@djangocfg/api 2.1.450 → 2.1.452

package/dist/auth.cjs

@@ -46,9 +46,18 @@ __export(auth_exports, {
   formatAuthError: () => formatAuthError,
   getCacheMetadata: () => getCacheMetadata,
   getCachedProfile: () => getCachedProfile,
+  getTokenExpiry: () => getTokenExpiry,
   hasValidCache: () => hasValidCache,
+  isAllowedAuthPath: () => isAllowedAuthPath,
+  isTokenExpired: () => isTokenExpired,
+  isTokenExpiringSoon: () => isTokenExpiringSoon,
   logger: () => logger,
+  nextAuthEvaluationDelay: () => nextAuthEvaluationDelay,
+  normalizePath: () => normalizePath,
+  resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
+  resolveGuardIsLoading: () => resolveGuardIsLoading,
   setCachedProfile: () => setCachedProfile,
+  shouldRedirectToAuth: () => shouldRedirectToAuth,
   useAccountsContext: () => useAccountsContext,
   useAuth: () => useAuth,
   useAuthForm: () => useAuthForm,
@@ -348,21 +357,28 @@ var authLogger = logger.withTag("auth");
 // src/auth/hooks/useAutoAuth.ts
 var import_navigation3 = require("next/navigation");
 var import_react5 = require("react");
+
+// src/auth/utils/path.ts
 var normalizePath = /* @__PURE__ */ __name((path) => {
   if (!path) return "";
   const withoutLocale = path.replace(/^\/[a-z]{2}(?=\/|$)/, "");
   const trimmed = withoutLocale.replace(/\/+$/, "");
   return trimmed || "/";
 }, "normalizePath");
+var isAllowedAuthPath = /* @__PURE__ */ __name((pathname, allowedPaths) => {
+  const normalized = normalizePath(pathname);
+  return allowedPaths.some(
+    (p) => normalized === p || normalized.startsWith(p + "/")
+  );
+}, "isAllowedAuthPath");
+
+// src/auth/hooks/useAutoAuth.ts
 var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
   const queryParams = useQueryParams();
   const pathname = (0, import_navigation3.usePathname)();
   const router = useCfgRouter();
-  const normalizedPath = normalizePath(pathname);
-  const isAllowedPath = allowedPaths.some(
-    (path) => normalizedPath === path || normalizedPath.startsWith(path + "/")
-  );
+  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);
   const queryOtp = queryParams.get("otp") || "";
   const queryEmail = queryParams.get("email") || void 0;
   const hasOTP = !!queryOtp;
@@ -4002,6 +4018,30 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
   };
 }, "useDeleteAccount");
 
+// src/auth/utils/guard.ts
+function resolveGuardIsLoading(s) {
+  if (!s.mounted) return true;
+  if (!s.requireAuth) return false;
+  return s.authLoading || s.isRedirecting || !s.isAuthenticated;
+}
+__name(resolveGuardIsLoading, "resolveGuardIsLoading");
+function shouldRedirectToAuth(s) {
+  return s.mounted && s.requireAuth && !s.authLoading && !s.isAuthenticated && !s.isRedirecting;
+}
+__name(shouldRedirectToAuth, "shouldRedirectToAuth");
+function resolveGuardIsAuthenticated(s) {
+  return !s.requireAuth || s.isAuthenticated;
+}
+__name(resolveGuardIsAuthenticated, "resolveGuardIsAuthenticated");
+function nextAuthEvaluationDelay(accessExp, refreshExp, now) {
+  const future = [accessExp, refreshExp].filter(
+    (d) => d !== null && d > now
+  );
+  if (future.length === 0) return null;
+  return Math.max(0, Math.min(...future) - now) + 1e3;
+}
+__name(nextAuthEvaluationDelay, "nextAuthEvaluationDelay");
+
 // src/auth/context/AccountsContext.tsx
 var import_react16 = require("react");
 
@@ -4764,6 +4804,14 @@ var isSessionDeadOnBootstrap = /* @__PURE__ */ __name((accessToken, refreshToken
   const refreshDead = isTokenExpired(refreshToken, 0, now);
   return refreshDead;
 }, "isSessionDeadOnBootstrap");
+var isSessionAlive = /* @__PURE__ */ __name((now = Date.now()) => {
+  if (typeof window === "undefined") return false;
+  return !isSessionDeadOnBootstrap(
+    CfgAccountsApi.getToken(),
+    CfgAccountsApi.getRefreshToken(),
+    now
+  );
+}, "isSessionAlive");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   ensureRefreshHandler();
@@ -4781,6 +4829,17 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const [initialized, setInitialized] = (0, import_react17.useState)(false);
   const [authTick, setAuthTick] = (0, import_react17.useState)(0);
   const bumpAuthTick = (0, import_react17.useCallback)(() => setAuthTick((t) => t + 1), []);
+  (0, import_react17.useEffect)(() => {
+    if (typeof window === "undefined") return;
+    const delay = nextAuthEvaluationDelay(
+      getTokenExpiry(CfgAccountsApi.getToken()),
+      getTokenExpiry(CfgAccountsApi.getRefreshToken()),
+      Date.now()
+    );
+    if (delay === null) return;
+    const timer = setTimeout(bumpAuthTick, Math.min(delay, 2e9));
+    return () => clearTimeout(timer);
+  }, [authTick, bumpAuthTick]);
   const onUnauthorizedRef = (0, import_react17.useRef)(false);
   const router = useCfgRouter();
   const pathname = (0, import_navigation4.usePathname)();
@@ -5170,10 +5229,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     () => ({
       user,
       isLoading,
-      // Consider authenticated if we have valid tokens, even without user profile.
-      // `authTick` (in deps) forces recompute after tokens are cleared/set, since
-      // token state lives in storage, not React state.
-      isAuthenticated: CfgAccountsApi.isAuthenticated(),
+      // Authenticated iff the session is locally alive (access valid OR a usable
+      // refresh token) — validated by `exp`, NOT by mere token presence. This is
+      // what makes the guard self-sufficient: an expired session reads as
+      // unauthenticated WITHOUT waiting for a server 401 (which CSP / a hung
+      // request / offline can swallow). `authTick` (in deps) forces recompute
+      // after tokens are cleared/set, since token state lives in storage.
+      isAuthenticated: isSessionAlive(),
       isAdminUser,
       loadCurrentProfile,
       checkAuthAndRedirect,