@djangocfg/api 2.1.598 → 2.1.600

package/src/_api/generated/openapi.json

@@ -328,7 +328,7 @@
     "/cfg/accounts/oauth/github/authorize/": {
       "post": {
         "operationId": "cfg_accounts_oauth_github_authorize_create",
-        "description": "Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.",
+        "description": "Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.",
         "summary": "Start GitHub OAuth",
         "tags": [
           "cfg_accounts_oauth"
@@ -356,6 +356,16 @@
             },
             "description": ""
           },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
           "503": {
             "content": {
               "application/json": {
@@ -373,7 +383,7 @@
     "/cfg/accounts/oauth/github/callback/": {
       "post": {
         "operationId": "cfg_accounts_oauth_github_callback_create",
-        "description": "Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.",
+        "description": "Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.",
         "summary": "Complete GitHub OAuth",
         "tags": [
           "cfg_accounts_oauth"
@@ -411,6 +421,187 @@
               }
             },
             "description": ""
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          }
+        },
+        "x-async-capable": false
+      }
+    },
+    "/cfg/accounts/oauth/google/authorize/": {
+      "post": {
+        "operationId": "cfg_accounts_oauth_google_authorize_create",
+        "description": "Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.",
+        "summary": "Start Google OAuth",
+        "tags": [
+          "cfg_accounts_oauth"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OAuthAuthorizeRequestRequest"
+              }
+            }
+          }
+        },
+        "security": [
+          {}
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthAuthorizeResponse"
+                }
+              }
+            },
+            "description": ""
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          }
+        },
+        "x-async-capable": false
+      }
+    },
+    "/cfg/accounts/oauth/google/callback/": {
+      "post": {
+        "operationId": "cfg_accounts_oauth_google_callback_create",
+        "description": "Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.",
+        "summary": "Complete Google OAuth",
+        "tags": [
+          "cfg_accounts_oauth"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OAuthCallbackRequestRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "security": [
+          {}
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthTokenResponse"
+                }
+              }
+            },
+            "description": ""
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
           }
         },
         "x-async-capable": false
@@ -419,7 +610,7 @@
     "/cfg/accounts/oauth/providers/": {
       "get": {
         "operationId": "cfg_accounts_oauth_providers_retrieve",
-        "description": "Get list of available OAuth providers for authentication.",
+        "description": "Providers that are configured, in display order. The login screen shows exactly these buttons.",
         "summary": "List OAuth providers",
         "tags": [
           "cfg_accounts_oauth"
@@ -2050,7 +2241,7 @@
           "redirect_uri": {
             "type": "string",
             "format": "uri",
-            "description": "URL to redirect after OAuth authorization. If not provided, uses config's site_url + callback_path"
+            "description": "Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin."
           },
           "source_url": {
             "type": "string",
@@ -2084,20 +2275,20 @@
         "properties": {
           "code": {
             "type": "string",
-            "minLength": 10,
+            "minLength": 1,
             "description": "Authorization code from OAuth provider callback",
-            "maxLength": 500
+            "maxLength": 2048
           },
           "state": {
             "type": "string",
-            "minLength": 20,
-            "description": "State token for CSRF verification (from authorize response)",
-            "maxLength": 100
+            "minLength": 1,
+            "description": "State token from the authorize response; single use",
+            "maxLength": 64
           },
           "redirect_uri": {
             "type": "string",
             "format": "uri",
-            "description": "Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path"
+            "description": "Ignored. The server reuses the redirect URI stored with the state."
           }
         },
         "required": [
@@ -2120,7 +2311,7 @@
               }
             ],
             "readOnly": true,
-            "description": "OAuth provider name (github, google, etc.)\n\n* `github` - GitHub"
+            "description": "OAuth provider name (github, google, etc.)\n\n* `github` - GitHub\n* `google` - Google"
           },
           "provider_display": {
             "type": "string",
@@ -2177,7 +2368,7 @@
                 "$ref": "#/components/schemas/OAuthProviderEnum"
               }
             ],
-            "description": "OAuth provider to disconnect\n\n* `github` - GitHub"
+            "description": "OAuth provider to disconnect\n\n* `github` - GitHub\n* `google` - Google"
           }
         },
         "required": [
@@ -2189,8 +2380,12 @@
         "description": "Error response for OAuth endpoints.",
         "properties": {
           "error": {
-            "type": "string",
-            "description": "Error code"
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/OAuthErrorCodeEnum"
+              }
+            ],
+            "description": "Error code (closed set)\n\n* `oauth_disabled` - oauth_disabled\n* `github_oauth_disabled` - github_oauth_disabled\n* `origin_not_allowed` - origin_not_allowed\n* `missing_redirect_uri` - missing_redirect_uri\n* `invalid_state` - invalid_state\n* `oauth_exchange_failed` - oauth_exchange_failed\n* `invalid_id_token` - invalid_id_token\n* `email_missing` - email_missing\n* `email_not_verified` - email_not_verified\n* `hosted_domain_not_allowed` - hosted_domain_not_allowed\n* `account_inactive` - account_inactive\n* `link_not_allowed` - link_not_allowed\n* `rate_limited` - rate_limited\n* `provider_unavailable` - provider_unavailable\n* `server_error` - server_error\n* `not_found` - not_found"
           },
           "error_description": {
             "type": "string",
@@ -2201,12 +2396,62 @@
           "error"
         ]
       },
+      "OAuthErrorCodeEnum": {
+        "enum": [
+          "oauth_disabled",
+          "github_oauth_disabled",
+          "origin_not_allowed",
+          "missing_redirect_uri",
+          "invalid_state",
+          "oauth_exchange_failed",
+          "invalid_id_token",
+          "email_missing",
+          "email_not_verified",
+          "hosted_domain_not_allowed",
+          "account_inactive",
+          "link_not_allowed",
+          "rate_limited",
+          "provider_unavailable",
+          "server_error",
+          "not_found"
+        ],
+        "type": "string",
+        "description": "* `oauth_disabled` - oauth_disabled\n* `github_oauth_disabled` - github_oauth_disabled\n* `origin_not_allowed` - origin_not_allowed\n* `missing_redirect_uri` - missing_redirect_uri\n* `invalid_state` - invalid_state\n* `oauth_exchange_failed` - oauth_exchange_failed\n* `invalid_id_token` - invalid_id_token\n* `email_missing` - email_missing\n* `email_not_verified` - email_not_verified\n* `hosted_domain_not_allowed` - hosted_domain_not_allowed\n* `account_inactive` - account_inactive\n* `link_not_allowed` - link_not_allowed\n* `rate_limited` - rate_limited\n* `provider_unavailable` - provider_unavailable\n* `server_error` - server_error\n* `not_found` - not_found"
+      },
       "OAuthProviderEnum": {
         "enum": [
-          "github"
+          "github",
+          "google"
         ],
         "type": "string",
-        "description": "* `github` - GitHub"
+        "description": "* `github` - GitHub\n* `google` - Google"
+      },
+      "OAuthProviderInfo": {
+        "type": "object",
+        "description": "One enabled sign-in provider.",
+        "properties": {
+          "id": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/OAuthProviderEnum"
+              }
+            ],
+            "description": "Provider id\n\n* `github` - GitHub\n* `google` - Google"
+          },
+          "name": {
+            "type": "string",
+            "description": "Display name"
+          },
+          "icon": {
+            "type": "string",
+            "description": "Icon key"
+          }
+        },
+        "required": [
+          "icon",
+          "id",
+          "name"
+        ]
       },
       "OAuthProvidersResponse": {
         "type": "object",
@@ -2215,10 +2460,9 @@
           "providers": {
             "type": "array",
             "items": {
-              "type": "object",
-              "additionalProperties": {}
+              "$ref": "#/components/schemas/OAuthProviderInfo"
             },
-            "description": "List of available OAuth providers"
+            "description": "Providers that are configured, in display order. The login screen shows exactly these."
           }
         },
         "required": [

package/src/_api/generated/sdk.gen.ts

@@ -2,7 +2,7 @@
 
 import { type Client, type ClientMeta, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';
 import { client } from './client.gen';
-import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenCreateData, CfgAccountsTokenCreateErrors, CfgAccountsTokenCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
+import type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateData, CfgAccountsOauthGoogleAuthorizeCreateErrors, CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleCallbackCreateData, CfgAccountsOauthGoogleCallbackCreateErrors, CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenCreateData, CfgAccountsTokenCreateErrors, CfgAccountsTokenCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';
 
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
     /**
@@ -158,7 +158,7 @@ export class CfgAccountsOauth {
     /**
      * Start GitHub OAuth
      *
-     * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+     * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
      */
     public static cfgAccountsOauthGithubAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGithubAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError> {
         return (options?.client ?? client).post<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError>({
@@ -174,7 +174,7 @@ export class CfgAccountsOauth {
     /**
      * Complete GitHub OAuth
      *
-     * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+     * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.
      */
     public static cfgAccountsOauthGithubCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGithubCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError> {
         return (options.client ?? client).post<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError>({
@@ -187,10 +187,42 @@ export class CfgAccountsOauth {
         });
     }
 
+    /**
+     * Start Google OAuth
+     *
+     * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
+     */
+    public static cfgAccountsOauthGoogleAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGoogleAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError> {
+        return (options?.client ?? client).post<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError>({
+            url: '/cfg/accounts/oauth/google/authorize/',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options?.headers
+            }
+        });
+    }
+
+    /**
+     * Complete Google OAuth
+     *
+     * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.
+     */
+    public static cfgAccountsOauthGoogleCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGoogleCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError> {
+        return (options.client ?? client).post<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError>({
+            url: '/cfg/accounts/oauth/google/callback/',
+            ...options,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers
+            }
+        });
+    }
+
     /**
      * List OAuth providers
      *
-     * Get list of available OAuth providers for authentication.
+     * Providers that are configured, in display order. The login screen shows exactly these buttons.
      */
     public static cfgAccountsOauthProvidersRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthProvidersRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError> {
         return (options?.client ?? client).get<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError>({ url: '/cfg/accounts/oauth/providers/', ...options });

package/src/_api/generated/types.gen.ts

@@ -282,7 +282,7 @@ export enum MarketingConsentDefaultEnum {
  */
 export type OAuthAuthorizeRequestRequest = {
     /**
-     * URL to redirect after OAuth authorization. If not provided, uses config's site_url + callback_path
+     * Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin.
      */
     redirect_uri?: string;
     /**
@@ -314,11 +314,11 @@ export type OAuthCallbackRequestRequest = {
      */
     code: string;
     /**
-     * State token for CSRF verification (from authorize response)
+     * State token from the authorize response; single use
      */
     state: string;
     /**
-     * Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path
+     * Ignored. The server reuses the redirect URI stored with the state.
      */
     redirect_uri?: string;
 };
@@ -332,6 +332,7 @@ export type OAuthConnection = {
      * OAuth provider name (github, google, etc.)
      *
      * * `github` - GitHub
+     * * `google` - Google
      */
     readonly provider: OAuthProviderEnum;
     readonly provider_display: string;
@@ -365,6 +366,7 @@ export type OAuthDisconnectRequestRequest = {
      * OAuth provider to disconnect
      *
      * * `github` - GitHub
+     * * `google` - Google
      */
     provider: OAuthProviderEnum;
 };
@@ -374,32 +376,107 @@ export type OAuthDisconnectRequestRequest = {
  */
 export type OAuthError = {
     /**
-     * Error code
-     */
-    error: string;
+     * Error code (closed set)
+     *
+     * * `oauth_disabled` - oauth_disabled
+     * * `github_oauth_disabled` - github_oauth_disabled
+     * * `origin_not_allowed` - origin_not_allowed
+     * * `missing_redirect_uri` - missing_redirect_uri
+     * * `invalid_state` - invalid_state
+     * * `oauth_exchange_failed` - oauth_exchange_failed
+     * * `invalid_id_token` - invalid_id_token
+     * * `email_missing` - email_missing
+     * * `email_not_verified` - email_not_verified
+     * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+     * * `account_inactive` - account_inactive
+     * * `link_not_allowed` - link_not_allowed
+     * * `rate_limited` - rate_limited
+     * * `provider_unavailable` - provider_unavailable
+     * * `server_error` - server_error
+     * * `not_found` - not_found
+     */
+    error: OAuthErrorCodeEnum;
     /**
      * Human-readable error description
      */
     error_description?: string;
 };
 
+/**
+ * * `oauth_disabled` - oauth_disabled
+ * * `github_oauth_disabled` - github_oauth_disabled
+ * * `origin_not_allowed` - origin_not_allowed
+ * * `missing_redirect_uri` - missing_redirect_uri
+ * * `invalid_state` - invalid_state
+ * * `oauth_exchange_failed` - oauth_exchange_failed
+ * * `invalid_id_token` - invalid_id_token
+ * * `email_missing` - email_missing
+ * * `email_not_verified` - email_not_verified
+ * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+ * * `account_inactive` - account_inactive
+ * * `link_not_allowed` - link_not_allowed
+ * * `rate_limited` - rate_limited
+ * * `provider_unavailable` - provider_unavailable
+ * * `server_error` - server_error
+ * * `not_found` - not_found
+ */
+export enum OAuthErrorCodeEnum {
+    OAUTH_DISABLED = 'oauth_disabled',
+    GITHUB_OAUTH_DISABLED = 'github_oauth_disabled',
+    ORIGIN_NOT_ALLOWED = 'origin_not_allowed',
+    MISSING_REDIRECT_URI = 'missing_redirect_uri',
+    INVALID_STATE = 'invalid_state',
+    OAUTH_EXCHANGE_FAILED = 'oauth_exchange_failed',
+    INVALID_ID_TOKEN = 'invalid_id_token',
+    EMAIL_MISSING = 'email_missing',
+    EMAIL_NOT_VERIFIED = 'email_not_verified',
+    HOSTED_DOMAIN_NOT_ALLOWED = 'hosted_domain_not_allowed',
+    ACCOUNT_INACTIVE = 'account_inactive',
+    LINK_NOT_ALLOWED = 'link_not_allowed',
+    RATE_LIMITED = 'rate_limited',
+    PROVIDER_UNAVAILABLE = 'provider_unavailable',
+    SERVER_ERROR = 'server_error',
+    NOT_FOUND = 'not_found'
+}
+
 /**
  * * `github` - GitHub
+ * * `google` - Google
  */
 export enum OAuthProviderEnum {
-    GITHUB = 'github'
+    GITHUB = 'github',
+    GOOGLE = 'google'
 }
 
+/**
+ * One enabled sign-in provider.
+ */
+export type OAuthProviderInfo = {
+    /**
+     * Provider id
+     *
+     * * `github` - GitHub
+     * * `google` - Google
+     */
+    id: OAuthProviderEnum;
+    /**
+     * Display name
+     */
+    name: string;
+    /**
+     * Icon key
+     */
+    icon: string;
+};
+
 /**
  * Response with available OAuth providers.
  */
 export type OAuthProvidersResponse = {
     /**
-     * List of available OAuth providers
+     * Providers that are configured, in display order. The login screen shows exactly these.
      */
-    providers: Array<{
-        [key: string]: unknown;
-    }>;
+    providers: Array<OAuthProviderInfo>;
 };
 
 /**
@@ -1244,6 +1321,7 @@ export type CfgAccountsOauthGithubAuthorizeCreateData = {
 };
 
 export type CfgAccountsOauthGithubAuthorizeCreateErrors = {
+    400: OAuthError;
     503: OAuthError;
 };
 
@@ -1264,6 +1342,10 @@ export type CfgAccountsOauthGithubCallbackCreateData = {
 
 export type CfgAccountsOauthGithubCallbackCreateErrors = {
     400: OAuthError;
+    403: OAuthError;
+    429: OAuthError;
+    502: OAuthError;
+    503: OAuthError;
 };
 
 export type CfgAccountsOauthGithubCallbackCreateError = CfgAccountsOauthGithubCallbackCreateErrors[keyof CfgAccountsOauthGithubCallbackCreateErrors];
@@ -1274,6 +1356,49 @@ export type CfgAccountsOauthGithubCallbackCreateResponses = {
 
 export type CfgAccountsOauthGithubCallbackCreateResponse = CfgAccountsOauthGithubCallbackCreateResponses[keyof CfgAccountsOauthGithubCallbackCreateResponses];
 
+export type CfgAccountsOauthGoogleAuthorizeCreateData = {
+    body?: OAuthAuthorizeRequestRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/oauth/google/authorize/';
+};
+
+export type CfgAccountsOauthGoogleAuthorizeCreateErrors = {
+    400: OAuthError;
+    503: OAuthError;
+};
+
+export type CfgAccountsOauthGoogleAuthorizeCreateError = CfgAccountsOauthGoogleAuthorizeCreateErrors[keyof CfgAccountsOauthGoogleAuthorizeCreateErrors];
+
+export type CfgAccountsOauthGoogleAuthorizeCreateResponses = {
+    200: OAuthAuthorizeResponse;
+};
+
+export type CfgAccountsOauthGoogleAuthorizeCreateResponse = CfgAccountsOauthGoogleAuthorizeCreateResponses[keyof CfgAccountsOauthGoogleAuthorizeCreateResponses];
+
+export type CfgAccountsOauthGoogleCallbackCreateData = {
+    body: OAuthCallbackRequestRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/oauth/google/callback/';
+};
+
+export type CfgAccountsOauthGoogleCallbackCreateErrors = {
+    400: OAuthError;
+    403: OAuthError;
+    429: OAuthError;
+    502: OAuthError;
+    503: OAuthError;
+};
+
+export type CfgAccountsOauthGoogleCallbackCreateError = CfgAccountsOauthGoogleCallbackCreateErrors[keyof CfgAccountsOauthGoogleCallbackCreateErrors];
+
+export type CfgAccountsOauthGoogleCallbackCreateResponses = {
+    200: OAuthTokenResponse;
+};
+
+export type CfgAccountsOauthGoogleCallbackCreateResponse = CfgAccountsOauthGoogleCallbackCreateResponses[keyof CfgAccountsOauthGoogleCallbackCreateResponses];
+
 export type CfgAccountsOauthProvidersRetrieveData = {
     body?: never;
     path?: never;