@djangocfg/api 2.1.448 → 2.1.450

package/dist/auth.mjs

@@ -27,7 +27,7 @@ import {
   useContext as useContext2,
   useEffect as useEffect9,
   useMemo as useMemo3,
-  useRef as useRef7,
+  useRef as useRef6,
   useState as useState12
 } from "react";
 import { SWRConfig } from "swr";
@@ -161,6 +161,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [acceptedTerms, setAcceptedTerms] = useState2(true);
   const [step, setStep] = useState2("identifier");
   const [error, setError] = useState2("");
+  const [webmail, setWebmail] = useState2(null);
   const [twoFactorSessionId, setTwoFactorSessionId] = useState2(null);
   const [shouldPrompt2FA, setShouldPrompt2FA] = useState2(false);
   const [twoFactorCode, setTwoFactorCode] = useState2("");
@@ -200,6 +201,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     rateLimitSeconds,
     isRateLimited: rateLimitSeconds > 0,
     rateLimitLabel: formatCountdown(rateLimitSeconds),
+    webmail,
     // Handlers
     setIdentifier,
     setOtp,
@@ -212,7 +214,8 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     setShouldPrompt2FA,
     setTwoFactorCode,
     setUseBackupCode,
-    startRateLimitCountdown
+    startRateLimitCountdown,
+    setWebmail
   };
 }, "useAuthFormState");
 
@@ -598,6 +601,17 @@ var auth = {
    */
   setRefreshHandler(fn) {
     _refreshHandler = fn;
+  },
+  /**
+   * Proactively run the registered refresh handler right now, reusing the
+   * SAME single-flight promise as the 401-recovery interceptor. Callers
+   * (e.g. an expiry timer / focus / reconnect) get token rotation,
+   * de-duplication and rotated-token persistence for free — they must NOT
+   * re-implement any of it. Returns the fresh access token, or null if
+   * there is no handler / no refresh token / the refresh failed.
+   */
+  refreshNow() {
+    return tryRefresh();
   }
 };
 async function tryRefresh() {
@@ -2321,6 +2335,14 @@ var API = class {
   setRefreshHandler(fn) {
     auth.setRefreshHandler(fn);
   }
+  /**
+   * Proactively refresh now via the registered handler, sharing the single
+   * 401-recovery flight (rotation + dedup + rotated-token persistence).
+   * See `auth.refreshNow`.
+   */
+  refreshNow() {
+    return auth.refreshNow();
+  }
 };
 
 // src/_api/generated/_cfg_centrifugo/api.ts
@@ -2385,6 +2407,14 @@ var API2 = class {
   setRefreshHandler(fn) {
     auth.setRefreshHandler(fn);
   }
+  /**
+   * Proactively refresh now via the registered handler, sharing the single
+   * 401-recovery flight (rotation + dedup + rotated-token persistence).
+   * See `auth.refreshNow`.
+   */
+  refreshNow() {
+    return auth.refreshNow();
+  }
 };
 
 // src/_api/generated/_cfg_totp/api.ts
@@ -2452,6 +2482,14 @@ var API3 = class {
   setRefreshHandler(fn) {
     auth.setRefreshHandler(fn);
   }
+  /**
+   * Proactively refresh now via the registered handler, sharing the single
+   * 401-recovery flight (rotation + dedup + rotated-token persistence).
+   * See `auth.refreshNow`.
+   */
+  refreshNow() {
+    return auth.refreshNow();
+  }
 };
 
 // src/_api/generated/index.ts
@@ -2672,7 +2710,8 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setShouldPrompt2FA,
     setTwoFactorCode,
     setUseBackupCode,
-    startRateLimitCountdown
+    startRateLimitCountdown,
+    setWebmail
   } = formState;
   const twoFactor = useTwoFactor({
     onSuccess: /* @__PURE__ */ __name(() => {
@@ -2724,6 +2763,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       const result = await requestOTP(identifier, sourceUrl);
       if (result.success) {
         saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
         setStep("otp");
         onIdentifierSuccess?.(identifier);
       } else {
@@ -2753,6 +2793,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setIsLoading,
     setStep,
     clearError,
+    setWebmail,
     startRateLimitCountdown,
     onIdentifierSuccess,
     onError,
@@ -2808,6 +2849,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       const result = await requestOTP(identifier, sourceUrl);
       if (result.success) {
         saveIdentifierToStorage(identifier);
+        setWebmail(result.webmail ?? null);
         setOtp("");
       } else {
         if (result.retryAfter) {
@@ -2825,7 +2867,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     } finally {
       setIsLoading(false);
     }
-  }, [identifier, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, onError, sourceUrl]);
+  }, [identifier, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
   const handleBackToIdentifier = useCallback5(() => {
     setStep("identifier");
     clearError();
@@ -3727,51 +3769,91 @@ function getCacheMetadata() {
 __name(getCacheMetadata, "getCacheMetadata");
 
 // src/auth/hooks/useTokenRefresh.ts
-import { useCallback as useCallback9, useEffect as useEffect7, useRef as useRef5 } from "react";
-var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
-var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-function getTokenExpiry(token) {
+import { useCallback as useCallback9, useEffect as useEffect7 } from "react";
+
+// src/auth/refreshHandler.ts
+var _registered = false;
+function ensureRefreshHandler() {
+  if (_registered) return;
+  _registered = true;
+  CfgAccountsApi.setRefreshHandler(async (refresh) => {
+    const result = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
+      body: { refresh },
+      throwOnError: true
+    });
+    const access = result.data?.access;
+    if (!access) {
+      authLogger.error("Refresh response missing access token");
+      return null;
+    }
+    return { access, refresh: result.data?.refresh ?? refresh };
+  });
+  authLogger.debug("Canonical refresh handler registered");
+}
+__name(ensureRefreshHandler, "ensureRefreshHandler");
+function triggerRefresh() {
+  ensureRefreshHandler();
+  const maybe = CfgAccountsApi;
+  if (typeof maybe.refreshNow === "function") {
+    return maybe.refreshNow();
+  }
+  authLogger.warn("api.refreshNow() unavailable \u2014 run `make generate` to regenerate the client");
+  return Promise.resolve(null);
+}
+__name(triggerRefresh, "triggerRefresh");
+
+// src/auth/utils/jwt.ts
+function decodeSegment(segment) {
   try {
-    const payload = JSON.parse(atob(token.split(".")[1]));
-    return payload.exp * 1e3;
+    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    if (typeof atob !== "function") return null;
+    const json = atob(base64);
+    return JSON.parse(json);
   } catch {
     return null;
   }
 }
+__name(decodeSegment, "decodeSegment");
+function getTokenExpiry(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const payload = decodeSegment(parts[1]);
+  if (!payload || typeof payload !== "object") return null;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+  return exp * 1e3;
+}
 __name(getTokenExpiry, "getTokenExpiry");
-function isTokenExpiringSoon(token, thresholdMs) {
+function isTokenExpired(token, skewMs = 0, now = Date.now()) {
+  const expiry = getTokenExpiry(token);
+  if (expiry === null) return true;
+  return expiry - skewMs <= now;
+}
+__name(isTokenExpired, "isTokenExpired");
+function isTokenExpiringSoon(token, thresholdMs, now = Date.now()) {
   const expiry = getTokenExpiry(token);
-  if (!expiry) return false;
-  const timeUntilExpiry = expiry - Date.now();
-  return timeUntilExpiry < thresholdMs;
+  if (expiry === null) return false;
+  return expiry - now < thresholdMs;
 }
 __name(isTokenExpiringSoon, "isTokenExpiringSoon");
+
+// src/auth/hooks/useTokenRefresh.ts
+var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function useTokenRefresh(options = {}) {
   const { enabled = true, onRefresh, onRefreshError } = options;
-  const isRefreshingRef = useRef5(false);
   const refreshToken = useCallback9(async () => {
-    if (isRefreshingRef.current) {
-      authLogger.debug("Token refresh already in progress");
-      return false;
-    }
-    const refreshTokenValue = CfgAccountsApi.getRefreshToken();
-    if (!refreshTokenValue) {
+    if (!CfgAccountsApi.getRefreshToken()) {
       authLogger.warn("No refresh token available");
       return false;
     }
-    isRefreshingRef.current = true;
     authLogger.info("Refreshing token...");
     try {
-      const result = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
-        body: { refresh: refreshTokenValue },
-        throwOnError: true
-      });
-      const newAccessToken = result.data.access;
+      const newAccessToken = await triggerRefresh();
       if (!newAccessToken) {
-        throw new Error("No access token in refresh response");
+        throw new Error("Token refresh failed");
       }
-      CfgAccountsApi.setToken(newAccessToken);
-      CfgAccountsApi.setRefreshToken(refreshTokenValue);
       authLogger.info("Token refreshed successfully");
       onRefresh?.(newAccessToken);
       return true;
@@ -3779,8 +3861,6 @@ function useTokenRefresh(options = {}) {
       authLogger.error("Token refresh error:", error);
       onRefreshError?.(error instanceof Error ? error : new Error(String(error)));
       return false;
-    } finally {
-      isRefreshingRef.current = false;
     }
   }, [onRefresh, onRefreshError]);
   const checkAndRefresh = useCallback9(async () => {
@@ -3867,7 +3947,7 @@ import {
   useContext,
   useEffect as useEffect8,
   useMemo as useMemo2,
-  useRef as useRef6,
+  useRef as useRef5,
   useState as useState11
 } from "react";
 
@@ -3971,8 +4051,8 @@ var OAuthTokenResponseSchema = z10.object({
   access: z10.string().nullable().optional(),
   refresh: z10.string().nullable().optional(),
   user: z10.object({}).passthrough().nullable().optional(),
-  is_new_user: z10.boolean(),
-  is_new_connection: z10.boolean(),
+  is_new_user: z10.boolean().default(false).optional(),
+  is_new_connection: z10.boolean().default(false).optional(),
   should_prompt_2fa: z10.boolean().optional()
 });
 
@@ -3989,9 +4069,27 @@ var OAuthProvidersResponseSchema = z11.object({
 import useSWRMutation7 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/schemas/OTPRequestResponse.ts
+import { z as z14 } from "zod";
+
+// src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts
+import { z as z13 } from "zod";
+
+// src/_api/generated/_cfg_accounts/schemas/WebmailLinkProviderEnum.ts
 import { z as z12 } from "zod";
-var OTPRequestResponseSchema = z12.object({
-  message: z12.string()
+var WebmailLinkProviderEnumSchema = z12.enum(["gmail", "outlook", "yahoo", "icloud", "proton", "zoho", "aol", "fastmail", "gmx", "mailcom", "mail_ru", "yandex", "rambler", "qq", "netease", "sina", "aliyun", "naver", "daum", "web_de", "tonline", "seznam", "wp_pl", "o2_pl", "interia", "libero", "virgilio", "orange", "laposte", "free_fr", "sfr"]);
+
+// src/_api/generated/_cfg_accounts/schemas/WebmailLink.ts
+var WebmailLinkSchema = z13.object({
+  provider: WebmailLinkProviderEnumSchema,
+  provider_name: z13.string(),
+  url: z13.string(),
+  is_search: z13.boolean()
+});
+
+// src/_api/generated/_cfg_accounts/schemas/OTPRequestResponse.ts
+var OTPRequestResponseSchema = z14.object({
+  message: z14.string(),
+  webmail: WebmailLinkSchema.nullable().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts
@@ -4045,52 +4143,52 @@ __name(useCfgAccountsOtpRequestCreate, "useCfgAccountsOtpRequestCreate");
 import useSWRMutation8 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyResponse.ts
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 
 // src/_api/generated/_cfg_accounts/schemas/User.ts
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 
 // src/_api/generated/_cfg_accounts/schemas/CentrifugoToken.ts
-import { z as z13 } from "zod";
-var CentrifugoTokenSchema = z13.object({
-  token: z13.string(),
-  centrifugo_url: z13.string(),
-  expires_at: z13.string().datetime({ offset: true }),
-  channels: z13.array(z13.string())
+import { z as z15 } from "zod";
+var CentrifugoTokenSchema = z15.object({
+  token: z15.string(),
+  centrifugo_url: z15.string(),
+  expires_at: z15.string().datetime({ offset: true }),
+  channels: z15.array(z15.string())
 });
 
 // src/_api/generated/_cfg_accounts/schemas/User.ts
-var UserSchema = z14.object({
-  id: z14.number().int(),
-  email: z14.email(),
-  first_name: z14.string().max(50).nullable().optional(),
-  last_name: z14.string().max(50).nullable().optional(),
-  full_name: z14.string(),
-  initials: z14.string(),
-  display_username: z14.string(),
-  company: z14.string().max(100).nullable().optional(),
-  phone: z14.string().max(20).nullable().optional(),
-  position: z14.string().max(100).nullable().optional(),
-  language: z14.string().max(10).nullable().optional(),
-  timezone: z14.string().max(64).nullable().optional(),
-  avatar: z14.string().nullable(),
-  is_staff: z14.boolean(),
-  is_superuser: z14.boolean(),
-  date_joined: z14.string().datetime({ offset: true }),
-  last_login: z14.string().datetime({ offset: true }).nullable(),
-  unanswered_messages_count: z14.number().int().default(0),
+var UserSchema = z16.object({
+  id: z16.number().int(),
+  email: z16.email(),
+  first_name: z16.string().max(50).nullable().optional(),
+  last_name: z16.string().max(50).nullable().optional(),
+  full_name: z16.string(),
+  initials: z16.string(),
+  display_username: z16.string(),
+  company: z16.string().max(100).nullable().optional(),
+  phone: z16.string().max(20).nullable().optional(),
+  position: z16.string().max(100).nullable().optional(),
+  language: z16.string().max(10).nullable().optional(),
+  timezone: z16.string().max(64).nullable().optional(),
+  avatar: z16.string().nullable(),
+  is_staff: z16.boolean(),
+  is_superuser: z16.boolean(),
+  date_joined: z16.string().datetime({ offset: true }),
+  last_login: z16.string().datetime({ offset: true }).nullable(),
+  unanswered_messages_count: z16.number().int().default(0),
   centrifugo: CentrifugoTokenSchema.nullable(),
-  api_key: z14.string().nullable()
+  api_key: z16.string().nullable()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyResponse.ts
-var OTPVerifyResponseSchema = z15.object({
-  requires_2fa: z15.boolean().default(false).optional(),
-  session_id: z15.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
-  refresh: z15.string().nullable().optional(),
-  access: z15.string().nullable().optional(),
+var OTPVerifyResponseSchema = z17.object({
+  requires_2fa: z17.boolean().default(false).optional(),
+  session_id: z17.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+  refresh: z17.string().nullable().optional(),
+  access: z17.string().nullable().optional(),
   user: UserSchema.nullable().optional(),
-  should_prompt_2fa: z15.boolean().optional()
+  should_prompt_2fa: z17.boolean().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
@@ -4192,10 +4290,10 @@ __name(useCfgAccountsProfileAvatarCreate, "useCfgAccountsProfileAvatarCreate");
 import useSWRMutation10 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/schemas/AccountDeleteResponse.ts
-import { z as z16 } from "zod";
-var AccountDeleteResponseSchema = z16.object({
-  success: z16.boolean(),
-  message: z16.string()
+import { z as z18 } from "zod";
+var AccountDeleteResponseSchema = z18.object({
+  success: z18.boolean(),
+  message: z18.string()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts
@@ -4307,10 +4405,10 @@ __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 import useSWRMutation15 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
-import { z as z17 } from "zod";
-var TokenRefreshSchema = z17.object({
-  access: z17.string(),
-  refresh: z17.string()
+import { z as z19 } from "zod";
+var TokenRefreshSchema = z19.object({
+  access: z19.string(),
+  refresh: z19.string()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
@@ -4361,98 +4459,98 @@ function useCfgAccountsTokenRefreshCreate(config) {
 __name(useCfgAccountsTokenRefreshCreate, "useCfgAccountsTokenRefreshCreate");
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
-import { z as z18 } from "zod";
-var APIKeyRequestSchema = z18.object({
-  key: z18.string().min(1),
-  reissued_at: z18.string().datetime({ offset: true }).nullable(),
-  created_at: z18.string().datetime({ offset: true })
+import { z as z20 } from "zod";
+var APIKeyRequestSchema = z20.object({
+  key: z20.string().min(1),
+  reissued_at: z20.string().datetime({ offset: true }).nullable(),
+  created_at: z20.string().datetime({ offset: true })
 });
 
 // src/_api/generated/_cfg_accounts/schemas/APIKeyTestRequest.ts
-import { z as z19 } from "zod";
-var APIKeyTestRequestSchema = z19.object({
-  key: z19.string().min(1)
+import { z as z21 } from "zod";
+var APIKeyTestRequestSchema = z21.object({
+  key: z21.string().min(1)
 });
 
 // src/_api/generated/_cfg_accounts/schemas/CfgUserUpdateRequest.ts
-import { z as z20 } from "zod";
-var CfgUserUpdateRequestSchema = z20.object({
-  first_name: z20.string().max(50).optional(),
-  last_name: z20.string().max(50).optional(),
-  company: z20.string().max(100).optional(),
-  phone: z20.string().max(20).optional(),
-  position: z20.string().max(100).optional(),
-  language: z20.string().max(10).optional(),
-  timezone: z20.string().max(64).optional()
+import { z as z22 } from "zod";
+var CfgUserUpdateRequestSchema = z22.object({
+  first_name: z22.string().max(50).optional(),
+  last_name: z22.string().max(50).optional(),
+  company: z22.string().max(100).optional(),
+  phone: z22.string().max(20).optional(),
+  position: z22.string().max(100).optional(),
+  language: z22.string().max(10).optional(),
+  timezone: z22.string().max(64).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
-import { z as z21 } from "zod";
-var OAuthAuthorizeRequestRequestSchema = z21.object({
-  redirect_uri: z21.string().optional(),
-  source_url: z21.string().optional()
+import { z as z23 } from "zod";
+var OAuthAuthorizeRequestRequestSchema = z23.object({
+  redirect_uri: z23.string().optional(),
+  source_url: z23.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
-import { z as z22 } from "zod";
-var OAuthCallbackRequestRequestSchema = z22.object({
-  code: z22.string().min(10).max(500),
-  state: z22.string().min(20).max(100),
-  redirect_uri: z22.string().optional()
+import { z as z24 } from "zod";
+var OAuthCallbackRequestRequestSchema = z24.object({
+  code: z24.string().min(10).max(500),
+  state: z24.string().min(20).max(100),
+  redirect_uri: z24.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
-import { z as z23 } from "zod";
-var OAuthDisconnectRequestRequestSchema = z23.object({
+import { z as z25 } from "zod";
+var OAuthDisconnectRequestRequestSchema = z25.object({
   provider: OAuthProviderEnumSchema
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthError.ts
-import { z as z24 } from "zod";
-var OAuthErrorSchema = z24.object({
-  error: z24.string(),
-  error_description: z24.string().optional()
+import { z as z26 } from "zod";
+var OAuthErrorSchema = z26.object({
+  error: z26.string(),
+  error_description: z26.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPErrorResponse.ts
-import { z as z25 } from "zod";
-var OTPErrorResponseSchema = z25.object({
-  error: z25.string(),
-  error_code: z25.string().nullable().optional(),
-  retry_after: z25.number().int().nullable().optional()
+import { z as z27 } from "zod";
+var OTPErrorResponseSchema = z27.object({
+  error: z27.string(),
+  error_code: z27.string().nullable().optional(),
+  retry_after: z27.number().int().nullable().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts
-import { z as z26 } from "zod";
-var OTPRequestRequestSchema = z26.object({
-  identifier: z26.string().min(1),
-  source_url: z26.string().optional()
+import { z as z28 } from "zod";
+var OTPRequestRequestSchema = z28.object({
+  identifier: z28.string().min(1),
+  source_url: z28.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts
-import { z as z27 } from "zod";
-var OTPVerifyRequestSchema = z27.object({
-  identifier: z27.string().min(1),
-  otp: z27.string().min(4).max(4),
-  source_url: z27.string().optional()
+import { z as z29 } from "zod";
+var OTPVerifyRequestSchema = z29.object({
+  identifier: z29.string().min(1),
+  otp: z29.string().min(4).max(4),
+  source_url: z29.string().optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
-import { z as z28 } from "zod";
-var PatchedCfgUserUpdateRequestSchema = z28.object({
-  first_name: z28.string().max(50).optional(),
-  last_name: z28.string().max(50).optional(),
-  company: z28.string().max(100).optional(),
-  phone: z28.string().max(20).optional(),
-  position: z28.string().max(100).optional(),
-  language: z28.string().max(10).optional(),
-  timezone: z28.string().max(64).optional()
+import { z as z30 } from "zod";
+var PatchedCfgUserUpdateRequestSchema = z30.object({
+  first_name: z30.string().max(50).optional(),
+  last_name: z30.string().max(50).optional(),
+  company: z30.string().max(100).optional(),
+  phone: z30.string().max(20).optional(),
+  position: z30.string().max(100).optional(),
+  language: z30.string().max(10).optional(),
+  timezone: z30.string().max(64).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
-import { z as z29 } from "zod";
-var TokenRefreshRequestSchema = z29.object({
-  refresh: z29.string().min(1)
+import { z as z31 } from "zod";
+var TokenRefreshRequestSchema = z31.object({
+  refresh: z31.string().min(1)
 });
 
 // src/auth/context/AccountsContext.tsx
@@ -4465,8 +4563,8 @@ function AccountsProvider({ children }) {
   });
   const [isLoadingProfile, setIsLoadingProfile] = useState11(false);
   const [profileError, setProfileError] = useState11(null);
-  const profileRef = useRef6(profile);
-  const isLoadingRef = useRef6(false);
+  const profileRef = useRef5(profile);
+  const isLoadingRef = useRef5(false);
   useEffect8(() => {
     profileRef.current = profile;
   }, [profile]);
@@ -4606,8 +4704,15 @@ var hasValidTokens = /* @__PURE__ */ __name(() => {
   if (typeof window === "undefined") return false;
   return CfgAccountsApi.isAuthenticated();
 }, "hasValidTokens");
+var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken, now = Date.now()) => {
+  const accessDead = isTokenExpired(accessToken, 0, now);
+  if (!accessDead) return false;
+  const refreshDead = isTokenExpired(refreshToken, 0, now);
+  return refreshDead;
+}, "isSessionDeadOnBootstrap");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
+  ensureRefreshHandler();
   const redirectManager = useAuthRedirectManager({
     fallbackUrl: config?.routes?.defaultCallback || defaultRoutes.defaultCallback,
     clearOnUse: true
@@ -4620,23 +4725,17 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     return true;
   });
   const [initialized, setInitialized] = useState12(false);
+  const [authTick, setAuthTick] = useState12(0);
+  const bumpAuthTick = useCallback12(() => setAuthTick((t) => t + 1), []);
+  const onUnauthorizedRef = useRef6(false);
   const router = useCfgRouter();
   const pathname = usePathname3();
   const queryParams = useQueryParams();
   const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
-  useTokenRefresh({
-    enabled: true,
-    onRefresh: /* @__PURE__ */ __name((newToken) => {
-      authLogger.info("Token auto-refreshed successfully");
-    }, "onRefresh"),
-    onRefreshError: /* @__PURE__ */ __name((error) => {
-      authLogger.warn("Token auto-refresh failed:", error.message);
-    }, "onRefreshError")
-  });
   const user = accounts.profile;
-  const userRef = useRef7(user);
-  const configRef = useRef7(config);
-  const isLoadingProfileRef = useRef7(false);
+  const userRef = useRef6(user);
+  const configRef = useRef6(config);
+  const isLoadingProfileRef = useRef6(false);
   useEffect9(() => {
     userRef.current = user;
   }, [user]);
@@ -4649,7 +4748,23 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     clearProfileCache();
     setInitialized(true);
     setIsLoading(false);
-  }, []);
+    bumpAuthTick();
+  }, [bumpAuthTick]);
+  const handleProactiveRefreshError = useCallback12((error) => {
+    authLogger.warn("Proactive token refresh failed \u2014 session is dead, redirecting to login:", error.message);
+    if (onUnauthorizedRef.current) return;
+    onUnauthorizedRef.current = true;
+    clearAuthState("proactiveRefresh:failed");
+    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+    router.hardReplace(authCallbackUrl);
+  }, [clearAuthState, router]);
+  useTokenRefresh({
+    enabled: true,
+    onRefresh: /* @__PURE__ */ __name(() => {
+      authLogger.info("Token auto-refreshed successfully");
+    }, "onRefresh"),
+    onRefreshError: handleProactiveRefreshError
+  });
   const handleGlobalAuthError = useCallback12((error, context = "API Request") => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
     if (isAuthError) {
@@ -4662,7 +4777,21 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     }
     return false;
   }, [clearAuthState]);
-  const isAutoLoggingOutRef = useRef7(false);
+  useEffect9(() => {
+    const handler = /* @__PURE__ */ __name(() => {
+      if (onUnauthorizedRef.current) return;
+      onUnauthorizedRef.current = true;
+      authLogger.warn("Unrecoverable 401 (refresh failed) \u2014 clearing session and redirecting to login");
+      clearAuthState("onUnauthorized:401");
+      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+      router.hardReplace(authCallbackUrl);
+    }, "handler");
+    CfgAccountsApi.onUnauthorized(handler);
+    return () => {
+      CfgAccountsApi.onUnauthorized(null);
+    };
+  }, [clearAuthState, router]);
+  const isAutoLoggingOutRef = useRef6(false);
   const swrOnError = useCallback12((error) => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
     if (isAuthError && !isAutoLoggingOutRef.current) {
@@ -4726,6 +4855,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       authLogger.info("Token from API:", token ? `${token.substring(0, 20)}...` : "null");
       authLogger.info("Refresh token from API:", refreshToken2 ? `${refreshToken2.substring(0, 20)}...` : "null");
       authLogger.info("localStorage keys:", Object.keys(localStorage).filter((k) => k.includes("token") || k.includes("auth")));
+      if (!isInIframe && isSessionDeadOnBootstrap(token, refreshToken2)) {
+        authLogger.warn("Bootstrap: dead session in storage (access + refresh both unusable) \u2014 clearing and showing login");
+        clearAuthState("initializeAuth:deadSession");
+        return;
+      }
       const hasTokens = hasValidTokens();
       authLogger.info("Has tokens:", hasTokens);
       if (userRef.current) {
@@ -4826,7 +4960,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
         });
         return {
           success: true,
-          message: result.message || `OTP code sent to your email address`
+          message: result.message || `OTP code sent to your email address`,
+          webmail: result.webmail ?? null
         };
       } catch (error) {
         authLogger.error("Request OTP error:", error);
@@ -4981,7 +5116,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
-      // Consider authenticated if we have valid tokens, even without user profile
+      // Consider authenticated if we have valid tokens, even without user profile.
+      // `authTick` (in deps) forces recompute after tokens are cleared/set, since
+      // token state lives in storage, not React state.
       isAuthenticated: CfgAccountsApi.isAuthenticated(),
       isAdminUser,
       loadCurrentProfile,
@@ -5007,6 +5144,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      authTick,
+      // recompute isAuthenticated when tokens are cleared/set
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,