@djangocfg/api 2.1.486 → 2.1.488

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.486",
+  "version": "2.1.488",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -84,7 +84,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.486",
+    "@djangocfg/typescript-config": "^2.1.488",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/_api/generated/helpers/auth.ts

@@ -86,31 +86,20 @@ function backendFor(mode: StorageMode): KVStore {
 }
 
 /**
- * Which backend holds the session — persisted, because the mode has to outlive
- * the module.
+ * The session backend. `localStorage` by default and for every login path.
  *
- * A non-persistent sign-in ("remember me" unchecked) writes its tokens to
- * `sessionStorage`. Without this marker the next page load would start from the
- * `localStorage` default and look there instead — finding nothing, and silently
- * bouncing an authenticated user back to the login form. The marker itself is
- * NOT the session: it lives in `localStorage` (a plain enum, no credential), so
- * only the tokens follow the tab's lifetime.
+ * `setStorageMode` exists for a host that must relocate the whole session once
+ * at bootstrap — e.g. 'cookie' so Next.js `cookies()` can read the token during
+ * SSR. It is NOT a per-login switch: this value lives in module memory and
+ * resets to the default on every page load, so tokens written to a non-default
+ * backend after startup would be stranded — present in the browser, invisible
+ * to the client, and every request would go out unauthenticated.
+ *
+ * Session LENGTH is therefore not a client concern. The server decides it when
+ * minting the refresh token (`remember_me`); the client just stores whatever it
+ * was given, in one place.
  */
-const STORAGE_MODE_KEY = 'cfg.access_token.storage_mode';
-
-function readPersistedMode(): StorageMode {
-  if (!isBrowser) return 'localStorage';
-  try {
-    const raw = window.localStorage.getItem(STORAGE_MODE_KEY);
-    return raw === 'sessionStorage' || raw === 'cookie' || raw === 'localStorage'
-      ? raw
-      : 'localStorage';
-  } catch {
-    return 'localStorage';
-  }
-}
-
-let _storageMode: StorageMode = readPersistedMode();
+let _storageMode: StorageMode = 'localStorage';
 let _storage: KVStore = backendFor(_storageMode);
 
 /** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */
@@ -357,13 +346,12 @@ function pushClientConfig(): void {
 export const auth = {
   // ── Storage mode ──────────────────────────────────────────────────
   getStorageMode(): StorageMode { return _storageMode; },
+  /** Relocate the session backend. Call once at bootstrap, before any sign-in:
+   *  the mode is module state and resets on reload, so a later switch strands
+   *  whatever was written after it. */
   setStorageMode(mode: StorageMode): void {
     _storageMode = mode;
     _storage = backendFor(mode);
-    // Persist the choice so the next page load reads from the same backend.
-    if (isBrowser) {
-      try { window.localStorage.setItem(STORAGE_MODE_KEY, mode); } catch {}
-    }
     notifySessionChanged();
   },
 
@@ -379,19 +367,13 @@ export const auth = {
     notifySessionChanged();
   },
   clearTokens(): void {
-    // Clear every backend, not just the active one: a sign-out must not leave a
-    // stale token behind in the backend the PREVIOUS session used, or the next
-    // page load would resurrect it.
+    // Clear every backend, not just the active one. Sign-out must leave nothing
+    // behind anywhere — including tokens an older build stranded in
+    // sessionStorage — or the next page load could resurrect a dead session.
     for (const backend of [localStorageBackend, sessionStorageBackend, cookieBackend]) {
       backend.set(ACCESS_KEY, null);
       backend.set(REFRESH_KEY, null);
     }
-    // Back to the default, so the next sign-in starts from a known mode.
-    _storageMode = 'localStorage';
-    _storage = localStorageBackend;
-    if (isBrowser) {
-      try { window.localStorage.removeItem(STORAGE_MODE_KEY); } catch {}
-    }
     notifySessionChanged();
   },
   /** Session-aware: token PRESENT and not past its `exp` (or a live refresh

package/src/auth/context/AccountsContext.tsx

@@ -183,7 +183,11 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
 
     if (result.access && result.refresh) {
       // The ONE write path — atomic pair, notifies every session subscriber.
-      auth.setStorageMode(result.persistent_session ? 'localStorage' : 'sessionStorage');
+      // Storage is always localStorage: "remember me" is a TOKEN LIFETIME
+      // decision the server already made (`remember_me` → REMEMBER_ME_LIFETIME),
+      // not a storage decision. Switching the client to sessionStorage here used
+      // to strand the tokens — the module reinitializes to localStorage on the
+      // next page load and would never look at sessionStorage again.
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId: 'verifyOTP', force: true });

package/src/auth/hooks/useGithubAuth.ts

@@ -168,8 +168,9 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
 
       authLogger.info('GitHub OAuth successful, user:', response.user);
 
-      auth.setStorageMode(response.persistent_session ? 'localStorage' : 'sessionStorage');
-        // The ONE write path — atomic pair + session notification.
+        // The ONE write path — atomic pair + session notification. Storage is
+        // always localStorage; session length is the server's call via
+        // `remember_me`. See AccountsContext.verifyOTP.
       auth.setSession({ access: response.access, refresh: response.refresh });
 
         // Track successful OAuth

package/src/auth/hooks/useTwoFactorVerify.ts

@@ -71,8 +71,9 @@ export const useTwoFactorVerify = (
   remaining_backup_codes?: number;
   persistent_session: boolean;
   }) => {
-    auth.setStorageMode(response.persistent_session ? 'localStorage' : 'sessionStorage');
     // Save tokens — the ONE write path (atomic pair + session notification).
+    // Storage is always localStorage; session length is the server's call via
+    // `remember_me`. See AccountsContext.verifyOTP.
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
 
     if (response.warning) {