@djangocfg/api 2.1.455 → 2.1.456

package/src/auth/hooks/useTokenRefresh.ts

@@ -1,131 +0,0 @@
-'use client';
-
-/**
- * Token Refresh Hook (proactive trigger only)
- *
- * Refreshes the access token BEFORE it expires, and on window focus / network
- * reconnect. This hook deliberately owns NO refresh logic of its own — it only
- * decides WHEN to refresh and delegates HOW to the canonical path
- * (`triggerRefresh` → `api.refreshNow` → the store's single-flight
- * `tryRefresh`). That path handles token rotation, concurrent de-duplication,
- * and persisting the rotated refresh token.
- *
- * Historical note: this hook (and a now-removed fetch middleware) used to run
- * their own refresh calls and persisted the OLD refresh token instead of the
- * rotated one the server returned. With Django's default
- * ROTATE_REFRESH_TOKENS + BLACKLIST_AFTER_ROTATION that produced a
- * "Token is blacklisted" 401 on the following refresh and logged users out.
- * Funnelling every refresh through one implementation removes that whole class
- * of bug — see auth/refreshHandler.ts.
- */
-
-import { useCallback, useEffect } from 'react';
-
-import { api as apiAccounts } from '../../';
-import { triggerRefresh } from '../refreshHandler';
-import { authLogger } from '../utils/logger';
-import { isTokenExpiringSoon } from '../utils/jwt';
-
-// Configuration
-const TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1000; // 10 minutes before expiry
-const CHECK_INTERVAL_MS = 5 * 60 * 1000; // Check every 5 minutes
-
-interface UseTokenRefreshOptions {
-  /** Enable automatic token refresh (default: true) */
-  enabled?: boolean;
-  /** Callback when token is refreshed */
-  onRefresh?: (newToken: string) => void;
-  /** Callback when refresh fails */
-  onRefreshError?: (error: Error) => void;
-}
-
-/**
- * Hook for proactive automatic token refresh.
- * (JWT expiry helpers live in ../utils/jwt so they can be unit-tested and
- * reused by the auth-bootstrap validation path.)
- */
-export function useTokenRefresh(options: UseTokenRefreshOptions = {}) {
-  const { enabled = true, onRefresh, onRefreshError } = options;
-
-  /**
-   * Refresh the token via the canonical single-flight path. Returns true on
-   * success. No local in-flight guard needed — `triggerRefresh` shares the
-   * store's single-flight promise, so overlapping calls coalesce.
-   */
-  const refreshToken = useCallback(async (): Promise<boolean> => {
-    if (!apiAccounts.getRefreshToken()) {
-      authLogger.warn('No refresh token available');
-      return false;
-    }
-
-    authLogger.info('Refreshing token...');
-    try {
-      const newAccessToken = await triggerRefresh();
-      if (!newAccessToken) {
-        throw new Error('Token refresh failed');
-      }
-      authLogger.info('Token refreshed successfully');
-      onRefresh?.(newAccessToken);
-      return true;
-    } catch (error) {
-      authLogger.error('Token refresh error:', error);
-      onRefreshError?.(error instanceof Error ? error : new Error(String(error)));
-      return false;
-    }
-  }, [onRefresh, onRefreshError]);
-
-  /**
-   * Check and refresh if the current token is expiring soon.
-   */
-  const checkAndRefresh = useCallback(async () => {
-    const token = apiAccounts.getToken();
-    if (!token) return;
-
-    if (isTokenExpiringSoon(token, TOKEN_REFRESH_THRESHOLD_MS)) {
-      authLogger.info('Token expiring soon, refreshing proactively');
-      await refreshToken();
-    }
-  }, [refreshToken]);
-
-  // Periodic check
-  useEffect(() => {
-    if (!enabled) return;
-
-    checkAndRefresh();
-    const intervalId = setInterval(checkAndRefresh, CHECK_INTERVAL_MS);
-    return () => clearInterval(intervalId);
-  }, [enabled, checkAndRefresh]);
-
-  // Refresh on window focus
-  useEffect(() => {
-    if (!enabled) return;
-
-    const handleFocus = () => {
-      authLogger.debug('Window focused, checking token...');
-      checkAndRefresh();
-    };
-
-    window.addEventListener('focus', handleFocus);
-    return () => window.removeEventListener('focus', handleFocus);
-  }, [enabled, checkAndRefresh]);
-
-  // Refresh on network reconnect
-  useEffect(() => {
-    if (!enabled) return;
-
-    const handleOnline = () => {
-      authLogger.info('Network reconnected, checking token...');
-      checkAndRefresh();
-    };
-
-    window.addEventListener('online', handleOnline);
-    return () => window.removeEventListener('online', handleOnline);
-  }, [enabled, checkAndRefresh]);
-
-  return {
-    refreshToken,
-    checkAndRefresh,
-  };
-}
-
-export default useTokenRefresh;

package/src/auth/refreshHandler.ts

@@ -1,79 +0,0 @@
-'use client';
-
-/**
- * Canonical refresh strategy — registered ONCE, used by every refresh path.
- *
- * The generated client (`installAuthOnClient` in helpers/auth.ts) already owns
- * the hard parts of token refresh: single-flight de-duplication of concurrent
- * 401s, one automatic retry of the failed request, and — crucially —
- * persisting the ROTATED refresh token the server returns. It only needs a
- * strategy telling it HOW to call the refresh endpoint. That strategy is here.
- *
- * Why this matters: Django (SimpleJWT via django-cfg) ships with
- * `ROTATE_REFRESH_TOKENS=True` + `BLACKLIST_AFTER_ROTATION=True` by default.
- * Every successful refresh returns a NEW refresh token and blacklists the old
- * one. The handler MUST return `{ access, refresh }` so the store persists the
- * rotated token; reusing the old one yields a "Token is blacklisted" 401 on the
- * next refresh. The canonical store (auth.tryRefresh) does the persistence — we
- * only surface the rotated token to it.
- *
- * This is the single source of truth. Proactive refresh (useTokenRefresh) and
- * reactive 401 recovery (the response interceptor) both funnel through it via
- * `api.refreshNow()` / `tryRefresh()`. Do NOT re-implement refresh anywhere
- * else.
- */
-
-import { api as apiAccounts } from '../';
-import { CfgAccountsAuth } from '../_api/generated/sdk.gen';
-import { authLogger } from './utils/logger';
-
-let _registered = false;
-
-/**
- * Register the canonical refresh handler on the shared auth store. Idempotent:
- * safe to call from every AuthProvider mount; only the first call wires it.
- */
-export function ensureRefreshHandler(): void {
-  if (_registered) return;
-  _registered = true;
-
-  apiAccounts.setRefreshHandler(async (refresh: string) => {
-    const result = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
-      body: { refresh },
-      throwOnError: true,
-    });
-
-    const access = result.data?.access;
-    if (!access) {
-      authLogger.error('Refresh response missing access token');
-      return null;
-    }
-
-    // Return the ROTATED refresh token so the store persists it. Fall back to
-    // the current one only if the server omits it (rotation disabled).
-    return { access, refresh: result.data?.refresh ?? refresh };
-  });
-
-  authLogger.debug('Canonical refresh handler registered');
-}
-
-/**
- * Proactively run the canonical refresh now, sharing the SAME single-flight as
- * 401 recovery (rotation + dedup + rotated-token persistence handled by the
- * store). Ensures the handler is registered first. Returns the fresh access
- * token, or null if refresh failed / no refresh token / no handler.
- *
- * Use this for expiry-timer / focus / reconnect triggers — never re-implement
- * the refresh call itself.
- */
-export function triggerRefresh(): Promise<string | null> {
-  ensureRefreshHandler();
-  // `refreshNow` is provided by the generated auth facade (helpers/auth.ts +
-  // per-group api.ts). Guarded so this compiles even before regeneration.
-  const maybe = apiAccounts as unknown as { refreshNow?: () => Promise<string | null> };
-  if (typeof maybe.refreshNow === 'function') {
-    return maybe.refreshNow();
-  }
-  authLogger.warn('api.refreshNow() unavailable — run `make generate` to regenerate the client');
-  return Promise.resolve(null);
-}

package/src/auth/utils/jwt.ts

@@ -1,66 +0,0 @@
-/**
- * JWT inspection helpers (browser-safe, dependency-free).
- *
- * These decode ONLY the `exp` claim to reason about token freshness on the
- * client. They do NOT verify the signature — that is the server's job. The
- * point is purely to avoid firing doomed requests with a token we can already
- * see is malformed or expired, and to let auth bootstrap collapse a dead
- * session to the login form instead of hanging on a preloader.
- *
- * A JWT that cannot be decoded is treated as EXPIRED/invalid (fail-closed):
- * better to re-authenticate than to loop on 401s with garbage in storage.
- */
-
-/** Base64url-decode a JWT segment. Returns null on any malformation. */
-function decodeSegment(segment: string): unknown {
-  try {
-    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
-    // atob is defined in browsers and modern Node (global). Guard anyway.
-    if (typeof atob !== 'function') return null;
-    const json = atob(base64);
-    return JSON.parse(json);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Extract the `exp` claim (epoch ms), or null if the token is undecodable or
- * has no numeric `exp`.
- */
-export function getTokenExpiry(token: string | null | undefined): number | null {
-  if (!token || typeof token !== 'string') return null;
-  const parts = token.split('.');
-  if (parts.length !== 3) return null; // not a well-formed JWT
-  const payload = decodeSegment(parts[1]);
-  if (!payload || typeof payload !== 'object') return null;
-  const exp = (payload as { exp?: unknown }).exp;
-  if (typeof exp !== 'number' || !Number.isFinite(exp)) return null;
-  return exp * 1000;
-}
-
-/**
- * True when the token is missing, malformed, or already past its `exp`.
- * `skewMs` treats a token expiring within the skew window as already expired
- * (default 0). Fail-closed: an undecodable token is considered expired.
- */
-export function isTokenExpired(token: string | null | undefined, skewMs = 0, now = Date.now()): boolean {
-  const expiry = getTokenExpiry(token);
-  if (expiry === null) return true; // undecodable / no exp → treat as dead
-  return expiry - skewMs <= now;
-}
-
-/**
- * True when a valid token exists but expires within `thresholdMs` (used by the
- * proactive refresher). A missing/undecodable token returns false here — that
- * case is handled by the "expired" path, not the "expiring soon" path.
- */
-export function isTokenExpiringSoon(
-  token: string | null | undefined,
-  thresholdMs: number,
-  now = Date.now(),
-): boolean {
-  const expiry = getTokenExpiry(token);
-  if (expiry === null) return false;
-  return expiry - now < thresholdMs;
-}