoApi = new API2();
 var CfgTotpApi = new API3();
+
+// src/auth/utils/env.ts
+var isDev = process.env.NODE_ENV === "development";
+var isProd = !isDev;
+var isBrowser2 = typeof window !== "undefined";
+var isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === "true";
+var dpopEnabled2 = process.env.NEXT_PUBLIC_DPOP_ENABLED === "true";
+
+// src/log-control.ts
+var verboseByDefault = isDev || isStaticBuild;
+var DEFAULT_LEVEL = verboseByDefault ? 4 : 1;
+var _level = DEFAULT_LEVEL;
+var _subscribers = /* @__PURE__ */ new Set();
+function getLogLevel() {
+  return _level;
+}
+__name(getLogLevel, "getLogLevel");
+function setLogLevel(level) {
+  _level = level;
+  for (const fn of _subscribers) {
+    try {
+      fn(level);
+    } catch {
+    }
+  }
+}
+__name(setLogLevel, "setLogLevel");
+function onLogLevelChange(fn) {
+  _subscribers.add(fn);
+  try {
+    fn(_level);
+  } catch {
+  }
+  return () => _subscribers.delete(fn);
+}
+__name(onLogLevelChange, "onLogLevelChange");
+function applyRoleLogPolicy(opts) {
+  const devMode = opts.isDev ?? verboseByDefault;
+  if (opts.isAdmin || devMode) {
+    setLogLevel(4);
+  } else {
+    setLogLevel(1);
+  }
+}
+__name(applyRoleLogPolicy, "applyRoleLogPolicy");
 //# sourceMappingURL=index.cjs.map