@djangocfg/api 2.1.546 → 2.1.547

package/src/auth/hooks/useAuthForm.ts

@@ -43,6 +43,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
   const {
     requestOTP,
     verifyOTP,
+    login,
     getSavedEmail,
     saveEmail,
   } = useAuth();
@@ -51,6 +52,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
   const {
     identifier,
     otp,
+    password,
     acceptedTerms,
     marketingConsent,
     rememberMe,
@@ -235,6 +237,87 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     await submitOTP(identifier, otp);
   }, [identifier, otp, submitOTP]);
 
+  // ─────────────────────────────────────────────────────────────────────────
+  // Password Submit
+  // ─────────────────────────────────────────────────────────────────────────
+
+  // The password credential lands on the SAME step machine as the OTP code:
+  // both end at '2fa' or 'success', so the layout renders one set of screens.
+  const submitPassword = useCallback(async (
+    submitIdentifier: string,
+    submitPassword_: string,
+  ): Promise<boolean> => {
+    if (!submitIdentifier || !validateIdentifier(submitIdentifier)) {
+      const msg = 'Please enter a valid email address';
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+
+    if (!submitPassword_) {
+      const msg = 'Please enter your password';
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+
+    setIsLoading(true);
+    clearError();
+
+    try {
+      // Skip redirect - we'll show success screen first
+      const result = await login(submitIdentifier, submitPassword_, {
+        redirectUrl,
+        skipRedirect: true,
+        rememberMe,
+      });
+
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info('2FA required after password login');
+        setTwoFactorSessionId(result.session_id);
+        setShouldPrompt2FA(result.should_prompt_2fa || false);
+        setStep('2fa');
+        saveIdentifierToStorage(submitIdentifier);
+        return true; // Password was accepted, now need 2FA
+      }
+
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info('Password login successful, showing success screen');
+        setStep('success');
+        onOTPSuccess?.();
+        return true;
+      }
+
+      // A lockout (429) carries a retry-after; show the countdown instead of a
+      // message the user can only re-trigger.
+      if (result.retryAfter) {
+        startRateLimitCountdown(result.retryAfter);
+        clearError();
+      } else {
+        setError(result.message);
+        onError?.(result.message);
+      }
+      return false;
+    } catch {
+      const msg = 'An unexpected error occurred';
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [
+    login, validateIdentifier, saveIdentifierToStorage, setError, setIsLoading,
+    clearError, startRateLimitCountdown, onOTPSuccess, onError, redirectUrl,
+    rememberMe, setTwoFactorSessionId, setShouldPrompt2FA, setStep,
+  ]);
+
+  const handlePasswordSubmit = useCallback(async (e: React.FormEvent) => {
+    e.preventDefault();
+    await submitPassword(identifier, password);
+  }, [identifier, password, submitPassword]);
+
   const handleResendOTP = useCallback(async () => {
     setIsLoading(true);
     clearError();
@@ -370,6 +453,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     // Submit handlers
     handleIdentifierSubmit,
     handleOTPSubmit,
+    handlePasswordSubmit,
     handleResendOTP,
     handleBackToIdentifier,
     forceOTPStep,

package/src/auth/hooks/useAuthFormState.ts

@@ -21,6 +21,7 @@ export const useAuthFormState = (
 ): UseAuthFormStateReturn => {
   const [identifier, setIdentifier] = useState(initialIdentifier);
   const [otp, setOtp] = useState('');
+  const [password, setPassword] = useState('');
   const [isLoading, setIsLoading] = useState(false);
   const [acceptedTerms, setAcceptedTerms] = useState(true);
   // null until the marketing-consent feature (if enabled) resolves its
@@ -66,6 +67,7 @@ export const useAuthFormState = (
     // State
     identifier,
     otp,
+    password,
     isLoading,
     acceptedTerms,
     marketingConsent,
@@ -83,6 +85,7 @@ export const useAuthFormState = (
     // Handlers
     setIdentifier,
     setOtp,
+    setPassword,
     setAcceptedTerms,
     setMarketingConsent,
     setRememberMe,

package/src/auth/types/form.ts

@@ -7,7 +7,7 @@
 
 import type { MutableRefObject } from 'react';
 
-import type { WebmailLink } from '../../_api/generated/types.gen';
+import type { User, WebmailLink } from '../../_api/generated/types.gen';
 
 export type { WebmailLink };
 
@@ -41,6 +41,41 @@ export interface OTPRequestConsent {
   disclosureVersion: string;
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Password Login Types
+// ─────────────────────────────────────────────────────────────────────────────
+
+export interface PasswordLoginOptions {
+  /** URL to redirect to after a successful login (ignored when skipRedirect). */
+  redirectUrl?: string;
+  /** Caller owns ALL navigation for this login, including the 2FA continuation. */
+  skipRedirect?: boolean;
+  /** Ask the server for a 30-day session instead of the default lifetime. */
+  rememberMe?: boolean;
+}
+
+/**
+ * Result of a password login.
+ *
+ * Deliberately the same shape as the verifyOTP result plus the failure codes
+ * the password endpoint adds: a sign-in form branches on `requires_2fa` the
+ * same way whichever credential it collected.
+ */
+export interface PasswordLoginResult {
+  success: boolean;
+  message: string;
+  user?: User;
+  requires_2fa?: boolean;
+  session_id?: string | null;
+  should_prompt_2fa?: boolean;
+  /** HTTP status of a failure — 401 for bad credentials, 429 when throttled. */
+  statusCode?: number;
+  /** Machine-readable failure code, e.g. `invalid_credentials`, `locked_out`. */
+  errorCode?: string;
+  /** Seconds until a throttled caller may retry (429 only). */
+  retryAfter?: number;
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Form State
 // ─────────────────────────────────────────────────────────────────────────────
@@ -50,6 +85,8 @@ export interface AuthFormState {
   identifier: string;
   /** OTP code input */
   otp: string;
+  /** Password input (password sign-in; empty for the OTP-only flow) */
+  password: string;
   /** Loading state */
   isLoading: boolean;
   /** Terms acceptance state */
@@ -91,6 +128,7 @@ export interface AuthFormState {
 export interface AuthFormStateHandlers {
   setIdentifier: (identifier: string) => void;
   setOtp: (otp: string) => void;
+  setPassword: (password: string) => void;
   setAcceptedTerms: (accepted: boolean) => void;
   setMarketingConsent: (consent: boolean | null) => void;
   setRememberMe: (rememberMe: boolean) => void;
@@ -111,6 +149,8 @@ export interface AuthFormStateHandlers {
 export interface AuthFormSubmitHandlers {
   handleIdentifierSubmit: (e: React.FormEvent) => Promise<void>;
   handleOTPSubmit: (e: React.FormEvent) => Promise<void>;
+  /** Submit email + password against the password grant */
+  handlePasswordSubmit: (e: React.FormEvent) => Promise<void>;
   handleResendOTP: () => Promise<void>;
   handleBackToIdentifier: () => void;
   forceOTPStep: () => void;

package/src/auth/types/index.ts

@@ -14,6 +14,8 @@ export type {
   UseAuthFormOptions,
   OTPRequestResult,
   OTPRequestConsent,
+  PasswordLoginOptions,
+  PasswordLoginResult,
   WebmailLink,
 } from './form';
 

package/src/auth/utils/analytics.ts

@@ -19,6 +19,7 @@ export enum AnalyticsEvent {
   AUTH_OTP_REQUEST = 'auth_otp_request',
   AUTH_LOGIN_SUCCESS = 'auth_login_success',
   AUTH_OTP_VERIFY_FAIL = 'auth_otp_verify_fail',
+  AUTH_PASSWORD_LOGIN_FAIL = 'auth_password_login_fail',
   AUTH_SESSION_EXPIRED = 'auth_session_expired',
   AUTH_TOKEN_REFRESH = 'auth_token_refresh',
   AUTH_TOKEN_REFRESH_FAIL = 'auth_token_refresh_fail',