@djangocfg/api 2.1.449 → 2.1.452

package/dist/auth.cjs

@@ -46,9 +46,18 @@ __export(auth_exports, {
   formatAuthError: () => formatAuthError,
   getCacheMetadata: () => getCacheMetadata,
   getCachedProfile: () => getCachedProfile,
+  getTokenExpiry: () => getTokenExpiry,
   hasValidCache: () => hasValidCache,
+  isAllowedAuthPath: () => isAllowedAuthPath,
+  isTokenExpired: () => isTokenExpired,
+  isTokenExpiringSoon: () => isTokenExpiringSoon,
   logger: () => logger,
+  nextAuthEvaluationDelay: () => nextAuthEvaluationDelay,
+  normalizePath: () => normalizePath,
+  resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
+  resolveGuardIsLoading: () => resolveGuardIsLoading,
   setCachedProfile: () => setCachedProfile,
+  shouldRedirectToAuth: () => shouldRedirectToAuth,
   useAccountsContext: () => useAccountsContext,
   useAuth: () => useAuth,
   useAuthForm: () => useAuthForm,
@@ -348,21 +357,28 @@ var authLogger = logger.withTag("auth");
 // src/auth/hooks/useAutoAuth.ts
 var import_navigation3 = require("next/navigation");
 var import_react5 = require("react");
+
+// src/auth/utils/path.ts
 var normalizePath = /* @__PURE__ */ __name((path) => {
   if (!path) return "";
   const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, "");
   const trimmed = withoutLocale.replace(/\/+$/, "");
   return trimmed || "/";
 }, "normalizePath");
+var isAllowedAuthPath = /* @__PURE__ */ __name((pathname, allowedPaths) => {
+  const normalized = normalizePath(pathname);
+  return allowedPaths.some(
+    (p) => normalized === p || normalized.startsWith(p + "/")
+  );
+}, "isAllowedAuthPath");
+
+// src/auth/hooks/useAutoAuth.ts
 var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
   const queryParams = useQueryParams();
   const pathname = (0, import_navigation3.usePathname)();
   const router = useCfgRouter();
-  const normalizedPath = normalizePath(pathname);
-  const isAllowedPath = allowedPaths.some(
-    (path) => normalizedPath === path || normalizedPath.startsWith(path + "/")
-  );
+  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);
   const queryOtp = queryParams.get("otp") || "";
   const queryEmail = queryParams.get("email") || void 0;
   const hasOTP = !!queryOtp;
@@ -3864,24 +3880,45 @@ function triggerRefresh() {
 }
 __name(triggerRefresh, "triggerRefresh");
 
-// src/auth/hooks/useTokenRefresh.ts
-var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
-var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
-function getTokenExpiry(token) {
+// src/auth/utils/jwt.ts
+function decodeSegment(segment) {
   try {
-    const payload = JSON.parse(atob(token.split(".")[1]));
-    return payload.exp * 1e3;
+    const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+    if (typeof atob !== "function") return null;
+    const json = atob(base64);
+    return JSON.parse(json);
   } catch {
     return null;
   }
 }
+__name(decodeSegment, "decodeSegment");
+function getTokenExpiry(token) {
+  if (!token || typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const payload = decodeSegment(parts[1]);
+  if (!payload || typeof payload !== "object") return null;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return null;
+  return exp * 1e3;
+}
 __name(getTokenExpiry, "getTokenExpiry");
-function isTokenExpiringSoon(token, thresholdMs) {
+function isTokenExpired(token, skewMs = 0, now = Date.now()) {
+  const expiry = getTokenExpiry(token);
+  if (expiry === null) return true;
+  return expiry - skewMs <= now;
+}
+__name(isTokenExpired, "isTokenExpired");
+function isTokenExpiringSoon(token, thresholdMs, now = Date.now()) {
   const expiry = getTokenExpiry(token);
-  if (!expiry) return false;
-  return expiry - Date.now() < thresholdMs;
+  if (expiry === null) return false;
+  return expiry - now < thresholdMs;
 }
 __name(isTokenExpiringSoon, "isTokenExpiringSoon");
+
+// src/auth/hooks/useTokenRefresh.ts
+var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 function useTokenRefresh(options = {}) {
   const { enabled = true, onRefresh, onRefreshError } = options;
   const refreshToken = (0, import_react14.useCallback)(async () => {
@@ -3981,6 +4018,30 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
   };
 }, "useDeleteAccount");
 
+// src/auth/utils/guard.ts
+function resolveGuardIsLoading(s) {
+  if (!s.mounted) return true;
+  if (!s.requireAuth) return false;
+  return s.authLoading || s.isRedirecting || !s.isAuthenticated;
+}
+__name(resolveGuardIsLoading, "resolveGuardIsLoading");
+function shouldRedirectToAuth(s) {
+  return s.mounted && s.requireAuth && !s.authLoading && !s.isAuthenticated && !s.isRedirecting;
+}
+__name(shouldRedirectToAuth, "shouldRedirectToAuth");
+function resolveGuardIsAuthenticated(s) {
+  return !s.requireAuth || s.isAuthenticated;
+}
+__name(resolveGuardIsAuthenticated, "resolveGuardIsAuthenticated");
+function nextAuthEvaluationDelay(accessExp, refreshExp, now) {
+  const future = [accessExp, refreshExp].filter(
+    (d) => d !== null && d > now
+  );
+  if (future.length === 0) return null;
+  return Math.max(0, Math.min(...future) - now) + 1e3;
+}
+__name(nextAuthEvaluationDelay, "nextAuthEvaluationDelay");
+
 // src/auth/context/AccountsContext.tsx
 var import_react16 = require("react");
 
@@ -4737,6 +4798,20 @@ var hasValidTokens = /* @__PURE__ */ __name(() => {
   if (typeof window === "undefined") return false;
   return CfgAccountsApi.isAuthenticated();
 }, "hasValidTokens");
+var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken, now = Date.now()) => {
+  const accessDead = isTokenExpired(accessToken, 0, now);
+  if (!accessDead) return false;
+  const refreshDead = isTokenExpired(refreshToken, 0, now);
+  return refreshDead;
+}, "isSessionDeadOnBootstrap");
+var isSessionAlive = /* @__PURE__ */ __name((now = Date.now()) => {
+  if (typeof window === "undefined") return false;
+  return !isSessionDeadOnBootstrap(
+    CfgAccountsApi.getToken(),
+    CfgAccountsApi.getRefreshToken(),
+    now
+  );
+}, "isSessionAlive");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   ensureRefreshHandler();
@@ -4752,19 +4827,24 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     return true;
   });
   const [initialized, setInitialized] = (0, import_react17.useState)(false);
+  const [authTick, setAuthTick] = (0, import_react17.useState)(0);
+  const bumpAuthTick = (0, import_react17.useCallback)(() => setAuthTick((t) => t + 1), []);
+  (0, import_react17.useEffect)(() => {
+    if (typeof window === "undefined") return;
+    const delay = nextAuthEvaluationDelay(
+      getTokenExpiry(CfgAccountsApi.getToken()),
+      getTokenExpiry(CfgAccountsApi.getRefreshToken()),
+      Date.now()
+    );
+    if (delay === null) return;
+    const timer = setTimeout(bumpAuthTick, Math.min(delay, 2e9));
+    return () => clearTimeout(timer);
+  }, [authTick, bumpAuthTick]);
+  const onUnauthorizedRef = (0, import_react17.useRef)(false);
   const router = useCfgRouter();
   const pathname = (0, import_navigation4.usePathname)();
   const queryParams = useQueryParams();
   const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
-  useTokenRefresh({
-    enabled: true,
-    onRefresh: /* @__PURE__ */ __name((newToken) => {
-      authLogger.info("Token auto-refreshed successfully");
-    }, "onRefresh"),
-    onRefreshError: /* @__PURE__ */ __name((error) => {
-      authLogger.warn("Token auto-refresh failed:", error.message);
-    }, "onRefreshError")
-  });
   const user = accounts.profile;
   const userRef = (0, import_react17.useRef)(user);
   const configRef = (0, import_react17.useRef)(config);
@@ -4781,7 +4861,23 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     clearProfileCache();
     setInitialized(true);
     setIsLoading(false);
-  }, []);
+    bumpAuthTick();
+  }, [bumpAuthTick]);
+  const handleProactiveRefreshError = (0, import_react17.useCallback)((error) => {
+    authLogger.warn("Proactive token refresh failed \u2014 session is dead, redirecting to login:", error.message);
+    if (onUnauthorizedRef.current) return;
+    onUnauthorizedRef.current = true;
+    clearAuthState("proactiveRefresh:failed");
+    const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+    router.hardReplace(authCallbackUrl);
+  }, [clearAuthState, router]);
+  useTokenRefresh({
+    enabled: true,
+    onRefresh: /* @__PURE__ */ __name(() => {
+      authLogger.info("Token auto-refreshed successfully");
+    }, "onRefresh"),
+    onRefreshError: handleProactiveRefreshError
+  });
   const handleGlobalAuthError = (0, import_react17.useCallback)((error, context = "API Request") => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
     if (isAuthError) {
@@ -4794,6 +4890,20 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     }
     return false;
   }, [clearAuthState]);
+  (0, import_react17.useEffect)(() => {
+    const handler = /* @__PURE__ */ __name(() => {
+      if (onUnauthorizedRef.current) return;
+      onUnauthorizedRef.current = true;
+      authLogger.warn("Unrecoverable 401 (refresh failed) \u2014 clearing session and redirecting to login");
+      clearAuthState("onUnauthorized:401");
+      const authCallbackUrl = configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
+      router.hardReplace(authCallbackUrl);
+    }, "handler");
+    CfgAccountsApi.onUnauthorized(handler);
+    return () => {
+      CfgAccountsApi.onUnauthorized(null);
+    };
+  }, [clearAuthState, router]);
   const isAutoLoggingOutRef = (0, import_react17.useRef)(false);
   const swrOnError = (0, import_react17.useCallback)((error) => {
     const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
@@ -4858,6 +4968,11 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       authLogger.info("Token from API:", token ? `${token.substring(0, 20)}...` : "null");
       authLogger.info("Refresh token from API:", refreshToken2 ? `${refreshToken2.substring(0, 20)}...` : "null");
       authLogger.info("localStorage keys:", Object.keys(localStorage).filter((k) => k.includes("token") || k.includes("auth")));
+      if (!isInIframe && isSessionDeadOnBootstrap(token, refreshToken2)) {
+        authLogger.warn("Bootstrap: dead session in storage (access + refresh both unusable) \u2014 clearing and showing login");
+        clearAuthState("initializeAuth:deadSession");
+        return;
+      }
       const hasTokens = hasValidTokens();
       authLogger.info("Has tokens:", hasTokens);
       if (userRef.current) {
@@ -5114,8 +5229,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
-      // Consider authenticated if we have valid tokens, even without user profile
-      isAuthenticated: CfgAccountsApi.isAuthenticated(),
+      // Authenticated iff the session is locally alive (access valid OR a usable
+      // refresh token) — validated by `exp`, NOT by mere token presence. This is
+      // what makes the guard self-sufficient: an expired session reads as
+      // unauthenticated WITHOUT waiting for a server 401 (which CSP / a hung
+      // request / offline can swallow). `authTick` (in deps) forces recompute
+      // after tokens are cleared/set, since token state lives in storage.
+      isAuthenticated: isSessionAlive(),
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,
@@ -5140,6 +5260,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     [
       user,
       isLoading,
+      authTick,
+      // recompute isAuthenticated when tokens are cleared/set
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,