@djangocfg/api 2.1.599 → 2.1.600

package/src/_api/generated/_cfg_accounts/openapi.json

@@ -336,7 +336,7 @@
     "/cfg/accounts/oauth/github/authorize/": {
       "post": {
         "operationId": "cfg_accounts_oauth_github_authorize_create",
-        "description": "Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.",
+        "description": "Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.",
         "summary": "Start GitHub OAuth",
         "tags": [
           "cfg_accounts_oauth"
@@ -364,6 +364,16 @@
             },
             "description": ""
           },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
           "503": {
             "content": {
               "application/json": {
@@ -381,7 +391,7 @@
     "/cfg/accounts/oauth/github/callback/": {
       "post": {
         "operationId": "cfg_accounts_oauth_github_callback_create",
-        "description": "Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.",
+        "description": "Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.",
         "summary": "Complete GitHub OAuth",
         "tags": [
           "cfg_accounts_oauth"
@@ -419,6 +429,187 @@
               }
             },
             "description": ""
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          }
+        },
+        "x-async-capable": false
+      }
+    },
+    "/cfg/accounts/oauth/google/authorize/": {
+      "post": {
+        "operationId": "cfg_accounts_oauth_google_authorize_create",
+        "description": "Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.",
+        "summary": "Start Google OAuth",
+        "tags": [
+          "cfg_accounts_oauth"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OAuthAuthorizeRequestRequest"
+              }
+            }
+          }
+        },
+        "security": [
+          {}
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthAuthorizeResponse"
+                }
+              }
+            },
+            "description": ""
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          }
+        },
+        "x-async-capable": false
+      }
+    },
+    "/cfg/accounts/oauth/google/callback/": {
+      "post": {
+        "operationId": "cfg_accounts_oauth_google_callback_create",
+        "description": "Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.",
+        "summary": "Complete Google OAuth",
+        "tags": [
+          "cfg_accounts_oauth"
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/OAuthCallbackRequestRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "security": [
+          {}
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthTokenResponse"
+                }
+              }
+            },
+            "description": ""
+          },
+          "400": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "403": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "429": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "502": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
+          },
+          "503": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/OAuthError"
+                }
+              }
+            },
+            "description": ""
           }
         },
         "x-async-capable": false
@@ -427,7 +618,7 @@
     "/cfg/accounts/oauth/providers/": {
       "get": {
         "operationId": "cfg_accounts_oauth_providers_retrieve",
-        "description": "Get list of available OAuth providers for authentication.",
+        "description": "Providers that are configured, in display order. The login screen shows exactly these buttons.",
         "summary": "List OAuth providers",
         "tags": [
           "cfg_accounts_oauth"
@@ -1415,7 +1606,7 @@
           "redirect_uri": {
             "type": "string",
             "format": "uri",
-            "description": "URL to redirect after OAuth authorization. If not provided, uses config's site_url + callback_path"
+            "description": "Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin."
           },
           "source_url": {
             "type": "string",
@@ -1449,20 +1640,20 @@
         "properties": {
           "code": {
             "type": "string",
-            "minLength": 10,
+            "minLength": 1,
             "description": "Authorization code from OAuth provider callback",
-            "maxLength": 500
+            "maxLength": 2048
           },
           "state": {
             "type": "string",
-            "minLength": 20,
-            "description": "State token for CSRF verification (from authorize response)",
-            "maxLength": 100
+            "minLength": 1,
+            "description": "State token from the authorize response; single use",
+            "maxLength": 64
           },
           "redirect_uri": {
             "type": "string",
             "format": "uri",
-            "description": "Same redirect_uri used in authorize request. If not provided, uses config's site_url + callback_path"
+            "description": "Ignored. The server reuses the redirect URI stored with the state."
           }
         },
         "required": [
@@ -1485,7 +1676,7 @@
               }
             ],
             "readOnly": true,
-            "description": "OAuth provider name (github, google, etc.)\n\n* `github` - GitHub"
+            "description": "OAuth provider name (github, google, etc.)\n\n* `github` - GitHub\n* `google` - Google"
           },
           "provider_display": {
             "type": "string",
@@ -1542,7 +1733,7 @@
                 "$ref": "#/components/schemas/OAuthProviderEnum"
               }
             ],
-            "description": "OAuth provider to disconnect\n\n* `github` - GitHub"
+            "description": "OAuth provider to disconnect\n\n* `github` - GitHub\n* `google` - Google"
           }
         },
         "required": [
@@ -1554,8 +1745,12 @@
         "description": "Error response for OAuth endpoints.",
         "properties": {
           "error": {
-            "type": "string",
-            "description": "Error code"
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/OAuthErrorCodeEnum"
+              }
+            ],
+            "description": "Error code (closed set)\n\n* `oauth_disabled` - oauth_disabled\n* `github_oauth_disabled` - github_oauth_disabled\n* `origin_not_allowed` - origin_not_allowed\n* `missing_redirect_uri` - missing_redirect_uri\n* `invalid_state` - invalid_state\n* `oauth_exchange_failed` - oauth_exchange_failed\n* `invalid_id_token` - invalid_id_token\n* `email_missing` - email_missing\n* `email_not_verified` - email_not_verified\n* `hosted_domain_not_allowed` - hosted_domain_not_allowed\n* `account_inactive` - account_inactive\n* `link_not_allowed` - link_not_allowed\n* `rate_limited` - rate_limited\n* `provider_unavailable` - provider_unavailable\n* `server_error` - server_error\n* `not_found` - not_found"
           },
           "error_description": {
             "type": "string",
@@ -1566,12 +1761,62 @@
           "error"
         ]
       },
+      "OAuthErrorCodeEnum": {
+        "enum": [
+          "oauth_disabled",
+          "github_oauth_disabled",
+          "origin_not_allowed",
+          "missing_redirect_uri",
+          "invalid_state",
+          "oauth_exchange_failed",
+          "invalid_id_token",
+          "email_missing",
+          "email_not_verified",
+          "hosted_domain_not_allowed",
+          "account_inactive",
+          "link_not_allowed",
+          "rate_limited",
+          "provider_unavailable",
+          "server_error",
+          "not_found"
+        ],
+        "type": "string",
+        "description": "* `oauth_disabled` - oauth_disabled\n* `github_oauth_disabled` - github_oauth_disabled\n* `origin_not_allowed` - origin_not_allowed\n* `missing_redirect_uri` - missing_redirect_uri\n* `invalid_state` - invalid_state\n* `oauth_exchange_failed` - oauth_exchange_failed\n* `invalid_id_token` - invalid_id_token\n* `email_missing` - email_missing\n* `email_not_verified` - email_not_verified\n* `hosted_domain_not_allowed` - hosted_domain_not_allowed\n* `account_inactive` - account_inactive\n* `link_not_allowed` - link_not_allowed\n* `rate_limited` - rate_limited\n* `provider_unavailable` - provider_unavailable\n* `server_error` - server_error\n* `not_found` - not_found"
+      },
       "OAuthProviderEnum": {
         "enum": [
-          "github"
+          "github",
+          "google"
         ],
         "type": "string",
-        "description": "* `github` - GitHub"
+        "description": "* `github` - GitHub\n* `google` - Google"
+      },
+      "OAuthProviderInfo": {
+        "type": "object",
+        "description": "One enabled sign-in provider.",
+        "properties": {
+          "id": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/OAuthProviderEnum"
+              }
+            ],
+            "description": "Provider id\n\n* `github` - GitHub\n* `google` - Google"
+          },
+          "name": {
+            "type": "string",
+            "description": "Display name"
+          },
+          "icon": {
+            "type": "string",
+            "description": "Icon key"
+          }
+        },
+        "required": [
+          "icon",
+          "id",
+          "name"
+        ]
       },
       "OAuthProvidersResponse": {
         "type": "object",
@@ -1580,10 +1825,9 @@
           "providers": {
             "type": "array",
             "items": {
-              "type": "object",
-              "additionalProperties": {}
+              "$ref": "#/components/schemas/OAuthProviderInfo"
             },
-            "description": "List of available OAuth providers"
+            "description": "Providers that are configured, in display order. The login screen shows exactly these."
           }
         },
         "required": [

package/src/_api/generated/_cfg_accounts/schemas/OAuthCallbackRequestRequest.ts

@@ -5,8 +5,8 @@
 import { z } from "zod";
 
 export const OAuthCallbackRequestRequestSchema = z.object({
-  code: z.string().min(10).max(500),
-  state: z.string().min(20).max(100),
+  code: z.string().min(1).max(2048),
+  state: z.string().min(1).max(64),
   redirect_uri: z.url().or(z.literal("")).optional(),
 });
 

package/src/_api/generated/_cfg_accounts/schemas/OAuthError.ts

@@ -3,9 +3,10 @@
 // DO NOT EDIT — re-run `make gen-clients`.
 
 import { z } from "zod";
+import { OAuthErrorCodeEnumSchema } from "./OAuthErrorCodeEnum";
 
 export const OAuthErrorSchema = z.object({
-  error: z.string(),
+  error: OAuthErrorCodeEnumSchema,
   error_description: z.string().optional(),
 });
 

package/src/_api/generated/_cfg_accounts/schemas/OAuthErrorCodeEnum.ts

@@ -0,0 +1,9 @@
+// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras
+// Source: OpenAPI 3.1 components.schemas
+// DO NOT EDIT — re-run `make gen-clients`.
+
+import { z } from "zod";
+
+export const OAuthErrorCodeEnumSchema = z.enum(["oauth_disabled", "github_oauth_disabled", "origin_not_allowed", "missing_redirect_uri", "invalid_state", "oauth_exchange_failed", "invalid_id_token", "email_missing", "email_not_verified", "hosted_domain_not_allowed", "account_inactive", "link_not_allowed", "rate_limited", "provider_unavailable", "server_error", "not_found"]);
+
+export type OAuthErrorCodeEnum = z.infer<typeof OAuthErrorCodeEnumSchema>;

package/src/_api/generated/_cfg_accounts/schemas/OAuthProviderEnum.ts

@@ -4,6 +4,6 @@
 
 import { z } from "zod";
 
-export const OAuthProviderEnumSchema = z.enum(["github"]);
+export const OAuthProviderEnumSchema = z.enum(["github", "google"]);
 
 export type OAuthProviderEnum = z.infer<typeof OAuthProviderEnumSchema>;

package/src/_api/generated/_cfg_accounts/schemas/OAuthProviderInfo.ts

@@ -0,0 +1,14 @@
+// AUTO-GENERATED by cmdop_server / devtools.generator.ts_extras
+// Source: OpenAPI 3.1 components.schemas
+// DO NOT EDIT — re-run `make gen-clients`.
+
+import { z } from "zod";
+import { OAuthProviderEnumSchema } from "./OAuthProviderEnum";
+
+export const OAuthProviderInfoSchema = z.object({
+  id: OAuthProviderEnumSchema,
+  name: z.string(),
+  icon: z.string(),
+});
+
+export type OAuthProviderInfo = z.infer<typeof OAuthProviderInfoSchema>;

package/src/_api/generated/_cfg_accounts/schemas/OAuthProvidersResponse.ts

@@ -3,9 +3,10 @@
 // DO NOT EDIT — re-run `make gen-clients`.
 
 import { z } from "zod";
+import { OAuthProviderInfoSchema } from "./OAuthProviderInfo";
 
 export const OAuthProvidersResponseSchema = z.object({
-  providers: z.array(z.object({}).passthrough()),
+  providers: z.array(OAuthProviderInfoSchema),
 });
 
 export type OAuthProvidersResponse = z.infer<typeof OAuthProvidersResponseSchema>;

package/src/_api/generated/_cfg_accounts/schemas/index.ts

@@ -17,7 +17,9 @@ export * from "./OAuthCallbackRequestRequest";
 export * from "./OAuthConnection";
 export * from "./OAuthDisconnectRequestRequest";
 export * from "./OAuthError";
+export * from "./OAuthErrorCodeEnum";
 export * from "./OAuthProviderEnum";
+export * from "./OAuthProviderInfo";
 export * from "./OAuthProvidersResponse";
 export * from "./OAuthTokenResponse";
 export * from "./OTPErrorResponse";

package/src/_api/generated/helpers/keys.ts

@@ -49,6 +49,7 @@ export const CFG_KEYS = {
   redirectUrlTs: k('cfg.auth.redirect_url_ts', 'session', true),
   oauthState: k('cfg.auth.oauth_state', 'session', true),
   oauthProvider: k('cfg.auth.oauth_provider', 'session', true),
+  oauthProviders: k('cfg.auth.oauth_providers', 'session', false),
   profileCache: k('cfg.profile.cache', 'local', true),
   monitorSessionId: k('cfg.monitor.session_id', 'local', false),
   monitorSessionCookie: k('cfg.monitor.session_id', 'cookie', false),