@djangocfg/api 2.1.429 → 2.1.430

package/dist/auth.cjs

@@ -187,10 +187,22 @@ function useQueryParams() {
     }, "updateQueryParams");
     updateQueryParams();
     window.addEventListener("popstate", updateQueryParams);
-    const intervalId = setInterval(updateQueryParams, 100);
+    const origPush = window.history.pushState;
+    const origReplace = window.history.replaceState;
+    window.history.pushState = function(...args) {
+      const result = origPush.apply(this, args);
+      updateQueryParams();
+      return result;
+    };
+    window.history.replaceState = function(...args) {
+      const result = origReplace.apply(this, args);
+      updateQueryParams();
+      return result;
+    };
     return () => {
       window.removeEventListener("popstate", updateQueryParams);
-      clearInterval(intervalId);
+      window.history.pushState = origPush;
+      window.history.replaceState = origReplace;
     };
   }, [pathname]);
   return queryParams;
@@ -348,25 +360,27 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const isAllowedPath = allowedPaths.some(
     (path) => normalizedPath === path || normalizedPath.startsWith(path + "/")
   );
-  const hasOTP = !!queryParams.get("otp");
+  const queryOtp = queryParams.get("otp") || "";
+  const queryEmail = queryParams.get("email") || void 0;
+  const hasOTP = !!queryOtp;
   const isReady = !!pathname && hasOTP && isAllowedPath;
+  const otpValid = queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH;
+  const onOTPDetectedRef = (0, import_react5.useRef)(onOTPDetected);
+  onOTPDetectedRef.current = onOTPDetected;
   (0, import_react5.useEffect)(() => {
-    if (!isReady) return;
-    const queryOtp = queryParams.get("otp");
-    const queryEmail = queryParams.get("email") || void 0;
-    if (queryOtp && typeof queryOtp === "string" && queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {
-      authLogger.info("OTP detected in URL on auth page:", queryOtp);
-      onOTPDetected?.(queryOtp, queryEmail);
-    }
-    if (cleanupUrl && queryOtp) {
-      const cleanQuery = Object.fromEntries(queryParams.entries());
-      delete cleanQuery.otp;
-      delete cleanQuery.email;
-      const queryString = new URLSearchParams(cleanQuery).toString();
-      const realPathname = typeof window !== "undefined" ? window.location.pathname : pathname;
-      router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);
-    }
-  }, [pathname, queryParams, onOTPDetected, cleanupUrl, router, isReady]);
+    if (!isReady || !otpValid) return;
+    authLogger.info("OTP detected in URL on auth page:", queryOtp);
+    onOTPDetectedRef.current?.(queryOtp, queryEmail);
+  }, [isReady, otpValid, queryOtp, queryEmail]);
+  (0, import_react5.useEffect)(() => {
+    if (!isReady || !cleanupUrl || !queryOtp) return;
+    const cleanQuery = Object.fromEntries(queryParams.entries());
+    delete cleanQuery.otp;
+    delete cleanQuery.email;
+    const queryString = new URLSearchParams(cleanQuery).toString();
+    const realPathname = typeof window !== "undefined" ? window.location.pathname : pathname;
+    router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);
+  }, [isReady, cleanupUrl, queryOtp]);
   return {
     isReady,
     hasOTP,
@@ -2761,6 +2775,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   const formState = useAuthFormState();
   const validation = useAuthValidation();
   const isAutoSubmitFromUrlRef = (0, import_react7.useRef)(false);
+  const processedOtpKeyRef = (0, import_react7.useRef)(null);
   const {
     requestOTP,
     verifyOTP,
@@ -2971,29 +2986,32 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setTwoFactorCode("");
     clearError();
   }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  useAutoAuth({
-    allowedPaths: [authPath],
-    onOTPDetected: /* @__PURE__ */ __name((detectedOtp, detectedEmail) => {
-      if (isAutoSubmitFromUrlRef.current || isLoading) return;
-      isAutoSubmitFromUrlRef.current = true;
-      authLogger.info("OTP detected from URL, auto-submitting");
-      const autoIdentifier = detectedEmail || getSavedEmail() || "";
-      if (!autoIdentifier) {
-        authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
+  const handleOTPFromUrl = (0, import_react7.useCallback)((detectedOtp, detectedEmail) => {
+    const autoIdentifier = detectedEmail || getSavedEmail() || "";
+    if (!autoIdentifier) {
+      authLogger.warn("No identifier found for auto-submit (no email in URL or storage)");
+      return;
+    }
+    const otpKey = `${autoIdentifier}:${detectedOtp}`;
+    if (processedOtpKeyRef.current === otpKey) return;
+    if (isAutoSubmitFromUrlRef.current) return;
+    processedOtpKeyRef.current = otpKey;
+    isAutoSubmitFromUrlRef.current = true;
+    authLogger.info("OTP detected from URL, auto-submitting");
+    setIdentifier(autoIdentifier);
+    setOtp(detectedOtp);
+    setStep("otp");
+    setTimeout(async () => {
+      try {
+        await submitOTP(autoIdentifier, detectedOtp);
+      } finally {
         isAutoSubmitFromUrlRef.current = false;
-        return;
       }
-      setIdentifier(autoIdentifier);
-      setOtp(detectedOtp);
-      setStep("otp");
-      setTimeout(async () => {
-        try {
-          await submitOTP(autoIdentifier, detectedOtp);
-        } finally {
-          isAutoSubmitFromUrlRef.current = false;
-        }
-      }, 100);
-    }, "onOTPDetected"),
+    }, 100);
+  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);
+  useAutoAuth({
+    allowedPaths: [authPath],
+    onOTPDetected: handleOTPFromUrl,
     cleanupUrl: true
   });
   return {