@djangocfg/api 2.1.448 → 2.1.450

package/dist/auth.cjs

@@ -223,6 +223,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [acceptedTerms, setAcceptedTerms] = (0, import_react3.useState)(true);
   const [step, setStep] = (0, import_react3.useState)("identifier");
   const [error, setError] = (0, import_react3.useState)("");
+  const [webmail, setWebmail] = (0, import_react3.useState)(null);
   const [twoFactorSessionId, setTwoFactorSessionId] = (0, import_react3.useState)(null);
   const [shouldPrompt2FA, setShouldPrompt2FA] = (0, import_react3.useState)(false);
   const [twoFactorCode, setTwoFactorCode] = (0, import_react3.useState)("");
@@ -262,6 +263,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     rateLimitSeconds,
     isRateLimited: rateLimitSeconds > 0,
     rateLimitLabel: formatCountdown(rateLimitSeconds),
+    webmail,
     // Handlers
     setIdentifier,
     setOtp,
@@ -274,7 +276,8 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     setShouldPrompt2FA,
     setTwoFactorCode,
     setUseBackupCode,
-    startRateLimitCountdown
+    startRateLimitCountdown,
+    setWebmail
   };
 }, "useAuthFormState");
 
@@ -660,6 +663,17 @@ var auth = {
    */
   setRefreshHandler(fn) {
     _refreshHandler = fn;
+  },
+  /**
+   * Proactively run the registered refresh handler right now, reusing the
+   * SAME single-flight promise as the 401-recovery interceptor. Callers
+   * (e.g. an expiry timer / focus / reconnect) get token rotation,
+   * de-duplication and rotated-token persistence for free — they must NOT
+   * re-implement any of it. Returns the fresh access token, or null if
+   * there is no handler / no refresh token / the refresh failed.
+   */
+  refreshNow() {
+    return tryRefresh();
   }
 };
 async function tryRefresh() {
@@ -2383,6 +2397,14 @@ var API = class {
   setRefreshHandler(fn) {
     auth.setRefreshHandler(fn);
   }
+  /**
+   * Proactively refresh now via the registered handler, sharing the single
+   * 401-recovery flight (rotation + dedup + rotated-token persistence).
+   * See `auth.refreshNow`.
+   */
+  refreshNow() {
+    return auth.refreshNow();
+  }
 };
 
 // src/_api/generated/_cfg_centrifugo/api.ts
@@ -2447,6 +2469,14 @@ var API2 = class {
   setRefreshHandler(fn) {
     auth.setRefreshHandler(fn);
   }
+  /**
+   * Proactively refresh now via the registered handler, sharing the single
+   * 401-recovery flight (rotation + dedup + rotated-token persistence).
+   * See `auth.refreshNow`.
+   */
+  refreshNow() {
+    return auth.refreshNow();
+  }
 };
 
 // src/_api/generated/_cfg_totp/api.ts
@@ -2514,6 +2544,14 @@ var API3 = class {
   setRefreshHandler(fn) {
     auth.setRefreshHandler(fn);
   }
+  /**
+   * Proactively refresh now via the registered handler, sharing the single
+   * 401-recovery flight (rotation + dedup + rotated-token persistence).
+   * See `auth.refreshNow`.
+   */
+  refreshNow() {
+    return auth.refreshNow();
+  }
 };
 
 // src/_api/generated/index.ts
@@ -2734,7 +2772,8 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setShouldPrompt2FA,
     setTwoFactorCode,
     setUseBackupCode,
-    startRateLimitCountdown
+    startRateLimitCountdown,
+    setWebmail
   } = formState;
   const twoFactor = useTwoFactor({
     onSuccess: /* @__PURE__ */ __name(() => {
@@ -2786,6 +2825,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       const result = await requestOTP(identifier, sourceUrl);
       if (result.success) {
         saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
         setStep("otp");
         onIdentifierSuccess?.(identifier);
       } else {
@@ -2815,6 +2855,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setIsLoading,
     setStep,
     clearError,
+    setWebmail,
     startRateLimitCountdown,
     onIdentifierSuccess,
     onError,
@@ -2870,6 +2911,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       const result = await requestOTP(identifier, sourceUrl);
       if (result.success) {
         saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
         setOtp("");
       } else {
         if (result.retryAfter) {
@@ -2887,7 +2929,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     } finally {
       setIsLoading(false);
     }
-  }, [identifier, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, onError, sourceUrl]);
+  }, [identifier, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
   const handleBackToIdentifier = (0, import_react7.useCallback)(() => {
     setStep("identifier");
     clearError();
@@ -3790,50 +3832,90 @@ __name(getCacheMetadata, "getCacheMetadata");
 
 // src/auth/hooks/useTokenRefresh.ts
 var import_react14 = require("react");
-var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
-var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-function getTokenExpiry(token) {
+
+// src/auth/refreshHandler.ts
+var _registered = false;
+function ensureRefreshHandler() {
+  if (_registered) return;
+  _registered = true;
+  CfgAccountsApi.setRefreshHandler(async (refresh) => {
+    const result = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
+      body: { refresh },
+      throwOnError: true
+    });
+    const access = result.data?.access;
+    if (!access) {
+      authLogger.error("Refresh response missing access token");
+      return null;
+    }
+    return { access, refresh: result.data?.refresh ?? refresh };
+  });
+  authLogger.debug("Canonical refresh handler registered");
+}
+__name(ensureRefreshHandler, "ensureRefreshHandler");
+function triggerRefresh() {
+  ensureRefreshHandler();
+  const maybe = CfgAccountsApi;
+  if (typeof maybe.refreshNow === "function") {
+    return maybe.refreshNow();
+  }
+  authLogger.warn("api.refreshNow() unavailable \u2014 run `make generate` to regenerate the client");
+  return Promise.resolve(null);
+}
+__name(triggerRefresh, "triggerRefresh");
+
+// src/auth/utils/jwt.ts
+function decodeSegment(segment) {
   try {
-    const payload = JSON.parse(atob(token.split(".")[1]));
-    return payload.exp * 1e3;
+    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    if (typeof atob !== "function") return null;
+    const json = atob(base64);
+    return JSON.parse(json);
   } catch {
     return null;
   }
 }
+__name(decodeSegment, "decodeSegment");
+function getTokenExpiry(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const payload = decodeSegment(parts[1]);
+  if (!payload || typeof payload !== "object") return null;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+  return exp * 1e3;
+}
 __name(getTokenExpiry, "getTokenExpiry");
-function isTokenExpiringSoon(token, thresholdMs) {
+function isTokenExpired(token, skewMs = 0, now = Date.now()) {
+  const expiry = getTokenExpiry(token);
+  if (expiry === null) return true;
+  return expiry - skewMs <= now;
+}
+__name(isTokenExpired, "isTokenExpired");
+function isTokenExpiringSoon(token, thresholdMs, now = Date.now()) {
   const expiry = getTokenExpiry(token);
-  if (!expiry) return false;
-  const timeUntilExpiry = expiry - Date.now();
-  return timeUntilExpiry < thresholdMs;
+  if (expiry === null) return false;
+  return expiry - now < thresholdMs;
 }
 __name(isTokenExpiringSoon, "isTokenExpiringSoon");
+
+// src/auth/hooks/useTokenRefresh.ts
+var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function useTokenRefresh(options = {}) {
   const { enabled = true, onRefresh, onRefreshError } = options;
-  const isRefreshingRef = (0, import_react14.useRef)(false);
   const refreshToken = (0, import_react14.useCallback)(async () => {
-    if (isRefreshingRef.current) {
-      authLogger.debug("Token refresh already in progress");
-      return false;
-    }
-    const refreshTokenValue = CfgAccountsApi.getRefreshToken();
-    if (!refreshTokenValue) {
+    if (!CfgAccountsApi.getRefreshToken()) {
       authLogger.warn("No refresh token available");
       return false;
     }
-    isRefreshingRef.current = true;
     authLogger.info("Refreshing token...");
     try {
-      const result = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
-        body: { refresh: refreshTokenValue },
-        throwOnError: true
-      });
-      const newAccessToken = result.data.access;
+      const newAccessToken = await triggerRefresh();
       if (!newAccessToken) {
-        throw new Error("No access token in refresh response");
+        throw new Error("Token refresh failed");
       }
-      CfgAccountsApi.setToken(newAccessToken);
-      CfgAccountsApi.setRefreshToken(refreshTokenValue);
       authLogger.info("Token refreshed successfully");
       onRefresh?.(newAccessToken);
       return true;
@@ -3841,8 +3923,6 @@ function useTokenRefresh(options = {}) {
       authLogger.error("Token refresh error:", error);
       onRefreshError?.(error instanceof Error ? error : new Error(String(error)));
       return false;
-    } finally {
-      isRefreshingRef.current = false;
     }
   }, [onRefresh, onRefreshError]);
   const checkAndRefresh = (0, import_react14.useCallback)(async () => {
@@ -4025,8 +4105,8 @@ var OAuthTokenResponseSchema = import_zod10.z.object({
   access: import_zod10.z.string().nullable().optional(),
   refresh: import_zod10.z.string().nullable().optional(),
   user: import_zod10.z.object({}).passthrough().nullable().optional(),
-  is_new_user: import_zod10.z.boolean(),
-  is_new_connection: import_zod10.z.boolean(),
+  is_new_user: import_zod10.z.boolean().default(false).optional(),
+  is_new_connection: import_zod10.z.boolean().default(false).optional(),
   should_prompt_2fa: import_zod10.z.boolean().optional()
 });
 
@@ -4043,9 +4123,27 @@ var OAuthProvidersResponseSchema = import_zod11.z.object({
 var import_mutation7 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/schemas/OTPRequestResponse.ts
+var import_zod14 = require("zod");
+
+// src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts
+var import_zod13 = require("zod");
+
+// src/_api/generated/_cfg_accounts/schemas/WebmailLinkProviderEnum.ts
 var import_zod12 = require("zod");
-var OTPRequestResponseSchema = import_zod12.z.object({
-  message: import_zod12.z.string()
+var WebmailLinkProviderEnumSchema = import_zod12.z.enum(["gmail", "outlook", "yahoo", "icloud", "proton", "zoho", "aol", "fastmail", "gmx", "mailcom", "mail_ru", "yandex", "rambler", "qq", "netease", "sina", "aliyun", "naver", "daum", "web_de", "tonline", "seznam", "wp_pl", "o2_pl", "interia", "libero", "virgilio", "orange", "laposte", "free_fr", "sfr"]);
+
+// src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts
+var WebmailLinkSchema = import_zod13.z.object({
+  provider: WebmailLinkProviderEnumSchema,
+  provider_name: import_zod13.z.string(),
+  url: import_zod13.z.string(),
+  is_search: import_zod13.z.boolean()
+});
+
+// src/_api/generated/_cfg_accounts/schemas/OTPRequestResponse.ts
+var OTPRequestResponseSchema = import_zod14.z.object({
+  message: import_zod14.z.string(),
+  webmail: WebmailLinkSchema.nullable().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts
@@ -4099,52 +4197,52 @@ __name(useCfgAccountsOtpRequestCreate, "useCfgAccountsOtpRequestCreate");
 var import_mutation8 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyResponse.ts
-var import_zod15 = require("zod");
+var import_zod17 = require("zod");
 
 // src/_api/generated/_cfg_accounts/schemas/User.ts
-var import_zod14 = require("zod");
+var import_zod16 = require("zod");
 
 // src/_api/generated/_cfg_accounts/schemas/CentrifugoToken.ts
-var import_zod13 = require("zod");
-var CentrifugoTokenSchema = import_zod13.z.object({
-  token: import_zod13.z.string(),
-  centrifugo_url: import_zod13.z.string(),
-  expires_at: import_zod13.z.string().datetime({ offset: true }),
-  channels: import_zod13.z.array(import_zod13.z.string())
+var import_zod15 = require("zod");
+var CentrifugoTokenSchema = import_zod15.z.object({
+  token: import_zod15.z.string(),
+  centrifugo_url: import_zod15.z.string(),
+  expires_at: import_zod15.z.string().datetime({ offset: true }),
+  channels: import_zod15.z.array(import_zod15.z.string())
 });
 
 // src/_api/generated/_cfg_accounts/schemas/User.ts
-var UserSchema = import_zod14.z.object({
-  id: import_zod14.z.number().int(),
-  email: import_zod14.z.email(),
-  first_name: import_zod14.z.string().max(50).nullable().optional(),
-  last_name: import_zod14.z.string().max(50).nullable().optional(),
-  full_name: import_zod14.z.string(),
-  initials: import_zod14.z.string(),
-  display_username: import_zod14.z.string(),
-  company: import_zod14.z.string().max(100).nullable().optional(),
-  phone: import_zod14.z.string().max(20).nullable().optional(),
-  position: import_zod14.z.string().max(100).nullable().optional(),
-  language: import_zod14.z.string().max(10).nullable().optional(),
-  timezone: import_zod14.z.string().max(64).nullable().optional(),
-  avatar: import_zod14.z.string().nullable(),
-  is_staff: import_zod14.z.boolean(),
-  is_superuser: import_zod14.z.boolean(),
-  date_joined: import_zod14.z.string().datetime({ offset: true }),
-  last_login: import_zod14.z.string().datetime({ offset: true }).nullable(),
-  unanswered_messages_count: import_zod14.z.number().int().default(0),
+var UserSchema = import_zod16.z.object({
+  id: import_zod16.z.number().int(),
+  email: import_zod16.z.email(),
+  first_name: import_zod16.z.string().max(50).nullable().optional(),
+  last_name: import_zod16.z.string().max(50).nullable().optional(),
+  full_name: import_zod16.z.string(),
+  initials: import_zod16.z.string(),
+  display_username: import_zod16.z.string(),
+  company: import_zod16.z.string().max(100).nullable().optional(),
+  phone: import_zod16.z.string().max(20).nullable().optional(),
+  position: import_zod16.z.string().max(100).nullable().optional(),
+  language: import_zod16.z.string().max(10).nullable().optional(),
+  timezone: import_zod16.z.string().max(64).nullable().optional(),
+  avatar: import_zod16.z.string().nullable(),
+  is_staff: import_zod16.z.boolean(),
+  is_superuser: import_zod16.z.boolean(),
+  date_joined: import_zod16.z.string().datetime({ offset: true }),
+  last_login: import_zod16.z.string().datetime({ offset: true }).nullable(),
+  unanswered_messages_count: import_zod16.z.number().int().default(0),
   centrifugo: CentrifugoTokenSchema.nullable(),
-  api_key: import_zod14.z.string().nullable()
+  api_key: import_zod16.z.string().nullable()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyResponse.ts
-var OTPVerifyResponseSchema = import_zod15.z.object({
-  requires_2fa: import_zod15.z.boolean().default(false).optional(),
-  session_id: import_zod15.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
-  refresh: import_zod15.z.string().nullable().optional(),
-  access: import_zod15.z.string().nullable().optional(),
+var OTPVerifyResponseSchema = import_zod17.z.object({
+  requires_2fa: import_zod17.z.boolean().default(false).optional(),
+  session_id: import_zod17.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+  refresh: import_zod17.z.string().nullable().optional(),
+  access: import_zod17.z.string().nullable().optional(),
   user: UserSchema.nullable().optional(),
-  should_prompt_2fa: import_zod15.z.boolean().optional()
+  should_prompt_2fa: import_zod17.z.boolean().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
@@ -4246,10 +4344,10 @@ __name(useCfgAccountsProfileAvatarCreate, "useCfgAccountsProfileAvatarCreate");
 var import_mutation10 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/schemas/AccountDeleteResponse.ts
-var import_zod16 = require("zod");
-var AccountDeleteResponseSchema = import_zod16.z.object({
-  success: import_zod16.z.boolean(),
-  message: import_zod16.z.string()
+var import_zod18 = require("zod");
+var AccountDeleteResponseSchema = import_zod18.z.object({
+  success: import_zod18.z.boolean(),
+  message: import_zod18.z.string()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts
@@ -4361,10 +4459,10 @@ __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 var import_mutation15 = __toESM(require("swr/mutation"), 1);
 
 // src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
-var import_zod17 = require("zod");
-var TokenRefreshSchema = import_zod17.z.object({
-  access: import_zod17.z.string(),
-  refresh: import_zod17.z.string()
+var import_zod19 = require("zod");
+var TokenRefreshSchema = import_zod19.z.object({
+  access: import_zod19.z.string(),
+  refresh: import_zod19.z.string()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
@@ -4415,98 +4513,98 @@ function useCfgAccountsTokenRefreshCreate(config) {
 __name(useCfgAccountsTokenRefreshCreate, "useCfgAccountsTokenRefreshCreate");
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
-var import_zod18 = require("zod");
-var APIKeyRequestSchema = import_zod18.z.object({
-  key: import_zod18.z.string().min(1),
-  reissued_at: import_zod18.z.string().datetime({ offset: true }).nullable(),
-  created_at: import_zod18.z.string().datetime({ offset: true })
+var import_zod20 = require("zod");
+var APIKeyRequestSchema = import_zod20.z.object({
+  key: import_zod20.z.string().min(1),
+  reissued_at: import_zod20.z.string().datetime({ offset: true }).nullable(),
+  created_at: import_zod20.z.string().datetime({ offset: true })
 });
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyTestRequest.ts
-var import_zod19 = require("zod");
-var APIKeyTestRequestSchema = import_zod19.z.object({
-  key: import_zod19.z.string().min(1)
+var import_zod21 = require("zod");
+var APIKeyTestRequestSchema = import_zod21.z.object({
+  key: import_zod21.z.string().min(1)
 });
 
 // src/_api/generated/_cfg_accounts/schemas/CfgUserUpdateRequest.ts
-var import_zod20 = require("zod");
-var CfgUserUpdateRequestSchema = import_zod20.z.object({
-  first_name: import_zod20.z.string().max(50).optional(),
-  last_name: import_zod20.z.string().max(50).optional(),
-  company: import_zod20.z.string().max(100).optional(),
-  phone: import_zod20.z.string().max(20).optional(),
-  position: import_zod20.z.string().max(100).optional(),
-  language: import_zod20.z.string().max(10).optional(),
-  timezone: import_zod20.z.string().max(64).optional()
+var import_zod22 = require("zod");
+var CfgUserUpdateRequestSchema = import_zod22.z.object({
+  first_name: import_zod22.z.string().max(50).optional(),
+  last_name: import_zod22.z.string().max(50).optional(),
+  company: import_zod22.z.string().max(100).optional(),
+  phone: import_zod22.z.string().max(20).optional(),
+  position: import_zod22.z.string().max(100).optional(),
+  language: import_zod22.z.string().max(10).optional(),
+  timezone: import_zod22.z.string().max(64).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
-var import_zod21 = require("zod");
-var OAuthAuthorizeRequestRequestSchema = import_zod21.z.object({
-  redirect_uri: import_zod21.z.string().optional(),
-  source_url: import_zod21.z.string().optional()
+var import_zod23 = require("zod");
+var OAuthAuthorizeRequestRequestSchema = import_zod23.z.object({
+  redirect_uri: import_zod23.z.string().optional(),
+  source_url: import_zod23.z.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
-var import_zod22 = require("zod");
-var OAuthCallbackRequestRequestSchema = import_zod22.z.object({
-  code: import_zod22.z.string().min(10).max(500),
-  state: import_zod22.z.string().min(20).max(100),
-  redirect_uri: import_zod22.z.string().optional()
+var import_zod24 = require("zod");
+var OAuthCallbackRequestRequestSchema = import_zod24.z.object({
+  code: import_zod24.z.string().min(10).max(500),
+  state: import_zod24.z.string().min(20).max(100),
+  redirect_uri: import_zod24.z.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
-var import_zod23 = require("zod");
-var OAuthDisconnectRequestRequestSchema = import_zod23.z.object({
+var import_zod25 = require("zod");
+var OAuthDisconnectRequestRequestSchema = import_zod25.z.object({
   provider: OAuthProviderEnumSchema
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthError.ts
-var import_zod24 = require("zod");
-var OAuthErrorSchema = import_zod24.z.object({
-  error: import_zod24.z.string(),
-  error_description: import_zod24.z.string().optional()
+var import_zod26 = require("zod");
+var OAuthErrorSchema = import_zod26.z.object({
+  error: import_zod26.z.string(),
+  error_description: import_zod26.z.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPErrorResponse.ts
-var import_zod25 = require("zod");
-var OTPErrorResponseSchema = import_zod25.z.object({
-  error: import_zod25.z.string(),
-  error_code: import_zod25.z.string().nullable().optional(),
-  retry_after: import_zod25.z.number().int().nullable().optional()
+var import_zod27 = require("zod");
+var OTPErrorResponseSchema = import_zod27.z.object({
+  error: import_zod27.z.string(),
+  error_code: import_zod27.z.string().nullable().optional(),
+  retry_after: import_zod27.z.number().int().nullable().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts
-var import_zod26 = require("zod");
-var OTPRequestRequestSchema = import_zod26.z.object({
-  identifier: import_zod26.z.string().min(1),
-  source_url: import_zod26.z.string().optional()
+var import_zod28 = require("zod");
+var OTPRequestRequestSchema = import_zod28.z.object({
+  identifier: import_zod28.z.string().min(1),
+  source_url: import_zod28.z.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts
-var import_zod27 = require("zod");
-var OTPVerifyRequestSchema = import_zod27.z.object({
-  identifier: import_zod27.z.string().min(1),
-  otp: import_zod27.z.string().min(4).max(4),
-  source_url: import_zod27.z.string().optional()
+var import_zod29 = require("zod");
+var OTPVerifyRequestSchema = import_zod29.z.object({
+  identifier: import_zod29.z.string().min(1),
+  otp: import_zod29.z.string().min(4).max(4),
+  source_url: import_zod29.z.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
-var import_zod28 = require("zod");
-var PatchedCfgUserUpdateRequestSchema = import_zod28.z.object({
-  first_name: import_zod28.z.string().max(50).optional(),
-  last_name: import_zod28.z.string().max(50).optional(),
-  company: import_zod28.z.string().max(100).optional(),
-  phone: import_zod28.z.string().max(20).optional(),
-  position: import_zod28.z.string().max(100).optional(),
-  language: import_zod28.z.string().max(10).optional(),
-  timezone: import_zod28.z.string().max(64).optional()
+var import_zod30 = require("zod");
+var PatchedCfgUserUpdateRequestSchema = import_zod30.z.object({
+  first_name: import_zod30.z.string().max(50).optional(),
+  last_name: import_zod30.z.string().max(50).optional(),
+  company: import_zod30.z.string().max(100).optional(),
+  phone: import_zod30.z.string().max(20).optional(),
+  position: import_zod30.z.string().max(100).optional(),
+  language: import_zod30.z.string().max(10).optional(),
+  timezone: import_zod30.z.string().max(64).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
-var import_zod29 = require("zod");
-var TokenRefreshRequestSchema = import_zod29.z.object({
-  refresh: import_zod29.z.string().min(1)
+var import_zod31 = require("zod");
+var TokenRefreshRequestSchema = import_zod31.z.object({
+  refresh: import_zod31.z.string().min(1)
 });
 
 // src/auth/context/AccountsContext.tsx
@@ -4660,8 +4758,15 @@ var hasValidTokens = /* @__PURE__ */ __name(() => {
   if (typeof window === "undefined") return false;
   return CfgAccountsApi.isAuthenticated();
 }, "hasValidTokens");
+var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken, now = Date.now()) => {
+  const accessDead = isTokenExpired(accessToken, 0, now);
+  if (!accessDead) return false;
+  const refreshDead = isTokenExpired(refreshToken, 0, now);
+  return refreshDead;
+}, "isSessionDeadOnBootstrap");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
+  ensureRefreshHandler();
   const redirectManager = useAuthRedirectManager({
     fallbackUrl: config?.routes?.defaultCallback || defaultRoutes.defaultCallback,
     clearOnUse: true
@@ -4674,19 +4779,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     return true;
   });
   const [initialized, setInitialized] = (0, import_react17.useState)(false);
+  const [authTick, setAuthTick] = (0, import_react17.useState)(0);
+  const bumpAuthTick = (0, import_react17.useCallback)(() => setAuthTick((t) => t + 1), []);
+  const onUnauthorizedRef = (0, import_react17.useRef)(false);
   const router = useCfgRouter();
   const pathname = (0, import_navigation4.usePathname)();
   const queryParams = useQueryParams();
   const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
-  useTokenRefresh({
-    enabled: true,
-    onRefresh: /* @__PURE__ */ __name((newToken) => {
-      authLogger.info("Token auto-refreshed successfully");
-    }, "onRefresh"),
-    onRefreshError: /* @__PURE__ */ __name((error) => {
-      authLogger.warn("Token auto-refresh failed:", error.message);
-    }, "onRefreshError")
-  });
   const user = accounts.profile;
   const userRef = (0, import_react17.useRef)(user);
   const configRef = (0, import_react17.useRef)(config);
@@ -4703,7 +4802,23 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     clearProfileCache();
     setInitialized(true);
     setIsLoading(false);
-  }, []);
+    bumpAuthTick();
+  }, [bumpAuthTick]);
+  const handleProactiveRefreshError = (0, import_react17.useCallback)((error) => {
+    authLogger.warn("Proactive token refresh failed \u2014 session is dead, redirecting to login:", error.message);
+    if (onUnauthorizedRef.current) return;
+    onUnauthorizedRef.current = true;
+    clearAuthState("proactiveRefresh:failed");
+    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+    router.hardReplace(authCallbackUrl);
+  }, [clearAuthState, router]);
+  useTokenRefresh({
+    enabled: true,
+    onRefresh: /* @__PURE__ */ __name(() => {
+      authLogger.info("Token auto-refreshed successfully");
+    }, "onRefresh"),
+    onRefreshError: handleProactiveRefreshError
+  });
   const handleGlobalAuthError = (0, import_react17.useCallback)((error, context = "API Request") => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
     if (isAuthError) {
@@ -4716,6 +4831,20 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     }
     return false;
   }, [clearAuthState]);
+  (0, import_react17.useEffect)(() => {
+    const handler = /* @__PURE__ */ __name(() => {
+      if (onUnauthorizedRef.current) return;
+      onUnauthorizedRef.current = true;
+      authLogger.warn("Unrecoverable 401 (refresh failed) \u2014 clearing session and redirecting to login");
+      clearAuthState("onUnauthorized:401");
+      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+      router.hardReplace(authCallbackUrl);
+    }, "handler");
+    CfgAccountsApi.onUnauthorized(handler);
+    return () => {
+      CfgAccountsApi.onUnauthorized(null);
+    };
+  }, [clearAuthState, router]);
   const isAutoLoggingOutRef = (0, import_react17.useRef)(false);
   const swrOnError = (0, import_react17.useCallback)((error) => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
@@ -4780,6 +4909,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       authLogger.info("Token from API:", token ? `${token.substring(0, 20)}...` : "null");
       authLogger.info("Refresh token from API:", refreshToken2 ? `${refreshToken2.substring(0, 20)}...` : "null");
       authLogger.info("localStorage keys:", Object.keys(localStorage).filter((k) => k.includes("token") || k.includes("auth")));
+      if (!isInIframe && isSessionDeadOnBootstrap(token, refreshToken2)) {
+        authLogger.warn("Bootstrap: dead session in storage (access + refresh both unusable) \u2014 clearing and showing login");
+        clearAuthState("initializeAuth:deadSession");
+        return;
+      }
       const hasTokens = hasValidTokens();
       authLogger.info("Has tokens:", hasTokens);
       if (userRef.current) {
@@ -4880,7 +5014,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         });
         return {
           success: true,
-          message: result.message || `OTP code sent to your email address`
+          message: result.message || `OTP code sent to your email address`,
+          webmail: result.webmail ?? null
         };
       } catch (error) {
         authLogger.error("Request OTP error:", error);
@@ -5035,7 +5170,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
-      // Consider authenticated if we have valid tokens, even without user profile
+      // Consider authenticated if we have valid tokens, even without user profile.
+      // `authTick` (in deps) forces recompute after tokens are cleared/set, since
+      // token state lives in storage, not React state.
       isAuthenticated: CfgAccountsApi.isAuthenticated(),
       isAdminUser,
       loadCurrentProfile,
@@ -5061,6 +5198,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      authTick,
+      // recompute isAuthenticated when tokens are cleared/set
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,