@djangocfg/api 2.1.583 → 2.1.584

package/src/_api/generated/types.gen.ts

@@ -321,10 +321,6 @@ export type OAuthCallbackRequestRequest = {
      * Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path
      */
     redirect_uri?: string;
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
 };
 
 /**
@@ -454,10 +450,6 @@ export type OAuthTokenResponse = {
      * True if user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 /**
@@ -545,10 +537,6 @@ export type OtpVerifyRequest = {
      * Source URL for tracking login (e.g., https://my.djangocfg.com)
      */
     source_url?: string;
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
 };
 
 /**
@@ -589,10 +577,6 @@ export type OtpVerifyResponse = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 /**
@@ -623,14 +607,12 @@ export type PasswordLoginError = {
  *
  * Subclasses SimpleJWT so the field/validation contract stays theirs, but
  * replaces ``validate()`` — the token pair itself is minted by the view via
- * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
+ * ``mint_tokens_for_request`` so the DPoP binding and token
  * lifetime match OTP, OAuth and TOTP exactly.
  */
 export type PasswordLoginRequest = {
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
+    email: string;
+    password: string;
 };
 
 /**
@@ -664,10 +646,6 @@ export type PasswordLoginResponse = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 /**
@@ -868,10 +846,6 @@ export type VerifyResponse = {
      * User profile data
      */
     user: TotpVerifyUser;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session: boolean;
     /**
      * Number of remaining backup codes (if backup code was used)
      */
@@ -1064,27 +1038,6 @@ export type OtpVerifyResponseWritable = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
-};
-
-/**
- * Validate email+password against live accounts only.
- *
- * Subclasses SimpleJWT so the field/validation contract stays theirs, but
- * replaces ``validate()`` — the token pair itself is minted by the view via
- * ``mint_tokens_for_request`` so the DPoP binding and remembered-session
- * lifetime match OTP, OAuth and TOTP exactly.
- */
-export type PasswordLoginRequestWritable = {
-    /**
-     * Keep this browser signed in for 30 days
-     */
-    remember_me?: boolean;
-    email: string;
-    password: string;
 };
 
 /**
@@ -1118,10 +1071,6 @@ export type PasswordLoginResponseWritable = {
      * Whether user should be prompted to enable 2FA
      */
     should_prompt_2fa?: boolean;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session?: boolean;
 };
 
 export type TokenRefreshWritable = {
@@ -1171,10 +1120,6 @@ export type VerifyResponseWritable = {
      * User profile data
      */
     user: TotpVerifyUserWritable;
-    /**
-     * Whether this login should persist across browser restarts
-     */
-    persistent_session: boolean;
     /**
      * Number of remaining backup codes (if backup code was used)
      */
@@ -1566,7 +1511,7 @@ export type CfgAccountsProfileUpdateUpdateResponses = {
 export type CfgAccountsProfileUpdateUpdateResponse = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];
 
 export type CfgAccountsTokenCreateData = {
-    body: PasswordLoginRequestWritable;
+    body: PasswordLoginRequest;
     path?: never;
     query?: never;
     url: '/cfg/accounts/token/';

package/src/auth/__tests__/passwordLogin.test.tsx

@@ -136,21 +136,19 @@ describe('AuthContext.login (password grant)', () => {
     expect(tokens).toEqual({ access: 'access-1', refresh: 'refresh-1' });
   });
 
-  it('sends email, password and remember_me to the password endpoint', async () => {
+  it('sends email and password to the password endpoint', async () => {
     respondWith({ requires_2fa: false, access: 'access-1', refresh: 'refresh-1', user: USER });
     const { result } = await renderAuth();
 
     await act(async () => {
       await result.current.login('jane@example.com', 'correct horse', {
         skipRedirect: true,
-        rememberMe: true,
       });
     });
 
     expect(loginWithPassword).toHaveBeenCalledWith({
       email: 'jane@example.com',
       password: 'correct horse',
-      remember_me: true,
     });
   });
 

package/src/auth/context/AccountsContext.tsx

@@ -57,7 +57,7 @@ import type {
     OtpVerifyRequest,
     OtpRequestResponse,
     OtpVerifyResponse,
-    PasswordLoginRequestWritable,
+    PasswordLoginRequest,
     PasswordLoginResponse,
 } from '../../_api/generated/_cfg_accounts/types.gen';
 
@@ -79,7 +79,7 @@ export interface AccountsContextValue {
 
   requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;
   verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;
-  loginWithPassword: (data: PasswordLoginRequestWritable) => Promise<PasswordLoginResponse>;
+  loginWithPassword: (data: PasswordLoginRequest) => Promise<PasswordLoginResponse>;
   logout: () => void;
 }
 
@@ -207,11 +207,9 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
 
     if (result.access && result.refresh) {
       // The ONE write path — atomic pair, notifies every session subscriber.
-      // Storage is always localStorage: "remember me" is a TOKEN LIFETIME
-      // decision the server already made (`remember_me` → REMEMBER_ME_LIFETIME),
-      // not a storage decision. Switching the client to sessionStorage here used
-      // to strand the tokens — the module reinitializes to localStorage on the
-      // next page load and would never look at sessionStorage again.
+      // Storage is always localStorage: session length is the token lifetime
+      // the server chose. A sessionStorage switch would strand the tokens — the
+      // module reinitializes to localStorage on the next page load.
       auth.setSession({ access: result.access, refresh: result.refresh });
       try {
         await refreshProfile({ callerId, force: true });
@@ -228,7 +226,7 @@ export function AccountsProvider({ children }: AccountsProviderProps) {
   }, [triggerOtpVerify, settleLoginEnvelope]);
 
   const loginWithPassword = useCallback(async (
-    data: PasswordLoginRequestWritable,
+    data: PasswordLoginRequest,
   ): Promise<PasswordLoginResponse> => {
     // Errors propagate: the SWR trigger throws APIError for 401/429 and the
     // caller maps them. Nothing is written to the session on a failure.

package/src/auth/context/AuthContext.tsx

@@ -288,7 +288,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       sourceUrl?: string,
       redirectUrl?: string,
       skipRedirect?: boolean,
-      rememberMe = false,
     ): Promise<{
       success: boolean;
       message: string;
@@ -306,7 +305,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
           identifier,
           otp: otpCode,
           source_url: sourceUrl,
-          remember_me: rememberMe,
         });
 
         if (result.requires_2fa && result.session_id) {
@@ -379,7 +377,7 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
       password: string,
       options?: PasswordLoginOptions,
     ): Promise<PasswordLoginResult> => {
-      const { redirectUrl, skipRedirect, rememberMe = false } = options || {};
+      const { redirectUrl, skipRedirect } = options || {};
 
       try {
         // The caller opting out of redirect commits to handling ALL navigation
@@ -389,7 +387,6 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
         const result = await accountsRef.current.loginWithPassword({
           email,
           password,
-          remember_me: rememberMe,
         });
 
         if (result.requires_2fa && result.session_id) {

package/src/auth/context/types.ts

@@ -55,7 +55,7 @@ export interface AuthContextType {
 
   // OTP Methods - email only
   requestOTP: (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent) => Promise<OTPRequestResult>;
-  verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean, rememberMe?: boolean) => Promise<{
+  verifyOTP: (identifier: string, otpCode: string, sourceUrl?: string, redirectUrl?: string, skipRedirect?: boolean) => Promise<{
     success: boolean;
     message: string;
     user?: UserProfile;

package/src/auth/hooks/useAuthForm.ts

@@ -55,7 +55,6 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     password,
     acceptedTerms,
     marketingConsent,
-    rememberMe,
     setIdentifier,
     setOtp,
     setStep,
@@ -176,7 +175,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
 
     try {
       // Skip redirect - we'll show success screen first
-      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true, rememberMe);
+      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);
 
       if (result.requires_2fa && result.session_id) {
         authLogger.info('2FA required after OTP verification');
@@ -205,7 +204,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
     } finally {
       setIsLoading(false);
     }
-  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, rememberMe, setStep]);
+  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setStep]);
 
   const handleOTPSubmit = useCallback(async (e: React.FormEvent) => {
     e.preventDefault();
@@ -244,7 +243,6 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
       const result = await login(submitIdentifier, submitPassword_, {
         redirectUrl,
         skipRedirect: true,
-        rememberMe,
       });
 
       if (result.requires_2fa && result.session_id) {
@@ -283,7 +281,7 @@ export const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {
   }, [
     login, validateIdentifier, saveIdentifierToStorage, setError, setIsLoading,
     clearError, startRateLimitCountdown, onOTPSuccess, onError, redirectUrl,
-    rememberMe, setStep,
+    setStep,
   ]);
 
   const handlePasswordSubmit = useCallback(async (e: React.FormEvent) => {

package/src/auth/hooks/useAuthFormState.ts

@@ -53,8 +53,6 @@ export const useAuthFormState = (
   // null until the marketing-consent feature (if enabled) resolves its
   // jurisdiction-aware default — the layout owns that decision.
   const [marketingConsent, setMarketingConsent] = useState<boolean | null>(null);
-  // Signed in for 30 days unless an app opts into showing the choice.
-  const [rememberMe, setRememberMe] = useState(true);
   const [step, setStep] = useState<AuthStep>('identifier');
   const [error, setError] = useState('');
   const [webmail, setWebmail] = useState<WebmailLink | null>(null);
@@ -72,7 +70,6 @@ export const useAuthFormState = (
     isLoading,
     acceptedTerms,
     marketingConsent,
-    rememberMe,
     step,
     error,
     rateLimitSeconds: rateLimit.seconds,
@@ -87,7 +84,6 @@ export const useAuthFormState = (
     setPassword,
     setAcceptedTerms,
     setMarketingConsent,
-    setRememberMe,
     setError,
     clearError,
     setStep,

package/src/auth/hooks/useGithubAuth.ts

@@ -13,7 +13,6 @@ import { useCfgRouter } from './useCfgRouter';
 
 const OAUTH_STATE_KEY = CFG_KEYS.oauthState.key;
 const OAUTH_PROVIDER_KEY = CFG_KEYS.oauthProvider.key;
-const OAUTH_REMEMBER_KEY = CFG_KEYS.oauthRememberMe.key;
 
 /**
  * The user payload as the OAuth endpoint declares it.
@@ -27,8 +26,6 @@ export type OAuthUser = NonNullable<OAuthTokenResponse['user']>;
 
 export interface UseGithubAuthOptions {
   sourceUrl?: string;
-  /** Keep the completed browser session for 30 days. */
-  rememberMe?: boolean;
   /**
    * The OAuth endpoint's OpenAPI schema types `user` as a free-form object, so
    * this is what the server actually promises — not a `User`. Narrow it at the
@@ -70,7 +67,7 @@ export interface UseGithubAuthReturn {
  * ```
  */
 export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuthReturn => {
-  const { sourceUrl, rememberMe = false, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
+  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter();
 
   const [isLoading, setIsLoading] = useState(false);
@@ -114,7 +111,6 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       if (typeof window !== 'undefined') {
         sessionStorage.setItem(OAUTH_STATE_KEY, response.state);
         sessionStorage.setItem(OAUTH_PROVIDER_KEY, 'github');
-        sessionStorage.setItem(OAUTH_REMEMBER_KEY, String(rememberMe));
       }
 
       window.location.href = response.authorization_url;
@@ -133,7 +129,7 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
     } finally {
       setIsLoading(false);
     }
-  }, [sourceUrl, rememberMe, onError]);
+  }, [sourceUrl, onError]);
 
   /**
    * Handle GitHub OAuth callback - exchanges code for JWT tokens.
@@ -149,22 +145,19 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       authLogger.info('Processing GitHub OAuth callback...');
 
       // Verify state matches what we stored
-      let rememberMeForSession = false;
       if (typeof window !== 'undefined') {
         const storedState = sessionStorage.getItem(OAUTH_STATE_KEY);
         if (storedState && storedState !== state) {
           throw new Error('Invalid OAuth state - possible CSRF attack');
         }
-        rememberMeForSession = sessionStorage.getItem(OAUTH_REMEMBER_KEY) === 'true';
         // Clear stored state
         sessionStorage.removeItem(OAUTH_STATE_KEY);
         sessionStorage.removeItem(OAUTH_PROVIDER_KEY);
-        sessionStorage.removeItem(OAUTH_REMEMBER_KEY);
 
       }
 
       const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state, remember_me: rememberMeForSession },
+        body: { code, state },
         throwOnError: true,
       });
       const response = result.data;
@@ -191,8 +184,8 @@ export const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuth
       authLogger.info('GitHub OAuth successful, user:', response.user);
 
         // The ONE write path — atomic pair + session notification. Storage is
-        // always localStorage; session length is the server's call via
-        // `remember_me`. See AccountsContext.verifyOTP.
+        // always localStorage; session length is the server's call.
+        // See AccountsContext.verifyOTP.
       auth.setSession({ access: response.access, refresh: response.refresh });
 
         // Track successful OAuth

package/src/auth/hooks/useTwoFactorVerify.ts

@@ -69,8 +69,8 @@ export const useTwoFactorVerify = (
   // copy it replaces cannot drift from the server contract any more.
   const handleSuccess = useCallback((response: VerifyResponse) => {
     // Save tokens — the ONE write path (atomic pair + session notification).
-    // Storage is always localStorage; session length is the server's call via
-    // `remember_me`. See AccountsContext.verifyOTP.
+    // Storage is always localStorage; session length is the server's call.
+    // See AccountsContext.verifyOTP.
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
 
     if (response.warning) {

package/src/auth/types/form.ts

@@ -52,8 +52,6 @@ export interface PasswordLoginOptions {
   redirectUrl?: string;
   /** Caller owns ALL navigation for this login, including the 2FA continuation. */
   skipRedirect?: boolean;
-  /** Ask the server for a 30-day session instead of the default lifetime. */
-  rememberMe?: boolean;
 }
 
 /**
@@ -99,8 +97,6 @@ export interface AuthFormState {
    * jurisdiction-aware default on mount.
    */
   marketingConsent: boolean | null;
-  /** Keep this browser signed in for 30 days after successful verification. */
-  rememberMe: boolean;
   /** Current form step */
   step: AuthStep;
   /** Error message */
@@ -129,7 +125,6 @@ export interface AuthFormStateHandlers {
   setPassword: (password: string) => void;
   setAcceptedTerms: (accepted: boolean) => void;
   setMarketingConsent: (consent: boolean | null) => void;
-  setRememberMe: (rememberMe: boolean) => void;
   setError: (error: string) => void;
   clearError: () => void;
   setStep: (step: AuthStep) => void;