@djangocfg/api 2.1.580 → 2.1.582

package/dist/auth.d.cts

@@ -13,6 +13,8 @@ declare const AUTH_CONSTANTS: {
     readonly TOTP_LENGTH: 6;
     /** Backup code max length. */
     readonly BACKUP_CODE_MAX_LENGTH: 12;
+    /** Resend cooldown (s) when the server does not state one. Mirrors the backend per-email cooldown. */
+    readonly RESEND_COOLDOWN_SECONDS: 30;
 };
 
 type SessionStatus = 'authenticated' | 'anonymous';
@@ -124,6 +126,14 @@ type OtpRequestResponse = {
      * Webmail deep-link for the recipient's provider, or null if the domain is unknown.
      */
     webmail?: WebmailLink | null;
+    /**
+     * Seconds until a new code may be requested for this email.
+     */
+    resend_in?: number;
+    /**
+     * Seconds the code stays valid.
+     */
+    expires_in?: number;
 };
 /**
  * Serializer for OTP verification.
@@ -470,7 +480,7 @@ type PasswordLoginRequestWritable = {
  * Used by both @djangocfg/api/auth hooks and @djangocfg/layouts/AuthLayout.
  */
 
-type AuthStep = 'identifier' | 'otp' | '2fa' | '2fa-setup' | 'success';
+type AuthStep = 'identifier' | 'otp' | 'success';
 interface OTPRequestResult {
     success: boolean;
     message: string;
@@ -478,6 +488,8 @@ interface OTPRequestResult {
     retryAfter?: number;
     /** Webmail deep-link for the recipient's provider, or null if unknown. */
     webmail?: WebmailLink | null;
+    /** Seconds until a new code may be requested. */
+    resendIn?: number;
 }
 /**
  * Marketing-consent payload attached to an OTP request when the consuming
@@ -541,20 +553,16 @@ interface AuthFormState {
     step: AuthStep;
     /** Error message */
     error: string;
-    /** 2FA session ID from OTP/OAuth verification */
-    twoFactorSessionId: string | null;
-    /** Whether user should be prompted to enable 2FA */
-    shouldPrompt2FA: boolean;
-    /** 2FA code input */
-    twoFactorCode: string;
-    /** Using backup code instead of TOTP */
-    useBackupCode: boolean;
     /** Seconds remaining until rate limit lifts (0 = not rate limited) */
     rateLimitSeconds: number;
     /** True when rateLimitSeconds > 0 — submit should be disabled */
     isRateLimited: boolean;
     /** Formatted countdown label, e.g. "19:00" or "42s" */
     rateLimitLabel: string;
+    /** Seconds until another code may be requested (0 = may resend now) */
+    resendSeconds: number;
+    /** Formatted resend countdown, e.g. "28s" */
+    resendLabel: string;
     /** Webmail deep-link for the current identifier's provider (null = no button). */
     webmail: WebmailLink | null;
 }
@@ -569,12 +577,10 @@ interface AuthFormStateHandlers {
     clearError: () => void;
     setStep: (step: AuthStep) => void;
     setIsLoading: (loading: boolean) => void;
-    setTwoFactorSessionId: (sessionId: string | null) => void;
-    setShouldPrompt2FA: (prompt: boolean) => void;
-    setTwoFactorCode: (code: string) => void;
-    setUseBackupCode: (useBackup: boolean) => void;
     /** Start a countdown timer that disables submit for `seconds` seconds */
     startRateLimitCountdown: (seconds: number) => void;
+    /** Start the countdown before another code may be requested */
+    startResendCountdown: (seconds: number) => void;
     /** Set (or clear) the webmail deep-link for the current identifier */
     setWebmail: (webmail: WebmailLink | null) => void;
 }
@@ -586,12 +592,6 @@ interface AuthFormSubmitHandlers {
     handleResendOTP: () => Promise<void>;
     handleBackToIdentifier: () => void;
     forceOTPStep: () => void;
-    /** Handle 2FA TOTP/backup code verification */
-    handle2FASubmit: (e: React.FormEvent) => Promise<void>;
-    /** Switch to backup code input */
-    handleUseBackupCode: () => void;
-    /** Switch back to TOTP input */
-    handleUseTOTP: () => void;
 }
 interface AuthFormValidation {
     /** Validate identifier format */
@@ -601,15 +601,7 @@ interface AuthFormAutoSubmit {
     /** Ref to track if auto-submit from URL is in progress */
     isAutoSubmittingFromUrl: MutableRefObject<boolean>;
 }
-interface AuthForm2FAState {
-    /** Loading state for 2FA verification */
-    is2FALoading: boolean;
-    /** Warning message from 2FA (e.g., low backup codes) */
-    twoFactorWarning: string | null;
-    /** Remaining attempts before 2FA lockout (null = unknown) */
-    twoFactorAttemptsRemaining: number | null;
-}
-interface AuthFormReturn extends AuthFormState, AuthFormStateHandlers, AuthFormSubmitHandlers, AuthFormValidation, AuthFormAutoSubmit, AuthForm2FAState {
+interface AuthFormReturn extends AuthFormState, AuthFormStateHandlers, AuthFormSubmitHandlers, AuthFormValidation, AuthFormAutoSubmit {
 }
 interface UseAuthFormOptions {
     /** Callback when identifier step succeeds */
@@ -1059,6 +1051,17 @@ interface UseTwoFactorReturn {
  */
 declare const useTwoFactor: (options?: UseTwoFactorOptions) => UseTwoFactorReturn;
 
+/** A pending login that needs a TOTP or backup code before tokens are issued. */
+interface TwoFactorChallenge {
+    sessionId: string;
+}
+/** Called by whichever step received `requires_2fa` (OTP, password, OAuth callback). */
+declare const beginTwoFactorChallenge: (challenge: TwoFactorChallenge) => void;
+/** Called when the challenge is verified or abandoned. */
+declare const endTwoFactorChallenge: () => void;
+/** The pending challenge, or null. */
+declare const useTwoFactorChallenge: () => TwoFactorChallenge | null;
+
 interface AuthRedirectOptions {
     fallbackUrl?: string;
     clearOnUse?: boolean;
@@ -1429,4 +1432,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logAuthFailure, logger, normalizePath, peekSavedRedirect, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorChallenge, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, beginTwoFactorChallenge, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logAuthFailure, logger, normalizePath, peekSavedRedirect, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };

package/dist/auth.d.ts

@@ -13,6 +13,8 @@ declare const AUTH_CONSTANTS: {
     readonly TOTP_LENGTH: 6;
     /** Backup code max length. */
     readonly BACKUP_CODE_MAX_LENGTH: 12;
+    /** Resend cooldown (s) when the server does not state one. Mirrors the backend per-email cooldown. */
+    readonly RESEND_COOLDOWN_SECONDS: 30;
 };
 
 type SessionStatus = 'authenticated' | 'anonymous';
@@ -124,6 +126,14 @@ type OtpRequestResponse = {
      * Webmail deep-link for the recipient's provider, or null if the domain is unknown.
      */
     webmail?: WebmailLink | null;
+    /**
+     * Seconds until a new code may be requested for this email.
+     */
+    resend_in?: number;
+    /**
+     * Seconds the code stays valid.
+     */
+    expires_in?: number;
 };
 /**
  * Serializer for OTP verification.
@@ -470,7 +480,7 @@ type PasswordLoginRequestWritable = {
  * Used by both @djangocfg/api/auth hooks and @djangocfg/layouts/AuthLayout.
  */
 
-type AuthStep = 'identifier' | 'otp' | '2fa' | '2fa-setup' | 'success';
+type AuthStep = 'identifier' | 'otp' | 'success';
 interface OTPRequestResult {
     success: boolean;
     message: string;
@@ -478,6 +488,8 @@ interface OTPRequestResult {
     retryAfter?: number;
     /** Webmail deep-link for the recipient's provider, or null if unknown. */
     webmail?: WebmailLink | null;
+    /** Seconds until a new code may be requested. */
+    resendIn?: number;
 }
 /**
  * Marketing-consent payload attached to an OTP request when the consuming
@@ -541,20 +553,16 @@ interface AuthFormState {
     step: AuthStep;
     /** Error message */
     error: string;
-    /** 2FA session ID from OTP/OAuth verification */
-    twoFactorSessionId: string | null;
-    /** Whether user should be prompted to enable 2FA */
-    shouldPrompt2FA: boolean;
-    /** 2FA code input */
-    twoFactorCode: string;
-    /** Using backup code instead of TOTP */
-    useBackupCode: boolean;
     /** Seconds remaining until rate limit lifts (0 = not rate limited) */
     rateLimitSeconds: number;
     /** True when rateLimitSeconds > 0 — submit should be disabled */
     isRateLimited: boolean;
     /** Formatted countdown label, e.g. "19:00" or "42s" */
     rateLimitLabel: string;
+    /** Seconds until another code may be requested (0 = may resend now) */
+    resendSeconds: number;
+    /** Formatted resend countdown, e.g. "28s" */
+    resendLabel: string;
     /** Webmail deep-link for the current identifier's provider (null = no button). */
     webmail: WebmailLink | null;
 }
@@ -569,12 +577,10 @@ interface AuthFormStateHandlers {
     clearError: () => void;
     setStep: (step: AuthStep) => void;
     setIsLoading: (loading: boolean) => void;
-    setTwoFactorSessionId: (sessionId: string | null) => void;
-    setShouldPrompt2FA: (prompt: boolean) => void;
-    setTwoFactorCode: (code: string) => void;
-    setUseBackupCode: (useBackup: boolean) => void;
     /** Start a countdown timer that disables submit for `seconds` seconds */
     startRateLimitCountdown: (seconds: number) => void;
+    /** Start the countdown before another code may be requested */
+    startResendCountdown: (seconds: number) => void;
     /** Set (or clear) the webmail deep-link for the current identifier */
     setWebmail: (webmail: WebmailLink | null) => void;
 }
@@ -586,12 +592,6 @@ interface AuthFormSubmitHandlers {
     handleResendOTP: () => Promise<void>;
     handleBackToIdentifier: () => void;
     forceOTPStep: () => void;
-    /** Handle 2FA TOTP/backup code verification */
-    handle2FASubmit: (e: React.FormEvent) => Promise<void>;
-    /** Switch to backup code input */
-    handleUseBackupCode: () => void;
-    /** Switch back to TOTP input */
-    handleUseTOTP: () => void;
 }
 interface AuthFormValidation {
     /** Validate identifier format */
@@ -601,15 +601,7 @@ interface AuthFormAutoSubmit {
     /** Ref to track if auto-submit from URL is in progress */
     isAutoSubmittingFromUrl: MutableRefObject<boolean>;
 }
-interface AuthForm2FAState {
-    /** Loading state for 2FA verification */
-    is2FALoading: boolean;
-    /** Warning message from 2FA (e.g., low backup codes) */
-    twoFactorWarning: string | null;
-    /** Remaining attempts before 2FA lockout (null = unknown) */
-    twoFactorAttemptsRemaining: number | null;
-}
-interface AuthFormReturn extends AuthFormState, AuthFormStateHandlers, AuthFormSubmitHandlers, AuthFormValidation, AuthFormAutoSubmit, AuthForm2FAState {
+interface AuthFormReturn extends AuthFormState, AuthFormStateHandlers, AuthFormSubmitHandlers, AuthFormValidation, AuthFormAutoSubmit {
 }
 interface UseAuthFormOptions {
     /** Callback when identifier step succeeds */
@@ -1059,6 +1051,17 @@ interface UseTwoFactorReturn {
  */
 declare const useTwoFactor: (options?: UseTwoFactorOptions) => UseTwoFactorReturn;
 
+/** A pending login that needs a TOTP or backup code before tokens are issued. */
+interface TwoFactorChallenge {
+    sessionId: string;
+}
+/** Called by whichever step received `requires_2fa` (OTP, password, OAuth callback). */
+declare const beginTwoFactorChallenge: (challenge: TwoFactorChallenge) => void;
+/** Called when the challenge is verified or abandoned. */
+declare const endTwoFactorChallenge: () => void;
+/** The pending challenge, or null. */
+declare const useTwoFactorChallenge: () => TwoFactorChallenge | null;
+
 interface AuthRedirectOptions {
     fallbackUrl?: string;
     clearOnUse?: boolean;
@@ -1429,4 +1432,4 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logAuthFailure, logger, normalizePath, peekSavedRedirect, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, type AccountsContextValue, AccountsProvider, Analytics, AnalyticsCategory, type AnalyticsCategoryType, AnalyticsEvent, type AnalyticsEventType, type AnalyticsSink, type AuthConfig, AuthContext, type AuthContextType, type AuthErrorCopy, type AuthErrorKey, type AuthFormAutoSubmit, type AuthFormReturn, type AuthFormState, type AuthFormStateHandlers, type AuthFormSubmitHandlers, type AuthFormValidation, AuthProvider, type AuthProviderProps, type AuthStep, type DeleteAccountResult, type GuardInput, type OTPRequestConsent, type OTPRequestResult, type PasswordLoginOptions, type PasswordLoginResult, type PatchedCfgUserUpdateRequest, type ProfileCacheOptions, type SessionSnapshot, type SessionStatus, type TwoFactorChallenge, type TwoFactorDevice, type TwoFactorSetupData, type UseAuthFormOptions, type UseAuthFormStateReturn, type UseAutoAuthOptions, type UseDeleteAccountReturn, type UseGithubAuthOptions, type UseGithubAuthReturn, type UseTwoFactorOptions, type UseTwoFactorReturn, type UseTwoFactorSetupOptions, type UseTwoFactorSetupReturn, type UseTwoFactorStatusReturn, type UseTwoFactorVerifyOptions, type UseTwoFactorVerifyReturn, type UserProfile, type WebmailLink, authLogger, beginTwoFactorChallenge, clearProfileCache, consumeSavedRedirect, decodeBase64, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, isAllowedAuthPath, isForbidden, logAuthFailure, logger, normalizePath, peekSavedRedirect, resolveAuthError, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useQueryParams, useSession, useSessionStorage, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };