@djangocfg/api 2.1.449 → 2.1.450

package/dist/auth.d.cts

@@ -951,6 +951,8 @@ interface UseTokenRefreshOptions {
 }
 /**
  * Hook for proactive automatic token refresh.
+ * (JWT expiry helpers live in ../utils/jwt so they can be unit-tested and
+ * reused by the auth-bootstrap validation path.)
  */
 declare function useTokenRefresh(options?: UseTokenRefreshOptions): {
     refreshToken: () => Promise<boolean>;

package/dist/auth.d.ts

@@ -951,6 +951,8 @@ interface UseTokenRefreshOptions {
 }
 /**
  * Hook for proactive automatic token refresh.
+ * (JWT expiry helpers live in ../utils/jwt so they can be unit-tested and
+ * reused by the auth-bootstrap validation path.)
  */
 declare function useTokenRefresh(options?: UseTokenRefreshOptions): {
     refreshToken: () => Promise<boolean>;

package/dist/auth.mjs

@@ -3802,24 +3802,45 @@ function triggerRefresh() {
 }
 __name(triggerRefresh, "triggerRefresh");
 
-// src/auth/hooks/useTokenRefresh.ts
-var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
-var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-function getTokenExpiry(token) {
+// src/auth/utils/jwt.ts
+function decodeSegment(segment) {
   try {
-    const payload = JSON.parse(atob(token.split(".")[1]));
-    return payload.exp * 1e3;
+    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    if (typeof atob !== "function") return null;
+    const json = atob(base64);
+    return JSON.parse(json);
   } catch {
     return null;
   }
 }
+__name(decodeSegment, "decodeSegment");
+function getTokenExpiry(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const payload = decodeSegment(parts[1]);
+  if (!payload || typeof payload !== "object") return null;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+  return exp * 1e3;
+}
 __name(getTokenExpiry, "getTokenExpiry");
-function isTokenExpiringSoon(token, thresholdMs) {
+function isTokenExpired(token, skewMs = 0, now = Date.now()) {
+  const expiry = getTokenExpiry(token);
+  if (expiry === null) return true;
+  return expiry - skewMs <= now;
+}
+__name(isTokenExpired, "isTokenExpired");
+function isTokenExpiringSoon(token, thresholdMs, now = Date.now()) {
   const expiry = getTokenExpiry(token);
-  if (!expiry) return false;
-  return expiry - Date.now() < thresholdMs;
+  if (expiry === null) return false;
+  return expiry - now < thresholdMs;
 }
 __name(isTokenExpiringSoon, "isTokenExpiringSoon");
+
+// src/auth/hooks/useTokenRefresh.ts
+var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function useTokenRefresh(options = {}) {
   const { enabled = true, onRefresh, onRefreshError } = options;
   const refreshToken = useCallback9(async () => {
@@ -4683,6 +4704,12 @@ var hasValidTokens = /* @__PURE__ */ __name(() => {
   if (typeof window === "undefined") return false;
   return CfgAccountsApi.isAuthenticated();
 }, "hasValidTokens");
+var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken, now = Date.now()) => {
+  const accessDead = isTokenExpired(accessToken, 0, now);
+  if (!accessDead) return false;
+  const refreshDead = isTokenExpired(refreshToken, 0, now);
+  return refreshDead;
+}, "isSessionDeadOnBootstrap");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   ensureRefreshHandler();
@@ -4698,19 +4725,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     return true;
   });
   const [initialized, setInitialized] = useState12(false);
+  const [authTick, setAuthTick] = useState12(0);
+  const bumpAuthTick = useCallback12(() => setAuthTick((t) => t + 1), []);
+  const onUnauthorizedRef = useRef6(false);
   const router = useCfgRouter();
   const pathname = usePathname3();
   const queryParams = useQueryParams();
   const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
-  useTokenRefresh({
-    enabled: true,
-    onRefresh: /* @__PURE__ */ __name((newToken) => {
-      authLogger.info("Token auto-refreshed successfully");
-    }, "onRefresh"),
-    onRefreshError: /* @__PURE__ */ __name((error) => {
-      authLogger.warn("Token auto-refresh failed:", error.message);
-    }, "onRefreshError")
-  });
   const user = accounts.profile;
   const userRef = useRef6(user);
   const configRef = useRef6(config);
@@ -4727,7 +4748,23 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     clearProfileCache();
     setInitialized(true);
     setIsLoading(false);
-  }, []);
+    bumpAuthTick();
+  }, [bumpAuthTick]);
+  const handleProactiveRefreshError = useCallback12((error) => {
+    authLogger.warn("Proactive token refresh failed \u2014 session is dead, redirecting to login:", error.message);
+    if (onUnauthorizedRef.current) return;
+    onUnauthorizedRef.current = true;
+    clearAuthState("proactiveRefresh:failed");
+    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+    router.hardReplace(authCallbackUrl);
+  }, [clearAuthState, router]);
+  useTokenRefresh({
+    enabled: true,
+    onRefresh: /* @__PURE__ */ __name(() => {
+      authLogger.info("Token auto-refreshed successfully");
+    }, "onRefresh"),
+    onRefreshError: handleProactiveRefreshError
+  });
   const handleGlobalAuthError = useCallback12((error, context = "API Request") => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
     if (isAuthError) {
@@ -4740,6 +4777,20 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     }
     return false;
   }, [clearAuthState]);
+  useEffect9(() => {
+    const handler = /* @__PURE__ */ __name(() => {
+      if (onUnauthorizedRef.current) return;
+      onUnauthorizedRef.current = true;
+      authLogger.warn("Unrecoverable 401 (refresh failed) \u2014 clearing session and redirecting to login");
+      clearAuthState("onUnauthorized:401");
+      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+      router.hardReplace(authCallbackUrl);
+    }, "handler");
+    CfgAccountsApi.onUnauthorized(handler);
+    return () => {
+      CfgAccountsApi.onUnauthorized(null);
+    };
+  }, [clearAuthState, router]);
   const isAutoLoggingOutRef = useRef6(false);
   const swrOnError = useCallback12((error) => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
@@ -4804,6 +4855,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       authLogger.info("Token from API:", token ? `${token.substring(0, 20)}...` : "null");
       authLogger.info("Refresh token from API:", refreshToken2 ? `${refreshToken2.substring(0, 20)}...` : "null");
       authLogger.info("localStorage keys:", Object.keys(localStorage).filter((k) => k.includes("token") || k.includes("auth")));
+      if (!isInIframe && isSessionDeadOnBootstrap(token, refreshToken2)) {
+        authLogger.warn("Bootstrap: dead session in storage (access + refresh both unusable) \u2014 clearing and showing login");
+        clearAuthState("initializeAuth:deadSession");
+        return;
+      }
       const hasTokens = hasValidTokens();
       authLogger.info("Has tokens:", hasTokens);
       if (userRef.current) {
@@ -5060,7 +5116,9 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
-      // Consider authenticated if we have valid tokens, even without user profile
+      // Consider authenticated if we have valid tokens, even without user profile.
+      // `authTick` (in deps) forces recompute after tokens are cleared/set, since
+      // token state lives in storage, not React state.
       isAuthenticated: CfgAccountsApi.isAuthenticated(),
       isAdminUser,
       loadCurrentProfile,
@@ -5086,6 +5144,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      authTick,
+      // recompute isAuthenticated when tokens are cleared/set
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,