@djangocfg/api 2.1.477 → 2.1.478

package/src/auth/context/types.ts

@@ -1,7 +1,7 @@
 import React from 'react';
 
 import type { User } from '../../';
-import type { OTPRequestResult } from '../types';
+import type { OTPRequestConsent, OTPRequestResult } from '../types';
 
 // User profile type
 export type UserProfile = User;
@@ -49,7 +49,7 @@ export interface AuthContextType {
   clearSavedEmail: () => void;
 
   // OTP Methods - email only
-  requestOTP: (identifier: string, sourceUrl?: string) => Promise<OTPRequestResult>;
+  requestOTP: (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent) => Promise<OTPRequestResult>;
   verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean) => Promise<{
     success: boolean;
     message: string;

package/src/auth/hooks/useAuthForm.ts

@@ -23,6 +23,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     sourceUrl,
     redirectUrl,
     requireTermsAcceptance = false,
+    marketingConsent: marketingConsentOption,
     authPath = '/auth',
   } = options;
 
@@ -52,6 +53,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     otp,
     isLoading,
     acceptedTerms,
+    marketingConsent,
     twoFactorSessionId,
     twoFactorCode,
     useBackupCode,
@@ -139,7 +141,11 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     clearError();
 
     try {
-      const result = await requestOTP(identifier, sourceUrl);
+      // Only apps that opted in send consent fields — absent option ⇒ body unchanged.
+      const consent = marketingConsentOption
+        ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion }
+        : undefined;
+      const result = await requestOTP(identifier, sourceUrl, consent);
 
       if (result.success) {
         saveIdentifierToStorage(identifier);
@@ -164,6 +170,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     }
   }, [
     identifier, acceptedTerms, requireTermsAcceptance,
+    marketingConsent, marketingConsentOption,
     validateIdentifier, requestOTP, saveIdentifierToStorage,
     setError, setIsLoading, setStep, clearError, setWebmail,
     startRateLimitCountdown, onIdentifierSuccess, onError, sourceUrl,
@@ -233,7 +240,12 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     clearError();
 
     try {
-      const result = await requestOTP(identifier, sourceUrl);
+      // Resend repeats the same OTP request — carry the same consent state so
+      // the backend never sees a consent-less duplicate of an opted-in request.
+      const consent = marketingConsentOption
+        ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion }
+        : undefined;
+      const result = await requestOTP(identifier, sourceUrl, consent);
 
       if (result.success) {
         saveIdentifierToStorage(identifier);
@@ -255,7 +267,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     } finally {
       setIsLoading(false);
     }
-  }, [identifier, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
+  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, setWebmail, onError, sourceUrl]);
 
   const handleBackToIdentifier = useCallback(() => {
     setStep('identifier');

package/src/auth/hooks/useAuthFormState.ts

@@ -23,6 +23,9 @@ export const useAuthFormState = (
   const [otp, setOtp] = useState('');
   const [isLoading, setIsLoading] = useState(false);
   const [acceptedTerms, setAcceptedTerms] = useState(true);
+  // null until the marketing-consent feature (if enabled) resolves its
+  // jurisdiction-aware default — the layout owns that decision.
+  const [marketingConsent, setMarketingConsent] = useState<boolean | null>(null);
   const [step, setStep] = useState<AuthStep>('identifier');
   const [error, setError] = useState('');
   const [webmail, setWebmail] = useState<WebmailLink | null>(null);
@@ -64,6 +67,7 @@ export const useAuthFormState = (
     otp,
     isLoading,
     acceptedTerms,
+    marketingConsent,
     step,
     error,
     twoFactorSessionId,
@@ -78,6 +82,7 @@ export const useAuthFormState = (
     setIdentifier,
     setOtp,
     setAcceptedTerms,
+    setMarketingConsent,
     setError,
     clearError,
     setStep,

package/src/auth/types/form.ts

@@ -30,6 +30,17 @@ export interface OTPRequestResult {
   webmail?: WebmailLink | null;
 }
 
+/**
+ * Marketing-consent payload attached to an OTP request when the consuming
+ * app enables the opt-in checkbox. Absent ⇒ the request body is unchanged.
+ */
+export interface OTPRequestConsent {
+  /** Checkbox value at submit time. */
+  marketingConsent: boolean;
+  /** Version tag of the disclosure copy the user saw (e.g. "product-updates-reg-v1"). */
+  disclosureVersion: string;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Form State
 // ─────────────────────────────────────────────────────────────────────────────
@@ -43,6 +54,12 @@ export interface AuthFormState {
   isLoading: boolean;
   /** Terms acceptance state */
   acceptedTerms: boolean;
+  /**
+   * Marketing-consent checkbox state. `null` = feature not initialised (no
+   * checkbox rendered, or default not yet resolved); the layout owns the
+   * jurisdiction-aware default on mount.
+   */
+  marketingConsent: boolean | null;
   /** Current form step */
   step: AuthStep;
   /** Error message */
@@ -73,6 +90,7 @@ export interface AuthFormStateHandlers {
   setIdentifier: (identifier: string) => void;
   setOtp: (otp: string) => void;
   setAcceptedTerms: (accepted: boolean) => void;
+  setMarketingConsent: (consent: boolean | null) => void;
   setError: (error: string) => void;
   clearError: () => void;
   setStep: (step: AuthStep) => void;
@@ -161,6 +179,15 @@ export interface UseAuthFormOptions {
   redirectUrl?: string;
   /** If true, user must accept terms before submitting. Default: false */
   requireTermsAcceptance?: boolean;
+  /**
+   * Enables the marketing-consent opt-in: when set, the checkbox value +
+   * this disclosure version are sent with the OTP request. Absent ⇒ the
+   * request body is unchanged (backward compatible).
+   */
+  marketingConsent?: {
+    /** Version tag of the disclosure copy shown next to the checkbox. */
+    disclosureVersion: string;
+  };
   /** Path to auth page for auto-OTP detection. Default: '/auth' */
   authPath?: string;
 }

package/src/auth/types/index.ts

@@ -13,6 +13,7 @@ export type {
   AuthFormReturn,
   UseAuthFormOptions,
   OTPRequestResult,
+  OTPRequestConsent,
   WebmailLink,
 } from './form';
 

package/src/hooks/index.ts

@@ -1 +1,7 @@
 export { useApiKey, type UseApiKeyReturn } from './useApiKey';
+
+// Consent policy (GET /cfg/accounts/otp/consent-policy/) — server-decided
+// default for the marketing-consent checkbox, derived from the request's
+// country. Re-exported directly: the generated SWR hook needs no wrapping.
+export { useCfgAccountsOtpConsentPolicyRetrieve } from '../_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpConsentPolicyRetrieve';
+export type { ConsentPolicy } from '../_api/generated/_cfg_accounts/schemas/ConsentPolicy';