@djangocfg/api 2.1.546 → 2.1.547

package/dist/auth.d.cts

@@ -187,6 +187,42 @@ type OtpVerifyResponse = {
      */
     persistent_session?: boolean;
 };
+/**
+ * Password-login response.
+ *
+ * Mirrors the OTP verify response so a client can treat every login flow
+ * identically. ``requires_2fa=True`` carries a session id instead of tokens.
+ */
+type PasswordLoginResponse = {
+    /**
+     * Whether 2FA verification is required
+     */
+    requires_2fa?: boolean;
+    /**
+     * 2FA session ID (if requires_2fa is True)
+     */
+    session_id?: string | null;
+    /**
+     * JWT refresh token (if requires_2fa is False)
+     */
+    refresh?: string | null;
+    /**
+     * JWT access token (if requires_2fa is False)
+     */
+    access?: string | null;
+    /**
+     * User information (if requires_2fa is False)
+     */
+    user?: User | null;
+    /**
+     * Whether user should be prompted to enable 2FA
+     */
+    should_prompt_2fa?: boolean;
+    /**
+     * Whether this login should persist across browser restarts
+     */
+    persistent_session?: boolean;
+};
 /**
  * Serializer for updating user profile.
  */
@@ -411,6 +447,22 @@ declare enum WebmailLinkProviderEnum {
     FREE_FR = "free_fr",
     SFR = "sfr"
 }
+/**
+ * Validate email+password against live accounts only.
+ *
+ * Subclasses SimpleJWT so the field/validation contract stays theirs, but
+ * replaces ``validate()`` — the token pair itself is minted by the view via
+ * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
+ * lifetime match OTP, OAuth and TOTP exactly.
+ */
+type PasswordLoginRequestWritable = {
+    /**
+     * Keep this browser signed in for 30 days
+     */
+    remember_me?: boolean;
+    email: string;
+    password: string;
+};
 
 /**
  * Auth Form Types
@@ -438,11 +490,42 @@ interface OTPRequestConsent {
     /** Version tag of the disclosure copy the user saw (e.g. "product-updates-reg-v1"). */
     disclosureVersion: string;
 }
+interface PasswordLoginOptions {
+    /** URL to redirect to after a successful login (ignored when skipRedirect). */
+    redirectUrl?: string;
+    /** Caller owns ALL navigation for this login, including the 2FA continuation. */
+    skipRedirect?: boolean;
+    /** Ask the server for a 30-day session instead of the default lifetime. */
+    rememberMe?: boolean;
+}
+/**
+ * Result of a password login.
+ *
+ * Deliberately the same shape as the verifyOTP result plus the failure codes
+ * the password endpoint adds: a sign-in form branches on `requires_2fa` the
+ * same way whichever credential it collected.
+ */
+interface PasswordLoginResult {
+    success: boolean;
+    message: string;
+    user?: User;
+    requires_2fa?: boolean;
+    session_id?: string | null;
+    should_prompt_2fa?: boolean;
+    /** HTTP status of a failure — 401 for bad credentials, 429 when throttled. */
+    statusCode?: number;
+    /** Machine-readable failure code, e.g. `invalid_credentials`, `locked_out`. */
+    errorCode?: string;
+    /** Seconds until a throttled caller may retry (429 only). */
+    retryAfter?: number;
+}
 interface AuthFormState {
     /** Email address */
     identifier: string;
     /** OTP code input */
     otp: string;
+    /** Password input (password sign-in; empty for the OTP-only flow) */
+    password: string;
     /** Loading state */
     isLoading: boolean;
     /** Terms acceptance state */
@@ -479,6 +562,7 @@ interface AuthFormState {
 interface AuthFormStateHandlers {
     setIdentifier: (identifier: string) => void;
     setOtp: (otp: string) => void;
+    setPassword: (password: string) => void;
     setAcceptedTerms: (accepted: boolean) => void;
     setMarketingConsent: (consent: boolean | null) => void;
     setRememberMe: (rememberMe: boolean) => void;
@@ -498,6 +582,8 @@ interface AuthFormStateHandlers {
 interface AuthFormSubmitHandlers {
     handleIdentifierSubmit: (e: React.FormEvent) => Promise<void>;
     handleOTPSubmit: (e: React.FormEvent) => Promise<void>;
+    /** Submit email + password against the password grant */
+    handlePasswordSubmit: (e: React.FormEvent) => Promise<void>;
     handleResendOTP: () => Promise<void>;
     handleBackToIdentifier: () => void;
     forceOTPStep: () => void;
@@ -595,6 +681,7 @@ interface AuthContextType {
         session_id?: string | null;
         should_prompt_2fa?: boolean;
     }>;
+    login: (email: string, password: string, options?: PasswordLoginOptions) => Promise<PasswordLoginResult>;
     refreshToken: () => Promise<{
         success: boolean;
         message: string;
@@ -657,6 +744,7 @@ interface AccountsContextValue {
     }) => Promise<User | undefined>;
     requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;
     verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;
+    loginWithPassword: (data: PasswordLoginRequestWritable) => Promise<PasswordLoginResponse>;
     logout: () => void;
 }
 interface AccountsProviderProps {
@@ -1217,6 +1305,7 @@ declare enum AnalyticsEvent {
     AUTH_OTP_REQUEST = "auth_otp_request",
     AUTH_LOGIN_SUCCESS = "auth_login_success",
     AUTH_OTP_VERIFY_FAIL = "auth_otp_verify_fail",
+    AUTH_PASSWORD_LOGIN_FAIL = "auth_password_login_fail",
     AUTH_SESSION_EXPIRED = "auth_session_expired",
     AUTH_TOKEN_REFRESH = "auth_token_refresh",
     AUTH_TOKEN_REFRESH_FAIL = "auth_token_refresh_fail",
@@ -1266,4 +1355,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.d.ts

@@ -187,6 +187,42 @@ type OtpVerifyResponse = {
      */
     persistent_session?: boolean;
 };
+/**
+ * Password-login response.
+ *
+ * Mirrors the OTP verify response so a client can treat every login flow
+ * identically. ``requires_2fa=True`` carries a session id instead of tokens.
+ */
+type PasswordLoginResponse = {
+    /**
+     * Whether 2FA verification is required
+     */
+    requires_2fa?: boolean;
+    /**
+     * 2FA session ID (if requires_2fa is True)
+     */
+    session_id?: string | null;
+    /**
+     * JWT refresh token (if requires_2fa is False)
+     */
+    refresh?: string | null;
+    /**
+     * JWT access token (if requires_2fa is False)
+     */
+    access?: string | null;
+    /**
+     * User information (if requires_2fa is False)
+     */
+    user?: User | null;
+    /**
+     * Whether user should be prompted to enable 2FA
+     */
+    should_prompt_2fa?: boolean;
+    /**
+     * Whether this login should persist across browser restarts
+     */
+    persistent_session?: boolean;
+};
 /**
  * Serializer for updating user profile.
  */
@@ -411,6 +447,22 @@ declare enum WebmailLinkProviderEnum {
     FREE_FR = "free_fr",
     SFR = "sfr"
 }
+/**
+ * Validate email+password against live accounts only.
+ *
+ * Subclasses SimpleJWT so the field/validation contract stays theirs, but
+ * replaces ``validate()`` — the token pair itself is minted by the view via
+ * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
+ * lifetime match OTP, OAuth and TOTP exactly.
+ */
+type PasswordLoginRequestWritable = {
+    /**
+     * Keep this browser signed in for 30 days
+     */
+    remember_me?: boolean;
+    email: string;
+    password: string;
+};
 
 /**
  * Auth Form Types
@@ -438,11 +490,42 @@ interface OTPRequestConsent {
     /** Version tag of the disclosure copy the user saw (e.g. "product-updates-reg-v1"). */
     disclosureVersion: string;
 }
+interface PasswordLoginOptions {
+    /** URL to redirect to after a successful login (ignored when skipRedirect). */
+    redirectUrl?: string;
+    /** Caller owns ALL navigation for this login, including the 2FA continuation. */
+    skipRedirect?: boolean;
+    /** Ask the server for a 30-day session instead of the default lifetime. */
+    rememberMe?: boolean;
+}
+/**
+ * Result of a password login.
+ *
+ * Deliberately the same shape as the verifyOTP result plus the failure codes
+ * the password endpoint adds: a sign-in form branches on `requires_2fa` the
+ * same way whichever credential it collected.
+ */
+interface PasswordLoginResult {
+    success: boolean;
+    message: string;
+    user?: User;
+    requires_2fa?: boolean;
+    session_id?: string | null;
+    should_prompt_2fa?: boolean;
+    /** HTTP status of a failure — 401 for bad credentials, 429 when throttled. */
+    statusCode?: number;
+    /** Machine-readable failure code, e.g. `invalid_credentials`, `locked_out`. */
+    errorCode?: string;
+    /** Seconds until a throttled caller may retry (429 only). */
+    retryAfter?: number;
+}
 interface AuthFormState {
     /** Email address */
     identifier: string;
     /** OTP code input */
     otp: string;
+    /** Password input (password sign-in; empty for the OTP-only flow) */
+    password: string;
     /** Loading state */
     isLoading: boolean;
     /** Terms acceptance state */
@@ -479,6 +562,7 @@ interface AuthFormState {
 interface AuthFormStateHandlers {
     setIdentifier: (identifier: string) => void;
     setOtp: (otp: string) => void;
+    setPassword: (password: string) => void;
     setAcceptedTerms: (accepted: boolean) => void;
     setMarketingConsent: (consent: boolean | null) => void;
     setRememberMe: (rememberMe: boolean) => void;
@@ -498,6 +582,8 @@ interface AuthFormStateHandlers {
 interface AuthFormSubmitHandlers {
     handleIdentifierSubmit: (e: React.FormEvent) => Promise<void>;
     handleOTPSubmit: (e: React.FormEvent) => Promise<void>;
+    /** Submit email + password against the password grant */
+    handlePasswordSubmit: (e: React.FormEvent) => Promise<void>;
     handleResendOTP: () => Promise<void>;
     handleBackToIdentifier: () => void;
     forceOTPStep: () => void;
@@ -595,6 +681,7 @@ interface AuthContextType {
         session_id?: string | null;
         should_prompt_2fa?: boolean;
     }>;
+    login: (email: string, password: string, options?: PasswordLoginOptions) => Promise<PasswordLoginResult>;
     refreshToken: () => Promise<{
         success: boolean;
         message: string;
@@ -657,6 +744,7 @@ interface AccountsContextValue {
     }) => Promise<User | undefined>;
     requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;
     verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;
+    loginWithPassword: (data: PasswordLoginRequestWritable) => Promise<PasswordLoginResponse>;
     logout: () => void;
 }
 interface AccountsProviderProps {
@@ -1217,6 +1305,7 @@ declare enum AnalyticsEvent {
     AUTH_OTP_REQUEST = "auth_otp_request",
     AUTH_LOGIN_SUCCESS = "auth_login_success",
     AUTH_OTP_VERIFY_FAIL = "auth_otp_verify_fail",
+    AUTH_PASSWORD_LOGIN_FAIL = "auth_password_login_fail",
     AUTH_SESSION_EXPIRED = "auth_session_expired",
     AUTH_TOKEN_REFRESH = "auth_token_refresh",
     AUTH_TOKEN_REFRESH_FAIL = "auth_token_refresh_fail",
@@ -1266,4 +1355,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };