@djangocfg/api 2.1.455 → 2.1.456

package/src/_api/generated/sdk.gen.ts

@@ -2,7 +2,7 @@
 
 import { type Client, type ClientMeta, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';
 import { client } from './client.gen';
-import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgCentrifugoAuthTokenRetrieveData, CfgCentrifugoAuthTokenRetrieveErrors, CfgCentrifugoAuthTokenRetrieveResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
+import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgCentrifugoAuthTokenRetrieveData, CfgCentrifugoAuthTokenRetrieveErrors, CfgCentrifugoAuthTokenRetrieveResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
 
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
     /**
@@ -124,7 +124,11 @@ export class CfgAccountsOauth {
      */
     public static cfgAccountsOauthConnectionsList<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthConnectionsListData, ThrowOnError>): RequestResult<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/oauth/connections/',
             ...options
         });
@@ -137,7 +141,11 @@ export class CfgAccountsOauth {
      */
     public static cfgAccountsOauthDisconnectCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthDisconnectCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/oauth/disconnect/',
             ...options,
             headers: {
@@ -195,7 +203,11 @@ export class CfgAccounts {
      */
     public static cfgAccountsOtpRequestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpRequestCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/otp/request/',
             ...options,
             headers: {
@@ -217,7 +229,11 @@ export class CfgAccounts {
      */
     public static cfgAccountsOtpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpVerifyCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/otp/verify/',
             ...options,
             headers: {
@@ -254,7 +270,11 @@ export class CfgAccountsProfile {
     public static cfgAccountsProfileAvatarCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileAvatarCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError> {
         return (options?.client ?? client).post<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError>({
             ...formDataBodySerializer,
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/accounts/profile/avatar/',
             ...options,
             headers: {
@@ -377,6 +397,24 @@ export class CfgAccountsProfile {
 }
 
 export class CfgAccountsAuth {
+    /**
+     * Revoke a refresh token (logout).
+     *
+     * Blacklists the posted refresh token so it can never mint another access
+     * token. Called best-effort by the client's logout — without it, "logout"
+     * is purely client-side and a stolen refresh token survives until expiry.
+     */
+    public static cfgAccountsTokenBlacklistCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenBlacklistCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError> {
+        return (options.client ?? client).post<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError>({
+            url: '/cfg/accounts/token/blacklist/',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+    
     /**
      * Refresh JWT token.
      *
@@ -406,7 +444,11 @@ export class CfgCentrifugo {
      */
     public static cfgCentrifugoAuthTokenRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgCentrifugoAuthTokenRetrieveData, ThrowOnError>): RequestResult<CfgCentrifugoAuthTokenRetrieveResponses, CfgCentrifugoAuthTokenRetrieveErrors, ThrowOnError> {
         return (options?.client ?? client).get<CfgCentrifugoAuthTokenRetrieveResponses, CfgCentrifugoAuthTokenRetrieveErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/centrifugo/auth/token/',
             ...options
         });
@@ -419,7 +461,11 @@ export class CfgTotpBackupCodes {
      */
     public static cfgTotpBackupCodesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpBackupCodesRetrieveData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/backup-codes/',
             ...options
         });
@@ -433,7 +479,11 @@ export class CfgTotpBackupCodes {
      */
     public static cfgTotpBackupCodesRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpBackupCodesRegenerateCreateData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/backup-codes/regenerate/',
             ...options,
             headers: {
@@ -450,7 +500,11 @@ export class CfgTotp {
      */
     public static cfgTotpDevicesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpDevicesRetrieveData, ThrowOnError>): RequestResult<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/devices/',
             ...options
         });
@@ -463,7 +517,11 @@ export class CfgTotp {
      */
     public static cfgTotpDevicesDestroy<ThrowOnError extends boolean = false>(options: Options<CfgTotpDevicesDestroyData, ThrowOnError>): RequestResult<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError> {
         return (options.client ?? client).delete<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/devices/{id}/',
             ...options
         });
@@ -476,7 +534,11 @@ export class CfgTotp {
      */
     public static cfgTotpDisableCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpDisableCreateData, ThrowOnError>): RequestResult<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/disable/',
             ...options,
             headers: {
@@ -495,7 +557,11 @@ export class CfgTotpSetup {
      */
     public static cfgTotpSetupCreate<ThrowOnError extends boolean = false>(options?: Options<CfgTotpSetupCreateData, ThrowOnError>): RequestResult<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError> {
         return (options?.client ?? client).post<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/setup/',
             ...options,
             headers: {
@@ -512,7 +578,11 @@ export class CfgTotpSetup {
      */
     public static cfgTotpSetupConfirmCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpSetupConfirmCreateData, ThrowOnError>): RequestResult<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/setup/confirm/',
             ...options,
             headers: {
@@ -531,7 +601,11 @@ export class CfgTotpVerify {
      */
     public static cfgTotpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/verify/',
             ...options,
             headers: {
@@ -548,7 +622,11 @@ export class CfgTotpVerify {
      */
     public static cfgTotpVerifyBackupCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyBackupCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError>({
-            security: [{ name: 'X-API-Key', type: 'apiKey' }, { scheme: 'bearer', type: 'http' }],
+            security: [
+                { name: 'X-API-Key', type: 'apiKey' },
+                { scheme: 'bearer', type: 'http' },
+                { name: 'Authorization', type: 'apiKey' }
+            ],
             url: '/cfg/totp/verify/backup/',
             ...options,
             headers: {

package/src/_api/generated/types.gen.ts

@@ -643,6 +643,10 @@ export type SetupResponse = {
     expires_in: number;
 };
 
+export type TokenBlacklistRequest = {
+    refresh: string;
+};
+
 export type TokenRefresh = {
     readonly access: string;
     refresh: string;
@@ -1404,6 +1408,20 @@ export type CfgAccountsProfileUpdateUpdateResponses = {
 
 export type CfgAccountsProfileUpdateUpdateResponse = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];
 
+export type CfgAccountsTokenBlacklistCreateData = {
+    body: TokenBlacklistRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/token/blacklist/';
+};
+
+export type CfgAccountsTokenBlacklistCreateResponses = {
+    /**
+     * No response body
+     */
+    200: unknown;
+};
+
 export type CfgAccountsTokenRefreshCreateData = {
     body: TokenRefreshRequest;
     path?: never;

package/src/auth/__tests__/guard.test.ts

@@ -15,7 +15,6 @@ import {
   resolveGuardIsLoading,
   resolveGuardIsAuthenticated,
   shouldRedirectToAuth,
-  nextAuthEvaluationDelay,
   type GuardInput,
 } from '../utils/guard';
 
@@ -112,33 +111,3 @@ describe('resolveGuardIsAuthenticated', () => {
   });
 });
 
-describe('nextAuthEvaluationDelay (time-driven re-check scheduling)', () => {
-  const NOW = 1_800_000_000_000;
-
-  it('schedules on the SOONEST future expiry + 1s cushion', () => {
-    const access = NOW + 5 * 60_000; // 5 min
-    const refresh = NOW + 60 * 60_000; // 60 min
-    expect(nextAuthEvaluationDelay(access, refresh, NOW)).toBe(5 * 60_000 + 1000);
-  });
-
-  it('uses refresh expiry when access is already past', () => {
-    const access = NOW - 1000; // already expired → ignored
-    const refresh = NOW + 10 * 60_000;
-    expect(nextAuthEvaluationDelay(access, refresh, NOW)).toBe(10 * 60_000 + 1000);
-  });
-
-  it('returns null when nothing live remains (no timer to arm)', () => {
-    expect(nextAuthEvaluationDelay(NOW - 1, NOW - 2, NOW)).toBeNull();
-    expect(nextAuthEvaluationDelay(null, null, NOW)).toBeNull();
-  });
-
-  it('handles a single live token (other absent)', () => {
-    expect(nextAuthEvaluationDelay(NOW + 30_000, null, NOW)).toBe(31_000);
-    expect(nextAuthEvaluationDelay(null, NOW + 30_000, NOW)).toBe(31_000);
-  });
-
-  it('never returns a negative delay', () => {
-    const d = nextAuthEvaluationDelay(NOW + 1, NOW + 1, NOW);
-    expect(d).toBeGreaterThan(0);
-  });
-});

package/src/auth/constants.ts

@@ -11,3 +11,9 @@ export const AUTH_CONSTANTS = {
   /** Backup code max length. */
   BACKUP_CODE_MAX_LENGTH: 12,
 } as const;
+
+/** Default route for the sign-in page. Override per app via AuthConfig.routes. */
+export const DEFAULT_AUTH_PATH = '/auth';
+
+/** Default post-login destination. Override per app via AuthConfig.routes. */
+export const DEFAULT_CALLBACK_PATH = '/dashboard';

package/src/auth/context/AccountsContext.tsx

@@ -17,15 +17,14 @@ import {
     createContext, memo, ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState
 } from 'react';
 
-import { CfgAccountsApi } from '../../';
-import { CfgAccountsProfile } from '../../_api/generated/_cfg_accounts/sdk.gen';
+import { auth } from '../../_api/generated/helpers/auth';
+import { CfgAccountsAuth, CfgAccountsProfile } from '../../_api/generated/_cfg_accounts/sdk.gen';
 import {
     useCfgAccountsOtpRequestCreate,
     useCfgAccountsOtpVerifyCreate,
     useCfgAccountsProfileAvatarCreate,
     useCfgAccountsProfilePartialUpdate,
     useCfgAccountsProfileUpdateUpdate,
-    useCfgAccountsTokenRefreshCreate,
 } from '../../_api/generated/_cfg_accounts/hooks';
 import { PatchedCfgUserUpdateRequestSchema } from '../../_api/generated/_cfg_accounts/schemas';
 import { clearProfileCache, getCachedProfile, setCachedProfile } from '../hooks/useProfileCache';
@@ -39,8 +38,6 @@ import type {
     OtpVerifyRequest,
     OtpRequestResponse,
     OtpVerifyResponse,
-    TokenRefresh,
-    TokenRefreshRequest,
 } from '../../_api/generated/_cfg_accounts/types.gen';
 
 export { PatchedCfgUserUpdateRequestSchema };
@@ -62,7 +59,6 @@ export interface AccountsContextValue {
 
   requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;
   verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;
-  refreshToken: (refresh: string) => Promise<TokenRefresh>;
   logout: () => void;
 }
 
@@ -96,7 +92,6 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
   const { trigger: triggerAvatar } = useCfgAccountsProfileAvatarCreate();
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
-  const { trigger: triggerTokenRefresh } = useCfgAccountsTokenRefreshCreate();
 
   const refreshProfile = useCallback(async (options?: { callerId?: string; force?: boolean }): Promise<User | undefined> => {
     const { callerId, force } = options || {};
@@ -159,8 +154,8 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
     }
 
     if (result.access && result.refresh) {
-      CfgAccountsApi.setToken(result.access);
-      CfgAccountsApi.setRefreshToken(result.refresh);
+      // The ONE write path — atomic pair, notifies every session subscriber.
+      auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: 'verifyOTP', force: true });
       } catch (profileError) {
@@ -171,20 +166,17 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
     return result;
   };
 
-  const refreshToken = async (refresh: string): Promise<TokenRefresh> => {
-    const body: TokenRefreshRequest = { refresh };
-    const result = (await triggerTokenRefresh({ body })) as TokenRefresh;
-
-    if (result.access) {
-      CfgAccountsApi.setToken(result.access);
-      CfgAccountsApi.setRefreshToken(refresh);
-    }
-
-    return result;
-  };
-
   const logout = useCallback(() => {
-    CfgAccountsApi.clearToken();
+    // Best-effort server-side revocation: without blacklisting, a stolen
+    // refresh token survives "logout" until it expires. Fire-and-forget —
+    // local logout must never block on the network.
+    const refresh = auth.getRefreshToken();
+    if (refresh) {
+      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
+        authLogger.warn('Refresh-token blacklist failed (logged out locally anyway)');
+      });
+    }
+    auth.clearSession();
     setProfile(undefined);
     setProfileError(null);
     clearProfileCache();
@@ -200,7 +192,6 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
     refreshProfile,
     requestOTP,
     verifyOTP,
-    refreshToken,
     logout,
   }), [
     profile,
@@ -212,7 +203,6 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
     refreshProfile,
     requestOTP,
     verifyOTP,
-    refreshToken,
     logout,
   ]);