@djangocfg/api 2.1.542 → 2.1.544

package/dist/index.d.cts

@@ -2297,8 +2297,8 @@ declare class APIError extends Error {
 /** Network Error (connection failed, timeout, etc.) */
 declare class NetworkError extends Error {
     url: string;
-    originalError?: Error;
-    constructor(message: string, url: string, originalError?: Error);
+    originalError?: Error | undefined;
+    constructor(message: string, url: string, originalError?: Error | undefined);
 }
 
 interface ValidationErrorDetail {

package/dist/index.d.ts

@@ -2297,8 +2297,8 @@ declare class APIError extends Error {
 /** Network Error (connection failed, timeout, etc.) */
 declare class NetworkError extends Error {
     url: string;
-    originalError?: Error;
-    constructor(message: string, url: string, originalError?: Error);
+    originalError?: Error | undefined;
+    constructor(message: string, url: string, originalError?: Error | undefined);
 }
 
 interface ValidationErrorDetail {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.542",
+  "version": "2.1.544",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -71,6 +71,7 @@
     "build": "tsup",
     "clean": "rm -rf dist",
     "dev": "tsup --watch",
+    "lint": "eslint .",
     "check": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest"
@@ -84,7 +85,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.542",
+    "@djangocfg/typescript-config": "^2.1.544",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/auth/__tests__/useTwoFactorStatus.test.ts

@@ -21,7 +21,7 @@ const mockDisableCreate = vi.fn();
 vi.mock('../../_api/generated/sdk.gen', () => ({
   CfgTotp: {
     cfgTotpDevicesRetrieve: () => mockDevicesRetrieve(),
-    cfgTotpDisableCreate: (args: any) => mockDisableCreate(args),
+    cfgTotpDisableCreate: (args: unknown) => mockDisableCreate(args),
   },
 }));
 
@@ -117,7 +117,7 @@ describe('useTwoFactorStatus', () => {
     });
 
     it('should set loading state during fetch', async () => {
-      let resolvePromise: (value: any) => void;
+      let resolvePromise: (value: unknown) => void;
       mockDevicesRetrieve.mockReturnValue(
         new Promise((resolve) => {
           resolvePromise = resolve;

package/src/auth/context/AccountsContext.tsx

@@ -14,7 +14,7 @@
 "use client";
 
 import {
-    createContext, memo, ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState
+    createContext, ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState
 } from 'react';
 
 import { auth } from '../../_api/generated/helpers/auth';
@@ -150,30 +150,34 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
     }
   }, []);
 
-  const updateProfile = async (data: CfgUserUpdateRequest): Promise<User> => {
+  // These five are `useCallback`ed because they are dependencies of the context
+  // `useMemo` below. Rebuilt each render, they made that memo return a new object
+  // every time — so every consumer of this root provider re-rendered on every
+  // render of it, and the memo bought nothing. SWR guarantees a stable `trigger`.
+  const updateProfile = useCallback(async (data: CfgUserUpdateRequest): Promise<User> => {
     await triggerProfileUpdate({ body: data });
     const user = await refreshProfile({ callerId: 'updateProfile', force: true });
     return user as User;
-  };
+  }, [triggerProfileUpdate, refreshProfile]);
 
-  const partialUpdateProfile = async (data: PatchedCfgUserUpdateRequest): Promise<User> => {
+  const partialUpdateProfile = useCallback(async (data: PatchedCfgUserUpdateRequest): Promise<User> => {
     await triggerProfilePartialUpdate({ body: data });
     const user = await refreshProfile({ callerId: 'partialUpdateProfile', force: true });
     return user as User;
-  };
+  }, [triggerProfilePartialUpdate, refreshProfile]);
 
-  const uploadAvatar = async (avatar: File | Blob): Promise<User> => {
+  const uploadAvatar = useCallback(async (avatar: File | Blob): Promise<User> => {
     await triggerAvatar({ body: { avatar } });
     const user = await refreshProfile({ callerId: 'uploadAvatar', force: true });
     return user as User;
-  };
+  }, [triggerAvatar, refreshProfile]);
 
-  const requestOTP = async (data: OtpRequestRequest): Promise<OtpRequestResponse> => {
+  const requestOTP = useCallback(async (data: OtpRequestRequest): Promise<OtpRequestResponse> => {
     const result = await triggerOtpRequest({ body: data });
     return result as OtpRequestResponse;
-  };
+  }, [triggerOtpRequest]);
 
-  const verifyOTP = async (data: OtpVerifyRequest): Promise<OtpVerifyResponse> => {
+  const verifyOTP = useCallback(async (data: OtpVerifyRequest): Promise<OtpVerifyResponse> => {
     const result = (await triggerOtpVerify({ body: data })) as OtpVerifyResponse;
 
     if (result.requires_2fa && result.session_id) {
@@ -197,7 +201,7 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
     }
 
     return result;
-  };
+  }, [triggerOtpVerify, refreshProfile]);
 
   const logout = useCallback(() => {
     // Best-effort server-side revocation: without blacklisting, a stolen

package/src/auth/hooks/useAuthForm.ts

@@ -51,7 +51,6 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
   const {
     identifier,
     otp,
-    isLoading,
     acceptedTerms,
     marketingConsent,
     rememberMe,

package/src/auth/hooks/useCfgRouter.ts

@@ -63,11 +63,8 @@ function withBasePath(path: string, basePath: string): string {
 export function useCfgRouter() {
   const router = useNextRouter();
 
-  // Get basePath and check if we're in static build mode
+  // Get basePath
   const basePath = useMemo(() => getBasePath(), []);
-  const isStaticBuild = useMemo(() => {
-    return typeof process !== 'undefined' && process.env.NEXT_PUBLIC_STATIC_BUILD === 'true';
-  }, []);
 
   const push = useCallback((href: string, options?: { scroll?: boolean }) => {
     if (basePath) {

package/src/auth/hooks/useGithubAuth.ts

@@ -4,15 +4,31 @@ import { useCallback, useState } from 'react';
 
 import { auth } from '../../_api/generated/helpers/auth';
 import { CfgAccountsOauth } from '../../_api/generated/sdk.gen';
+import type { OAuthTokenResponse } from '../../_api/generated/types.gen';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
 import { authLogger } from '../utils/logger';
 import { useCfgRouter } from './useCfgRouter';
 
+/**
+ * The user payload as the OAuth endpoint declares it.
+ *
+ * Derived from the generated response rather than restated, so a schema change
+ * reaches callers through `make gen` instead of drifting silently. Today the
+ * backend types it as a free-form object; when it names a real user model, this
+ * narrows on its own.
+ */
+export type OAuthUser = NonNullable<OAuthTokenResponse['user']>;
+
 export interface UseGithubAuthOptions {
   sourceUrl?: string;
   /** Keep the completed browser session for 30 days. */
   rememberMe?: boolean;
-  onSuccess?: (user: any, isNewUser: boolean) => void;
+  /**
+   * The OAuth endpoint's OpenAPI schema types `user` as a free-form object, so
+   * this is what the server actually promises — not a `User`. Narrow it at the
+   * call site; typing it tighter here would be an assertion, not a fact.
+   */
+  onSuccess?: (user: OAuthUser, isNewUser: boolean) => void;
   onError?: (error: string) => void;
   /** Callback when 2FA is required */
   onRequires2FA?: (sessionId: string, shouldPrompt2FA: boolean) => void;
@@ -184,8 +200,14 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
         Analytics.setUser(String(response.user.id));
       }
 
-        // Call success callback
-      onSuccess?.(response.user, response.is_new_user || false);
+        // Call success callback.
+        //
+        // Guarded because the schema allows `user: null` — the 2FA branch returns
+        // no user — and five lines up this same value is read through `?.`. The
+        // old `any` let one line be careful and the next not.
+      if (response.user) {
+        onSuccess?.(response.user, response.is_new_user || false);
+      }
 
         // Redirect (unless skipRedirect is true)
       if (!skipRedirect) {

package/src/auth/hooks/useLocalStorage.ts

@@ -1,8 +1,9 @@
 'use client';
 
-import { useEffect, useState } from 'react';
+import { useState } from 'react';
 
 import { authLogger } from '../utils/logger';
+import { isQuotaExceededError, isWithinSizeLimit } from '../utils/storage';
 
 /**
  * Simple localStorage hook with better error handling
@@ -36,26 +37,6 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
     }
   });
 
-  // Check data size and limit
-  const checkDataSize = (data: any): boolean => {
-    try {
-      const jsonString = JSON.stringify(data);
-      const sizeInBytes = new Blob([jsonString]).size;
-      const sizeInKB = sizeInBytes / 1024;
-      
-      // Limit to 1MB per item
-      if (sizeInKB > 1024) {
-        authLogger.warn(`Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`);
-        return false;
-      }
-
-      return true;
-    } catch (error) {
-      authLogger.error(`Error checking data size for key "${key}":`, error);
-      return false;
-    }
-  };
-
   // Clear old data when localStorage is full
   const clearOldData = () => {
     try {
@@ -102,7 +83,7 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
       const valueToStore = value instanceof Function ? value(storedValue) : value;
       
       // Check data size before attempting to save
-      if (!checkDataSize(valueToStore)) {
+      if (!isWithinSizeLimit(valueToStore, key)) {
         authLogger.warn(`Data size too large for key "${key}", removing key`);
         // Remove the key if data is too large
         try {
@@ -129,11 +110,9 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
           }
           // Add timestamp for cleanup
           window.localStorage.setItem(`${key}_timestamp`, Date.now().toString());
-        } catch (storageError: any) {
+        } catch (storageError: unknown) {
           // If quota exceeded, clear old data and try again
-          if (storageError.name === 'QuotaExceededError' ||
-              storageError.code === 22 ||
-              storageError.message?.includes('quota')) {
+          if (isQuotaExceededError(storageError)) {
             authLogger.warn('localStorage quota exceeded, clearing old data...');
             clearOldData();
             
@@ -185,11 +164,9 @@ export function useLocalStorage<T>(key: string, initialValue: T) {
         try {
           window.localStorage.removeItem(key);
           window.localStorage.removeItem(`${key}_timestamp`);
-        } catch (removeError: any) {
+        } catch (removeError: unknown) {
           // If removal fails due to quota, try to clear some data first
-          if (removeError.name === 'QuotaExceededError' ||
-              removeError.code === 22 ||
-              removeError.message?.includes('quota')) {
+          if (isQuotaExceededError(removeError)) {
             authLogger.warn('localStorage quota exceeded during removal, clearing old data...');
             clearOldData();
             

package/src/auth/hooks/useSessionStorage.ts

@@ -3,6 +3,7 @@
 import { useState } from 'react';
 
 import { authLogger } from '../utils/logger';
+import { isQuotaExceededError, isWithinSizeLimit } from '../utils/storage';
 
 /**
  * Simple sessionStorage hook with better error handling
@@ -26,26 +27,6 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
     }
   });
 
-  // Check data size and limit
-  const checkDataSize = (data: any): boolean => {
-    try {
-      const jsonString = JSON.stringify(data);
-      const sizeInBytes = new Blob([jsonString]).size;
-      const sizeInKB = sizeInBytes / 1024;
-      
-      // Limit to 1MB per item
-      if (sizeInKB > 1024) {
-        authLogger.warn(`Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`);
-        return false;
-      }
-
-      return true;
-    } catch (error) {
-      authLogger.error(`Error checking data size for key "${key}":`, error);
-      return false;
-    }
-  };
-
   // Clear old data when sessionStorage is full
   const clearOldData = () => {
     try {
@@ -92,7 +73,7 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
       const valueToStore = value instanceof Function ? value(storedValue) : value;
       
       // Check data size before attempting to save
-      if (!checkDataSize(valueToStore)) {
+      if (!isWithinSizeLimit(valueToStore, key)) {
         authLogger.warn(`Data size too large for key "${key}", removing key`);
         // Remove the key if data is too large
         try {
@@ -114,11 +95,9 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
           window.sessionStorage.setItem(key, JSON.stringify(valueToStore));
           // Add timestamp for cleanup
           window.sessionStorage.setItem(`${key}_timestamp`, Date.now().toString());
-        } catch (storageError: any) {
+        } catch (storageError: unknown) {
           // If quota exceeded, clear old data and try again
-          if (storageError.name === 'QuotaExceededError' ||
-              storageError.code === 22 ||
-              storageError.message?.includes('quota')) {
+          if (isQuotaExceededError(storageError)) {
             authLogger.warn('sessionStorage quota exceeded, clearing old data...');
             clearOldData();
             
@@ -160,11 +139,9 @@ export function useSessionStorage<T>(key: string, initialValue: T) {
         try {
           window.sessionStorage.removeItem(key);
           window.sessionStorage.removeItem(`${key}_timestamp`);
-        } catch (removeError: any) {
+        } catch (removeError: unknown) {
           // If removal fails due to quota, try to clear some data first
-          if (removeError.name === 'QuotaExceededError' ||
-              removeError.code === 22 ||
-              removeError.message?.includes('quota')) {
+          if (isQuotaExceededError(removeError)) {
             authLogger.warn('sessionStorage quota exceeded during removal, clearing old data...');
             clearOldData();
             

package/src/auth/hooks/useTwoFactorVerify.ts

@@ -4,6 +4,7 @@ import { useCallback, useState } from 'react';
 
 import { auth } from '../../_api/generated/helpers/auth';
 import { CfgTotpVerify } from '../../_api/generated/sdk.gen';
+import type { TotpVerifyUser, VerifyResponse } from '../../_api/generated/types.gen';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
 import { authLogger } from '../utils/logger';
 import { consumeSavedRedirect } from './useAuthRedirect';
@@ -12,7 +13,7 @@ import { extractAttemptsRemaining, extractTwoFactorError, isValidTotpCode } from
 
 export interface UseTwoFactorVerifyOptions {
   /** Callback on successful 2FA verification */
-  onSuccess?: (user: any) => void;
+  onSuccess?: (user: TotpVerifyUser) => void;
   /** Callback on error */
   onError?: (error: string) => void;
   /** URL to redirect after successful verification */
@@ -63,14 +64,9 @@ export const useTwoFactorVerify = (
     setError(null);
   }, []);
 
-  const handleSuccess = useCallback((response: {
-    access_token: string;
-    refresh_token: string;
-    user: any;
-  warning?: string;
-  remaining_backup_codes?: number;
-  persistent_session: boolean;
-  }) => {
+  // `VerifyResponse` is the generated shape of this endpoint, so the hand-written
+  // copy it replaces cannot drift from the server contract any more.
+  const handleSuccess = useCallback((response: VerifyResponse) => {
     // Save tokens — the ONE write path (atomic pair + session notification).
     // Storage is always localStorage; session length is the server's call via
     // `remember_me`. See AccountsContext.verifyOTP.

package/src/auth/utils/analytics.ts

@@ -34,16 +34,36 @@ export enum AnalyticsCategory {
 export type AnalyticsEventType = `${AnalyticsEvent}`;
 export type AnalyticsCategoryType = `${AnalyticsCategory}`;
 
+/**
+ * What an analytics backend can actually carry.
+ *
+ * GA4 and OpenPanel serialise a property to a scalar; an object or a function
+ * arrives as "[object Object]" without erroring anywhere. Declaring the wider
+ * `unknown` here promised a forwarding guarantee no implementation keeps, and
+ * it made this sink incompatible with `AnalyticsEventProperties` in
+ * `@djangocfg/analytics` — the two describe the same channel and must agree.
+ * Kept as a local declaration rather than an import: `api` does not depend on
+ * `analytics`, and one shared four-member union is not worth that edge.
+ */
+export type AnalyticsPropertyValue = string | number | boolean | null;
+
 interface AnalyticsEventParams {
   category?: AnalyticsCategoryType;
   label?: string;
   value?: number;
-  [key: string]: any;
+  // Extra dimensions vary per event; the sink only forwards them.
+  [key: string]: AnalyticsPropertyValue | undefined;
 }
 
 /** What an analytics implementation must provide to receive auth events. */
 export interface AnalyticsSink {
-  event(name: string, params?: Record<string, any>): void;
+  // `| undefined` in the value: an optional dimension that was not supplied
+  // reaches the sink as an explicit `undefined`, which every backend already
+  // treats as absent. Excluding it would reject the caller below.
+  event(
+    name: string,
+    params?: Record<string, AnalyticsPropertyValue | undefined>,
+  ): void;
   setUser(userId: string | null): void;
 }
 

package/src/auth/utils/errors.ts

@@ -1,21 +1,32 @@
+/** Read a property off an unknown value without asserting its shape. */
+const prop = (value: unknown, key: string): unknown =>
+  typeof value === 'object' && value !== null
+    ? (value as Record<string, unknown>)[key]
+    : undefined;
+
 /**
- * Format authentication error for display
+ * Format authentication error for display.
+ *
+ * Each candidate is checked to be a string before it is returned. Under the
+ * previous `any` the check was only that the property was truthy, so a DRF
+ * field-error object (`{detail: {email: [...]}}`) reached the UI as
+ * "[object Object]" — an error message that tells the user nothing.
  */
-export const formatAuthError = (error: any): string => {
+export const formatAuthError = (error: unknown): string => {
   if (typeof error === 'string') {
     return error;
   }
 
-  if (error?.message) {
-    return error.message;
-  }
-
-  if (error?.detail) {
-    return error.detail;
-  }
+  const candidates = [
+    prop(error, 'message'),
+    prop(error, 'detail'),
+    prop(prop(prop(error, 'response'), 'data'), 'detail'),
+  ];
 
-  if (error?.response?.data?.detail) {
-    return error.response.data.detail;
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate) {
+      return candidate;
+    }
   }
 
   return 'An unexpected error occurred';

package/src/auth/utils/storage.ts

@@ -0,0 +1,64 @@
+/**
+ * Web Storage helpers shared by `useLocalStorage` and `useSessionStorage`.
+ *
+ * Both hooks carried byte-identical copies of `checkDataSize`, and the quota
+ * check was written out four times — twice per hook, on write and on remove.
+ * Every copy typed its caught error `any` and then read three properties off
+ * it, which is exactly the read `unknown` makes you justify.
+ */
+
+import { authLogger } from './logger';
+
+/** Per-item ceiling. Browsers cap the whole origin near 5MB. */
+const MAX_ITEM_KB = 1024;
+
+/**
+ * Whether a caught error means the storage quota is full.
+ *
+ * Browsers disagree on how to say it: modern engines throw a `DOMException`
+ * named `QuotaExceededError`, older WebKit used code 22, and some report it
+ * only in the message. All three are checked because all three are still met
+ * in the wild — and because the caller's response (drop old data, retry) is
+ * the same for each.
+ */
+export function isQuotaExceededError(error: unknown): boolean {
+  if (typeof error !== 'object' || error === null) return false;
+
+  const { name, code, message } = error as {
+    name?: unknown;
+    code?: unknown;
+    message?: unknown;
+  };
+
+  return (
+    name === 'QuotaExceededError' ||
+    code === 22 ||
+    (typeof message === 'string' && message.includes('quota'))
+  );
+}
+
+/**
+ * Whether `data` serialises to something small enough to store.
+ *
+ * `unknown` rather than a type parameter: this only serialises, so it needs no
+ * knowledge of the shape, and a parameter would invite callers to read one.
+ * Returns false on a value that cannot be serialised at all — a circular
+ * reference is not storable either, and the caller's response is identical.
+ */
+export function isWithinSizeLimit(data: unknown, key: string): boolean {
+  try {
+    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;
+
+    if (sizeInKB > MAX_ITEM_KB) {
+      authLogger.warn(
+        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key "${key}"`,
+      );
+      return false;
+    }
+
+    return true;
+  } catch (error) {
+    authLogger.error(`Error checking data size for key "${key}":`, error);
+    return false;
+  }
+}