@djangocfg/api 2.1.547 → 2.1.548

package/dist/auth.d.cts

@@ -1232,7 +1232,9 @@ declare const formatAuthError: (error: unknown) => string;
  *
  * Invariant that fixes the bug: once auth is resolved (`authLoading === false`)
  * and the user is unauthenticated, `isLoading` must become false so the guard
- * redirects to the form instead of spinning forever.
+ * redirects to the form instead of spinning forever. The same invariant covers
+ * the forbidden case: a signed-in user without the required privilege must stop
+ * loading too, or the preloader spins on a state no redirect will ever clear.
  */
 interface GuardInput {
     /** First client render matches SSR (preloader) until mounted, to avoid hydration mismatch. */
@@ -1245,7 +1247,20 @@ interface GuardInput {
     isRedirecting: boolean;
     /** User currently has a (valid-looking) session. */
     isAuthenticated: boolean;
+    /** Route requires staff/admin privileges, not just a session. */
+    requireStaff?: boolean;
+    /** `is_staff || is_superuser`, from `useAuth().isAdminUser`. */
+    isAdminUser?: boolean;
 }
+/**
+ * True when the session is valid but lacks the required privilege.
+ *
+ * Distinct from unauthenticated: the fix is a different account, not signing
+ * in, so this must never redirect to the auth form. Redirecting would also
+ * loop — the guard saves the current URL first, so a successful re-login on
+ * the same account returns straight to the wall.
+ */
+declare function isForbidden(s: GuardInput): boolean;
 /**
  * True while the guard should render a preloader rather than the protected
  * content. Mirrors useAuthGuard's formula exactly.
@@ -1355,4 +1370,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.d.ts

@@ -1232,7 +1232,9 @@ declare const formatAuthError: (error: unknown) => string;
  *
  * Invariant that fixes the bug: once auth is resolved (`authLoading === false`)
  * and the user is unauthenticated, `isLoading` must become false so the guard
- * redirects to the form instead of spinning forever.
+ * redirects to the form instead of spinning forever. The same invariant covers
+ * the forbidden case: a signed-in user without the required privilege must stop
+ * loading too, or the preloader spins on a state no redirect will ever clear.
  */
 interface GuardInput {
     /** First client render matches SSR (preloader) until mounted, to avoid hydration mismatch. */
@@ -1245,7 +1247,20 @@ interface GuardInput {
     isRedirecting: boolean;
     /** User currently has a (valid-looking) session. */
     isAuthenticated: boolean;
+    /** Route requires staff/admin privileges, not just a session. */
+    requireStaff?: boolean;
+    /** `is_staff || is_superuser`, from `useAuth().isAdminUser`. */
+    isAdminUser?: boolean;
 }
+/**
+ * True when the session is valid but lacks the required privilege.
+ *
+ * Distinct from unauthenticated: the fix is a different account, not signing
+ * in, so this must never redirect to the auth form. Redirecting would also
+ * loop — the guard saves the current URL first, so a successful re-login on
+ * the same account returns straight to the wall.
+ */
+declare function isForbidden(s: GuardInput): boolean;
 /**
  * True while the guard should render a preloader rather than the protected
  * content. Mirrors useAuthGuard's formula exactly.
@@ -1355,4 +1370,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, PatchedCfgUserUpdateRequestSchema, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logger, normalizePath, peekSavedRedirect, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.mjs

@@ -5147,9 +5147,16 @@ var formatAuthError = /* @__PURE__ */ __name((error) => {
 }, "formatAuthError");
 
 // src/auth/utils/guard.ts
+function isForbidden(s) {
+  return Boolean(
+    s.mounted && s.requireAuth && s.requireStaff && !s.authLoading && s.isAuthenticated && !s.isAdminUser
+  );
+}
+__name(isForbidden, "isForbidden");
 function resolveGuardIsLoading(s) {
   if (!s.mounted) return true;
   if (!s.requireAuth) return false;
+  if (isForbidden(s)) return false;
   return s.authLoading || s.isRedirecting || !s.isAuthenticated;
 }
 __name(resolveGuardIsLoading, "resolveGuardIsLoading");
@@ -5180,6 +5187,7 @@ export {
   getCachedProfile,
   hasValidCache,
   isAllowedAuthPath,
+  isForbidden,
   logger,
   normalizePath,
   peekSavedRedirect,