@djangocfg/api 2.1.484 → 2.1.487

package/dist/auth.cjs

@@ -228,8 +228,12 @@ var cookieBackend = {
     }
   }
 };
-var _storage = localStorageBackend;
+function backendFor(mode) {
+  return mode === "cookie" ? cookieBackend : mode === "sessionStorage" ? sessionStorageBackend : localStorageBackend;
+}
+__name(backendFor, "backendFor");
 var _storageMode = "localStorage";
+var _storage = backendFor(_storageMode);
 function detectLocale() {
   try {
     if (typeof document !== "undefined") {
@@ -383,9 +387,12 @@ var auth = {
   getStorageMode() {
     return _storageMode;
   },
+  /** Relocate the session backend. Call once at bootstrap, before any sign-in:
+   *  the mode is module state and resets on reload, so a later switch strands
+   *  whatever was written after it. */
   setStorageMode(mode) {
     _storageMode = mode;
-    _storage = mode === "cookie" ? cookieBackend : mode === "sessionStorage" ? sessionStorageBackend : localStorageBackend;
+    _storage = backendFor(mode);
     notifySessionChanged();
   },
   // ── Bearer token ──────────────────────────────────────────────────
@@ -404,8 +411,10 @@ var auth = {
     notifySessionChanged();
   },
   clearTokens() {
-    _storage.set(ACCESS_KEY, null);
-    _storage.set(REFRESH_KEY, null);
+    for (const backend of [localStorageBackend, sessionStorageBackend, cookieBackend]) {
+      backend.set(ACCESS_KEY, null);
+      backend.set(REFRESH_KEY, null);
+    }
     notifySessionChanged();
   },
   /** Session-aware: token PRESENT and not past its `exp` (or a live refresh
@@ -2777,7 +2786,6 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
     setError(null);
   }, []);
   const handleSuccess = (0, import_react8.useCallback)((response) => {
-    auth.setStorageMode(response.persistent_session ? "localStorage" : "sessionStorage");
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -3269,7 +3277,6 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
         throw new Error("Invalid response from OAuth callback");
       }
       authLogger.info("GitHub OAuth successful, user:", response.user);
-      auth.setStorageMode(response.persistent_session ? "localStorage" : "sessionStorage");
       auth.setSession({ access: response.access, refresh: response.refresh });
       Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
         category: "auth" /* AUTH */,
@@ -4504,7 +4511,6 @@ function AccountsProvider({ children }) {
       return result;
     }
     if (result.access && result.refresh) {
-      auth.setStorageMode(result.persistent_session ? "localStorage" : "sessionStorage");
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: "verifyOTP", force: true });