@djangocfg/api 2.1.545 → 2.1.547

package/dist/clients.d.cts

@@ -925,6 +925,64 @@ type OtpVerifyResponse = {
      */
     persistent_session?: boolean;
 };
+/**
+ * Typed error response for password login.
+ *
+ * error_code values:
+ * - invalid_credentials — wrong email/password, inactive or deleted account
+ * - rate_limited        — IP rate limit hit
+ * - locked_out          — too many failed attempts for this email
+ */
+type PasswordLoginError = {
+    /**
+     * Human-readable error message
+     */
+    error: string;
+    /**
+     * Machine-readable error code
+     */
+    error_code: string;
+    /**
+     * Seconds until the caller may retry (throttled responses only)
+     */
+    retry_after?: number | null;
+};
+/**
+ * Password-login response.
+ *
+ * Mirrors the OTP verify response so a client can treat every login flow
+ * identically. ``requires_2fa=True`` carries a session id instead of tokens.
+ */
+type PasswordLoginResponse = {
+    /**
+     * Whether 2FA verification is required
+     */
+    requires_2fa?: boolean;
+    /**
+     * 2FA session ID (if requires_2fa is True)
+     */
+    session_id?: string | null;
+    /**
+     * JWT refresh token (if requires_2fa is False)
+     */
+    refresh?: string | null;
+    /**
+     * JWT access token (if requires_2fa is False)
+     */
+    access?: string | null;
+    /**
+     * User information (if requires_2fa is False)
+     */
+    user?: User | null;
+    /**
+     * Whether user should be prompted to enable 2FA
+     */
+    should_prompt_2fa?: boolean;
+    /**
+     * Whether this login should persist across browser restarts
+     */
+    persistent_session?: boolean;
+};
 /**
  * Serializer for updating user profile.
  */
@@ -1257,6 +1315,22 @@ type CfgAccountsOauthDisconnectResponse200AutoRef = {
  * 2FA disabled successfully
  */
 type CfgTotpDisableResponse200AutoRef = unknown;
+/**
+ * Validate email+password against live accounts only.
+ *
+ * Subclasses SimpleJWT so the field/validation contract stays theirs, but
+ * replaces ``validate()`` — the token pair itself is minted by the view via
+ * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
+ * lifetime match OTP, OAuth and TOTP exactly.
+ */
+type PasswordLoginRequestWritable = {
+    /**
+     * Keep this browser signed in for 30 days
+     */
+    remember_me?: boolean;
+    email: string;
+    password: string;
+};
 type CfgAccountsApiKeyRetrieveData = {
     body?: never;
     path?: never;
@@ -1536,6 +1610,19 @@ type CfgAccountsProfileUpdateUpdateErrors = {
 type CfgAccountsProfileUpdateUpdateResponses = {
     200: User;
 };
+type CfgAccountsTokenCreateData = {
+    body: PasswordLoginRequestWritable;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/token/';
+};
+type CfgAccountsTokenCreateErrors = {
+    401: PasswordLoginError;
+    429: PasswordLoginError;
+};
+type CfgAccountsTokenCreateResponses = {
+    200: PasswordLoginResponse;
+};
 type CfgAccountsTokenBlacklistCreateData = {
     body: TokenBlacklistRequest;
     path?: never;
@@ -1835,6 +1922,15 @@ declare class CfgAccountsProfile {
     static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>;
 }
 declare class CfgAccountsAuth {
+    /**
+     * Obtain a JWT pair with email + password.
+     *
+     * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with
+     * a session id, or the token pair plus the user object. Failures are uniform
+     * (401 ``invalid_credentials``) whether the email is unknown, the password is
+     * wrong, or the account is inactive/soft-deleted — no enumeration.
+     */
+    static cfgAccountsTokenCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError>;
     /**
      * Revoke a refresh token (logout).
      *

package/dist/clients.d.ts

@@ -925,6 +925,64 @@ type OtpVerifyResponse = {
      */
     persistent_session?: boolean;
 };
+/**
+ * Typed error response for password login.
+ *
+ * error_code values:
+ * - invalid_credentials — wrong email/password, inactive or deleted account
+ * - rate_limited        — IP rate limit hit
+ * - locked_out          — too many failed attempts for this email
+ */
+type PasswordLoginError = {
+    /**
+     * Human-readable error message
+     */
+    error: string;
+    /**
+     * Machine-readable error code
+     */
+    error_code: string;
+    /**
+     * Seconds until the caller may retry (throttled responses only)
+     */
+    retry_after?: number | null;
+};
+/**
+ * Password-login response.
+ *
+ * Mirrors the OTP verify response so a client can treat every login flow
+ * identically. ``requires_2fa=True`` carries a session id instead of tokens.
+ */
+type PasswordLoginResponse = {
+    /**
+     * Whether 2FA verification is required
+     */
+    requires_2fa?: boolean;
+    /**
+     * 2FA session ID (if requires_2fa is True)
+     */
+    session_id?: string | null;
+    /**
+     * JWT refresh token (if requires_2fa is False)
+     */
+    refresh?: string | null;
+    /**
+     * JWT access token (if requires_2fa is False)
+     */
+    access?: string | null;
+    /**
+     * User information (if requires_2fa is False)
+     */
+    user?: User | null;
+    /**
+     * Whether user should be prompted to enable 2FA
+     */
+    should_prompt_2fa?: boolean;
+    /**
+     * Whether this login should persist across browser restarts
+     */
+    persistent_session?: boolean;
+};
 /**
  * Serializer for updating user profile.
  */
@@ -1257,6 +1315,22 @@ type CfgAccountsOauthDisconnectResponse200AutoRef = {
  * 2FA disabled successfully
  */
 type CfgTotpDisableResponse200AutoRef = unknown;
+/**
+ * Validate email+password against live accounts only.
+ *
+ * Subclasses SimpleJWT so the field/validation contract stays theirs, but
+ * replaces ``validate()`` — the token pair itself is minted by the view via
+ * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
+ * lifetime match OTP, OAuth and TOTP exactly.
+ */
+type PasswordLoginRequestWritable = {
+    /**
+     * Keep this browser signed in for 30 days
+     */
+    remember_me?: boolean;
+    email: string;
+    password: string;
+};
 type CfgAccountsApiKeyRetrieveData = {
     body?: never;
     path?: never;
@@ -1536,6 +1610,19 @@ type CfgAccountsProfileUpdateUpdateErrors = {
 type CfgAccountsProfileUpdateUpdateResponses = {
     200: User;
 };
+type CfgAccountsTokenCreateData = {
+    body: PasswordLoginRequestWritable;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/token/';
+};
+type CfgAccountsTokenCreateErrors = {
+    401: PasswordLoginError;
+    429: PasswordLoginError;
+};
+type CfgAccountsTokenCreateResponses = {
+    200: PasswordLoginResponse;
+};
 type CfgAccountsTokenBlacklistCreateData = {
     body: TokenBlacklistRequest;
     path?: never;
@@ -1835,6 +1922,15 @@ declare class CfgAccountsProfile {
     static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>;
 }
 declare class CfgAccountsAuth {
+    /**
+     * Obtain a JWT pair with email + password.
+     *
+     * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with
+     * a session id, or the token pair plus the user object. Failures are uniform
+     * (401 ``invalid_credentials``) whether the email is unknown, the password is
+     * wrong, or the account is inactive/soft-deleted — no enumeration.
+     */
+    static cfgAccountsTokenCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError>;
     /**
      * Revoke a refresh token (logout).
      *

package/dist/clients.mjs

@@ -1992,6 +1992,24 @@ var CfgAccountsAuth = class {
   static {
     __name(this, "CfgAccountsAuth");
   }
+  /**
+   * Obtain a JWT pair with email + password.
+   *
+   * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with
+   * a session id, or the token pair plus the user object. Failures are uniform
+   * (401 ``invalid_credentials``) whether the email is unknown, the password is
+   * wrong, or the account is inactive/soft-deleted — no enumeration.
+   */
+  static cfgAccountsTokenCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/token/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * Revoke a refresh token (logout).
    *