@djangocfg/api 2.1.483 → 2.1.486

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.483",
+  "version": "2.1.486",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -84,7 +84,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.483",
+    "@djangocfg/typescript-config": "^2.1.486",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/_api/generated/helpers/auth.ts

@@ -77,8 +77,41 @@ const cookieBackend: KVStore = {
   },
 };
 
-let _storage: KVStore = localStorageBackend;
-let _storageMode: StorageMode = 'localStorage';
+function backendFor(mode: StorageMode): KVStore {
+  return mode === 'cookie'
+    ? cookieBackend
+    : mode === 'sessionStorage'
+      ? sessionStorageBackend
+      : localStorageBackend;
+}
+
+/**
+ * Which backend holds the session — persisted, because the mode has to outlive
+ * the module.
+ *
+ * A non-persistent sign-in ("remember me" unchecked) writes its tokens to
+ * `sessionStorage`. Without this marker the next page load would start from the
+ * `localStorage` default and look there instead — finding nothing, and silently
+ * bouncing an authenticated user back to the login form. The marker itself is
+ * NOT the session: it lives in `localStorage` (a plain enum, no credential), so
+ * only the tokens follow the tab's lifetime.
+ */
+const STORAGE_MODE_KEY = 'cfg.access_token.storage_mode';
+
+function readPersistedMode(): StorageMode {
+  if (!isBrowser) return 'localStorage';
+  try {
+    const raw = window.localStorage.getItem(STORAGE_MODE_KEY);
+    return raw === 'sessionStorage' || raw === 'cookie' || raw === 'localStorage'
+      ? raw
+      : 'localStorage';
+  } catch {
+    return 'localStorage';
+  }
+}
+
+let _storageMode: StorageMode = readPersistedMode();
+let _storage: KVStore = backendFor(_storageMode);
 
 /** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */
 function detectLocale(): string | null {
@@ -326,11 +359,11 @@ export const auth = {
   getStorageMode(): StorageMode { return _storageMode; },
   setStorageMode(mode: StorageMode): void {
     _storageMode = mode;
-    _storage = mode === 'cookie'
-      ? cookieBackend
-      : mode === 'sessionStorage'
-        ? sessionStorageBackend
-        : localStorageBackend;
+    _storage = backendFor(mode);
+    // Persist the choice so the next page load reads from the same backend.
+    if (isBrowser) {
+      try { window.localStorage.setItem(STORAGE_MODE_KEY, mode); } catch {}
+    }
     notifySessionChanged();
   },
 
@@ -346,8 +379,19 @@ export const auth = {
     notifySessionChanged();
   },
   clearTokens(): void {
-    _storage.set(ACCESS_KEY, null);
-    _storage.set(REFRESH_KEY, null);
+    // Clear every backend, not just the active one: a sign-out must not leave a
+    // stale token behind in the backend the PREVIOUS session used, or the next
+    // page load would resurrect it.
+    for (const backend of [localStorageBackend, sessionStorageBackend, cookieBackend]) {
+      backend.set(ACCESS_KEY, null);
+      backend.set(REFRESH_KEY, null);
+    }
+    // Back to the default, so the next sign-in starts from a known mode.
+    _storageMode = 'localStorage';
+    _storage = localStorageBackend;
+    if (isBrowser) {
+      try { window.localStorage.removeItem(STORAGE_MODE_KEY); } catch {}
+    }
     notifySessionChanged();
   },
   /** Session-aware: token PRESENT and not past its `exp` (or a live refresh

package/src/auth/context/AccountsContext.tsx

@@ -30,6 +30,25 @@ import { PatchedCfgUserUpdateRequestSchema } from '../../_api/generated/_cfg_acc
 import { clearProfileCache, getCachedProfile, setCachedProfile } from '../hooks/useProfileCache';
 import { authLogger } from '../utils/logger';
 
+/**
+ * Whether this build has a usable API origin.
+ *
+ * `NEXT_PUBLIC_API_URL` is inlined at build time; when it is missing the
+ * generated client falls back to `''`, and every request becomes relative to
+ * whatever page the user is on. A static build is same-origin by design, so
+ * relative paths ARE correct there.
+ */
+function hasApiOrigin(): boolean {
+  try {
+    if (typeof process === 'undefined' || !process.env) return false;
+    if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return true;
+    if (process.env.NEXT_PUBLIC_API_PROXY_URL !== undefined) return true;
+    return Boolean(process.env.NEXT_PUBLIC_API_URL);
+  } catch {
+    return false;
+  }
+}
+
 import type {
     User,
     CfgUserUpdateRequest,
@@ -96,6 +115,15 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
   const refreshProfile = useCallback(async (options?: { callerId?: string; force?: boolean }): Promise<User | undefined> => {
     const { callerId, force } = options || {};
 
+    // No API origin configured → skip the request instead of letting it resolve
+    // against the current page. A relative URL on an i18n-prefixed route turns
+    // `/cfg/accounts/profile` into `/<locale>/cfg/accounts/profile` on the
+    // site's own origin — a 404 that only ever shows up in production.
+    if (!hasApiOrigin()) {
+      authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);
+      return undefined;
+    }
+
     if (isLoadingRef.current) {
       authLogger.debug(`Profile loading in progress, skipping (caller: ${callerId})`);
       return profileRef.current;