@djangocfg/api 2.1.455 → 2.1.457

package/src/auth/context/types.ts

@@ -17,12 +17,25 @@ export interface AuthConfig {
   onLogout?: () => void;
 }
 
+/**
+ * AuthConfig.routes resolved against the framework conventions — no field is
+ * optional here. This is what components consume (via `useAuth().routes`)
+ * instead of defaulting to route constants themselves.
+ */
+export interface ResolvedAuthRoutes {
+  auth: string;
+  defaultCallback: string;
+  defaultAuthCallback: string;
+}
+
 // Auth context interface
 export interface AuthContextType {
   user: UserProfile | null;
   isLoading: boolean;
   isAuthenticated: boolean;
   isAdminUser: boolean;
+  /** Resolved route conventions (config override or framework default). */
+  routes: ResolvedAuthRoutes;
   loadCurrentProfile: (callerId?: string) => Promise<void>;
   checkAuthAndRedirect: () => Promise<void>;
 

package/src/auth/hooks/index.ts

@@ -1,5 +1,8 @@
 'use client';
 
+// Session (reactive snapshot from the generated auth store)
+export { useSession, type SessionSnapshot, type SessionStatus } from './useSession';
+
 // Router hooks
 export { useCfgRouter } from './useCfgRouter';
 export { useQueryParams } from './useQueryParams';
@@ -32,8 +35,11 @@ export {
 } from './useTwoFactorStatus';
 
 // Auth guards and redirects
-export { useAuthRedirectManager } from './useAuthRedirect';
-export { useAuthGuard } from './useAuthGuard';
+export {
+  consumeSavedRedirect,
+  peekSavedRedirect,
+  useAuthRedirectManager,
+} from './useAuthRedirect';
 
 // Storage hooks
 export { useSessionStorage } from './useSessionStorage';
@@ -50,9 +56,6 @@ export {
   type ProfileCacheOptions,
 } from './useProfileCache';
 
-// Token refresh
-export { useTokenRefresh } from './useTokenRefresh';
-
 // Account deletion
 export {
   useDeleteAccount,

package/src/auth/hooks/useAuthRedirect.ts

@@ -34,6 +34,23 @@ const clearRedirectFromStorage = (): void => {
   }
 };
 
+/**
+ * Read the saved back-url without clearing it. Null when nothing saved —
+ * unlike getFinalRedirectUrl, never substitutes a fallback.
+ */
+export const peekSavedRedirect = (): string | null => getRedirectFromStorage() || null;
+
+/**
+ * Read AND clear the saved back-url (single-use intent). Null when nothing
+ * saved. This is the one primitive every post-auth navigator uses to honor
+ * "return the user to where the guard bounced them from".
+ */
+export const consumeSavedRedirect = (): string | null => {
+  const stored = getRedirectFromStorage();
+  if (stored) clearRedirectFromStorage();
+  return stored || null;
+};
+
 export const useAuthRedirectManager = (options: AuthRedirectOptions = {}) => {
   const { fallbackUrl = '/dashboard', clearOnUse = true } = options;
   const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage<string>(AUTH_REDIRECT_KEY, '');

package/src/auth/hooks/useGithubAuth.ts

@@ -2,7 +2,7 @@
 
 import { useCallback, useState } from 'react';
 
-import { apiAccounts } from '../../clients';
+import { auth } from '../../_api/generated/helpers/auth';
 import { CfgAccountsOauth } from '../../_api/generated/sdk.gen';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
 import { authLogger } from '../utils/logger';
@@ -158,8 +158,8 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
 
       authLogger.info('GitHub OAuth successful, user:', response.user);
 
-      apiAccounts.setToken(response.access);
-      apiAccounts.setRefreshToken(response.refresh);
+      // The ONE write path — atomic pair + session notification.
+      auth.setSession({ access: response.access, refresh: response.refresh });
 
       // Track successful OAuth
       Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {

package/src/auth/hooks/useSession.ts

@@ -0,0 +1,22 @@
+'use client';
+
+/**
+ * useSession — reactive session snapshot from the generated auth store.
+ *
+ * The ONE way to answer "am I logged in" in React. The store owns the
+ * semantics (JWT `exp`-aware, refresh-token-aware) and pushes changes on
+ * token writes, refresh success/failure, expiry (internal timer), and
+ * cross-tab / cross-store sync. No polling, no ticks.
+ */
+
+import { useSyncExternalStore } from 'react';
+
+import { auth } from '../../_api/generated/helpers/auth';
+
+import type { SessionSnapshot, SessionStatus } from '../../_api/generated/helpers/auth';
+
+export type { SessionSnapshot, SessionStatus };
+
+export function useSession(): SessionSnapshot {
+  return useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getServerSnapshot);
+}

package/src/auth/hooks/useTwoFactor.ts

@@ -2,11 +2,13 @@
 
 import { useCallback, useState } from 'react';
 
-import { apiAccounts, apiTotp } from '../../clients';
+import { apiTotp } from '../../clients';
+import { auth } from '../../_api/generated/helpers/auth';
 import { APIError } from '../../_api/generated/helpers';
 import { CfgTotp, CfgTotpVerify } from '../../_api/generated/sdk.gen';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
 import { authLogger } from '../utils/logger';
+import { consumeSavedRedirect } from './useAuthRedirect';
 import { useCfgRouter } from './useCfgRouter';
 
 export interface UseTwoFactorOptions {
@@ -88,9 +90,8 @@ export const useTwoFactor = (options: UseTwoFactorOptions = {}): UseTwoFactorRet
     warning?: string;
     remaining_backup_codes?: number;
   }) => {
-    // Save tokens
-    apiAccounts.setToken(response.access_token);
-    apiAccounts.setRefreshToken(response.refresh_token);
+    // Save tokens — the ONE write path (atomic pair + session notification).
+    auth.setSession({ access: response.access_token, refresh: response.refresh_token });
 
     // Set warning if any
     if (response.warning) {
@@ -116,9 +117,10 @@ export const useTwoFactor = (options: UseTwoFactorOptions = {}): UseTwoFactorRet
     // Call success callback
     onSuccess?.(response.user);
 
-    // Redirect (unless skipRedirect is true)
+    // Redirect (unless skipRedirect is true).
+    // Priority: saved back-url (guard intent) > explicit option > default.
     if (!skipRedirect) {
-      const finalRedirectUrl = redirectUrl || '/dashboard';
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || '/';
       authLogger.info('2FA successful, redirecting to:', finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }

package/src/auth/middlewares/index.ts

@@ -1,8 +1,7 @@
 export { proxyMiddleware, proxyMiddlewareConfig } from './proxy';
 
-// NOTE: The former `tokenRefresh` middleware (createAutoRefreshFetch /
-// refreshAccessToken / refreshIfExpiringSoon) was removed. Automatic 401
-// recovery and proactive refresh now live in a single implementation: the
-// generated client interceptor (helpers/auth.ts `installAuthOnClient`) plus the
-// canonical strategy in `auth/refreshHandler.ts`. Do not reintroduce a parallel
-// refresh path here — see auth/refreshHandler.ts for the rationale.
+// NOTE: Automatic 401 recovery and proactive refresh live in ONE place: the
+// generated store (`_api/generated/helpers/auth.ts`) — interceptor, Web-Locks
+// single-flight, and an auto-registered refresh handler. Do not reintroduce a
+// parallel refresh path here (a former `tokenRefresh` middleware was removed
+// for exactly that reason).

package/src/auth/utils/guard.ts

@@ -55,25 +55,3 @@ export function resolveGuardIsAuthenticated(s: Pick<GuardInput, 'requireAuth' |
   return !s.requireAuth || s.isAuthenticated;
 }
 
-/**
- * Delay (ms from `now`) until `isAuthenticated` should next be re-evaluated,
- * given the access/refresh expiry timestamps (ms epoch, or null if absent).
- *
- * `isAuthenticated` is derived from token `exp`, so it can change with no event
- * to trigger a recompute — a tab left open silently crosses an expiry boundary.
- * We schedule a wake-up at the SOONEST future expiry (the next moment the answer
- * could flip), plus a 1s cushion so we re-check strictly after the inclusive
- * boundary. Returns null when nothing live remains to expire (no timer needed).
- * Callers should clamp the result to the platform setTimeout ceiling.
- */
-export function nextAuthEvaluationDelay(
-  accessExp: number | null,
-  refreshExp: number | null,
-  now: number,
-): number | null {
-  const future = [accessExp, refreshExp].filter(
-    (d): d is number => d !== null && d > now,
-  );
-  if (future.length === 0) return null;
-  return Math.max(0, Math.min(...future) - now) + 1000;
-}

package/src/auth/utils/index.ts

@@ -4,10 +4,8 @@ export {
   resolveGuardIsLoading,
   shouldRedirectToAuth,
   resolveGuardIsAuthenticated,
-  nextAuthEvaluationDelay,
   type GuardInput,
 } from './guard';
-export { getTokenExpiry, isTokenExpired, isTokenExpiringSoon } from './jwt';
 export { normalizePath, isAllowedAuthPath } from './path';
 export { logger, authLogger } from './logger';
 export {

package/src/_api/generated/_cfg_accounts/events.ts

@@ -1,198 +0,0 @@
-// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras.events
-// Hooks Hey API client interceptors → typed CustomEvents on `window`.
-// DO NOT EDIT — re-run `make gen-clients`.
-//
-// Usage:
-//   import "./generated/events"  // side-effect: registers interceptors
-//
-//   window.addEventListener("cmdop:network-error", (e) => {
-//     console.log(e.detail.status, e.detail.method, e.detail.url);
-//   });
-
-import { client } from "../client.gen";
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Event names + detail types
-// ─────────────────────────────────────────────────────────────────────────────
-
-export const NETWORK_ERROR_EVENT = "cmdop:network-error" as const;
-export const VALIDATION_ERROR_EVENT = "cmdop:validation-error" as const;
-export const RUNTIME_ERROR_EVENT = "cmdop:runtime-error" as const;
-
-export interface NetworkErrorDetail {
-  /** HTTP method (GET/POST/...). */
-  method: string;
-  /** Request URL. */
-  url: string;
-  /** HTTP status if response arrived; null on transport failure. */
-  status: number | null;
-  /** Response body parsed as text (best-effort, may be empty). */
-  body?: string;
-  /** Underlying error message (network failures, abort, etc.). */
-  error?: string;
-  /** Heuristic: did the request likely fail due to CORS? */
-  possiblyCors: boolean;
-  timestamp: Date;
-}
-
-export interface ValidationErrorDetail {
-  /** Operation ID this validation applies to (from the OpenAPI spec). */
-  operation: string;
-  /** Schema name that failed (if known). */
-  schema?: string;
-  /** Issues array — shape mirrors zod's ZodIssue but kept opaque here to
-   *  avoid forcing a hard zod dep on consumers that don't use schemas. */
-  issues: unknown;
-  /** Raw response data that failed validation. */
-  data: unknown;
-  timestamp: Date;
-}
-
-export interface RuntimeErrorDetail {
-  /** Free-form source identifier — component name, hook name, etc. */
-  source: string;
-  message: string;
-  /** Original Error object (may be undefined when caller lacks one). */
-  error?: Error;
-  /** Arbitrary context payload from the caller. */
-  context?: Record<string, unknown>;
-  timestamp: Date;
-}
-
-// Augment the global WindowEventMap so addEventListener gets typed details.
-declare global {
-  interface WindowEventMap {
-    "cmdop:network-error": CustomEvent<NetworkErrorDetail>;
-    "cmdop:validation-error": CustomEvent<ValidationErrorDetail>;
-    "cmdop:runtime-error": CustomEvent<RuntimeErrorDetail>;
-  }
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Dispatch helpers
-// ─────────────────────────────────────────────────────────────────────────────
-
-function _dispatch<T>(name: string, detail: T): void {
-  if (typeof window === "undefined") return;
-  try {
-    window.dispatchEvent(new CustomEvent(name, { detail, bubbles: true }));
-  } catch {
-    // Event dispatch must never crash the app.
-  }
-}
-
-/** Emit a runtime error from anywhere in app code. */
-export function emitRuntimeError(
-  source: string,
-  message: string,
-  error?: Error,
-  context?: Record<string, unknown>,
-): void {
-  _dispatch<RuntimeErrorDetail>(RUNTIME_ERROR_EVENT, {
-    source,
-    message,
-    error,
-    context,
-    timestamp: new Date(),
-  });
-}
-
-/** Emit a zod validation failure. Called by hooks when `validate` is provided. */
-export function dispatchValidationError(
-  operation: string,
-  data: unknown,
-  issues: unknown,
-  schema?: string,
-): void {
-  _dispatch<ValidationErrorDetail>(VALIDATION_ERROR_EVENT, {
-    operation,
-    schema,
-    issues,
-    data,
-    timestamp: new Date(),
-  });
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Listen helpers — typed wrappers over addEventListener, return cleanup fn.
-// ─────────────────────────────────────────────────────────────────────────────
-
-export function onNetworkError(
-  cb: (detail: NetworkErrorDetail) => void,
-): () => void {
-  if (typeof window === "undefined") return () => {};
-  const handler = (e: CustomEvent<NetworkErrorDetail>) => cb(e.detail);
-  window.addEventListener(NETWORK_ERROR_EVENT, handler);
-  return () => window.removeEventListener(NETWORK_ERROR_EVENT, handler);
-}
-
-export function onValidationError(
-  cb: (detail: ValidationErrorDetail) => void,
-): () => void {
-  if (typeof window === "undefined") return () => {};
-  const handler = (e: CustomEvent<ValidationErrorDetail>) => cb(e.detail);
-  window.addEventListener(VALIDATION_ERROR_EVENT, handler);
-  return () => window.removeEventListener(VALIDATION_ERROR_EVENT, handler);
-}
-
-export function onRuntimeError(
-  cb: (detail: RuntimeErrorDetail) => void,
-): () => void {
-  if (typeof window === "undefined") return () => {};
-  const handler = (e: CustomEvent<RuntimeErrorDetail>) => cb(e.detail);
-  window.addEventListener(RUNTIME_ERROR_EVENT, handler);
-  return () => window.removeEventListener(RUNTIME_ERROR_EVENT, handler);
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Hey API interceptors — wire once, emit on response/error.
-// ─────────────────────────────────────────────────────────────────────────────
-
-let _wired = false;
-
-function _wire(): void {
-  if (_wired) return;
-  _wired = true;
-
-  // response interceptor: every response, OK or not, lets us see status.
-  // We only emit for non-2xx — successful requests are silent.
-  client.interceptors.response.use(async (response, request) => {
-    if (!response.ok) {
-      let body: string | undefined;
-      try {
-        body = await response.clone().text();
-        if (body.length > 4000) body = body.slice(0, 4000) + "…";
-      } catch {
-        // ignore — body inaccessible
-      }
-      _dispatch<NetworkErrorDetail>(NETWORK_ERROR_EVENT, {
-        method: request.method,
-        url: request.url,
-        status: response.status,
-        body,
-        possiblyCors: false,
-        timestamp: new Date(),
-      });
-    }
-    return response;
-  });
-
-  // error interceptor: transport-level failures (abort, DNS, CORS, offline).
-  client.interceptors.error.use((error, _response, request) => {
-    const msg = error instanceof Error ? error.message : String(error);
-    // Heuristic: CORS-blocked fetches usually surface as "Failed to fetch"
-    // without a status. Not perfect, but catches the common case.
-    const possiblyCors = /failed to fetch|network error|cors/i.test(msg);
-    _dispatch<NetworkErrorDetail>(NETWORK_ERROR_EVENT, {
-      method: request?.method ?? "UNKNOWN",
-      url: request?.url ?? "",
-      status: null,
-      error: msg,
-      possiblyCors,
-      timestamp: new Date(),
-    });
-    return error;
-  });
-}
-
-_wire();

package/src/_api/generated/_cfg_centrifugo/events.ts

@@ -1,198 +0,0 @@
-// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras.events
-// Hooks Hey API client interceptors → typed CustomEvents on `window`.
-// DO NOT EDIT — re-run `make gen-clients`.
-//
-// Usage:
-//   import "./generated/events"  // side-effect: registers interceptors
-//
-//   window.addEventListener("cmdop:network-error", (e) => {
-//     console.log(e.detail.status, e.detail.method, e.detail.url);
-//   });
-
-import { client } from "../client.gen";
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Event names + detail types
-// ─────────────────────────────────────────────────────────────────────────────
-
-export const NETWORK_ERROR_EVENT = "cmdop:network-error" as const;
-export const VALIDATION_ERROR_EVENT = "cmdop:validation-error" as const;
-export const RUNTIME_ERROR_EVENT = "cmdop:runtime-error" as const;
-
-export interface NetworkErrorDetail {
-  /** HTTP method (GET/POST/...). */
-  method: string;
-  /** Request URL. */
-  url: string;
-  /** HTTP status if response arrived; null on transport failure. */
-  status: number | null;
-  /** Response body parsed as text (best-effort, may be empty). */
-  body?: string;
-  /** Underlying error message (network failures, abort, etc.). */
-  error?: string;
-  /** Heuristic: did the request likely fail due to CORS? */
-  possiblyCors: boolean;
-  timestamp: Date;
-}
-
-export interface ValidationErrorDetail {
-  /** Operation ID this validation applies to (from the OpenAPI spec). */
-  operation: string;
-  /** Schema name that failed (if known). */
-  schema?: string;
-  /** Issues array — shape mirrors zod's ZodIssue but kept opaque here to
-   *  avoid forcing a hard zod dep on consumers that don't use schemas. */
-  issues: unknown;
-  /** Raw response data that failed validation. */
-  data: unknown;
-  timestamp: Date;
-}
-
-export interface RuntimeErrorDetail {
-  /** Free-form source identifier — component name, hook name, etc. */
-  source: string;
-  message: string;
-  /** Original Error object (may be undefined when caller lacks one). */
-  error?: Error;
-  /** Arbitrary context payload from the caller. */
-  context?: Record<string, unknown>;
-  timestamp: Date;
-}
-
-// Augment the global WindowEventMap so addEventListener gets typed details.
-declare global {
-  interface WindowEventMap {
-    "cmdop:network-error": CustomEvent<NetworkErrorDetail>;
-    "cmdop:validation-error": CustomEvent<ValidationErrorDetail>;
-    "cmdop:runtime-error": CustomEvent<RuntimeErrorDetail>;
-  }
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Dispatch helpers
-// ─────────────────────────────────────────────────────────────────────────────
-
-function _dispatch<T>(name: string, detail: T): void {
-  if (typeof window === "undefined") return;
-  try {
-    window.dispatchEvent(new CustomEvent(name, { detail, bubbles: true }));
-  } catch {
-    // Event dispatch must never crash the app.
-  }
-}
-
-/** Emit a runtime error from anywhere in app code. */
-export function emitRuntimeError(
-  source: string,
-  message: string,
-  error?: Error,
-  context?: Record<string, unknown>,
-): void {
-  _dispatch<RuntimeErrorDetail>(RUNTIME_ERROR_EVENT, {
-    source,
-    message,
-    error,
-    context,
-    timestamp: new Date(),
-  });
-}
-
-/** Emit a zod validation failure. Called by hooks when `validate` is provided. */
-export function dispatchValidationError(
-  operation: string,
-  data: unknown,
-  issues: unknown,
-  schema?: string,
-): void {
-  _dispatch<ValidationErrorDetail>(VALIDATION_ERROR_EVENT, {
-    operation,
-    schema,
-    issues,
-    data,
-    timestamp: new Date(),
-  });
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Listen helpers — typed wrappers over addEventListener, return cleanup fn.
-// ─────────────────────────────────────────────────────────────────────────────
-
-export function onNetworkError(
-  cb: (detail: NetworkErrorDetail) => void,
-): () => void {
-  if (typeof window === "undefined") return () => {};
-  const handler = (e: CustomEvent<NetworkErrorDetail>) => cb(e.detail);
-  window.addEventListener(NETWORK_ERROR_EVENT, handler);
-  return () => window.removeEventListener(NETWORK_ERROR_EVENT, handler);
-}
-
-export function onValidationError(
-  cb: (detail: ValidationErrorDetail) => void,
-): () => void {
-  if (typeof window === "undefined") return () => {};
-  const handler = (e: CustomEvent<ValidationErrorDetail>) => cb(e.detail);
-  window.addEventListener(VALIDATION_ERROR_EVENT, handler);
-  return () => window.removeEventListener(VALIDATION_ERROR_EVENT, handler);
-}
-
-export function onRuntimeError(
-  cb: (detail: RuntimeErrorDetail) => void,
-): () => void {
-  if (typeof window === "undefined") return () => {};
-  const handler = (e: CustomEvent<RuntimeErrorDetail>) => cb(e.detail);
-  window.addEventListener(RUNTIME_ERROR_EVENT, handler);
-  return () => window.removeEventListener(RUNTIME_ERROR_EVENT, handler);
-}
-
-// ─────────────────────────────────────────────────────────────────────────────
-// Hey API interceptors — wire once, emit on response/error.
-// ─────────────────────────────────────────────────────────────────────────────
-
-let _wired = false;
-
-function _wire(): void {
-  if (_wired) return;
-  _wired = true;
-
-  // response interceptor: every response, OK or not, lets us see status.
-  // We only emit for non-2xx — successful requests are silent.
-  client.interceptors.response.use(async (response, request) => {
-    if (!response.ok) {
-      let body: string | undefined;
-      try {
-        body = await response.clone().text();
-        if (body.length > 4000) body = body.slice(0, 4000) + "…";
-      } catch {
-        // ignore — body inaccessible
-      }
-      _dispatch<NetworkErrorDetail>(NETWORK_ERROR_EVENT, {
-        method: request.method,
-        url: request.url,
-        status: response.status,
-        body,
-        possiblyCors: false,
-        timestamp: new Date(),
-      });
-    }
-    return response;
-  });
-
-  // error interceptor: transport-level failures (abort, DNS, CORS, offline).
-  client.interceptors.error.use((error, _response, request) => {
-    const msg = error instanceof Error ? error.message : String(error);
-    // Heuristic: CORS-blocked fetches usually surface as "Failed to fetch"
-    // without a status. Not perfect, but catches the common case.
-    const possiblyCors = /failed to fetch|network error|cors/i.test(msg);
-    _dispatch<NetworkErrorDetail>(NETWORK_ERROR_EVENT, {
-      method: request?.method ?? "UNKNOWN",
-      url: request?.url ?? "",
-      status: null,
-      error: msg,
-      possiblyCors,
-      timestamp: new Date(),
-    });
-    return error;
-  });
-}
-
-_wire();