@djangocfg/api 2.1.546 → 2.1.548

package/dist/auth.mjs

@@ -973,6 +973,7 @@ var formatCountdown = /* @__PURE__ */ __name((s) => {
 var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
   const [identifier, setIdentifier] = useState2(initialIdentifier);
   const [otp, setOtp] = useState2("");
+  const [password, setPassword] = useState2("");
   const [isLoading, setIsLoading] = useState2(false);
   const [acceptedTerms, setAcceptedTerms] = useState2(true);
   const [marketingConsent, setMarketingConsent] = useState2(null);
@@ -1008,6 +1009,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     // State
     identifier,
     otp,
+    password,
     isLoading,
     acceptedTerms,
     marketingConsent,
@@ -1025,6 +1027,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "") => {
     // Handlers
     setIdentifier,
     setOtp,
+    setPassword,
     setAcceptedTerms,
     setMarketingConsent,
     setRememberMe,
@@ -2239,6 +2242,24 @@ var CfgAccountsAuth = class {
   static {
     __name(this, "CfgAccountsAuth");
   }
+  /**
+   * Obtain a JWT pair with email + password.
+   *
+   * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with
+   * a session id, or the token pair plus the user object. Failures are uniform
+   * (401 ``invalid_credentials``) whether the email is unknown, the password is
+   * wrong, or the account is inactive/soft-deleted — no enumeration.
+   */
+  static cfgAccountsTokenCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/token/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * Revoke a refresh token (logout).
    *
@@ -2427,6 +2448,7 @@ var AnalyticsEvent = /* @__PURE__ */ ((AnalyticsEvent2) => {
   AnalyticsEvent2["AUTH_OTP_REQUEST"] = "auth_otp_request";
   AnalyticsEvent2["AUTH_LOGIN_SUCCESS"] = "auth_login_success";
   AnalyticsEvent2["AUTH_OTP_VERIFY_FAIL"] = "auth_otp_verify_fail";
+  AnalyticsEvent2["AUTH_PASSWORD_LOGIN_FAIL"] = "auth_password_login_fail";
   AnalyticsEvent2["AUTH_SESSION_EXPIRED"] = "auth_session_expired";
   AnalyticsEvent2["AUTH_TOKEN_REFRESH"] = "auth_token_refresh";
   AnalyticsEvent2["AUTH_TOKEN_REFRESH_FAIL"] = "auth_token_refresh_fail";
@@ -2866,12 +2888,14 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   const {
     requestOTP,
     verifyOTP,
+    login,
     getSavedEmail,
     saveEmail
   } = useAuth();
   const {
     identifier,
     otp,
+    password,
     acceptedTerms,
     marketingConsent,
     rememberMe,
@@ -3023,6 +3047,78 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     e.preventDefault();
     await submitOTP(identifier, otp);
   }, [identifier, otp, submitOTP]);
+  const submitPassword = useCallback5(async (submitIdentifier, submitPassword_) => {
+    if (!submitIdentifier || !validateIdentifier2(submitIdentifier)) {
+      const msg = "Please enter a valid email address";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    if (!submitPassword_) {
+      const msg = "Please enter your password";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    }
+    setIsLoading(true);
+    clearError();
+    try {
+      const result = await login(submitIdentifier, submitPassword_, {
+        redirectUrl,
+        skipRedirect: true,
+        rememberMe
+      });
+      if (result.requires_2fa && result.session_id) {
+        authLogger.info("2FA required after password login");
+        setTwoFactorSessionId(result.session_id);
+        setShouldPrompt2FA(result.should_prompt_2fa || false);
+        setStep("2fa");
+        saveIdentifierToStorage(submitIdentifier);
+        return true;
+      }
+      if (result.success) {
+        saveIdentifierToStorage(submitIdentifier);
+        authLogger.info("Password login successful, showing success screen");
+        setStep("success");
+        onOTPSuccess?.();
+        return true;
+      }
+      if (result.retryAfter) {
+        startRateLimitCountdown(result.retryAfter);
+        clearError();
+      } else {
+        setError(result.message);
+        onError?.(result.message);
+      }
+      return false;
+    } catch {
+      const msg = "An unexpected error occurred";
+      setError(msg);
+      onError?.(msg);
+      return false;
+    } finally {
+      setIsLoading(false);
+    }
+  }, [
+    login,
+    validateIdentifier2,
+    saveIdentifierToStorage,
+    setError,
+    setIsLoading,
+    clearError,
+    startRateLimitCountdown,
+    onOTPSuccess,
+    onError,
+    redirectUrl,
+    rememberMe,
+    setTwoFactorSessionId,
+    setShouldPrompt2FA,
+    setStep
+  ]);
+  const handlePasswordSubmit = useCallback5(async (e) => {
+    e.preventDefault();
+    await submitPassword(identifier, password);
+  }, [identifier, password, submitPassword]);
   const handleResendOTP = useCallback5(async () => {
     setIsLoading(true);
     clearError();
@@ -3116,6 +3212,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     // Submit handlers
     handleIdentifierSubmit,
     handleOTPSubmit,
+    handlePasswordSubmit,
     handleResendOTP,
     handleBackToIdentifier,
     forceOTPStep,
@@ -4227,119 +4324,197 @@ __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts
 import useSWRMutation15 from "swr/mutation";
 
-// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts
 import useSWRMutation16 from "swr/mutation";
 
-// src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
+// src/_api/generated/_cfg_accounts/schemas/PasswordLoginResponse.ts
 import { z as z20 } from "zod";
-var TokenRefreshSchema = z20.object({
-  access: z20.string(),
-  refresh: z20.string()
+var PasswordLoginResponseSchema = z20.object({
+  requires_2fa: z20.boolean().default(false).optional(),
+  session_id: z20.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i).nullable().optional(),
+  refresh: z20.string().nullable().optional(),
+  access: z20.string().nullable().optional(),
+  user: UserSchema.nullable().optional(),
+  should_prompt_2fa: z20.boolean().optional(),
+  persistent_session: z20.boolean().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts
+function useCfgAccountsTokenCreate(config) {
+  return useSWRMutation16(
+    ["cfg_accounts_token_create"],
+    async (_key, { arg }) => {
+      const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true });
+      const data = res.data;
+      const parsed = PasswordLoginResponseSchema.safeParse(data);
+      if (!parsed.success) {
+        console.warn(
+          "[zod] response did not match schema",
+          {
+            operation: "cfg_accounts_token_create",
+            method: "POST",
+            path: "/cfg/accounts/token/",
+            issues: parsed.error.issues,
+            data
+          }
+        );
+        if (typeof window !== "undefined") {
+          try {
+            window.dispatchEvent(
+              new CustomEvent("zod-validation-error", {
+                detail: {
+                  operation: "cfg_accounts_token_create",
+                  method: "POST",
+                  path: "/cfg/accounts/token/",
+                  issues: parsed.error.issues,
+                  data,
+                  timestamp: /* @__PURE__ */ new Date()
+                },
+                bubbles: true,
+                cancelable: false
+              })
+            );
+          } catch {
+          }
+        }
+        return data;
+      }
+      return parsed.data;
+    },
+    config
+  );
+}
+__name(useCfgAccountsTokenCreate, "useCfgAccountsTokenCreate");
+
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
+import useSWRMutation17 from "swr/mutation";
+
+// src/_api/generated/_cfg_accounts/schemas/TokenRefresh.ts
 import { z as z21 } from "zod";
-var APIKeyRequestSchema = z21.object({
-  key: z21.string().min(1),
-  reissued_at: z21.string().datetime({ offset: true }).nullable(),
-  created_at: z21.string().datetime({ offset: true })
+var TokenRefreshSchema = z21.object({
+  access: z21.string(),
+  refresh: z21.string()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/APIKeyTestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/APIKeyRequest.ts
 import { z as z22 } from "zod";
-var APIKeyTestRequestSchema = z22.object({
-  key: z22.string().min(1)
+var APIKeyRequestSchema = z22.object({
+  key: z22.string().min(1),
+  reissued_at: z22.string().datetime({ offset: true }).nullable(),
+  created_at: z22.string().datetime({ offset: true })
 });
 
-// src/_api/generated/_cfg_accounts/schemas/CfgUserUpdateRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/APIKeyTestRequest.ts
 import { z as z23 } from "zod";
-var CfgUserUpdateRequestSchema = z23.object({
-  first_name: z23.string().max(50).optional(),
-  last_name: z23.string().max(50).optional(),
-  company: z23.string().max(100).optional(),
-  phone: z23.string().max(20).optional(),
-  position: z23.string().max(100).optional(),
-  language: z23.string().max(10).optional(),
-  timezone: z23.string().max(64).optional()
+var APIKeyTestRequestSchema = z23.object({
+  key: z23.string().min(1)
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/CfgUserUpdateRequest.ts
 import { z as z24 } from "zod";
-var OAuthAuthorizeRequestRequestSchema = z24.object({
-  redirect_uri: z24.string().optional(),
-  source_url: z24.string().optional()
+var CfgUserUpdateRequestSchema = z24.object({
+  first_name: z24.string().max(50).optional(),
+  last_name: z24.string().max(50).optional(),
+  company: z24.string().max(100).optional(),
+  phone: z24.string().max(20).optional(),
+  position: z24.string().max(100).optional(),
+  language: z24.string().max(10).optional(),
+  timezone: z24.string().max(64).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
 import { z as z25 } from "zod";
-var OAuthCallbackRequestRequestSchema = z25.object({
-  code: z25.string().min(10).max(500),
-  state: z25.string().min(20).max(100),
+var OAuthAuthorizeRequestRequestSchema = z25.object({
   redirect_uri: z25.string().optional(),
-  remember_me: z25.boolean().default(false).optional()
+  source_url: z25.string().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
 import { z as z26 } from "zod";
-var OAuthDisconnectRequestRequestSchema = z26.object({
-  provider: OAuthProviderEnumSchema
+var OAuthCallbackRequestRequestSchema = z26.object({
+  code: z26.string().min(10).max(500),
+  state: z26.string().min(20).max(100),
+  redirect_uri: z26.string().optional(),
+  remember_me: z26.boolean().default(false).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OAuthError.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthDisconnectRequestRequest.ts
 import { z as z27 } from "zod";
-var OAuthErrorSchema = z27.object({
-  error: z27.string(),
-  error_description: z27.string().optional()
+var OAuthDisconnectRequestRequestSchema = z27.object({
+  provider: OAuthProviderEnumSchema
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OTPErrorResponse.ts
+// src/_api/generated/_cfg_accounts/schemas/OAuthError.ts
 import { z as z28 } from "zod";
-var OTPErrorResponseSchema = z28.object({
+var OAuthErrorSchema = z28.object({
   error: z28.string(),
-  error_code: z28.string().nullable().optional(),
-  retry_after: z28.number().int().nullable().optional()
+  error_description: z28.string().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OTPErrorResponse.ts
 import { z as z29 } from "zod";
-var OTPRequestRequestSchema = z29.object({
-  identifier: z29.string().min(1),
-  source_url: z29.string().optional(),
-  marketing_consent: z29.boolean().nullable().optional(),
-  consent_disclosure_version: z29.string().max(64).optional()
+var OTPErrorResponseSchema = z29.object({
+  error: z29.string(),
+  error_code: z29.string().nullable().optional(),
+  retry_after: z29.number().int().nullable().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OTPRequestRequest.ts
 import { z as z30 } from "zod";
-var OTPVerifyRequestSchema = z30.object({
+var OTPRequestRequestSchema = z30.object({
   identifier: z30.string().min(1),
-  otp: z30.string().min(4).max(4),
   source_url: z30.string().optional(),
-  remember_me: z30.boolean().default(false).optional()
+  marketing_consent: z30.boolean().nullable().optional(),
+  consent_disclosure_version: z30.string().max(64).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/OTPVerifyRequest.ts
 import { z as z31 } from "zod";
-var PatchedCfgUserUpdateRequestSchema = z31.object({
-  first_name: z31.string().max(50).optional(),
-  last_name: z31.string().max(50).optional(),
-  company: z31.string().max(100).optional(),
-  phone: z31.string().max(20).optional(),
-  position: z31.string().max(100).optional(),
-  language: z31.string().max(10).optional(),
-  timezone: z31.string().max(64).optional()
+var OTPVerifyRequestSchema = z31.object({
+  identifier: z31.string().min(1),
+  otp: z31.string().min(4).max(4),
+  source_url: z31.string().optional(),
+  remember_me: z31.boolean().default(false).optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/TokenBlacklistRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/PasswordLoginError.ts
 import { z as z32 } from "zod";
-var TokenBlacklistRequestSchema = z32.object({
-  refresh: z32.string().min(1)
+var PasswordLoginErrorSchema = z32.object({
+  error: z32.string(),
+  error_code: z32.string(),
+  retry_after: z32.number().int().nullable().optional()
 });
 
-// src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
+// src/_api/generated/_cfg_accounts/schemas/PasswordLoginRequest.ts
 import { z as z33 } from "zod";
-var TokenRefreshRequestSchema = z33.object({
-  refresh: z33.string().min(1)
+var PasswordLoginRequestSchema = z33.object({
+  remember_me: z33.boolean().default(false).optional(),
+  email: z33.email(),
+  password: z33.string()
+});
+
+// src/_api/generated/_cfg_accounts/schemas/PatchedCfgUserUpdateRequest.ts
+import { z as z34 } from "zod";
+var PatchedCfgUserUpdateRequestSchema = z34.object({
+  first_name: z34.string().max(50).optional(),
+  last_name: z34.string().max(50).optional(),
+  company: z34.string().max(100).optional(),
+  phone: z34.string().max(20).optional(),
+  position: z34.string().max(100).optional(),
+  language: z34.string().max(10).optional(),
+  timezone: z34.string().max(64).optional()
+});
+
+// src/_api/generated/_cfg_accounts/schemas/TokenBlacklistRequest.ts
+import { z as z35 } from "zod";
+var TokenBlacklistRequestSchema = z35.object({
+  refresh: z35.string().min(1)
+});
+
+// src/_api/generated/_cfg_accounts/schemas/TokenRefreshRequest.ts
+import { z as z36 } from "zod";
+var TokenRefreshRequestSchema = z36.object({
+  refresh: z36.string().min(1)
 });
 
 // src/auth/context/AccountsContext.tsx
@@ -4376,6 +4551,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerAvatar } = useCfgAccountsProfileAvatarCreate();
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
+  const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();
   const refreshProfile = useCallback10(async (options) => {
     const { callerId, force } = options || {};
     if (!hasApiOrigin()) {
@@ -4425,22 +4601,30 @@ function AccountsProvider({ children }) {
     const result = await triggerOtpRequest({ body: data });
     return result;
   }, [triggerOtpRequest]);
-  const verifyOTP = useCallback10(async (data) => {
-    const result = await triggerOtpVerify({ body: data });
+  const settleLoginEnvelope = useCallback10(async (result, callerId) => {
     if (result.requires_2fa && result.session_id) {
       authLogger.info("2FA required, session:", result.session_id);
-      return result;
+      return;
     }
     if (result.access && result.refresh) {
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
-        await refreshProfile({ callerId: "verifyOTP", force: true });
+        await refreshProfile({ callerId, force: true });
       } catch (profileError2) {
-        authLogger.warn("Profile refresh failed after OTP verify (tokens are saved):", profileError2);
+        authLogger.warn(`Profile refresh failed after ${callerId} (tokens are saved):`, profileError2);
       }
     }
+  }, [refreshProfile]);
+  const verifyOTP = useCallback10(async (data) => {
+    const result = await triggerOtpVerify({ body: data });
+    await settleLoginEnvelope(result, "verifyOTP");
     return result;
-  }, [triggerOtpVerify, refreshProfile]);
+  }, [triggerOtpVerify, settleLoginEnvelope]);
+  const loginWithPassword = useCallback10(async (data) => {
+    const result = await triggerPasswordLogin({ body: data });
+    await settleLoginEnvelope(result, "loginWithPassword");
+    return result;
+  }, [triggerPasswordLogin, settleLoginEnvelope]);
   const logout = useCallback10(() => {
     const refresh = auth.getRefreshToken();
     if (refresh) {
@@ -4463,6 +4647,7 @@ function AccountsProvider({ children }) {
     refreshProfile,
     requestOTP,
     verifyOTP,
+    loginWithPassword,
     logout
   }), [
     profile,
@@ -4474,6 +4659,7 @@ function AccountsProvider({ children }) {
     refreshProfile,
     requestOTP,
     verifyOTP,
+    loginWithPassword,
     logout
   ]);
   return /* @__PURE__ */ jsx(AccountsContext.Provider, { value, children });
@@ -4710,6 +4896,72 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
+  const login = useCallback11(
+    async (email, password, options) => {
+      const { redirectUrl, skipRedirect, rememberMe = false } = options || {};
+      try {
+        pendingManualNavRef.current = Boolean(skipRedirect);
+        const result = await accountsRef.current.loginWithPassword({
+          email,
+          password,
+          remember_me: rememberMe
+        });
+        if (result.requires_2fa && result.session_id) {
+          authLogger.info("2FA required, session:", result.session_id);
+          return {
+            success: true,
+            message: "Password verified, 2FA required",
+            requires_2fa: true,
+            session_id: result.session_id,
+            should_prompt_2fa: result.should_prompt_2fa
+          };
+        }
+        if (!result.access || !result.refresh) {
+          authLogger.error("Password login returned invalid response:", result);
+          return { success: false, message: "Invalid login response" };
+        }
+        setStoredEmail(email);
+        Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+          category: "auth" /* AUTH */,
+          label: "password"
+        });
+        if (result.user?.id) {
+          Analytics.setUser(String(result.user.id));
+        }
+        if (!skipRedirect) {
+          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
+          if (saved) redirectManager.clearRedirect();
+          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;
+          authLogger.info("Redirecting after auth to:", finalRedirectUrl);
+          router.hardPush(finalRedirectUrl);
+        }
+        return {
+          success: true,
+          message: "Login successful",
+          user: result.user,
+          should_prompt_2fa: result.should_prompt_2fa
+        };
+      } catch (error) {
+        authLogger.error("Password login error:", error);
+        Analytics.event("auth_password_login_fail" /* AUTH_PASSWORD_LOGIN_FAIL */, {
+          category: "auth" /* AUTH */,
+          label: "password"
+        });
+        if (error instanceof APIError) {
+          const body = error.response;
+          return {
+            success: false,
+            statusCode: error.statusCode,
+            message: apiErrorMessage(error),
+            errorCode: body?.error_code,
+            retryAfter: typeof body?.retry_after === "number" ? body.retry_after : void 0
+          };
+        }
+        return { success: false, message: "Failed to sign in" };
+      }
+    },
+    [setStoredEmail, redirectManager, router]
+  );
   const refreshToken = useCallback11(async () => {
     const access = await auth.refreshNow();
     if (access) {
@@ -4764,6 +5016,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       clearSavedEmail: clearStoredEmail,
       requestOTP,
       verifyOTP,
+      login,
       refreshToken,
       logout,
       saveRedirectUrl: redirectManager.setRedirect,
@@ -4786,6 +5039,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       clearStoredEmail,
       requestOTP,
       verifyOTP,
+      login,
       refreshToken,
       logout,
       redirectManager,
@@ -4829,6 +5083,10 @@ var defaultAuthState = {
     authLogger.warn("useAuth: verifyOTP called outside AuthProvider");
     return { success: false, message: "AuthProvider not available" };
   }, "verifyOTP"),
+  login: /* @__PURE__ */ __name(async () => {
+    authLogger.warn("useAuth: login called outside AuthProvider");
+    return { success: false, message: "AuthProvider not available" };
+  }, "login"),
   refreshToken: /* @__PURE__ */ __name(async () => {
     authLogger.warn("useAuth: refreshToken called outside AuthProvider");
     return { success: false, message: "AuthProvider not available" };
@@ -4889,9 +5147,16 @@ var formatAuthError = /* @__PURE__ */ __name((error) => {
 }, "formatAuthError");
 
 // src/auth/utils/guard.ts
+function isForbidden(s) {
+  return Boolean(
+    s.mounted && s.requireAuth && s.requireStaff && !s.authLoading && s.isAuthenticated && !s.isAdminUser
+  );
+}
+__name(isForbidden, "isForbidden");
 function resolveGuardIsLoading(s) {
   if (!s.mounted) return true;
   if (!s.requireAuth) return false;
+  if (isForbidden(s)) return false;
   return s.authLoading || s.isRedirecting || !s.isAuthenticated;
 }
 __name(resolveGuardIsLoading, "resolveGuardIsLoading");
@@ -4922,6 +5187,7 @@ export {
   getCachedProfile,
   hasValidCache,
   isAllowedAuthPath,
+  isForbidden,
   logger,
   normalizePath,
   peekSavedRedirect,