@djangocfg/api 2.1.598 → 2.1.600

package/dist/clients.d.cts

@@ -634,7 +634,7 @@ declare enum MarketingConsentDefaultEnum {
  */
 type OAuthAuthorizeRequestRequest = {
     /**
-     * URL to redirect after OAuth authorization. If not provided, uses config's site_url + callback_path
+     * Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin.
      */
     redirect_uri?: string;
     /**
@@ -664,11 +664,11 @@ type OAuthCallbackRequestRequest = {
      */
     code: string;
     /**
-     * State token for CSRF verification (from authorize response)
+     * State token from the authorize response; single use
      */
     state: string;
     /**
-     * Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path
+     * Ignored. The server reuses the redirect URI stored with the state.
      */
     redirect_uri?: string;
 };
@@ -681,6 +681,7 @@ type OAuthConnection = {
      * OAuth provider name (github, google, etc.)
      *
      * * `github` - GitHub
+     * * `google` - Google
      */
     readonly provider: OAuthProviderEnum;
     readonly provider_display: string;
@@ -713,6 +714,7 @@ type OAuthDisconnectRequestRequest = {
      * OAuth provider to disconnect
      *
      * * `github` - GitHub
+     * * `google` - Google
      */
     provider: OAuthProviderEnum;
 };
@@ -721,30 +723,103 @@ type OAuthDisconnectRequestRequest = {
  */
 type OAuthError = {
     /**
-     * Error code
-     */
-    error: string;
+     * Error code (closed set)
+     *
+     * * `oauth_disabled` - oauth_disabled
+     * * `github_oauth_disabled` - github_oauth_disabled
+     * * `origin_not_allowed` - origin_not_allowed
+     * * `missing_redirect_uri` - missing_redirect_uri
+     * * `invalid_state` - invalid_state
+     * * `oauth_exchange_failed` - oauth_exchange_failed
+     * * `invalid_id_token` - invalid_id_token
+     * * `email_missing` - email_missing
+     * * `email_not_verified` - email_not_verified
+     * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+     * * `account_inactive` - account_inactive
+     * * `link_not_allowed` - link_not_allowed
+     * * `rate_limited` - rate_limited
+     * * `provider_unavailable` - provider_unavailable
+     * * `server_error` - server_error
+     * * `not_found` - not_found
+     */
+    error: OAuthErrorCodeEnum;
     /**
      * Human-readable error description
      */
     error_description?: string;
 };
+/**
+ * * `oauth_disabled` - oauth_disabled
+ * * `github_oauth_disabled` - github_oauth_disabled
+ * * `origin_not_allowed` - origin_not_allowed
+ * * `missing_redirect_uri` - missing_redirect_uri
+ * * `invalid_state` - invalid_state
+ * * `oauth_exchange_failed` - oauth_exchange_failed
+ * * `invalid_id_token` - invalid_id_token
+ * * `email_missing` - email_missing
+ * * `email_not_verified` - email_not_verified
+ * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+ * * `account_inactive` - account_inactive
+ * * `link_not_allowed` - link_not_allowed
+ * * `rate_limited` - rate_limited
+ * * `provider_unavailable` - provider_unavailable
+ * * `server_error` - server_error
+ * * `not_found` - not_found
+ */
+declare enum OAuthErrorCodeEnum {
+    OAUTH_DISABLED = "oauth_disabled",
+    GITHUB_OAUTH_DISABLED = "github_oauth_disabled",
+    ORIGIN_NOT_ALLOWED = "origin_not_allowed",
+    MISSING_REDIRECT_URI = "missing_redirect_uri",
+    INVALID_STATE = "invalid_state",
+    OAUTH_EXCHANGE_FAILED = "oauth_exchange_failed",
+    INVALID_ID_TOKEN = "invalid_id_token",
+    EMAIL_MISSING = "email_missing",
+    EMAIL_NOT_VERIFIED = "email_not_verified",
+    HOSTED_DOMAIN_NOT_ALLOWED = "hosted_domain_not_allowed",
+    ACCOUNT_INACTIVE = "account_inactive",
+    LINK_NOT_ALLOWED = "link_not_allowed",
+    RATE_LIMITED = "rate_limited",
+    PROVIDER_UNAVAILABLE = "provider_unavailable",
+    SERVER_ERROR = "server_error",
+    NOT_FOUND = "not_found"
+}
 /**
  * * `github` - GitHub
+ * * `google` - Google
  */
 declare enum OAuthProviderEnum {
-    GITHUB = "github"
+    GITHUB = "github",
+    GOOGLE = "google"
 }
+/**
+ * One enabled sign-in provider.
+ */
+type OAuthProviderInfo = {
+    /**
+     * Provider id
+     *
+     * * `github` - GitHub
+     * * `google` - Google
+     */
+    id: OAuthProviderEnum;
+    /**
+     * Display name
+     */
+    name: string;
+    /**
+     * Icon key
+     */
+    icon: string;
+};
 /**
  * Response with available OAuth providers.
  */
 type OAuthProvidersResponse = {
     /**
-     * List of available OAuth providers
+     * Providers that are configured, in display order. The login screen shows exactly these.
      */
-    providers: Array<{
-        [key: string]: unknown;
-    }>;
+    providers: Array<OAuthProviderInfo>;
 };
 /**
  * Response with JWT tokens after OAuth authentication.
@@ -1394,6 +1469,7 @@ type CfgAccountsOauthGithubAuthorizeCreateData = {
     url: '/cfg/accounts/oauth/github/authorize/';
 };
 type CfgAccountsOauthGithubAuthorizeCreateErrors = {
+    400: OAuthError;
     503: OAuthError;
 };
 type CfgAccountsOauthGithubAuthorizeCreateResponses = {
@@ -1407,10 +1483,43 @@ type CfgAccountsOauthGithubCallbackCreateData = {
 };
 type CfgAccountsOauthGithubCallbackCreateErrors = {
     400: OAuthError;
+    403: OAuthError;
+    429: OAuthError;
+    502: OAuthError;
+    503: OAuthError;
 };
 type CfgAccountsOauthGithubCallbackCreateResponses = {
     200: OAuthTokenResponse;
 };
+type CfgAccountsOauthGoogleAuthorizeCreateData = {
+    body?: OAuthAuthorizeRequestRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/oauth/google/authorize/';
+};
+type CfgAccountsOauthGoogleAuthorizeCreateErrors = {
+    400: OAuthError;
+    503: OAuthError;
+};
+type CfgAccountsOauthGoogleAuthorizeCreateResponses = {
+    200: OAuthAuthorizeResponse;
+};
+type CfgAccountsOauthGoogleCallbackCreateData = {
+    body: OAuthCallbackRequestRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/oauth/google/callback/';
+};
+type CfgAccountsOauthGoogleCallbackCreateErrors = {
+    400: OAuthError;
+    403: OAuthError;
+    429: OAuthError;
+    502: OAuthError;
+    503: OAuthError;
+};
+type CfgAccountsOauthGoogleCallbackCreateResponses = {
+    200: OAuthTokenResponse;
+};
 type CfgAccountsOauthProvidersRetrieveData = {
     body?: never;
     path?: never;
@@ -1806,19 +1915,31 @@ declare class CfgAccountsOauth {
     /**
      * Start GitHub OAuth
      *
-     * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+     * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
      */
     static cfgAccountsOauthGithubAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGithubAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError>;
     /**
      * Complete GitHub OAuth
      *
-     * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+     * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.
      */
     static cfgAccountsOauthGithubCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGithubCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError>;
+    /**
+     * Start Google OAuth
+     *
+     * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
+     */
+    static cfgAccountsOauthGoogleAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGoogleAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError>;
+    /**
+     * Complete Google OAuth
+     *
+     * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.
+     */
+    static cfgAccountsOauthGoogleCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGoogleCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError>;
     /**
      * List OAuth providers
      *
-     * Get list of available OAuth providers for authentication.
+     * Providers that are configured, in display order. The login screen shows exactly these buttons.
      */
     static cfgAccountsOauthProvidersRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthProvidersRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError>;
 }

package/dist/clients.d.ts

@@ -634,7 +634,7 @@ declare enum MarketingConsentDefaultEnum {
  */
 type OAuthAuthorizeRequestRequest = {
     /**
-     * URL to redirect after OAuth authorization. If not provided, uses config's site_url + callback_path
+     * Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin.
      */
     redirect_uri?: string;
     /**
@@ -664,11 +664,11 @@ type OAuthCallbackRequestRequest = {
      */
     code: string;
     /**
-     * State token for CSRF verification (from authorize response)
+     * State token from the authorize response; single use
      */
     state: string;
     /**
-     * Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path
+     * Ignored. The server reuses the redirect URI stored with the state.
      */
     redirect_uri?: string;
 };
@@ -681,6 +681,7 @@ type OAuthConnection = {
      * OAuth provider name (github, google, etc.)
      *
      * * `github` - GitHub
+     * * `google` - Google
      */
     readonly provider: OAuthProviderEnum;
     readonly provider_display: string;
@@ -713,6 +714,7 @@ type OAuthDisconnectRequestRequest = {
      * OAuth provider to disconnect
      *
      * * `github` - GitHub
+     * * `google` - Google
      */
     provider: OAuthProviderEnum;
 };
@@ -721,30 +723,103 @@ type OAuthDisconnectRequestRequest = {
  */
 type OAuthError = {
     /**
-     * Error code
-     */
-    error: string;
+     * Error code (closed set)
+     *
+     * * `oauth_disabled` - oauth_disabled
+     * * `github_oauth_disabled` - github_oauth_disabled
+     * * `origin_not_allowed` - origin_not_allowed
+     * * `missing_redirect_uri` - missing_redirect_uri
+     * * `invalid_state` - invalid_state
+     * * `oauth_exchange_failed` - oauth_exchange_failed
+     * * `invalid_id_token` - invalid_id_token
+     * * `email_missing` - email_missing
+     * * `email_not_verified` - email_not_verified
+     * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+     * * `account_inactive` - account_inactive
+     * * `link_not_allowed` - link_not_allowed
+     * * `rate_limited` - rate_limited
+     * * `provider_unavailable` - provider_unavailable
+     * * `server_error` - server_error
+     * * `not_found` - not_found
+     */
+    error: OAuthErrorCodeEnum;
     /**
      * Human-readable error description
      */
     error_description?: string;
 };
+/**
+ * * `oauth_disabled` - oauth_disabled
+ * * `github_oauth_disabled` - github_oauth_disabled
+ * * `origin_not_allowed` - origin_not_allowed
+ * * `missing_redirect_uri` - missing_redirect_uri
+ * * `invalid_state` - invalid_state
+ * * `oauth_exchange_failed` - oauth_exchange_failed
+ * * `invalid_id_token` - invalid_id_token
+ * * `email_missing` - email_missing
+ * * `email_not_verified` - email_not_verified
+ * * `hosted_domain_not_allowed` - hosted_domain_not_allowed
+ * * `account_inactive` - account_inactive
+ * * `link_not_allowed` - link_not_allowed
+ * * `rate_limited` - rate_limited
+ * * `provider_unavailable` - provider_unavailable
+ * * `server_error` - server_error
+ * * `not_found` - not_found
+ */
+declare enum OAuthErrorCodeEnum {
+    OAUTH_DISABLED = "oauth_disabled",
+    GITHUB_OAUTH_DISABLED = "github_oauth_disabled",
+    ORIGIN_NOT_ALLOWED = "origin_not_allowed",
+    MISSING_REDIRECT_URI = "missing_redirect_uri",
+    INVALID_STATE = "invalid_state",
+    OAUTH_EXCHANGE_FAILED = "oauth_exchange_failed",
+    INVALID_ID_TOKEN = "invalid_id_token",
+    EMAIL_MISSING = "email_missing",
+    EMAIL_NOT_VERIFIED = "email_not_verified",
+    HOSTED_DOMAIN_NOT_ALLOWED = "hosted_domain_not_allowed",
+    ACCOUNT_INACTIVE = "account_inactive",
+    LINK_NOT_ALLOWED = "link_not_allowed",
+    RATE_LIMITED = "rate_limited",
+    PROVIDER_UNAVAILABLE = "provider_unavailable",
+    SERVER_ERROR = "server_error",
+    NOT_FOUND = "not_found"
+}
 /**
  * * `github` - GitHub
+ * * `google` - Google
  */
 declare enum OAuthProviderEnum {
-    GITHUB = "github"
+    GITHUB = "github",
+    GOOGLE = "google"
 }
+/**
+ * One enabled sign-in provider.
+ */
+type OAuthProviderInfo = {
+    /**
+     * Provider id
+     *
+     * * `github` - GitHub
+     * * `google` - Google
+     */
+    id: OAuthProviderEnum;
+    /**
+     * Display name
+     */
+    name: string;
+    /**
+     * Icon key
+     */
+    icon: string;
+};
 /**
  * Response with available OAuth providers.
  */
 type OAuthProvidersResponse = {
     /**
-     * List of available OAuth providers
+     * Providers that are configured, in display order. The login screen shows exactly these.
      */
-    providers: Array<{
-        [key: string]: unknown;
-    }>;
+    providers: Array<OAuthProviderInfo>;
 };
 /**
  * Response with JWT tokens after OAuth authentication.
@@ -1394,6 +1469,7 @@ type CfgAccountsOauthGithubAuthorizeCreateData = {
     url: '/cfg/accounts/oauth/github/authorize/';
 };
 type CfgAccountsOauthGithubAuthorizeCreateErrors = {
+    400: OAuthError;
     503: OAuthError;
 };
 type CfgAccountsOauthGithubAuthorizeCreateResponses = {
@@ -1407,10 +1483,43 @@ type CfgAccountsOauthGithubCallbackCreateData = {
 };
 type CfgAccountsOauthGithubCallbackCreateErrors = {
     400: OAuthError;
+    403: OAuthError;
+    429: OAuthError;
+    502: OAuthError;
+    503: OAuthError;
 };
 type CfgAccountsOauthGithubCallbackCreateResponses = {
     200: OAuthTokenResponse;
 };
+type CfgAccountsOauthGoogleAuthorizeCreateData = {
+    body?: OAuthAuthorizeRequestRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/oauth/google/authorize/';
+};
+type CfgAccountsOauthGoogleAuthorizeCreateErrors = {
+    400: OAuthError;
+    503: OAuthError;
+};
+type CfgAccountsOauthGoogleAuthorizeCreateResponses = {
+    200: OAuthAuthorizeResponse;
+};
+type CfgAccountsOauthGoogleCallbackCreateData = {
+    body: OAuthCallbackRequestRequest;
+    path?: never;
+    query?: never;
+    url: '/cfg/accounts/oauth/google/callback/';
+};
+type CfgAccountsOauthGoogleCallbackCreateErrors = {
+    400: OAuthError;
+    403: OAuthError;
+    429: OAuthError;
+    502: OAuthError;
+    503: OAuthError;
+};
+type CfgAccountsOauthGoogleCallbackCreateResponses = {
+    200: OAuthTokenResponse;
+};
 type CfgAccountsOauthProvidersRetrieveData = {
     body?: never;
     path?: never;
@@ -1806,19 +1915,31 @@ declare class CfgAccountsOauth {
     /**
      * Start GitHub OAuth
      *
-     * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+     * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
      */
     static cfgAccountsOauthGithubAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGithubAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError>;
     /**
      * Complete GitHub OAuth
      *
-     * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+     * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.
      */
     static cfgAccountsOauthGithubCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGithubCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError>;
+    /**
+     * Start Google OAuth
+     *
+     * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
+     */
+    static cfgAccountsOauthGoogleAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGoogleAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError>;
+    /**
+     * Complete Google OAuth
+     *
+     * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.
+     */
+    static cfgAccountsOauthGoogleCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGoogleCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError>;
     /**
      * List OAuth providers
      *
-     * Get list of available OAuth providers for authentication.
+     * Providers that are configured, in display order. The login screen shows exactly these buttons.
      */
     static cfgAccountsOauthProvidersRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthProvidersRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError>;
 }

package/dist/clients.mjs

@@ -79,6 +79,7 @@ var CFG_KEYS = {
   redirectUrlTs: k("cfg.auth.redirect_url_ts", "session", true),
   oauthState: k("cfg.auth.oauth_state", "session", true),
   oauthProvider: k("cfg.auth.oauth_provider", "session", true),
+  oauthProviders: k("cfg.auth.oauth_providers", "session", false),
   profileCache: k("cfg.profile.cache", "local", true),
   monitorSessionId: k("cfg.monitor.session_id", "local", false),
   monitorSessionCookie: k("cfg.monitor.session_id", "cookie", false),
@@ -1947,7 +1948,7 @@ var CfgAccountsOauth = class {
   /**
    * Start GitHub OAuth
    *
-   * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+   * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
    */
   static cfgAccountsOauthGithubAuthorizeCreate(options) {
     return (options?.client ?? client).post({
@@ -1962,7 +1963,7 @@ var CfgAccountsOauth = class {
   /**
    * Complete GitHub OAuth
    *
-   * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+   * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.
    */
   static cfgAccountsOauthGithubCallbackCreate(options) {
     return (options.client ?? client).post({
@@ -1974,10 +1975,40 @@ var CfgAccountsOauth = class {
       }
     });
   }
+  /**
+   * Start Google OAuth
+   *
+   * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
+   */
+  static cfgAccountsOauthGoogleAuthorizeCreate(options) {
+    return (options?.client ?? client).post({
+      url: "/cfg/accounts/oauth/google/authorize/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Complete Google OAuth
+   *
+   * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.
+   */
+  static cfgAccountsOauthGoogleCallbackCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/oauth/google/callback/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * List OAuth providers
    *
-   * Get list of available OAuth providers for authentication.
+   * Providers that are configured, in display order. The login screen shows exactly these buttons.
    */
   static cfgAccountsOauthProvidersRetrieve(options) {
     return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });