@djangocfg/api 2.1.455 → 2.1.457

package/dist/clients.d.cts

@@ -978,6 +978,9 @@ type SetupResponse = {
      */
     expires_in: number;
 };
+type TokenBlacklistRequest = {
+    refresh: string;
+};
 type TokenRefresh = {
     readonly access: string;
     refresh: string;
@@ -1525,6 +1528,18 @@ type CfgAccountsProfileUpdateUpdateErrors = {
 type CfgAccountsProfileUpdateUpdateResponses = {
     200: User;
 };
+type CfgAccountsTokenBlacklistCreateData = {
+    body: TokenBlacklistRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/token/blacklist/';
+};
+type CfgAccountsTokenBlacklistCreateResponses = {
+    /**
+     * No response body
+     */
+    200: unknown;
+};
 type CfgAccountsTokenRefreshCreateData = {
     body: TokenRefreshRequest;
     path?: never;
@@ -1823,6 +1838,14 @@ declare class CfgAccountsProfile {
     static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>;
 }
 declare class CfgAccountsAuth {
+    /**
+     * Revoke a refresh token (logout).
+     *
+     * Blacklists the posted refresh token so it can never mint another access
+     * token. Called best-effort by the client's logout — without it, "logout"
+     * is purely client-side and a stolen refresh token survives until expiry.
+     */
+    static cfgAccountsTokenBlacklistCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenBlacklistCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError>;
     /**
      * Refresh JWT token.
      *

package/dist/clients.d.ts

@@ -978,6 +978,9 @@ type SetupResponse = {
      */
     expires_in: number;
 };
+type TokenBlacklistRequest = {
+    refresh: string;
+};
 type TokenRefresh = {
     readonly access: string;
     refresh: string;
@@ -1525,6 +1528,18 @@ type CfgAccountsProfileUpdateUpdateErrors = {
 type CfgAccountsProfileUpdateUpdateResponses = {
     200: User;
 };
+type CfgAccountsTokenBlacklistCreateData = {
+    body: TokenBlacklistRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/token/blacklist/';
+};
+type CfgAccountsTokenBlacklistCreateResponses = {
+    /**
+     * No response body
+     */
+    200: unknown;
+};
 type CfgAccountsTokenRefreshCreateData = {
     body: TokenRefreshRequest;
     path?: never;
@@ -1823,6 +1838,14 @@ declare class CfgAccountsProfile {
     static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>;
 }
 declare class CfgAccountsAuth {
+    /**
+     * Revoke a refresh token (logout).
+     *
+     * Blacklists the posted refresh token so it can never mint another access
+     * token. Called best-effort by the client's logout — without it, "logout"
+     * is purely client-side and a stolen refresh token survives until expiry.
+     */
+    static cfgAccountsTokenBlacklistCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenBlacklistCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError>;
     /**
      * Refresh JWT token.
      *

package/dist/clients.mjs

@@ -169,6 +169,89 @@ var _onUnauthorized = null;
 var _refreshHandler = null;
 var _refreshInflight = null;
 var RETRY_MARKER = "X-Auth-Retry";
+function jwtExpMs(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    const json = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+    return typeof json.exp === "number" ? json.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+__name(jwtExpMs, "jwtExpMs");
+function computeSnapshot() {
+  const access = _storage.get(ACCESS_KEY);
+  const refresh = _storage.get(REFRESH_KEY);
+  const now = Date.now();
+  const accessExp = access ? jwtExpMs(access) : null;
+  const accessAlive = access !== null && (accessExp === null || accessExp > now);
+  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
+  return {
+    status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
+    accessExpiresAt: accessExp
+  };
+}
+__name(computeSnapshot, "computeSnapshot");
+var SERVER_SNAPSHOT = { status: "anonymous", accessExpiresAt: null };
+var SESSION_SYNC_EVENT = `cfg-auth:changed:${ACCESS_KEY}`;
+var _snapshot = computeSnapshot();
+var _sessionListeners = /* @__PURE__ */ new Set();
+var _expiryTimer = null;
+var _storageListenerInstalled = false;
+function scheduleExpiryFlip() {
+  if (!isBrowser) return;
+  if (_expiryTimer !== null) {
+    clearTimeout(_expiryTimer);
+    _expiryTimer = null;
+  }
+  if (_sessionListeners.size === 0) return;
+  const now = Date.now();
+  const exps = [];
+  const access = _storage.get(ACCESS_KEY);
+  const refresh = _storage.get(REFRESH_KEY);
+  const accessExp = access ? jwtExpMs(access) : null;
+  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  if (accessExp !== null && accessExp > now) exps.push(accessExp);
+  if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
+  if (!exps.length) return;
+  const delay = Math.min(Math.min(...exps) - now + 250, 2147483647);
+  _expiryTimer = setTimeout(notifySessionChanged, delay);
+}
+__name(scheduleExpiryFlip, "scheduleExpiryFlip");
+function notifySessionChanged() {
+  const next = computeSnapshot();
+  const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
+  if (changed) _snapshot = next;
+  scheduleExpiryFlip();
+  if (!changed) return;
+  for (const listener of Array.from(_sessionListeners)) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+  if (isBrowser) {
+    try {
+      window.dispatchEvent(new Event(SESSION_SYNC_EVENT));
+    } catch {
+    }
+  }
+}
+__name(notifySessionChanged, "notifySessionChanged");
+function ensureStorageSync() {
+  if (!isBrowser || _storageListenerInstalled) return;
+  _storageListenerInstalled = true;
+  window.addEventListener("storage", (e) => {
+    if (e.key === null || e.key === ACCESS_KEY || e.key === REFRESH_KEY) {
+      notifySessionChanged();
+    }
+  });
+  window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());
+}
+__name(ensureStorageSync, "ensureStorageSync");
+var _sessionExpiredHandlers = /* @__PURE__ */ new Set();
 var _client = null;
 function pushClientConfig() {
   if (!_client) return;
@@ -186,6 +269,7 @@ var auth = {
   setStorageMode(mode) {
     _storageMode = mode;
     _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
+    notifySessionChanged();
   },
   // ── Bearer token ──────────────────────────────────────────────────
   getToken() {
@@ -193,19 +277,79 @@ var auth = {
   },
   setToken(token) {
     _storage.set(ACCESS_KEY, token);
+    notifySessionChanged();
   },
   getRefreshToken() {
     return _storage.get(REFRESH_KEY);
   },
   setRefreshToken(token) {
     _storage.set(REFRESH_KEY, token);
+    notifySessionChanged();
   },
   clearTokens() {
     _storage.set(ACCESS_KEY, null);
     _storage.set(REFRESH_KEY, null);
+    notifySessionChanged();
   },
+  /** Session-aware: token PRESENT and not past its `exp` (or a live refresh
+   * token exists that can mint one). Prefer `getSnapshot().status` in React. */
   isAuthenticated() {
-    return _storage.get(ACCESS_KEY) !== null;
+    return computeSnapshot().status === "authenticated";
+  },
+  // ── Session (the ONE write path for login/logout flows) ──────────
+  /**
+   * Persist a token pair atomically. Every login flow (OTP verify, 2FA,
+   * OAuth callback) and the refresh handler should end here — do NOT
+   * scatter `setToken`/`setRefreshToken` pairs through app code.
+   * `refresh: undefined` keeps the current refresh token (access-only
+   * rotation); `refresh: null` explicitly drops it.
+   */
+  setSession(tokens) {
+    _storage.set(ACCESS_KEY, tokens.access);
+    if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
+    notifySessionChanged();
+  },
+  clearSession() {
+    auth.clearTokens();
+  },
+  // ── Reactive snapshot (for useSyncExternalStore) ──────────────────
+  /**
+   * @example React:
+   *   const session = useSyncExternalStore(
+   *     auth.subscribe, auth.getSnapshot, auth.getServerSnapshot,
+   *   );
+   *   const isAuthenticated = session.status === 'authenticated';
+   */
+  getSnapshot() {
+    return _snapshot;
+  },
+  getServerSnapshot() {
+    return SERVER_SNAPSHOT;
+  },
+  subscribe(listener) {
+    ensureStorageSync();
+    _sessionListeners.add(listener);
+    notifySessionChanged();
+    return () => {
+      _sessionListeners.delete(listener);
+      if (_sessionListeners.size === 0 && _expiryTimer !== null) {
+        clearTimeout(_expiryTimer);
+        _expiryTimer = null;
+      }
+    };
+  },
+  /**
+   * Fired on TERMINAL 401 — after the refresh+retry path is exhausted.
+   * The store has already cleared the session before calling back, so
+   * handlers only need to route to login (no clear-then-redirect
+   * ordering to get wrong). Returns an unsubscribe function; multiple
+   * handlers compose (unlike the legacy single-slot `onUnauthorized`).
+   */
+  onSessionExpired(cb) {
+    _sessionExpiredHandlers.add(cb);
+    return () => {
+      _sessionExpiredHandlers.delete(cb);
+    };
   },
   // ── API key ───────────────────────────────────────────────────────
   getApiKey() {
@@ -287,15 +431,22 @@ var auth = {
 async function tryRefresh() {
   if (_refreshInflight) return _refreshInflight;
   if (!_refreshHandler) return null;
-  const refresh = auth.getRefreshToken();
-  if (!refresh) return null;
+  const runRefresh = /* @__PURE__ */ __name(async () => {
+    const refresh = auth.getRefreshToken();
+    if (!refresh) return null;
+    const result = await _refreshHandler(refresh);
+    if (!result?.access) return null;
+    auth.setToken(result.access);
+    if (result.refresh) auth.setRefreshToken(result.refresh);
+    return result.access;
+  }, "runRefresh");
   _refreshInflight = (async () => {
     try {
-      const result = await _refreshHandler(refresh);
-      if (!result?.access) return null;
-      auth.setToken(result.access);
-      if (result.refresh) auth.setRefreshToken(result.refresh);
-      return result.access;
+      const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+      if (locks?.request) {
+        return await locks.request(`${REFRESH_KEY}:refresh`, runRefresh);
+      }
+      return await runRefresh();
     } catch {
       return null;
     } finally {
@@ -305,6 +456,22 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
+function expireSession(response) {
+  auth.clearTokens();
+  for (const cb of Array.from(_sessionExpiredHandlers)) {
+    try {
+      cb(response);
+    } catch {
+    }
+  }
+  if (_onUnauthorized) {
+    try {
+      _onUnauthorized(response);
+    } catch {
+    }
+  }
+}
+__name(expireSession, "expireSession");
 function dpopEnabled() {
   try {
     return typeof process !== "undefined" && process.env?.NEXT_PUBLIC_DPOP_ENABLED === "true";
@@ -434,22 +601,12 @@ function installAuthOnClient(client2) {
   client2.interceptors.response.use(async (response, request) => {
     if (response.status !== 401) return response;
     if (request.headers.get(RETRY_MARKER)) {
-      if (_onUnauthorized) {
-        try {
-          _onUnauthorized(response);
-        } catch {
-        }
-      }
+      expireSession(response);
       return response;
     }
     const newToken = await tryRefresh();
     if (!newToken) {
-      if (_onUnauthorized) {
-        try {
-          _onUnauthorized(response);
-        } catch {
-        }
-      }
+      expireSession(response);
       return response;
     }
     const retry = request.clone();
@@ -461,25 +618,36 @@ function installAuthOnClient(client2) {
     }
     try {
       const retried = await fetch(retry);
-      if (retried.status === 401 && _onUnauthorized) {
-        try {
-          _onUnauthorized(retried);
-        } catch {
-        }
-      }
+      if (retried.status === 401) expireSession(retried);
       return retried;
     } catch {
-      if (_onUnauthorized) {
-        try {
-          _onUnauthorized(response);
-        } catch {
-        }
-      }
       return response;
     }
   });
 }
 __name(installAuthOnClient, "installAuthOnClient");
+var REFRESH_ENDPOINT = "/cfg/accounts/token/refresh/";
+auth.setRefreshHandler(async (refresh) => {
+  try {
+    const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
+    const headers = { "Content-Type": "application/json" };
+    if (dpopEnabled() && typeof window !== "undefined") {
+      const proof = await _makeDpopProof("POST", url);
+      if (proof) headers["DPoP"] = proof;
+    }
+    const res = await fetch(url, {
+      method: "POST",
+      headers,
+      credentials: auth.getWithCredentials() ? "include" : "same-origin",
+      body: JSON.stringify({ refresh })
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
+  } catch {
+    return null;
+  }
+});
 
 // src/_api/generated/helpers/logger.ts
 import { createConsola } from "consola";
@@ -1504,7 +1672,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthConnectionsList(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/oauth/connections/",
       ...options
     });
@@ -1516,7 +1688,11 @@ var CfgAccountsOauth = class {
    */
   static cfgAccountsOauthDisconnectCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/oauth/disconnect/",
       ...options,
       headers: {
@@ -1573,7 +1749,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpRequestCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/otp/request/",
       ...options,
       headers: {
@@ -1594,7 +1774,11 @@ var CfgAccounts = class {
    */
   static cfgAccountsOtpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/otp/verify/",
       ...options,
       headers: {
@@ -1632,7 +1816,11 @@ var CfgAccountsProfile = class {
   static cfgAccountsProfileAvatarCreate(options) {
     return (options?.client ?? client).post({
       ...formDataBodySerializer,
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/accounts/profile/avatar/",
       ...options,
       headers: {
@@ -1752,6 +1940,23 @@ var CfgAccountsAuth = class {
   static {
     __name(this, "CfgAccountsAuth");
   }
+  /**
+   * Revoke a refresh token (logout).
+   *
+   * Blacklists the posted refresh token so it can never mint another access
+   * token. Called best-effort by the client's logout — without it, "logout"
+   * is purely client-side and a stolen refresh token survives until expiry.
+   */
+  static cfgAccountsTokenBlacklistCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/token/blacklist/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * Refresh JWT token.
    *
@@ -1783,7 +1988,11 @@ var CfgCentrifugo = class {
    */
   static cfgCentrifugoAuthTokenRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/centrifugo/auth/token/",
       ...options
     });
@@ -1798,7 +2007,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/backup-codes/",
       ...options
     });
@@ -1811,7 +2024,11 @@ var CfgTotpBackupCodes = class {
    */
   static cfgTotpBackupCodesRegenerateCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/backup-codes/regenerate/",
       ...options,
       headers: {
@@ -1830,7 +2047,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesRetrieve(options) {
     return (options?.client ?? client).get({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/devices/",
       ...options
     });
@@ -1842,7 +2063,11 @@ var CfgTotp = class {
    */
   static cfgTotpDevicesDestroy(options) {
     return (options.client ?? client).delete({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/devices/{id}/",
       ...options
     });
@@ -1854,7 +2079,11 @@ var CfgTotp = class {
    */
   static cfgTotpDisableCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/disable/",
       ...options,
       headers: {
@@ -1875,7 +2104,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupCreate(options) {
     return (options?.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/setup/",
       ...options,
       headers: {
@@ -1891,7 +2124,11 @@ var CfgTotpSetup = class {
    */
   static cfgTotpSetupConfirmCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/setup/confirm/",
       ...options,
       headers: {
@@ -1912,7 +2149,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/verify/",
       ...options,
       headers: {
@@ -1928,7 +2169,11 @@ var CfgTotpVerify = class {
    */
   static cfgTotpVerifyBackupCreate(options) {
     return (options.client ?? client).post({
-      security: [{ name: "X-API-Key", type: "apiKey" }, { scheme: "bearer", type: "http" }],
+      security: [
+        { name: "X-API-Key", type: "apiKey" },
+        { scheme: "bearer", type: "http" },
+        { name: "Authorization", type: "apiKey" }
+      ],
       url: "/cfg/totp/verify/backup/",
       ...options,
       headers: {