@djangocfg/api 2.1.566 → 2.1.569

package/dist/auth.cjs

@@ -33,6 +33,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var auth_exports = {};
 __export(auth_exports, {
   AUTH_CONSTANTS: () => AUTH_CONSTANTS,
+  AUTH_ERROR_KEYS: () => AUTH_ERROR_KEYS,
   AccountsProvider: () => AccountsProvider,
   Analytics: () => Analytics,
   AnalyticsCategory: () => AnalyticsCategory,
@@ -51,9 +52,11 @@ __export(auth_exports, {
   hasValidCache: () => hasValidCache,
   isAllowedAuthPath: () => isAllowedAuthPath,
   isForbidden: () => isForbidden,
+  logAuthFailure: () => logAuthFailure,
   logger: () => logger,
   normalizePath: () => normalizePath,
   peekSavedRedirect: () => peekSavedRedirect,
+  resolveAuthError: () => resolveAuthError,
   resolveGuardIsAuthenticated: () => resolveGuardIsAuthenticated,
   resolveGuardIsLoading: () => resolveGuardIsLoading,
   setAnalyticsSink: () => setAnalyticsSink,
@@ -2568,6 +2571,67 @@ var Analytics = {
   }
 };
 
+// src/auth/utils/errors.ts
+var prop = /* @__PURE__ */ __name((value, key) => typeof value === "object" && value !== null ? value[key] : void 0, "prop");
+var TRANSPORT_FALLBACK = /^HTTP \d{3}:\s*/;
+var AUTH_ERROR_KEYS = {
+  invalidCredentials: "ui.errors.unauthorized",
+  rateLimited: "api.errors.rateLimited",
+  serverUnavailable: "api.errors.serverUnavailable",
+  networkError: "api.errors.networkError",
+  generic: "ui.errors.generic"
+};
+var FALLBACK_COPY = {
+  [AUTH_ERROR_KEYS.invalidCredentials]: "Please sign in to continue",
+  [AUTH_ERROR_KEYS.rateLimited]: "Too many requests. Please wait.",
+  [AUTH_ERROR_KEYS.serverUnavailable]: "Server is unavailable",
+  [AUTH_ERROR_KEYS.networkError]: "Network error",
+  [AUTH_ERROR_KEYS.generic]: "Something went wrong"
+};
+var keyForStatus = /* @__PURE__ */ __name((status) => {
+  if (status === void 0) return AUTH_ERROR_KEYS.generic;
+  if (status === 401 || status === 403) return AUTH_ERROR_KEYS.invalidCredentials;
+  if (status === 404) return AUTH_ERROR_KEYS.serverUnavailable;
+  if (status === 429) return AUTH_ERROR_KEYS.rateLimited;
+  if (status >= 500) return AUTH_ERROR_KEYS.serverUnavailable;
+  return AUTH_ERROR_KEYS.generic;
+}, "keyForStatus");
+var resolveAuthError = /* @__PURE__ */ __name((error, fallback) => {
+  if (typeof error === "string" && error && !TRANSPORT_FALLBACK.test(error)) {
+    return { message: error };
+  }
+  const candidates = [
+    prop(error, "message"),
+    prop(error, "detail"),
+    prop(prop(error, "response"), "error"),
+    prop(prop(error, "response"), "detail"),
+    prop(prop(error, "response"), "message"),
+    prop(prop(prop(error, "response"), "data"), "detail")
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === "string" && candidate && !TRANSPORT_FALLBACK.test(candidate)) {
+      return { message: candidate };
+    }
+  }
+  const rawStatus = prop(error, "statusCode") ?? prop(error, "status");
+  const status = typeof rawStatus === "number" ? rawStatus : void 0;
+  if (status === void 0 && fallback) {
+    return { message: fallback };
+  }
+  const key = keyForStatus(status);
+  return { message: FALLBACK_COPY[key], key };
+}, "resolveAuthError");
+var formatAuthError = /* @__PURE__ */ __name((error, fallback) => resolveAuthError(error, fallback).message, "formatAuthError");
+var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
+  const code = prop(error, "statusCode") ?? prop(error, "status");
+  const isClientError = typeof code === "number" && code >= 400 && code < 500;
+  if (isClientError) {
+    log.warn(message, error);
+    return;
+  }
+  log.error(message, error);
+}, "logAuthFailure");
+
 // src/auth/hooks/useSessionStorage.ts
 var import_react7 = require("react");
 
@@ -2788,18 +2852,6 @@ var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
 
 // src/auth/hooks/twoFactor.shared.ts
 var TOTP_CODE_LENGTH = 6;
-function extractTwoFactorError(err, fallback) {
-  if (err instanceof APIError) {
-    const body = err.response ?? null;
-    if (typeof body?.error === "string") return body.error;
-    if (typeof body?.detail === "string") return body.detail;
-    if (typeof body?.message === "string") return body.message;
-    return err.errorMessage ?? err.message;
-  }
-  if (err instanceof Error) return err.message;
-  return fallback;
-}
-__name(extractTwoFactorError, "extractTwoFactorError");
 function extractAttemptsRemaining(err) {
   if (err instanceof APIError) {
     const body = err.response ?? null;
@@ -2875,8 +2927,8 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       handleSuccess(response);
       return true;
     } catch (err) {
-      authLogger.error("2FA TOTP verification error:", err);
-      const errorMessage = extractTwoFactorError(err, "Invalid verification code");
+      logAuthFailure(authLogger, "2FA TOTP verification failed:", err);
+      const errorMessage = formatAuthError(err, "Invalid verification code");
       const attempts = extractAttemptsRemaining(err);
       if (attempts !== null) setAttemptsRemaining(attempts);
       setError(errorMessage);
@@ -2921,8 +2973,8 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       handleSuccess(response);
       return true;
     } catch (err) {
-      authLogger.error("2FA backup code verification error:", err);
-      const errorMessage = extractTwoFactorError(err, "Invalid backup code");
+      logAuthFailure(authLogger, "2FA backup code verification failed:", err);
+      const errorMessage = formatAuthError(err, "Invalid backup code");
       const attempts = extractAttemptsRemaining(err);
       if (attempts !== null) setAttemptsRemaining(attempts);
       setError(errorMessage);
@@ -3345,7 +3397,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       }
       window.location.href = response.authorization_url;
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "Failed to start GitHub authentication";
+      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
       authLogger.error("GitHub OAuth start error:", err);
       setError(errorMessage);
       onError?.(errorMessage);
@@ -3408,7 +3460,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       }
       return;
     } catch (err) {
-      const errorMessage = err instanceof Error ? err.message : "GitHub authentication failed";
+      const errorMessage = formatAuthError(err, "GitHub authentication failed");
       authLogger.error("GitHub OAuth callback error:", err);
       setError(errorMessage);
       onError?.(errorMessage);
@@ -3470,8 +3522,8 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       authLogger.info("2FA setup initiated, expires in:", data.expiresIn, "seconds");
       return data;
     } catch (err) {
-      const errorMessage = extractTwoFactorError(err, "Failed to start 2FA setup");
-      authLogger.error("2FA setup error:", err);
+      const errorMessage = formatAuthError(err, "Failed to start 2FA setup");
+      logAuthFailure(authLogger, "2FA setup failed:", err);
       setError(errorMessage);
       setSetupStep("idle");
       onError?.(errorMessage);
@@ -3511,8 +3563,8 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       onComplete?.(codes);
       return codes;
     } catch (err) {
-      const errorMessage = extractTwoFactorError(err, "Invalid code. Please try again.");
-      authLogger.error("2FA setup confirmation error:", err);
+      const errorMessage = formatAuthError(err, "Invalid code. Please try again.");
+      logAuthFailure(authLogger, "2FA setup confirmation failed:", err);
       setError(errorMessage);
       setSetupStep("scanning");
       onError?.(errorMessage);
@@ -3563,8 +3615,8 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setHas2FAEnabled(response.has_2fa_enabled);
       authLogger.info("2FA status:", response.has_2fa_enabled ? "enabled" : "disabled");
     } catch (err) {
-      const errorMessage = extractTwoFactorError(err, "Failed to fetch 2FA status");
-      authLogger.error("Failed to fetch 2FA status:", err);
+      const errorMessage = formatAuthError(err, "Failed to fetch 2FA status");
+      logAuthFailure(authLogger, "Failed to fetch 2FA status:", err);
       setError(errorMessage);
     } finally {
       setIsLoading(false);
@@ -3585,8 +3637,8 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       authLogger.info("2FA disabled successfully");
       return true;
     } catch (err) {
-      const errorMessage = extractTwoFactorError(err, "Invalid verification code");
-      authLogger.error("Failed to disable 2FA:", err);
+      const errorMessage = formatAuthError(err, "Invalid verification code");
+      logAuthFailure(authLogger, "Failed to disable 2FA:", err);
       setError(errorMessage);
       return false;
     } finally {
@@ -3997,8 +4049,8 @@ var OAuthConnectionSchema = import_zod6.z.object({
   provider: OAuthProviderEnumSchema,
   provider_display: import_zod6.z.string(),
   provider_username: import_zod6.z.string(),
-  provider_email: import_zod6.z.email(),
-  provider_avatar_url: import_zod6.z.url(),
+  provider_email: import_zod6.z.email().or(import_zod6.z.literal("")),
+  provider_avatar_url: import_zod6.z.url().or(import_zod6.z.literal("")),
   connected_at: import_zod6.z.string().datetime({ offset: true }),
   last_login_at: import_zod6.z.string().datetime({ offset: true })
 });
@@ -4021,7 +4073,7 @@ var import_mutation5 = __toESM(require("swr/mutation"), 1);
 // src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeResponse.ts
 var import_zod9 = require("zod");
 var OAuthAuthorizeResponseSchema = import_zod9.z.object({
-  authorization_url: import_zod9.z.url(),
+  authorization_url: import_zod9.z.url().or(import_zod9.z.literal("")),
   state: import_zod9.z.string()
 });
 
@@ -4084,7 +4136,7 @@ var WebmailLinkProviderEnumSchema = import_zod14.z.enum(["gmail", "outlook", "ya
 var WebmailLinkSchema = import_zod15.z.object({
   provider: WebmailLinkProviderEnumSchema,
   provider_name: import_zod15.z.string(),
-  url: import_zod15.z.url(),
+  url: import_zod15.z.url().or(import_zod15.z.literal("")),
   is_search: import_zod15.z.boolean()
 });
 
@@ -4151,7 +4203,7 @@ var import_zod18 = require("zod");
 var import_zod17 = require("zod");
 var UserSchema = import_zod17.z.object({
   id: import_zod17.z.number().int(),
-  email: import_zod17.z.email(),
+  email: import_zod17.z.email().or(import_zod17.z.literal("")),
   first_name: import_zod17.z.string().max(50).nullable().optional(),
   last_name: import_zod17.z.string().max(50).nullable().optional(),
   full_name: import_zod17.z.string(),
@@ -4162,7 +4214,7 @@ var UserSchema = import_zod17.z.object({
   position: import_zod17.z.string().max(100).nullable().optional(),
   language: import_zod17.z.string().max(10).nullable().optional(),
   timezone: import_zod17.z.string().max(64).nullable().optional(),
-  avatar: import_zod17.z.url().nullable(),
+  avatar: import_zod17.z.url().or(import_zod17.z.literal("")).nullable(),
   is_staff: import_zod17.z.boolean(),
   is_superuser: import_zod17.z.boolean(),
   date_joined: import_zod17.z.string().datetime({ offset: true }),
@@ -4496,8 +4548,8 @@ var CfgUserUpdateRequestSchema = import_zod24.z.object({
 // src/_api/generated/_cfg_accounts/schemas/OAuthAuthorizeRequestRequest.ts
 var import_zod25 = require("zod");
 var OAuthAuthorizeRequestRequestSchema = import_zod25.z.object({
-  redirect_uri: import_zod25.z.url().optional(),
-  source_url: import_zod25.z.url().optional()
+  redirect_uri: import_zod25.z.url().or(import_zod25.z.literal("")).optional(),
+  source_url: import_zod25.z.url().or(import_zod25.z.literal("")).optional()
 });
 
 // src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts
@@ -4505,7 +4557,7 @@ var import_zod26 = require("zod");
 var OAuthCallbackRequestRequestSchema = import_zod26.z.object({
   code: import_zod26.z.string().min(10).max(500),
   state: import_zod26.z.string().min(20).max(100),
-  redirect_uri: import_zod26.z.url().optional(),
+  redirect_uri: import_zod26.z.url().or(import_zod26.z.literal("")).optional(),
   remember_me: import_zod26.z.boolean().default(false).optional()
 });
 
@@ -4534,7 +4586,7 @@ var OTPErrorResponseSchema = import_zod29.z.object({
 var import_zod30 = require("zod");
 var OTPRequestRequestSchema = import_zod30.z.object({
   identifier: import_zod30.z.string().min(1),
-  source_url: import_zod30.z.url().optional(),
+  source_url: import_zod30.z.url().or(import_zod30.z.literal("")).optional(),
   marketing_consent: import_zod30.z.boolean().nullable().optional(),
   consent_disclosure_version: import_zod30.z.string().max(64).optional()
 });
@@ -4544,7 +4596,7 @@ var import_zod31 = require("zod");
 var OTPVerifyRequestSchema = import_zod31.z.object({
   identifier: import_zod31.z.string().min(1),
   otp: import_zod31.z.string().min(4).max(4),
-  source_url: import_zod31.z.url().optional(),
+  source_url: import_zod31.z.url().or(import_zod31.z.literal("")).optional(),
   remember_me: import_zod31.z.boolean().default(false).optional()
 });
 
@@ -4764,10 +4816,6 @@ var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
 }), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = "auth_email";
 var AuthContext = (0, import_react16.createContext)(void 0);
-var apiErrorMessage = /* @__PURE__ */ __name((error) => {
-  const body = error.response;
-  return body?.error || body?.detail || body?.message || error.errorMessage;
-}, "apiErrorMessage");
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   const session = useSession();
@@ -4895,18 +4943,18 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           webmail: result.webmail ?? null
         };
       } catch (error) {
-        authLogger.error("Request OTP error:", error);
+        logAuthFailure(authLogger, "Request OTP failed:", error);
         if (error instanceof APIError) {
           const body = error.response;
           const retryAfter = body?.retry_after ?? body?.retryAfter;
           return {
             success: false,
             statusCode: error.statusCode,
-            message: apiErrorMessage(error),
+            message: formatAuthError(error),
             retryAfter: typeof retryAfter === "number" ? retryAfter : void 0
           };
         }
-        return { success: false, message: "Failed to send OTP" };
+        return { success: false, message: formatAuthError(error, "Failed to send OTP") };
       }
     },
     []
@@ -4959,15 +5007,15 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           should_prompt_2fa: result.should_prompt_2fa
         };
       } catch (error) {
-        authLogger.error("Verify OTP error:", error);
+        logAuthFailure(authLogger, "Verify OTP failed:", error);
         Analytics.event("auth_otp_verify_fail" /* AUTH_OTP_VERIFY_FAIL */, {
           category: "auth" /* AUTH */,
           label: "email"
         });
         if (error instanceof APIError) {
-          return { success: false, message: apiErrorMessage(error) };
+          return { success: false, message: formatAuthError(error) };
         }
-        return { success: false, message: "Failed to verify OTP" };
+        return { success: false, message: formatAuthError(error, "Failed to verify OTP") };
       }
     },
     [setStoredEmail, redirectManager, router]
@@ -5018,7 +5066,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           should_prompt_2fa: result.should_prompt_2fa
         };
       } catch (error) {
-        authLogger.error("Password login error:", error);
+        logAuthFailure(authLogger, "Password login failed:", error);
         Analytics.event("auth_password_login_fail" /* AUTH_PASSWORD_LOGIN_FAIL */, {
           category: "auth" /* AUTH */,
           label: "password"
@@ -5028,12 +5076,12 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           return {
             success: false,
             statusCode: error.statusCode,
-            message: apiErrorMessage(error),
+            message: formatAuthError(error),
             errorCode: body?.error_code,
             retryAfter: typeof body?.retry_after === "number" ? body.retry_after : void 0
           };
         }
-        return { success: false, message: "Failed to sign in" };
+        return { success: false, message: formatAuthError(error, "Failed to sign in") };
       }
     },
     [setStoredEmail, redirectManager, router]
@@ -5203,25 +5251,6 @@ var validateEmail = /* @__PURE__ */ __name((email) => {
   return emailRegex.test(email);
 }, "validateEmail");
 
-// src/auth/utils/errors.ts
-var prop = /* @__PURE__ */ __name((value, key) => typeof value === "object" && value !== null ? value[key] : void 0, "prop");
-var formatAuthError = /* @__PURE__ */ __name((error) => {
-  if (typeof error === "string") {
-    return error;
-  }
-  const candidates = [
-    prop(error, "message"),
-    prop(error, "detail"),
-    prop(prop(prop(error, "response"), "data"), "detail")
-  ];
-  for (const candidate of candidates) {
-    if (typeof candidate === "string" && candidate) {
-      return candidate;
-    }
-  }
-  return "An unexpected error occurred";
-}, "formatAuthError");
-
 // src/auth/utils/guard.ts
 function isForbidden(s) {
   return Boolean(