@djangocfg/api 2.1.481 → 2.1.483

package/README.md

@@ -55,7 +55,7 @@ const tokens = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({
 import { AuthProvider, useAuth } from '@djangocfg/api/auth';
 
 // Provider
-<AuthProvider config={{ routes: { auth: '/auth', defaultCallback: '/dashboard' } }}>
+<AuthProvider config={{ routes: { auth: '/auth', defaultCallback: '/private' } }}>
   {children}
 </AuthProvider>
 

package/dist/auth.cjs

@@ -182,6 +182,24 @@ var localStorageBackend = {
     }
   }
 };
+var sessionStorageBackend = {
+  get(key) {
+    if (!isBrowser) return null;
+    try {
+      return window.sessionStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    if (!isBrowser) return;
+    try {
+      if (value === null) window.sessionStorage.removeItem(key);
+      else window.sessionStorage.setItem(key, value);
+    } catch {
+    }
+  }
+};
 var COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
 var cookieBackend = {
   get(key) {
@@ -189,7 +207,8 @@ var cookieBackend = {
     try {
       const re = new RegExp(`(?:^|;\\s*)${encodeURIComponent(key)}=([^;]*)`);
       const m = document.cookie.match(re);
-      return m ? decodeURIComponent(m[1]) : null;
+      const value = m?.[1];
+      return value === void 0 ? null : decodeURIComponent(value);
     } catch {
       return null;
     }
@@ -215,7 +234,8 @@ function detectLocale() {
   try {
     if (typeof document !== "undefined") {
       const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
-      if (m) return decodeURIComponent(m[1]);
+      const locale = m?.[1];
+      if (locale !== void 0) return decodeURIComponent(locale);
     }
     if (typeof navigator !== "undefined" && navigator.language) {
       return navigator.language;
@@ -365,7 +385,7 @@ var auth = {
   },
   setStorageMode(mode) {
     _storageMode = mode;
-    _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
+    _storage = mode === "cookie" ? cookieBackend : mode === "sessionStorage" ? sessionStorageBackend : localStorageBackend;
     notifySessionChanged();
   },
   // ── Bearer token ──────────────────────────────────────────────────
@@ -629,7 +649,7 @@ __name(_getDpopKeyPair, "_getDpopKeyPair");
 function _b64urlFromBytes(bytes) {
   const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let s = "";
-  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i] ?? 0);
   return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 __name(_b64urlFromBytes, "_b64urlFromBytes");
@@ -647,7 +667,8 @@ async function _makeDpopProof(method, url) {
     const pair = await _getDpopKeyPair();
     const jwk = await _publicJwk(pair.publicKey);
     const header = { typ: "dpop+jwt", alg: "ES256", jwk };
-    const htu = url.split("#")[0].split("?")[0];
+    const withoutFragment = url.split("#")[0] ?? url;
+    const htu = withoutFragment.split("?")[0] ?? withoutFragment;
     const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
     const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
     const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
@@ -1019,6 +1040,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [isLoading, setIsLoading] = (0, import_react4.useState)(false);
   const [acceptedTerms, setAcceptedTerms] = (0, import_react4.useState)(true);
   const [marketingConsent, setMarketingConsent] = (0, import_react4.useState)(null);
+  const [rememberMe, setRememberMe] = (0, import_react4.useState)(false);
   const [step, setStep] = (0, import_react4.useState)("identifier");
   const [error, setError] = (0, import_react4.useState)("");
   const [webmail, setWebmail] = (0, import_react4.useState)(null);
@@ -1053,6 +1075,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     isLoading,
     acceptedTerms,
     marketingConsent,
+    rememberMe,
     step,
     error,
     twoFactorSessionId,
@@ -1068,6 +1091,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     setOtp,
     setAcceptedTerms,
     setMarketingConsent,
+    setRememberMe,
     setError,
     clearError,
     setStep,
@@ -2061,9 +2085,9 @@ var CfgAccountsOauth = class {
     return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });
   }
 };
-var CfgAccounts = class {
+var CfgAccountsOtp = class {
   static {
-    __name(this, "CfgAccounts");
+    __name(this, "CfgAccountsOtp");
   }
   /**
    * Marketing-consent checkbox policy for the caller's jurisdiction.
@@ -2674,7 +2698,7 @@ var consumeSavedRedirect = /* @__PURE__ */ __name(() => {
   return stored || null;
 }, "consumeSavedRedirect");
 var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
-  const { fallbackUrl = "/dashboard", clearOnUse = true } = options;
+  const { fallbackUrl = "/private", clearOnUse = true } = options;
   const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage(AUTH_REDIRECT_KEY, "");
   const setRedirect = /* @__PURE__ */ __name((url) => {
     setRedirectUrl(url);
@@ -2753,6 +2777,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     setError(null);
   }, []);
   const handleSuccess = (0, import_react8.useCallback)((response) => {
+    auth.setStorageMode(response.persistent_session ? "localStorage" : "sessionStorage");
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -2769,7 +2794,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     }
     onSuccess?.(response.user);
     if (!skipRedirect) {
-      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/";
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/private";
       authLogger.info("2FA successful, redirecting to:", finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }
@@ -2903,6 +2928,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     isLoading,
     acceptedTerms,
     marketingConsent,
+    rememberMe,
     twoFactorSessionId,
     twoFactorCode,
     useBackupCode,
@@ -3018,7 +3044,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setIsLoading(true);
     clearError();
     try {
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
       if (result.requires_2fa && result.session_id) {
         authLogger.info("2FA required after OTP verification");
         setTwoFactorSessionId(result.session_id);
@@ -3046,7 +3072,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     } finally {
       setIsLoading(false);
     }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
   const handleOTPSubmit = (0, import_react9.useCallback)(async (e) => {
     e.preventDefault();
     await submitOTP(identifier, otp);
@@ -3165,13 +3191,14 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
 // src/auth/hooks/useGithubAuth.ts
 var import_react10 = require("react");
 var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
   const [isLoading, setIsLoading] = (0, import_react10.useState)(false);
   const [error, setError] = (0, import_react10.useState)(null);
   const startGithubAuth = (0, import_react10.useCallback)(async () => {
     setIsLoading(true);
     setError(null);
+    auth.clearSession();
     try {
       authLogger.info("Starting GitHub OAuth flow...");
       Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
@@ -3192,6 +3219,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       if (typeof window !== "undefined") {
         sessionStorage.setItem("oauth_state", response.state);
         sessionStorage.setItem("oauth_provider", "github");
+        sessionStorage.setItem("cfg.oauth.remember_me", String(rememberMe));
       }
       window.location.href = response.authorization_url;
     } catch (err) {
@@ -3206,22 +3234,25 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
     } finally {
       setIsLoading(false);
     }
-  }, [sourceUrl, onError]);
+  }, [sourceUrl, rememberMe, onError]);
   const handleGithubCallback = (0, import_react10.useCallback)(async (code, state) => {
     setIsLoading(true);
     setError(null);
     try {
       authLogger.info("Processing GitHub OAuth callback...");
+      let rememberMeForSession = false;
       if (typeof window !== "undefined") {
         const storedState = sessionStorage.getItem("oauth_state");
         if (storedState && storedState !== state) {
           throw new Error("Invalid OAuth state - possible CSRF attack");
         }
+        rememberMeForSession = sessionStorage.getItem("cfg.oauth.remember_me") === "true";
         sessionStorage.removeItem("oauth_state");
         sessionStorage.removeItem("oauth_provider");
+        sessionStorage.removeItem("cfg.oauth.remember_me");
       }
       const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state },
+        body: { code, state, remember_me: rememberMeForSession },
         throwOnError: true
       });
       const response = result.data;
@@ -3238,6 +3269,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
         throw new Error("Invalid response from OAuth callback");
       }
       authLogger.info("GitHub OAuth successful, user:", response.user);
+      auth.setStorageMode(response.persistent_session ? "localStorage" : "sessionStorage");
       auth.setSession({ access: response.access, refresh: response.refresh });
       Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
         category: "auth" /* AUTH */,
@@ -3248,9 +3280,10 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       }
       onSuccess?.(response.user, response.is_new_user || false);
       if (!skipRedirect) {
-        const finalRedirectUrl = redirectUrl || "/dashboard";
+        const finalRedirectUrl = redirectUrl || "/private";
         router.hardPush(finalRedirectUrl);
       }
+      return;
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : "GitHub authentication failed";
       authLogger.error("GitHub OAuth callback error:", err);
@@ -3263,7 +3296,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
     } finally {
       setIsLoading(false);
     }
-  }, [onSuccess, onError, redirectUrl, router]);
+  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
   return {
     isLoading,
     error,
@@ -3897,7 +3930,8 @@ var OAuthTokenResponseSchema = import_zod10.z.object({
   user: import_zod10.z.object({}).passthrough().nullable().optional(),
   is_new_user: import_zod10.z.boolean().default(false).optional(),
   is_new_connection: import_zod10.z.boolean().default(false).optional(),
-  should_prompt_2fa: import_zod10.z.boolean().optional()
+  should_prompt_2fa: import_zod10.z.boolean().optional(),
+  persistent_session: import_zod10.z.boolean().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
@@ -3957,7 +3991,7 @@ function useCfgAccountsOtpRequestCreate(config) {
   return (0, import_mutation7.default)(
     ["cfg_accounts_otp_request_create"],
     async (_key, { arg }) => {
-      const res = await CfgAccounts.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
+      const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
       const data = res.data;
       const parsed = OTPRequestResponseSchema.safeParse(data);
       if (!parsed.success) {
@@ -4048,7 +4082,8 @@ var OTPVerifyResponseSchema = import_zod19.z.object({
   refresh: import_zod19.z.string().nullable().optional(),
   access: import_zod19.z.string().nullable().optional(),
   user: UserSchema.nullable().optional(),
-  should_prompt_2fa: import_zod19.z.boolean().optional()
+  should_prompt_2fa: import_zod19.z.boolean().optional(),
+  persistent_session: import_zod19.z.boolean().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
@@ -4056,7 +4091,7 @@ function useCfgAccountsOtpVerifyCreate(config) {
   return (0, import_mutation8.default)(
     ["cfg_accounts_otp_verify_create"],
     async (_key, { arg }) => {
-      const res = await CfgAccounts.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true });
+      const res = await CfgAccountsOtp.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true });
       const data = res.data;
       const parsed = OTPVerifyResponseSchema.safeParse(data);
       if (!parsed.success) {
@@ -4312,7 +4347,8 @@ var import_zod26 = require("zod");
 var OAuthCallbackRequestRequestSchema = import_zod26.z.object({
   code: import_zod26.z.string().min(10).max(500),
   state: import_zod26.z.string().min(20).max(100),
-  redirect_uri: import_zod26.z.string().optional()
+  redirect_uri: import_zod26.z.string().optional(),
+  remember_me: import_zod26.z.boolean().default(false).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
@@ -4350,7 +4386,8 @@ var import_zod31 = require("zod");
 var OTPVerifyRequestSchema = import_zod31.z.object({
   identifier: import_zod31.z.string().min(1),
   otp: import_zod31.z.string().min(4).max(4),
-  source_url: import_zod31.z.string().optional()
+  source_url: import_zod31.z.string().optional(),
+  remember_me: import_zod31.z.boolean().default(false).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
@@ -4452,6 +4489,7 @@ function AccountsProvider({ children }) {
       return result;
     }
     if (result.access && result.refresh) {
+      auth.setStorageMode(result.persistent_session ? "localStorage" : "sessionStorage");
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: "verifyOTP", force: true });
@@ -4512,7 +4550,7 @@ __name(useAccountsContext, "useAccountsContext");
 var import_jsx_runtime2 = require("react/jsx-runtime");
 var defaultRoutes = {
   auth: "/auth",
-  defaultCallback: "/",
+  defaultCallback: "/private",
   defaultAuthCallback: "/auth"
 };
 var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
@@ -4670,13 +4708,14 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     []
   );
   const verifyOTP = (0, import_react16.useCallback)(
-    async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
+    async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect, rememberMe = false) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
         const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
-          source_url: sourceUrl
+          source_url: sourceUrl,
+          remember_me: rememberMe
         });
         if (result.requires_2fa && result.session_id) {
           authLogger.info("2FA required, session:", result.session_id);