@djangocfg/api 2.1.456 → 2.1.457

package/src/_api/generated/helpers/auth.ts

@@ -775,22 +775,34 @@ export function installAuthOnClient(client: HeyClient): void {
 
 // ── Default refresh handler (auto-registered) ──────────────────────────────
 //
-// Wires the SimpleJWT refresh endpoint so a 401 transparently refreshes and
-// retries. Registered at import time; an app can override it afterwards with
-// `auth.setRefreshHandler(...)` (last write wins). Returns the ROTATED refresh
-// token so the store persists it — `ROTATE_REFRESH_TOKENS` blacklists the old
-// one, so reusing it would 401 on the next refresh.
+// POSTs straight to the SimpleJWT refresh endpoint so a 401 transparently
+// refreshes and retries. Registered at import time; an app can override it
+// afterwards with `auth.setRefreshHandler(...)` (last write wins). Returns the
+// ROTATED refresh token so the store persists it — `ROTATE_REFRESH_TOKENS`
+// blacklists the old one, so reusing it would 401 on the next refresh.
 //
-// The SDK is imported LAZILY inside the handler: a static import would close
-// the cycle auth.ts → sdk.gen → client.gen → auth.ts and TDZ-crash whichever
-// module evaluates first. The dynamic import resolves once, then caches.
+// Raw fetch, NOT the SDK: the endpoint exists on the server even when this
+// target's sliced SDK doesn't include the accounts group, and importing
+// sdk.gen here would close the cycle auth.ts → sdk.gen → client.gen → auth.ts.
+const REFRESH_ENDPOINT = '/cfg/accounts/token/refresh/';
+
 auth.setRefreshHandler(async (refresh) => {
   try {
-    const { CfgAccountsAuth } = await import('../sdk.gen');
-    const { data } = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
-      body: { refresh },
-      throwOnError: true,
+    const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
+    const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+    // Bound tokens (`cnf.jkt`) require a DPoP proof on the refresh call too.
+    if (dpopEnabled() && typeof window !== 'undefined') {
+      const proof = await _makeDpopProof('POST', url);
+      if (proof) headers['DPoP'] = proof;
+    }
+    const res = await fetch(url, {
+      method: 'POST',
+      headers,
+      credentials: auth.getWithCredentials() ? 'include' : 'same-origin',
+      body: JSON.stringify({ refresh }),
     });
+    if (!res.ok) return null;
+    const data = (await res.json()) as { access?: string; refresh?: string } | null;
     return data?.access
       ? { access: data.access, refresh: data.refresh ?? refresh }
       : null;

package/src/auth/constants.ts

@@ -12,8 +12,8 @@ export const AUTH_CONSTANTS = {
   BACKUP_CODE_MAX_LENGTH: 12,
 } as const;
 
-/** Default route for the sign-in page. Override per app via AuthConfig.routes. */
-export const DEFAULT_AUTH_PATH = '/auth';
-
-/** Default post-login destination. Override per app via AuthConfig.routes. */
-export const DEFAULT_CALLBACK_PATH = '/dashboard';
+// Route conventions are NOT exported here on purpose. The '/auth' and '/'
+// defaults are applied in exactly one place — AuthProvider's route resolution
+// — and every consumer reads the resolved values from `useAuth().routes`.
+// Exporting route constants invites components to default to them directly,
+// which silently diverges from an app's AuthConfig.routes override.

package/src/auth/context/AuthContext.tsx

@@ -29,7 +29,6 @@ import React, {
 } from 'react';
 
 import { auth } from '../../_api/generated/helpers/auth';
-import { DEFAULT_AUTH_PATH, DEFAULT_CALLBACK_PATH } from '../constants';
 import { APIError } from '../../_api/generated/helpers';
 import { applyRoleLogPolicy } from '../../log-control';
 import { useCfgRouter, useLocalStorage, useQueryParams, useSession } from '../hooks';
@@ -43,12 +42,25 @@ import { AccountsProvider, useAccountsContext } from './AccountsContext';
 import type { AuthContextType, AuthProviderProps, UserProfile } from './types';
 import type { OTPRequestResult } from '../types';
 
+// The ONLY place route conventions are declared. '/auth' is the sign-in page
+// convention; the framework has no opinion about where an app's "home" is, so
+// the callback default is the site root. Apps override via AuthConfig.routes;
+// everything downstream reads the RESOLVED values from `useAuth().routes`.
 const defaultRoutes = {
-  auth: DEFAULT_AUTH_PATH,
-  defaultCallback: DEFAULT_CALLBACK_PATH,
-  defaultAuthCallback: DEFAULT_AUTH_PATH,
+  auth: '/auth',
+  defaultCallback: '/',
+  defaultAuthCallback: '/auth',
 };
 
+/** Resolve AuthConfig.routes against the conventions — applied exactly once. */
+export const resolveAuthRoutes = (
+  routes?: { auth?: string; defaultCallback?: string; defaultAuthCallback?: string },
+) => ({
+  auth: routes?.auth || defaultRoutes.auth,
+  defaultCallback: routes?.defaultCallback || defaultRoutes.defaultCallback,
+  defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback,
+});
+
 const EMAIL_STORAGE_KEY = 'auth_email';
 
 const AuthContext = createContext<AuthContextType | undefined>(undefined);
@@ -74,8 +86,16 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
     null,
   );
 
+  // Resolved once; every consumer below (and, via context, every component)
+  // reads these — never the raw config and never a module constant.
+  const routes = useMemo(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = useRef(routes);
+  useEffect(() => {
+    routesRef.current = routes;
+  }, [routes]);
+
   const redirectManager = useAuthRedirectManager({
-    fallbackUrl: config?.routes?.defaultCallback || defaultRoutes.defaultCallback,
+    fallbackUrl: routes.defaultCallback,
     clearOnUse: true,
   });
 
@@ -89,6 +109,13 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
     accountsRef.current = accounts;
   }, [accounts]);
 
+  // Set when a login flow opts out of automatic navigation (verifyOTP with
+  // skipRedirect — the AuthLayout success screen owns the final hardPush,
+  // including through a 2FA continuation). While set, the "redirect
+  // authenticated users away from /auth" effect must stand down, otherwise it
+  // races the success screen and eats the saved back-url.
+  const pendingManualNavRef = useRef(false);
+
   // ── Bootstrap: settle the profile for the current session ─────────────────
   // The session itself needs no async bootstrap — the store answers
   // synchronously from token `exp`. The only async part is the profile fetch,
@@ -105,7 +132,15 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       // expired). Purge so the login form shows instantly instead of the app
       // firing doomed API calls — the automated "clear localStorage and the
       // form appears".
-      if (auth.getToken() || auth.getRefreshToken()) {
+      //
+      // CRITICAL: ask the STORE synchronously, never trust the React snapshot
+      // here. During hydration useSyncExternalStore serves the SERVER snapshot
+      // ('anonymous') for one commit even when perfectly live tokens sit in
+      // storage — purging on that stale value nuked fresh logins (user typed
+      // OTP → tokens saved → hardPush → hydration commit saw 'anonymous' →
+      // tokens cleared → bounced back to /auth).
+      const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
+      if (hasTokens && !auth.isAuthenticated()) {
         authLogger.warn('Dead session in storage — clearing');
         auth.clearSession();
         clearProfileCache();
@@ -151,22 +186,24 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       Analytics.event(AnalyticsEvent.AUTH_SESSION_EXPIRED, {
         category: AnalyticsCategory.AUTH,
       });
-      const authCallbackUrl =
-        configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-      router.hardReplace(authCallbackUrl);
+      router.hardReplace(routesRef.current.defaultAuthCallback);
     });
     return unsubscribe;
   }, [router]);
 
   // ── Redirect authenticated users away from the auth page ──────────────────
-  // Skipped while a `?flow` param is present (OTP / 2FA flows in progress).
+  // Stands down while a login flow on this page owns navigation (success
+  // screen / 2FA continuation — see pendingManualNavRef). When it does fire
+  // (an already-authenticated user landing on /auth), it honors the saved
+  // back-url with the same priority rule as every other consumer.
   useEffect(() => {
-    if (!isAuthenticated) return;
-    const authRoute = config?.routes?.auth || defaultRoutes.auth;
-    if (pathname === authRoute && !queryParams.get('flow')) {
-      router.push(config?.routes?.defaultCallback || defaultRoutes.defaultCallback);
+    if (!isAuthenticated || pendingManualNavRef.current) return;
+    if (pathname === routes.auth && !queryParams.get('flow')) {
+      const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+      if (saved) redirectManager.clearRedirect();
+      router.push(saved || routes.defaultCallback);
     }
-  }, [isAuthenticated, pathname, queryParams, config?.routes, router]);
+  }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
 
   // ── Profile actions (delegated to AccountsContext) ─────────────────────────
 
@@ -180,16 +217,15 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
   }, []);
 
   const checkAuthAndRedirect = useCallback(async (): Promise<void> => {
-    const routes = configRef.current?.routes;
     if (auth.isAuthenticated()) {
       try {
         await loadCurrentProfile('checkAuthAndRedirect');
       } catch (error) {
         authLogger.warn('checkAuthAndRedirect: profile load failed', error);
       }
-      router.push(routes?.defaultCallback || defaultRoutes.defaultCallback);
+      router.push(routesRef.current.defaultCallback);
     } else {
-      router.push(routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback);
+      router.push(routesRef.current.defaultAuthCallback);
     }
   }, [loadCurrentProfile, router]);
 
@@ -253,6 +289,10 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       should_prompt_2fa?: boolean;
     }> => {
       try {
+        // The caller opting out of redirect commits to handling ALL navigation
+        // for this login — including the 2FA continuation and success screen.
+        pendingManualNavRef.current = Boolean(skipRedirect);
+
         const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
@@ -288,14 +328,12 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
         }
 
         if (!skipRedirect) {
-          // Priority: explicit redirectUrl > saved redirect > config default.
+          // Priority: saved back-url (per-visit intent from the guard) >
+          // explicit redirectUrl (static app default) > config default.
           // hardPush = full page load so every context reinitializes cleanly.
-          const savedRedirect = redirectManager.useAndClearRedirect();
-          const finalRedirectUrl =
-            redirectUrl ||
-            savedRedirect ||
-            configRef.current?.routes?.defaultCallback ||
-            defaultRoutes.defaultCallback;
+          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+          if (saved) redirectManager.clearRedirect();
+          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;
           authLogger.info('Redirecting after auth to:', finalRedirectUrl);
           router.hardPush(finalRedirectUrl);
         }
@@ -346,9 +384,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
     accountsRef.current.logout(); // clears session + profile + cache
     // hardReplace = full reload + history replace, so contexts reinitialize
     // and Back doesn't return to a protected page.
-    const authCallbackUrl =
-      configRef.current?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
-    router.hardReplace(authCallbackUrl);
+    router.hardReplace(routesRef.current.defaultAuthCallback);
   }, [router]);
 
   // ── Derived state ──────────────────────────────────────────────────────────
@@ -387,6 +423,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.
       isAuthenticated,
       isAdminUser,
+      routes,
       loadCurrentProfile,
       checkAuthAndRedirect,
       getToken: () => auth.getToken(),
@@ -410,6 +447,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       isLoading,
       isAuthenticated,
       isAdminUser,
+      routes,
       loadCurrentProfile,
       checkAuthAndRedirect,
       storedEmail,
@@ -453,6 +491,7 @@ const defaultAuthState: AuthContextType = {
   isLoading: false,
   isAuthenticated: false,
   isAdminUser: false,
+  routes: resolveAuthRoutes(),
   loadCurrentProfile: async () => {
     authLogger.warn('useAuth: loadCurrentProfile called outside AuthProvider');
   },

package/src/auth/context/types.ts

@@ -17,12 +17,25 @@ export interface AuthConfig {
   onLogout?: () => void;
 }
 
+/**
+ * AuthConfig.routes resolved against the framework conventions — no field is
+ * optional here. This is what components consume (via `useAuth().routes`)
+ * instead of defaulting to route constants themselves.
+ */
+export interface ResolvedAuthRoutes {
+  auth: string;
+  defaultCallback: string;
+  defaultAuthCallback: string;
+}
+
 // Auth context interface
 export interface AuthContextType {
   user: UserProfile | null;
   isLoading: boolean;
   isAuthenticated: boolean;
   isAdminUser: boolean;
+  /** Resolved route conventions (config override or framework default). */
+  routes: ResolvedAuthRoutes;
   loadCurrentProfile: (callerId?: string) => Promise<void>;
   checkAuthAndRedirect: () => Promise<void>;
 

package/src/auth/hooks/index.ts

@@ -35,7 +35,11 @@ export {
 } from './useTwoFactorStatus';
 
 // Auth guards and redirects
-export { useAuthRedirectManager } from './useAuthRedirect';
+export {
+  consumeSavedRedirect,
+  peekSavedRedirect,
+  useAuthRedirectManager,
+} from './useAuthRedirect';
 
 // Storage hooks
 export { useSessionStorage } from './useSessionStorage';

package/src/auth/hooks/useAuthRedirect.ts

@@ -34,6 +34,23 @@ const clearRedirectFromStorage = (): void => {
   }
 };
 
+/**
+ * Read the saved back-url without clearing it. Null when nothing saved —
+ * unlike getFinalRedirectUrl, never substitutes a fallback.
+ */
+export const peekSavedRedirect = (): string | null => getRedirectFromStorage() || null;
+
+/**
+ * Read AND clear the saved back-url (single-use intent). Null when nothing
+ * saved. This is the one primitive every post-auth navigator uses to honor
+ * "return the user to where the guard bounced them from".
+ */
+export const consumeSavedRedirect = (): string | null => {
+  const stored = getRedirectFromStorage();
+  if (stored) clearRedirectFromStorage();
+  return stored || null;
+};
+
 export const useAuthRedirectManager = (options: AuthRedirectOptions = {}) => {
   const { fallbackUrl = '/dashboard', clearOnUse = true } = options;
   const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage<string>(AUTH_REDIRECT_KEY, '');

package/src/auth/hooks/useTwoFactor.ts

@@ -8,6 +8,7 @@ import { APIError } from '../../_api/generated/helpers';
 import { CfgTotp, CfgTotpVerify } from '../../_api/generated/sdk.gen';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
 import { authLogger } from '../utils/logger';
+import { consumeSavedRedirect } from './useAuthRedirect';
 import { useCfgRouter } from './useCfgRouter';
 
 export interface UseTwoFactorOptions {
@@ -116,9 +117,10 @@ export const useTwoFactor = (options: UseTwoFactorOptions = {}): UseTwoFactorRet
     // Call success callback
     onSuccess?.(response.user);
 
-    // Redirect (unless skipRedirect is true)
+    // Redirect (unless skipRedirect is true).
+    // Priority: saved back-url (guard intent) > explicit option > default.
     if (!skipRedirect) {
-      const finalRedirectUrl = redirectUrl || '/dashboard';
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || '/';
       authLogger.info('2FA successful, redirecting to:', finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }