@djangocfg/api 2.1.484 → 2.1.487

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.484",
+  "version": "2.1.487",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -84,7 +84,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.484",
+    "@djangocfg/typescript-config": "^2.1.487",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/_api/generated/helpers/auth.ts

@@ -77,8 +77,30 @@ const cookieBackend: KVStore = {
   },
 };
 
-let _storage: KVStore = localStorageBackend;
+function backendFor(mode: StorageMode): KVStore {
+  return mode === 'cookie'
+    ? cookieBackend
+    : mode === 'sessionStorage'
+      ? sessionStorageBackend
+      : localStorageBackend;
+}
+
+/**
+ * The session backend. `localStorage` by default and for every login path.
+ *
+ * `setStorageMode` exists for a host that must relocate the whole session once
+ * at bootstrap — e.g. 'cookie' so Next.js `cookies()` can read the token during
+ * SSR. It is NOT a per-login switch: this value lives in module memory and
+ * resets to the default on every page load, so tokens written to a non-default
+ * backend after startup would be stranded — present in the browser, invisible
+ * to the client, and every request would go out unauthenticated.
+ *
+ * Session LENGTH is therefore not a client concern. The server decides it when
+ * minting the refresh token (`remember_me`); the client just stores whatever it
+ * was given, in one place.
+ */
 let _storageMode: StorageMode = 'localStorage';
+let _storage: KVStore = backendFor(_storageMode);
 
 /** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */
 function detectLocale(): string | null {
@@ -324,13 +346,12 @@ function pushClientConfig(): void {
 export const auth = {
   // ── Storage mode ──────────────────────────────────────────────────
   getStorageMode(): StorageMode { return _storageMode; },
+  /** Relocate the session backend. Call once at bootstrap, before any sign-in:
+   *  the mode is module state and resets on reload, so a later switch strands
+   *  whatever was written after it. */
   setStorageMode(mode: StorageMode): void {
     _storageMode = mode;
-    _storage = mode === 'cookie'
-      ? cookieBackend
-      : mode === 'sessionStorage'
-        ? sessionStorageBackend
-        : localStorageBackend;
+    _storage = backendFor(mode);
     notifySessionChanged();
   },
 
@@ -346,8 +367,13 @@ export const auth = {
     notifySessionChanged();
   },
   clearTokens(): void {
-    _storage.set(ACCESS_KEY, null);
-    _storage.set(REFRESH_KEY, null);
+    // Clear every backend, not just the active one. Sign-out must leave nothing
+    // behind anywhere — including tokens an older build stranded in
+    // sessionStorage — or the next page load could resurrect a dead session.
+    for (const backend of [localStorageBackend, sessionStorageBackend, cookieBackend]) {
+      backend.set(ACCESS_KEY, null);
+      backend.set(REFRESH_KEY, null);
+    }
     notifySessionChanged();
   },
   /** Session-aware: token PRESENT and not past its `exp` (or a live refresh

package/src/auth/context/AccountsContext.tsx

@@ -183,7 +183,11 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
 
     if (result.access && result.refresh) {
       // The ONE write path — atomic pair, notifies every session subscriber.
-      auth.setStorageMode(result.persistent_session ? 'localStorage' : 'sessionStorage');
+      // Storage is always localStorage: "remember me" is a TOKEN LIFETIME
+      // decision the server already made (`remember_me` → REMEMBER_ME_LIFETIME),
+      // not a storage decision. Switching the client to sessionStorage here used
+      // to strand the tokens — the module reinitializes to localStorage on the
+      // next page load and would never look at sessionStorage again.
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: 'verifyOTP', force: true });

package/src/auth/hooks/useGithubAuth.ts

@@ -168,8 +168,9 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
 
       authLogger.info('GitHub OAuth successful, user:', response.user);
 
-      auth.setStorageMode(response.persistent_session ? 'localStorage' : 'sessionStorage');
-        // The ONE write path — atomic pair + session notification.
+        // The ONE write path — atomic pair + session notification. Storage is
+        // always localStorage; session length is the server's call via
+        // `remember_me`. See AccountsContext.verifyOTP.
       auth.setSession({ access: response.access, refresh: response.refresh });
 
         // Track successful OAuth

package/src/auth/hooks/useTwoFactorVerify.ts

@@ -71,8 +71,9 @@ export const useTwoFactorVerify = (
   remaining_backup_codes?: number;
   persistent_session: boolean;
   }) => {
-    auth.setStorageMode(response.persistent_session ? 'localStorage' : 'sessionStorage');
     // Save tokens — the ONE write path (atomic pair + session notification).
+    // Storage is always localStorage; session length is the server's call via
+    // `remember_me`. See AccountsContext.verifyOTP.
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
 
     if (response.warning) {