@djangocfg/api 2.1.484 → 2.1.486

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.484",
+  "version": "2.1.486",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -84,7 +84,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.484",
+    "@djangocfg/typescript-config": "^2.1.486",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/_api/generated/helpers/auth.ts

@@ -77,8 +77,41 @@ const cookieBackend: KVStore = {
   },
 };
 
-let _storage: KVStore = localStorageBackend;
-let _storageMode: StorageMode = 'localStorage';
+function backendFor(mode: StorageMode): KVStore {
+  return mode === 'cookie'
+    ? cookieBackend
+    : mode === 'sessionStorage'
+      ? sessionStorageBackend
+      : localStorageBackend;
+}
+
+/**
+ * Which backend holds the session — persisted, because the mode has to outlive
+ * the module.
+ *
+ * A non-persistent sign-in ("remember me" unchecked) writes its tokens to
+ * `sessionStorage`. Without this marker the next page load would start from the
+ * `localStorage` default and look there instead — finding nothing, and silently
+ * bouncing an authenticated user back to the login form. The marker itself is
+ * NOT the session: it lives in `localStorage` (a plain enum, no credential), so
+ * only the tokens follow the tab's lifetime.
+ */
+const STORAGE_MODE_KEY = 'cfg.access_token.storage_mode';
+
+function readPersistedMode(): StorageMode {
+  if (!isBrowser) return 'localStorage';
+  try {
+    const raw = window.localStorage.getItem(STORAGE_MODE_KEY);
+    return raw === 'sessionStorage' || raw === 'cookie' || raw === 'localStorage'
+      ? raw
+      : 'localStorage';
+  } catch {
+    return 'localStorage';
+  }
+}
+
+let _storageMode: StorageMode = readPersistedMode();
+let _storage: KVStore = backendFor(_storageMode);
 
 /** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */
 function detectLocale(): string | null {
@@ -326,11 +359,11 @@ export const auth = {
   getStorageMode(): StorageMode { return _storageMode; },
   setStorageMode(mode: StorageMode): void {
     _storageMode = mode;
-    _storage = mode === 'cookie'
-      ? cookieBackend
-      : mode === 'sessionStorage'
-        ? sessionStorageBackend
-        : localStorageBackend;
+    _storage = backendFor(mode);
+    // Persist the choice so the next page load reads from the same backend.
+    if (isBrowser) {
+      try { window.localStorage.setItem(STORAGE_MODE_KEY, mode); } catch {}
+    }
     notifySessionChanged();
   },
 
@@ -346,8 +379,19 @@ export const auth = {
     notifySessionChanged();
   },
   clearTokens(): void {
-    _storage.set(ACCESS_KEY, null);
-    _storage.set(REFRESH_KEY, null);
+    // Clear every backend, not just the active one: a sign-out must not leave a
+    // stale token behind in the backend the PREVIOUS session used, or the next
+    // page load would resurrect it.
+    for (const backend of [localStorageBackend, sessionStorageBackend, cookieBackend]) {
+      backend.set(ACCESS_KEY, null);
+      backend.set(REFRESH_KEY, null);
+    }
+    // Back to the default, so the next sign-in starts from a known mode.
+    _storageMode = 'localStorage';
+    _storage = localStorageBackend;
+    if (isBrowser) {
+      try { window.localStorage.removeItem(STORAGE_MODE_KEY); } catch {}
+    }
     notifySessionChanged();
   },
   /** Session-aware: token PRESENT and not past its `exp` (or a live refresh