@djangocfg/api 2.1.546 → 2.1.548

package/README.md

@@ -77,6 +77,31 @@ import {
 } from '@djangocfg/api/auth';
 ```
 
+### Guard resolvers
+
+The "spinner vs redirect vs render" decision is pure and separately testable.
+`useAuthGuard` (and `@djangocfg/layouts`' `PrivateLayout`) just wire React state
+into these:
+
+```typescript
+import {
+  resolveGuardIsLoading,      // show the preloader?
+  shouldRedirectToAuth,       // no session → send to the auth form
+  isForbidden,                // signed in, but lacks the required privilege
+  resolveGuardIsAuthenticated,
+  type GuardInput,
+} from '@djangocfg/api/auth';
+```
+
+`GuardInput` takes two optional fields for the role gate: `requireStaff` (the
+route needs staff/admin) and `isAdminUser` (from `useAuth()` — the
+`is_staff || is_superuser` fold, never one flag).
+
+`isForbidden` is deliberately **not** a redirect condition: the session is
+valid, so the auth form cannot fix it, and redirecting would loop on the saved
+URL. Render a distinct "not authorised" state instead. `resolveGuardIsLoading`
+returns `false` once forbidden, so the preloader never spins on it.
+
 ## Token storage & DPoP
 
 The token lives in the shared `auth` store (localStorage by default, switchable

package/dist/auth.cjs

@@ -50,6 +50,7 @@ __export(auth_exports, {
   getCachedProfile: () => getCachedProfile,
   hasValidCache: () => hasValidCache,
   isAllowedAuthPath: () => isAllowedAuthPath,
+  isForbidden: () => isForbidden,
   logger: () => logger,
   normalizePath: () => normalizePath,
   peekSavedRedirect: () => peekSavedRedirect,
@@ -1044,6 +1045,7 @@ var formatCountdown = /* @__PURE__ */ __name((s) => {
 var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [identifier, setIdentifier] = (0, import_react4.useState)(initialIdentifier);
   const [otp, setOtp] = (0, import_react4.useState)("");
+  const [password, setPassword] = (0, import_react4.useState)("");
   const [isLoading, setIsLoading] = (0, import_react4.useState)(false);
   const [acceptedTerms, setAcceptedTerms] = (0, import_react4.useState)(true);
   const [marketingConsent, setMarketingConsent] = (0, import_react4.useState)(null);
@@ -1079,6 +1081,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     // State
     identifier,
     otp,
+    password,
     isLoading,
     acceptedTerms,
     marketingConsent,
@@ -1096,6 +1099,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     // Handlers
     setIdentifier,
     setOtp,
+    setPassword,
     setAcceptedTerms,
     setMarketingConsent,
     setRememberMe,
@@ -2310,6 +2314,24 @@ var CfgAccountsAuth = class {
   static {
     __name(this, "CfgAccountsAuth");
   }
+  /**
+   * Obtain a JWT pair with email + password.
+   *
+   * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with
+   * a session id, or the token pair plus the user object. Failures are uniform
+   * (401 ``invalid_credentials``) whether the email is unknown, the password is
+   * wrong, or the account is inactive/soft-deleted — no enumeration.
+   */
+  static cfgAccountsTokenCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/token/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * Revoke a refresh token (logout).
    *
@@ -2498,6 +2520,7 @@ var AnalyticsEvent = /* @__PURE__ */ ((AnalyticsEvent2) => {
   AnalyticsEvent2["AUTH_OTP_REQUEST"] = "auth_otp_request";
   AnalyticsEvent2["AUTH_LOGIN_SUCCESS"] = "auth_login_success";
   AnalyticsEvent2["AUTH_OTP_VERIFY_FAIL"] = "auth_otp_verify_fail";
+  AnalyticsEvent2["AUTH_PASSWORD_LOGIN_FAIL"] = "auth_password_login_fail";
   AnalyticsEvent2["AUTH_SESSION_EXPIRED"] = "auth_session_expired";
   AnalyticsEvent2["AUTH_TOKEN_REFRESH"] = "auth_token_refresh";
   AnalyticsEvent2["AUTH_TOKEN_REFRESH_FAIL"] = "auth_token_refresh_fail";
@@ -2937,12 +2960,14 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   const {
     requestOTP,
     verifyOTP,
+    login,
     getSavedEmail,
     saveEmail
   } = useAuth();
   const {
     identifier,
     otp,
+    password,
     acceptedTerms,
     marketingConsent,
     rememberMe,
@@ -3094,6 +3119,78 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     e.preventDefault();
     await submitOTP(identifier, otp);
   }, [identifier, otp, submitOTP]);
+  const submitPassword = (0, import_react9.useCallback)(async (submitIdentifier, submitPassword_) => {
+    if (!submitIdentifier || !validateIdentifier2(submitIdentifier)) {
+      const msg = "Please enter a valid email address";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    if (!submitPassword_) {
+      const msg = "Please enter your password";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    setIsLoading(true);
+    clearError();
+    try {
+      const result = await login(submitIdentifier, submitPassword_, {
+        redirectUrl,
+        skipRedirect: true,
+        rememberMe
+      });
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info("2FA required after password login");
+        setTwoFactorSessionId(result.session_id);
+        setShouldPrompt2FA(result.should_prompt_2fa || false);
+        setStep("2fa");
+        saveIdentifierToStorage(submitIdentifier);
+        return true;
+      }
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info("Password login successful, showing success screen");
+        setStep("success");
+        onOTPSuccess?.();
+        return true;
+      }
+      if (result.retryAfter) {
+        startRateLimitCountdown(result.retryAfter);
+        clearError();
+      } else {
+        setError(result.message);
+        onError?.(result.message);
+      }
+      return false;
+    } catch {
+      const msg = "An unexpected error occurred";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [
+    login,
+    validateIdentifier2,
+    saveIdentifierToStorage,
+    setError,
+    setIsLoading,
+    clearError,
+    startRateLimitCountdown,
+    onOTPSuccess,
+    onError,
+    redirectUrl,
+    rememberMe,
+    setTwoFactorSessionId,
+    setShouldPrompt2FA,
+    setStep
+  ]);
+  const handlePasswordSubmit = (0, import_react9.useCallback)(async (e) => {
+    e.preventDefault();
+    await submitPassword(identifier, password);
+  }, [identifier, password, submitPassword]);
   const handleResendOTP = (0, import_react9.useCallback)(async () => {
     setIsLoading(true);
     clearError();
@@ -3187,6 +3284,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     // Submit handlers
     handleIdentifierSubmit,
     handleOTPSubmit,
+    handlePasswordSubmit,
     handleResendOTP,
     handleBackToIdentifier,
     forceOTPStep,
@@ -4290,119 +4388,197 @@ __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts
 var import_mutation15 = __toESM(require("swr/mutation"), 1);
 
-// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts
 var import_mutation16 = __toESM(require("swr/mutation"), 1);
 
-// src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
+// src/_api/generated/_cfg_accounts/schemas/PasswordLoginResponse.ts
 var import_zod20 = require("zod");
-var TokenRefreshSchema = import_zod20.z.object({
-  access: import_zod20.z.string(),
-  refresh: import_zod20.z.string()
+var PasswordLoginResponseSchema = import_zod20.z.object({
+  requires_2fa: import_zod20.z.boolean().default(false).optional(),
+  session_id: import_zod20.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+  refresh: import_zod20.z.string().nullable().optional(),
+  access: import_zod20.z.string().nullable().optional(),
+  user: UserSchema.nullable().optional(),
+  should_prompt_2fa: import_zod20.z.boolean().optional(),
+  persistent_session: import_zod20.z.boolean().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts
+function useCfgAccountsTokenCreate(config) {
+  return (0, import_mutation16.default)(
+    ["cfg_accounts_token_create"],
+    async (_key, { arg }) => {
+      const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true });
+      const data = res.data;
+      const parsed = PasswordLoginResponseSchema.safeParse(data);
+      if (!parsed.success) {
+        console.warn(
+          "[zod] response did not match schema",
+          {
+            operation: "cfg_accounts_token_create",
+            method: "POST",
+            path: "/cfg/accounts/token/",
+            issues: parsed.error.issues,
+            data
+          }
+        );
+        if (typeof window !== "undefined") {
+          try {
+            window.dispatchEvent(
+              new CustomEvent("zod-validation-error", {
+                detail: {
+                  operation: "cfg_accounts_token_create",
+                  method: "POST",
+                  path: "/cfg/accounts/token/",
+                  issues: parsed.error.issues,
+                  data,
+                  timestamp: /* @__PURE__ */ new Date()
+                },
+                bubbles: true,
+                cancelable: false
+              })
+            );
+          } catch {
+          }
+        }
+        return data;
+      }
+      return parsed.data;
+    },
+    config
+  );
+}
+__name(useCfgAccountsTokenCreate, "useCfgAccountsTokenCreate");
+
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
+var import_mutation17 = __toESM(require("swr/mutation"), 1);
+
+// src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
 var import_zod21 = require("zod");
-var APIKeyRequestSchema = import_zod21.z.object({
-  key: import_zod21.z.string().min(1),
-  reissued_at: import_zod21.z.string().datetime({ offset: true }).nullable(),
-  created_at: import_zod21.z.string().datetime({ offset: true })
+var TokenRefreshSchema = import_zod21.z.object({
+  access: import_zod21.z.string(),
+  refresh: import_zod21.z.string()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/APIKeyTestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
 var import_zod22 = require("zod");
-var APIKeyTestRequestSchema = import_zod22.z.object({
-  key: import_zod22.z.string().min(1)
+var APIKeyRequestSchema = import_zod22.z.object({
+  key: import_zod22.z.string().min(1),
+  reissued_at: import_zod22.z.string().datetime({ offset: true }).nullable(),
+  created_at: import_zod22.z.string().datetime({ offset: true })
 });
 
-// src/_api/generated/_cfg_accounts/schemas/CfgUserUpdateRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/APIKeyTestRequest.ts
 var import_zod23 = require("zod");
-var CfgUserUpdateRequestSchema = import_zod23.z.object({
-  first_name: import_zod23.z.string().max(50).optional(),
-  last_name: import_zod23.z.string().max(50).optional(),
-  company: import_zod23.z.string().max(100).optional(),
-  phone: import_zod23.z.string().max(20).optional(),
-  position: import_zod23.z.string().max(100).optional(),
-  language: import_zod23.z.string().max(10).optional(),
-  timezone: import_zod23.z.string().max(64).optional()
+var APIKeyTestRequestSchema = import_zod23.z.object({
+  key: import_zod23.z.string().min(1)
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/CfgUserUpdateRequest.ts
 var import_zod24 = require("zod");
-var OAuthAuthorizeRequestRequestSchema = import_zod24.z.object({
-  redirect_uri: import_zod24.z.string().optional(),
-  source_url: import_zod24.z.string().optional()
+var CfgUserUpdateRequestSchema = import_zod24.z.object({
+  first_name: import_zod24.z.string().max(50).optional(),
+  last_name: import_zod24.z.string().max(50).optional(),
+  company: import_zod24.z.string().max(100).optional(),
+  phone: import_zod24.z.string().max(20).optional(),
+  position: import_zod24.z.string().max(100).optional(),
+  language: import_zod24.z.string().max(10).optional(),
+  timezone: import_zod24.z.string().max(64).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
 var import_zod25 = require("zod");
-var OAuthCallbackRequestRequestSchema = import_zod25.z.object({
-  code: import_zod25.z.string().min(10).max(500),
-  state: import_zod25.z.string().min(20).max(100),
+var OAuthAuthorizeRequestRequestSchema = import_zod25.z.object({
   redirect_uri: import_zod25.z.string().optional(),
-  remember_me: import_zod25.z.boolean().default(false).optional()
+  source_url: import_zod25.z.string().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
 var import_zod26 = require("zod");
-var OAuthDisconnectRequestRequestSchema = import_zod26.z.object({
-  provider: OAuthProviderEnumSchema
+var OAuthCallbackRequestRequestSchema = import_zod26.z.object({
+  code: import_zod26.z.string().min(10).max(500),
+  state: import_zod26.z.string().min(20).max(100),
+  redirect_uri: import_zod26.z.string().optional(),
+  remember_me: import_zod26.z.boolean().default(false).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthError.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
 var import_zod27 = require("zod");
-var OAuthErrorSchema = import_zod27.z.object({
-  error: import_zod27.z.string(),
-  error_description: import_zod27.z.string().optional()
+var OAuthDisconnectRequestRequestSchema = import_zod27.z.object({
+  provider: OAuthProviderEnumSchema
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OTPErrorResponse.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthError.ts
 var import_zod28 = require("zod");
-var OTPErrorResponseSchema = import_zod28.z.object({
+var OAuthErrorSchema = import_zod28.z.object({
   error: import_zod28.z.string(),
-  error_code: import_zod28.z.string().nullable().optional(),
-  retry_after: import_zod28.z.number().int().nullable().optional()
+  error_description: import_zod28.z.string().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OTPErrorResponse.ts
 var import_zod29 = require("zod");
-var OTPRequestRequestSchema = import_zod29.z.object({
-  identifier: import_zod29.z.string().min(1),
-  source_url: import_zod29.z.string().optional(),
-  marketing_consent: import_zod29.z.boolean().nullable().optional(),
-  consent_disclosure_version: import_zod29.z.string().max(64).optional()
+var OTPErrorResponseSchema = import_zod29.z.object({
+  error: import_zod29.z.string(),
+  error_code: import_zod29.z.string().nullable().optional(),
+  retry_after: import_zod29.z.number().int().nullable().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts
 var import_zod30 = require("zod");
-var OTPVerifyRequestSchema = import_zod30.z.object({
+var OTPRequestRequestSchema = import_zod30.z.object({
   identifier: import_zod30.z.string().min(1),
-  otp: import_zod30.z.string().min(4).max(4),
   source_url: import_zod30.z.string().optional(),
-  remember_me: import_zod30.z.boolean().default(false).optional()
+  marketing_consent: import_zod30.z.boolean().nullable().optional(),
+  consent_disclosure_version: import_zod30.z.string().max(64).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts
 var import_zod31 = require("zod");
-var PatchedCfgUserUpdateRequestSchema = import_zod31.z.object({
-  first_name: import_zod31.z.string().max(50).optional(),
-  last_name: import_zod31.z.string().max(50).optional(),
-  company: import_zod31.z.string().max(100).optional(),
-  phone: import_zod31.z.string().max(20).optional(),
-  position: import_zod31.z.string().max(100).optional(),
-  language: import_zod31.z.string().max(10).optional(),
-  timezone: import_zod31.z.string().max(64).optional()
+var OTPVerifyRequestSchema = import_zod31.z.object({
+  identifier: import_zod31.z.string().min(1),
+  otp: import_zod31.z.string().min(4).max(4),
+  source_url: import_zod31.z.string().optional(),
+  remember_me: import_zod31.z.boolean().default(false).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/TokenBlacklistRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/PasswordLoginError.ts
 var import_zod32 = require("zod");
-var TokenBlacklistRequestSchema = import_zod32.z.object({
-  refresh: import_zod32.z.string().min(1)
+var PasswordLoginErrorSchema = import_zod32.z.object({
+  error: import_zod32.z.string(),
+  error_code: import_zod32.z.string(),
+  retry_after: import_zod32.z.number().int().nullable().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/PasswordLoginRequest.ts
 var import_zod33 = require("zod");
-var TokenRefreshRequestSchema = import_zod33.z.object({
-  refresh: import_zod33.z.string().min(1)
+var PasswordLoginRequestSchema = import_zod33.z.object({
+  remember_me: import_zod33.z.boolean().default(false).optional(),
+  email: import_zod33.z.email(),
+  password: import_zod33.z.string()
+});
+
+// src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
+var import_zod34 = require("zod");
+var PatchedCfgUserUpdateRequestSchema = import_zod34.z.object({
+  first_name: import_zod34.z.string().max(50).optional(),
+  last_name: import_zod34.z.string().max(50).optional(),
+  company: import_zod34.z.string().max(100).optional(),
+  phone: import_zod34.z.string().max(20).optional(),
+  position: import_zod34.z.string().max(100).optional(),
+  language: import_zod34.z.string().max(10).optional(),
+  timezone: import_zod34.z.string().max(64).optional()
+});
+
+// src/_api/generated/_cfg_accounts/schemas/TokenBlacklistRequest.ts
+var import_zod35 = require("zod");
+var TokenBlacklistRequestSchema = import_zod35.z.object({
+  refresh: import_zod35.z.string().min(1)
+});
+
+// src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
+var import_zod36 = require("zod");
+var TokenRefreshRequestSchema = import_zod36.z.object({
+  refresh: import_zod36.z.string().min(1)
 });
 
 // src/auth/context/AccountsContext.tsx
@@ -4439,6 +4615,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerAvatar } = useCfgAccountsProfileAvatarCreate();
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
+  const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();
   const refreshProfile = (0, import_react15.useCallback)(async (options) => {
     const { callerId, force } = options || {};
     if (!hasApiOrigin()) {
@@ -4488,22 +4665,30 @@ function AccountsProvider({ children }) {
     const result = await triggerOtpRequest({ body: data });
     return result;
   }, [triggerOtpRequest]);
-  const verifyOTP = (0, import_react15.useCallback)(async (data) => {
-    const result = await triggerOtpVerify({ body: data });
+  const settleLoginEnvelope = (0, import_react15.useCallback)(async (result, callerId) => {
     if (result.requires_2fa && result.session_id) {
       authLogger.info("2FA required, session:", result.session_id);
-      return result;
+      return;
     }
     if (result.access && result.refresh) {
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
-        await refreshProfile({ callerId: "verifyOTP", force: true });
+        await refreshProfile({ callerId, force: true });
       } catch (profileError2) {
-        authLogger.warn("Profile refresh failed after OTP verify (tokens are saved):", profileError2);
+        authLogger.warn(`Profile refresh failed after ${callerId} (tokens are saved):`, profileError2);
       }
     }
+  }, [refreshProfile]);
+  const verifyOTP = (0, import_react15.useCallback)(async (data) => {
+    const result = await triggerOtpVerify({ body: data });
+    await settleLoginEnvelope(result, "verifyOTP");
     return result;
-  }, [triggerOtpVerify, refreshProfile]);
+  }, [triggerOtpVerify, settleLoginEnvelope]);
+  const loginWithPassword = (0, import_react15.useCallback)(async (data) => {
+    const result = await triggerPasswordLogin({ body: data });
+    await settleLoginEnvelope(result, "loginWithPassword");
+    return result;
+  }, [triggerPasswordLogin, settleLoginEnvelope]);
   const logout = (0, import_react15.useCallback)(() => {
     const refresh = auth.getRefreshToken();
     if (refresh) {
@@ -4526,6 +4711,7 @@ function AccountsProvider({ children }) {
     refreshProfile,
     requestOTP,
     verifyOTP,
+    loginWithPassword,
     logout
   }), [
     profile,
@@ -4537,6 +4723,7 @@ function AccountsProvider({ children }) {
     refreshProfile,
     requestOTP,
     verifyOTP,
+    loginWithPassword,
     logout
   ]);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AccountsContext.Provider, { value, children });
@@ -4773,6 +4960,72 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
+  const login = (0, import_react16.useCallback)(
+    async (email, password, options) => {
+      const { redirectUrl, skipRedirect, rememberMe = false } = options || {};
+      try {
+        pendingManualNavRef.current = Boolean(skipRedirect);
+        const result = await accountsRef.current.loginWithPassword({
+          email,
+          password,
+          remember_me: rememberMe
+        });
+        if (result.requires_2fa && result.session_id) {
+          authLogger.info("2FA required, session:", result.session_id);
+          return {
+            success: true,
+            message: "Password verified, 2FA required",
+            requires_2fa: true,
+            session_id: result.session_id,
+            should_prompt_2fa: result.should_prompt_2fa
+          };
+        }
+        if (!result.access || !result.refresh) {
+          authLogger.error("Password login returned invalid response:", result);
+          return { success: false, message: "Invalid login response" };
+        }
+        setStoredEmail(email);
+        Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+          category: "auth" /* AUTH */,
+          label: "password"
+        });
+        if (result.user?.id) {
+          Analytics.setUser(String(result.user.id));
+        }
+        if (!skipRedirect) {
+          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+          if (saved) redirectManager.clearRedirect();
+          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;
+          authLogger.info("Redirecting after auth to:", finalRedirectUrl);
+          router.hardPush(finalRedirectUrl);
+        }
+        return {
+          success: true,
+          message: "Login successful",
+          user: result.user,
+          should_prompt_2fa: result.should_prompt_2fa
+        };
+      } catch (error) {
+        authLogger.error("Password login error:", error);
+        Analytics.event("auth_password_login_fail" /* AUTH_PASSWORD_LOGIN_FAIL */, {
+          category: "auth" /* AUTH */,
+          label: "password"
+        });
+        if (error instanceof APIError) {
+          const body = error.response;
+          return {
+            success: false,
+            statusCode: error.statusCode,
+            message: apiErrorMessage(error),
+            errorCode: body?.error_code,
+            retryAfter: typeof body?.retry_after === "number" ? body.retry_after : void 0
+          };
+        }
+        return { success: false, message: "Failed to sign in" };
+      }
+    },
+    [setStoredEmail, redirectManager, router]
+  );
   const refreshToken = (0, import_react16.useCallback)(async () => {
     const access = await auth.refreshNow();
     if (access) {
@@ -4827,6 +5080,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       clearSavedEmail: clearStoredEmail,
       requestOTP,
       verifyOTP,
+      login,
       refreshToken,
       logout,
       saveRedirectUrl: redirectManager.setRedirect,
@@ -4849,6 +5103,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       clearStoredEmail,
       requestOTP,
       verifyOTP,
+      login,
       refreshToken,
       logout,
       redirectManager,
@@ -4892,6 +5147,10 @@ var defaultAuthState = {
     authLogger.warn("useAuth: verifyOTP called outside AuthProvider");
     return { success: false, message: "AuthProvider not available" };
   }, "verifyOTP"),
+  login: /* @__PURE__ */ __name(async () => {
+    authLogger.warn("useAuth: login called outside AuthProvider");
+    return { success: false, message: "AuthProvider not available" };
+  }, "login"),
   refreshToken: /* @__PURE__ */ __name(async () => {
     authLogger.warn("useAuth: refreshToken called outside AuthProvider");
     return { success: false, message: "AuthProvider not available" };
@@ -4952,9 +5211,16 @@ var formatAuthError = /* @__PURE__ */ __name((error) => {
 }, "formatAuthError");
 
 // src/auth/utils/guard.ts
+function isForbidden(s) {
+  return Boolean(
+    s.mounted && s.requireAuth && s.requireStaff && !s.authLoading && s.isAuthenticated && !s.isAdminUser
+  );
+}
+__name(isForbidden, "isForbidden");
 function resolveGuardIsLoading(s) {
   if (!s.mounted) return true;
   if (!s.requireAuth) return false;
+  if (isForbidden(s)) return false;
   return s.authLoading || s.isRedirecting || !s.isAuthenticated;
 }
 __name(resolveGuardIsLoading, "resolveGuardIsLoading");