@djangocfg/api 2.1.482 → 2.1.483

package/dist/auth.d.cts

@@ -107,6 +107,10 @@ type OtpVerifyRequest = {
      * Source URL for tracking login (e.g., https://my.djangocfg.com)
      */
     source_url?: string;
+    /**
+     * Keep this browser signed in for 30 days
+     */
+    remember_me?: boolean;
 };
 /**
  * OTP verification response.
@@ -146,6 +150,10 @@ type OtpVerifyResponse = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
+    /**
+     * Whether this login should persist across browser restarts
+     */
+    persistent_session?: boolean;
 };
 /**
  * Serializer for updating user profile.
@@ -371,6 +379,8 @@ interface AuthFormState {
      * jurisdiction-aware default on mount.
      */
     marketingConsent: boolean | null;
+    /** Keep this browser signed in for 30 days after successful verification. */
+    rememberMe: boolean;
     /** Current form step */
     step: AuthStep;
     /** Error message */
@@ -397,6 +407,7 @@ interface AuthFormStateHandlers {
     setOtp: (otp: string) => void;
     setAcceptedTerms: (accepted: boolean) => void;
     setMarketingConsent: (consent: boolean | null) => void;
+    setRememberMe: (rememberMe: boolean) => void;
     setError: (error: string) => void;
     clearError: () => void;
     setStep: (step: AuthStep) => void;
@@ -502,7 +513,7 @@ interface AuthContextType {
     saveEmail: (email: string) => void;
     clearSavedEmail: () => void;
     requestOTP: (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent) => Promise<OTPRequestResult>;
-    verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean) => Promise<{
+    verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean, rememberMe?: boolean) => Promise<{
         success: boolean;
         message: string;
         user?: UserProfile;
@@ -696,6 +707,8 @@ declare const useAutoAuth: (options?: UseAutoAuthOptions) => {
 
 interface UseGithubAuthOptions {
     sourceUrl?: string;
+    /** Keep the completed browser session for 30 days. */
+    rememberMe?: boolean;
     onSuccess?: (user: any, isNewUser: boolean) => void;
     onError?: (error: string) => void;
     /** Callback when 2FA is required */

package/dist/auth.d.ts

@@ -107,6 +107,10 @@ type OtpVerifyRequest = {
      * Source URL for tracking login (e.g., https://my.djangocfg.com)
      */
     source_url?: string;
+    /**
+     * Keep this browser signed in for 30 days
+     */
+    remember_me?: boolean;
 };
 /**
  * OTP verification response.
@@ -146,6 +150,10 @@ type OtpVerifyResponse = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
+    /**
+     * Whether this login should persist across browser restarts
+     */
+    persistent_session?: boolean;
 };
 /**
  * Serializer for updating user profile.
@@ -371,6 +379,8 @@ interface AuthFormState {
      * jurisdiction-aware default on mount.
      */
     marketingConsent: boolean | null;
+    /** Keep this browser signed in for 30 days after successful verification. */
+    rememberMe: boolean;
     /** Current form step */
     step: AuthStep;
     /** Error message */
@@ -397,6 +407,7 @@ interface AuthFormStateHandlers {
     setOtp: (otp: string) => void;
     setAcceptedTerms: (accepted: boolean) => void;
     setMarketingConsent: (consent: boolean | null) => void;
+    setRememberMe: (rememberMe: boolean) => void;
     setError: (error: string) => void;
     clearError: () => void;
     setStep: (step: AuthStep) => void;
@@ -502,7 +513,7 @@ interface AuthContextType {
     saveEmail: (email: string) => void;
     clearSavedEmail: () => void;
     requestOTP: (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent) => Promise<OTPRequestResult>;
-    verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean) => Promise<{
+    verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean, rememberMe?: boolean) => Promise<{
         success: boolean;
         message: string;
         user?: UserProfile;
@@ -696,6 +707,8 @@ declare const useAutoAuth: (options?: UseAutoAuthOptions) => {
 
 interface UseGithubAuthOptions {
     sourceUrl?: string;
+    /** Keep the completed browser session for 30 days. */
+    rememberMe?: boolean;
     onSuccess?: (user: any, isNewUser: boolean) => void;
     onError?: (error: string) => void;
     /** Callback when 2FA is required */

package/dist/auth.mjs

@@ -112,6 +112,24 @@ var localStorageBackend = {
     }
   }
 };
+var sessionStorageBackend = {
+  get(key) {
+    if (!isBrowser) return null;
+    try {
+      return window.sessionStorage.getItem(key);
+    } catch {
+      return null;
+    }
+  },
+  set(key, value) {
+    if (!isBrowser) return;
+    try {
+      if (value === null) window.sessionStorage.removeItem(key);
+      else window.sessionStorage.setItem(key, value);
+    } catch {
+    }
+  }
+};
 var COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
 var cookieBackend = {
   get(key) {
@@ -119,7 +137,8 @@ var cookieBackend = {
     try {
       const re = new RegExp(`(?:^|;\\s*)${encodeURIComponent(key)}=([^;]*)`);
       const m = document.cookie.match(re);
-      return m ? decodeURIComponent(m[1]) : null;
+      const value = m?.[1];
+      return value === void 0 ? null : decodeURIComponent(value);
     } catch {
       return null;
     }
@@ -145,7 +164,8 @@ function detectLocale() {
   try {
     if (typeof document !== "undefined") {
       const m = document.cookie.match(/(?:^|;\s*)NEXT_LOCALE=([^;]*)/);
-      if (m) return decodeURIComponent(m[1]);
+      const locale = m?.[1];
+      if (locale !== void 0) return decodeURIComponent(locale);
     }
     if (typeof navigator !== "undefined" && navigator.language) {
       return navigator.language;
@@ -295,7 +315,7 @@ var auth = {
   },
   setStorageMode(mode) {
     _storageMode = mode;
-    _storage = mode === "cookie" ? cookieBackend : localStorageBackend;
+    _storage = mode === "cookie" ? cookieBackend : mode === "sessionStorage" ? sessionStorageBackend : localStorageBackend;
     notifySessionChanged();
   },
   // ── Bearer token ──────────────────────────────────────────────────
@@ -559,7 +579,7 @@ __name(_getDpopKeyPair, "_getDpopKeyPair");
 function _b64urlFromBytes(bytes) {
   const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
   let s = "";
-  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i]);
+  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i] ?? 0);
   return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 __name(_b64urlFromBytes, "_b64urlFromBytes");
@@ -577,7 +597,8 @@ async function _makeDpopProof(method, url) {
     const pair = await _getDpopKeyPair();
     const jwk = await _publicJwk(pair.publicKey);
     const header = { typ: "dpop+jwt", alg: "ES256", jwk };
-    const htu = url.split("#")[0].split("?")[0];
+    const withoutFragment = url.split("#")[0] ?? url;
+    const htu = withoutFragment.split("?")[0] ?? withoutFragment;
     const jti = crypto.randomUUID && crypto.randomUUID() || _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));
     const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1e3), jti };
     const signingInput = `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;
@@ -949,6 +970,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [isLoading, setIsLoading] = useState2(false);
   const [acceptedTerms, setAcceptedTerms] = useState2(true);
   const [marketingConsent, setMarketingConsent] = useState2(null);
+  const [rememberMe, setRememberMe] = useState2(false);
   const [step, setStep] = useState2("identifier");
   const [error, setError] = useState2("");
   const [webmail, setWebmail] = useState2(null);
@@ -983,6 +1005,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     isLoading,
     acceptedTerms,
     marketingConsent,
+    rememberMe,
     step,
     error,
     twoFactorSessionId,
@@ -998,6 +1021,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     setOtp,
     setAcceptedTerms,
     setMarketingConsent,
+    setRememberMe,
     setError,
     clearError,
     setStep,
@@ -1991,9 +2015,9 @@ var CfgAccountsOauth = class {
     return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });
   }
 };
-var CfgAccounts = class {
+var CfgAccountsOtp = class {
   static {
-    __name(this, "CfgAccounts");
+    __name(this, "CfgAccountsOtp");
   }
   /**
    * Marketing-consent checkbox policy for the caller's jurisdiction.
@@ -2604,7 +2628,7 @@ var consumeSavedRedirect = /* @__PURE__ */ __name(() => {
   return stored || null;
 }, "consumeSavedRedirect");
 var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
-  const { fallbackUrl = "/dashboard", clearOnUse = true } = options;
+  const { fallbackUrl = "/private", clearOnUse = true } = options;
   const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage(AUTH_REDIRECT_KEY, "");
   const setRedirect = /* @__PURE__ */ __name((url) => {
     setRedirectUrl(url);
@@ -2683,6 +2707,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     setError(null);
   }, []);
   const handleSuccess = useCallback4((response) => {
+    auth.setStorageMode(response.persistent_session ? "localStorage" : "sessionStorage");
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -2699,7 +2724,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     }
     onSuccess?.(response.user);
     if (!skipRedirect) {
-      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/";
+      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || "/private";
       authLogger.info("2FA successful, redirecting to:", finalRedirectUrl);
       router.hardPush(finalRedirectUrl);
     }
@@ -2833,6 +2858,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     isLoading,
     acceptedTerms,
     marketingConsent,
+    rememberMe,
     twoFactorSessionId,
     twoFactorCode,
     useBackupCode,
@@ -2948,7 +2974,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     setIsLoading(true);
     clearError();
     try {
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
       if (result.requires_2fa && result.session_id) {
         authLogger.info("2FA required after OTP verification");
         setTwoFactorSessionId(result.session_id);
@@ -2976,7 +3002,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     } finally {
       setIsLoading(false);
     }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setTwoFactorSessionId, setShouldPrompt2FA, setStep]);
   const handleOTPSubmit = useCallback5(async (e) => {
     e.preventDefault();
     await submitOTP(identifier, otp);
@@ -3095,13 +3121,14 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
 // src/auth/hooks/useGithubAuth.ts
 import { useCallback as useCallback6, useState as useState5 } from "react";
 var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
   const [isLoading, setIsLoading] = useState5(false);
   const [error, setError] = useState5(null);
   const startGithubAuth = useCallback6(async () => {
     setIsLoading(true);
     setError(null);
+    auth.clearSession();
     try {
       authLogger.info("Starting GitHub OAuth flow...");
       Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
@@ -3122,6 +3149,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       if (typeof window !== "undefined") {
         sessionStorage.setItem("oauth_state", response.state);
         sessionStorage.setItem("oauth_provider", "github");
+        sessionStorage.setItem("cfg.oauth.remember_me", String(rememberMe));
       }
       window.location.href = response.authorization_url;
     } catch (err) {
@@ -3136,22 +3164,25 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
     } finally {
       setIsLoading(false);
     }
-  }, [sourceUrl, onError]);
+  }, [sourceUrl, rememberMe, onError]);
   const handleGithubCallback = useCallback6(async (code, state) => {
     setIsLoading(true);
     setError(null);
     try {
       authLogger.info("Processing GitHub OAuth callback...");
+      let rememberMeForSession = false;
       if (typeof window !== "undefined") {
         const storedState = sessionStorage.getItem("oauth_state");
         if (storedState && storedState !== state) {
           throw new Error("Invalid OAuth state - possible CSRF attack");
         }
+        rememberMeForSession = sessionStorage.getItem("cfg.oauth.remember_me") === "true";
         sessionStorage.removeItem("oauth_state");
         sessionStorage.removeItem("oauth_provider");
+        sessionStorage.removeItem("cfg.oauth.remember_me");
       }
       const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state },
+        body: { code, state, remember_me: rememberMeForSession },
         throwOnError: true
       });
       const response = result.data;
@@ -3168,6 +3199,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
         throw new Error("Invalid response from OAuth callback");
       }
       authLogger.info("GitHub OAuth successful, user:", response.user);
+      auth.setStorageMode(response.persistent_session ? "localStorage" : "sessionStorage");
       auth.setSession({ access: response.access, refresh: response.refresh });
       Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
         category: "auth" /* AUTH */,
@@ -3178,9 +3210,10 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       }
       onSuccess?.(response.user, response.is_new_user || false);
       if (!skipRedirect) {
-        const finalRedirectUrl = redirectUrl || "/dashboard";
+        const finalRedirectUrl = redirectUrl || "/private";
         router.hardPush(finalRedirectUrl);
       }
+      return;
     } catch (err) {
       const errorMessage = err instanceof Error ? err.message : "GitHub authentication failed";
       authLogger.error("GitHub OAuth callback error:", err);
@@ -3193,7 +3226,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
     } finally {
       setIsLoading(false);
     }
-  }, [onSuccess, onError, redirectUrl, router]);
+  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
   return {
     isLoading,
     error,
@@ -3835,7 +3868,8 @@ var OAuthTokenResponseSchema = z10.object({
   user: z10.object({}).passthrough().nullable().optional(),
   is_new_user: z10.boolean().default(false).optional(),
   is_new_connection: z10.boolean().default(false).optional(),
-  should_prompt_2fa: z10.boolean().optional()
+  should_prompt_2fa: z10.boolean().optional(),
+  persistent_session: z10.boolean().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
@@ -3895,7 +3929,7 @@ function useCfgAccountsOtpRequestCreate(config) {
   return useSWRMutation7(
     ["cfg_accounts_otp_request_create"],
     async (_key, { arg }) => {
-      const res = await CfgAccounts.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
+      const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
       const data = res.data;
       const parsed = OTPRequestResponseSchema.safeParse(data);
       if (!parsed.success) {
@@ -3986,7 +4020,8 @@ var OTPVerifyResponseSchema = z19.object({
   refresh: z19.string().nullable().optional(),
   access: z19.string().nullable().optional(),
   user: UserSchema.nullable().optional(),
-  should_prompt_2fa: z19.boolean().optional()
+  should_prompt_2fa: z19.boolean().optional(),
+  persistent_session: z19.boolean().optional()
 });
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
@@ -3994,7 +4029,7 @@ function useCfgAccountsOtpVerifyCreate(config) {
   return useSWRMutation8(
     ["cfg_accounts_otp_verify_create"],
     async (_key, { arg }) => {
-      const res = await CfgAccounts.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true });
+      const res = await CfgAccountsOtp.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true });
       const data = res.data;
       const parsed = OTPVerifyResponseSchema.safeParse(data);
       if (!parsed.success) {
@@ -4250,7 +4285,8 @@ import { z as z26 } from "zod";
 var OAuthCallbackRequestRequestSchema = z26.object({
   code: z26.string().min(10).max(500),
   state: z26.string().min(20).max(100),
-  redirect_uri: z26.string().optional()
+  redirect_uri: z26.string().optional(),
+  remember_me: z26.boolean().default(false).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
@@ -4288,7 +4324,8 @@ import { z as z31 } from "zod";
 var OTPVerifyRequestSchema = z31.object({
   identifier: z31.string().min(1),
   otp: z31.string().min(4).max(4),
-  source_url: z31.string().optional()
+  source_url: z31.string().optional(),
+  remember_me: z31.boolean().default(false).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
@@ -4390,6 +4427,7 @@ function AccountsProvider({ children }) {
       return result;
     }
     if (result.access && result.refresh) {
+      auth.setStorageMode(result.persistent_session ? "localStorage" : "sessionStorage");
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: "verifyOTP", force: true });
@@ -4450,7 +4488,7 @@ __name(useAccountsContext, "useAccountsContext");
 import { Fragment, jsx as jsx2 } from "react/jsx-runtime";
 var defaultRoutes = {
   auth: "/auth",
-  defaultCallback: "/",
+  defaultCallback: "/private",
   defaultAuthCallback: "/auth"
 };
 var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
@@ -4608,13 +4646,14 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     []
   );
   const verifyOTP = useCallback11(
-    async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
+    async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect, rememberMe = false) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
         const result = await accountsRef.current.verifyOTP({
           identifier,
           otp: otpCode,
-          source_url: sourceUrl
+          source_url: sourceUrl,
+          remember_me: rememberMe
         });
         if (result.requires_2fa && result.session_id) {
           authLogger.info("2FA required, session:", result.session_id);