@djangocfg/api 2.1.481 → 2.1.483

package/src/auth/context/AuthContext.tsx

@@ -49,7 +49,7 @@ import type { OtpRequestRequest } from '../../_api/generated/_cfg_accounts/types
 // everything downstream reads the RESOLVED values from `useAuth().routes`.
 const defaultRoutes = {
   auth: '/auth',
-  defaultCallback: '/',
+  defaultCallback: '/private',
   defaultAuthCallback: '/auth',
 };
 
@@ -288,6 +288,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       sourceUrl?: string,
       redirectUrl?: string,
       skipRedirect?: boolean,
+      rememberMe = false,
     ): Promise<{
       success: boolean;
       message: string;
@@ -305,6 +306,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
           identifier,
           otp: otpCode,
           source_url: sourceUrl,
+          remember_me: rememberMe,
         });
 
         if (result.requires_2fa && result.session_id) {
@@ -322,7 +324,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
           authLogger.error('Verify OTP returned invalid response:', result);
           return { success: false, message: 'Invalid OTP verification response' };
         }
-
         if (identifier.includes('@')) {
           setStoredEmail(identifier);
         }

package/src/auth/context/types.ts

@@ -50,7 +50,7 @@ export interface AuthContextType {
 
   // OTP Methods - email only
   requestOTP: (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent) => Promise<OTPRequestResult>;
-  verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean) => Promise<{
+  verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean, rememberMe?: boolean) => Promise<{
     success: boolean;
     message: string;
     user?: UserProfile;

package/src/auth/hooks/useAuthForm.ts

@@ -54,6 +54,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     isLoading,
     acceptedTerms,
     marketingConsent,
+    rememberMe,
     twoFactorSessionId,
     twoFactorCode,
     useBackupCode,
@@ -193,7 +194,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
 
     try {
       // Skip redirect - we'll show success screen first
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
 
       // Check if 2FA is required (user has TOTP device)
       if (result.requires_2fa && result.session_id) {
@@ -228,7 +229,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     } finally {
       setIsLoading(false);
     }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
 
   const handleOTPSubmit = useCallback(async (e: React.FormEvent) => {
     e.preventDefault();

package/src/auth/hooks/useAuthFormState.ts

@@ -26,6 +26,7 @@ export const useAuthFormState = (
   // null until the marketing-consent feature (if enabled) resolves its
   // jurisdiction-aware default — the layout owns that decision.
   const [marketingConsent, setMarketingConsent] = useState<boolean | null>(null);
+  const [rememberMe, setRememberMe] = useState(false);
   const [step, setStep] = useState<AuthStep>('identifier');
   const [error, setError] = useState('');
   const [webmail, setWebmail] = useState<WebmailLink | null>(null);
@@ -68,6 +69,7 @@ export const useAuthFormState = (
     isLoading,
     acceptedTerms,
     marketingConsent,
+    rememberMe,
     step,
     error,
     twoFactorSessionId,
@@ -83,6 +85,7 @@ export const useAuthFormState = (
     setOtp,
     setAcceptedTerms,
     setMarketingConsent,
+    setRememberMe,
     setError,
     clearError,
     setStep,

package/src/auth/hooks/useAuthRedirect.ts

@@ -52,7 +52,7 @@ export const consumeSavedRedirect = (): string | null => {
 };
 
 export const useAuthRedirectManager = (options: AuthRedirectOptions = {}) => {
-  const { fallbackUrl = '/dashboard', clearOnUse = true } = options;
+  const { fallbackUrl = '/private', clearOnUse = true } = options;
   const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage<string>(AUTH_REDIRECT_KEY, '');
 
   const setRedirect = (url: string) => {
@@ -101,4 +101,4 @@ export const useAuthRedirectManager = (options: AuthRedirectOptions = {}) => {
     getFinalRedirectUrl,
     useAndClearRedirect
   };
-}; 
+}; 

package/src/auth/hooks/useGithubAuth.ts

@@ -10,6 +10,8 @@ import { useCfgRouter } from './useCfgRouter';
 
 export interface UseGithubAuthOptions {
   sourceUrl?: string;
+  /** Keep the completed browser session for 30 days. */
+  rememberMe?: boolean;
   onSuccess?: (user: any, isNewUser: boolean) => void;
   onError?: (error: string) => void;
   /** Callback when 2FA is required */
@@ -46,7 +48,7 @@ export interface UseGithubAuthReturn {
  * ```
  */
 export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuthReturn => {
-  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
 
   const [isLoading, setIsLoading] = useState(false);
@@ -58,6 +60,9 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
   const startGithubAuth = useCallback(async () => {
     setIsLoading(true);
     setError(null);
+    // Match the OTP flow: a new login must not leave an older persistent
+    // session available after this browser is intentionally made session-only.
+    auth.clearSession();
 
     try {
       authLogger.info('Starting GitHub OAuth flow...');
@@ -87,6 +92,7 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       if (typeof window !== 'undefined') {
         sessionStorage.setItem('oauth_state', response.state);
         sessionStorage.setItem('oauth_provider', 'github');
+        sessionStorage.setItem('cfg.oauth.remember_me', String(rememberMe));
       }
 
       window.location.href = response.authorization_url;
@@ -105,7 +111,7 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
     } finally {
       setIsLoading(false);
     }
-  }, [sourceUrl, onError]);
+  }, [sourceUrl, rememberMe, onError]);
 
   /**
    * Handle GitHub OAuth callback - exchanges code for JWT tokens.
@@ -121,34 +127,38 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       authLogger.info('Processing GitHub OAuth callback...');
 
       // Verify state matches what we stored
+      let rememberMeForSession = false;
       if (typeof window !== 'undefined') {
         const storedState = sessionStorage.getItem('oauth_state');
         if (storedState && storedState !== state) {
           throw new Error('Invalid OAuth state - possible CSRF attack');
         }
+        rememberMeForSession = sessionStorage.getItem('cfg.oauth.remember_me') === 'true';
         // Clear stored state
         sessionStorage.removeItem('oauth_state');
         sessionStorage.removeItem('oauth_provider');
+        sessionStorage.removeItem('cfg.oauth.remember_me');
+
       }
 
       const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state },
+        body: { code, state, remember_me: rememberMeForSession },
         throwOnError: true,
       });
       const response = result.data;
 
       // Check if 2FA is required
       if (response.requires_2fa && response.session_id) {
-        authLogger.info('GitHub OAuth requires 2FA, session:', response.session_id);
+          authLogger.info('GitHub OAuth requires 2FA, session:', response.session_id);
 
-        // Track 2FA requirement
-        Analytics.event(AnalyticsEvent.AUTH_OAUTH_START, {
-          category: AnalyticsCategory.AUTH,
-          label: 'github-2fa-required',
-        });
+          // Track 2FA requirement
+          Analytics.event(AnalyticsEvent.AUTH_OAUTH_START, {
+            category: AnalyticsCategory.AUTH,
+            label: 'github-2fa-required',
+          });
 
-        // Call 2FA callback
-        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
+          // Call 2FA callback
+          onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
         return;
       }
 
@@ -158,30 +168,33 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
 
       authLogger.info('GitHub OAuth successful, user:', response.user);
 
-      // The ONE write path — atomic pair + session notification.
+      auth.setStorageMode(response.persistent_session ? 'localStorage' : 'sessionStorage');
+        // The ONE write path — atomic pair + session notification.
       auth.setSession({ access: response.access, refresh: response.refresh });
 
-      // Track successful OAuth
+        // Track successful OAuth
       Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {
-        category: AnalyticsCategory.AUTH,
-        label: 'github',
+          category: AnalyticsCategory.AUTH,
+          label: 'github',
       });
 
-      // Set user ID for future tracking
+        // Set user ID for future tracking
       if (response.user?.id) {
         Analytics.setUser(String(response.user.id));
       }
 
-      // Call success callback
+        // Call success callback
       onSuccess?.(response.user, response.is_new_user || false);
 
-      // Redirect (unless skipRedirect is true)
+        // Redirect (unless skipRedirect is true)
       if (!skipRedirect) {
-        // Use hardPush for full page reload - ensures all React contexts reinitialize
-        const finalRedirectUrl = redirectUrl || '/dashboard';
+          // Use hardPush for full page reload - ensures all React contexts reinitialize
+        const finalRedirectUrl = redirectUrl || '/private';
         router.hardPush(finalRedirectUrl);
       }
 
+      return;
+
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : 'GitHub authentication failed';
       authLogger.error('GitHub OAuth callback error:', err);
@@ -196,7 +209,7 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
     } finally {
       setIsLoading(false);
     }
-  }, [onSuccess, onError, redirectUrl, router]);
+  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
 
   return {
     isLoading,

package/src/auth/hooks/useTwoFactorVerify.ts

@@ -67,9 +67,11 @@ export const useTwoFactorVerify = (
     access_token: string;
     refresh_token: string;
     user: any;
-    warning?: string;
-    remaining_backup_codes?: number;
+  warning?: string;
+  remaining_backup_codes?: number;
+  persistent_session: boolean;
   }) => {
+    auth.setStorageMode(response.persistent_session ? 'localStorage' : 'sessionStorage');
     // Save tokens — the ONE write path (atomic pair + session notification).
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
 
@@ -92,7 +94,7 @@ export const useTwoFactorVerify = (
 
     // Redirect (unless skipRedirect). Priority: saved back-url > option > default.
     if (!skipRedirect) {
-      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || '/';
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || '/private';
       authLogger.info('2FA successful, redirecting to:', finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }

package/src/auth/types/form.ts

@@ -60,6 +60,8 @@ export interface AuthFormState {
    * jurisdiction-aware default on mount.
    */
   marketingConsent: boolean | null;
+  /** Keep this browser signed in for 30 days after successful verification. */
+  rememberMe: boolean;
   /** Current form step */
   step: AuthStep;
   /** Error message */
@@ -91,6 +93,7 @@ export interface AuthFormStateHandlers {
   setOtp: (otp: string) => void;
   setAcceptedTerms: (accepted: boolean) => void;
   setMarketingConsent: (consent: boolean | null) => void;
+  setRememberMe: (rememberMe: boolean) => void;
   setError: (error: string) => void;
   clearError: () => void;
   setStep: (step: AuthStep) => void;
@@ -191,4 +194,3 @@ export interface UseAuthFormOptions {
   /** Path to auth page for auto-OTP detection. Default: '/auth' */
   authPath?: string;
 }
-

package/src/index.ts

@@ -14,7 +14,11 @@ export * from './_api/generated';
 export {
   CfgAccountsApiKey,
   CfgAccountsOauth,
-  CfgAccounts,
+  // Compatibility alias: the OTP operations were split out of the legacy
+  // `CfgAccounts` generated class, but this package's public API keeps that
+  // import stable for existing applications.
+  CfgAccountsOtp as CfgAccounts,
+  CfgAccountsOtp,
   CfgAccountsProfile,
   CfgAccountsAuth,
   CfgCentrifugo,