@djangocfg/api 2.1.599 → 2.1.600

package/dist/auth.mjs

@@ -20,11 +20,11 @@ import { usePathname as usePathname3 } from "next/navigation";
 import {
   createContext as createContext2,
   memo,
-  useCallback as useCallback12,
+  useCallback as useCallback13,
   useContext as useContext2,
-  useEffect as useEffect6,
-  useMemo as useMemo3,
-  useRef as useRef6,
+  useEffect as useEffect7,
+  useMemo as useMemo4,
+  useRef as useRef7,
   useState as useState11
 } from "react";
 
@@ -105,6 +105,7 @@ var CFG_KEYS = {
   redirectUrlTs: k("cfg.auth.redirect_url_ts", "session", true),
   oauthState: k("cfg.auth.oauth_state", "session", true),
   oauthProvider: k("cfg.auth.oauth_provider", "session", true),
+  oauthProviders: k("cfg.auth.oauth_providers", "session", false),
   profileCache: k("cfg.profile.cache", "local", true),
   monitorSessionId: k("cfg.monitor.session_id", "local", false),
   monitorSessionCookie: k("cfg.monitor.session_id", "cookie", false),
@@ -1692,8 +1693,8 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   };
 }, "useAuthForm");
 
-// src/auth/hooks/useGithubAuth.ts
-import { useCallback as useCallback6, useState as useState3 } from "react";
+// src/auth/hooks/useOAuthLogin.ts
+import { useCallback as useCallback6, useEffect as useEffect5, useRef as useRef5, useState as useState4 } from "react";
 
 // src/_api/generated/core/bodySerializer.gen.ts
 var serializeFormDataPair = /* @__PURE__ */ __name((data, key, value) => {
@@ -2559,7 +2560,7 @@ var CfgAccountsOauth = class {
   /**
    * Start GitHub OAuth
    *
-   * Generate GitHub OAuth authorization URL. Redirect user to this URL to start authentication.
+   * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
    */
   static cfgAccountsOauthGithubAuthorizeCreate(options) {
     return (options?.client ?? client).post({
@@ -2574,7 +2575,7 @@ var CfgAccountsOauth = class {
   /**
    * Complete GitHub OAuth
    *
-   * Exchange authorization code for JWT tokens. Call this after GitHub redirects back with code.
+   * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.
    */
   static cfgAccountsOauthGithubCallbackCreate(options) {
     return (options.client ?? client).post({
@@ -2586,10 +2587,40 @@ var CfgAccountsOauth = class {
       }
     });
   }
+  /**
+   * Start Google OAuth
+   *
+   * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.
+   */
+  static cfgAccountsOauthGoogleAuthorizeCreate(options) {
+    return (options?.client ?? client).post({
+      url: "/cfg/accounts/oauth/google/authorize/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers
+      }
+    });
+  }
+  /**
+   * Complete Google OAuth
+   *
+   * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.
+   */
+  static cfgAccountsOauthGoogleCallbackCreate(options) {
+    return (options.client ?? client).post({
+      url: "/cfg/accounts/oauth/google/callback/",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options.headers
+      }
+    });
+  }
   /**
    * List OAuth providers
    *
-   * Get list of available OAuth providers for authentication.
+   * Providers that are configured, in display order. The login screen shows exactly these buttons.
    */
   static cfgAccountsOauthProvidersRetrieve(options) {
     return (options?.client ?? client).get({ url: "/cfg/accounts/oauth/providers/", ...options });
@@ -3060,6 +3091,27 @@ var Analytics = {
   }
 };
 
+// src/_api/generated/types.gen.ts
+var OAuthErrorCodeEnum = /* @__PURE__ */ ((OAuthErrorCodeEnum2) => {
+  OAuthErrorCodeEnum2["OAUTH_DISABLED"] = "oauth_disabled";
+  OAuthErrorCodeEnum2["GITHUB_OAUTH_DISABLED"] = "github_oauth_disabled";
+  OAuthErrorCodeEnum2["ORIGIN_NOT_ALLOWED"] = "origin_not_allowed";
+  OAuthErrorCodeEnum2["MISSING_REDIRECT_URI"] = "missing_redirect_uri";
+  OAuthErrorCodeEnum2["INVALID_STATE"] = "invalid_state";
+  OAuthErrorCodeEnum2["OAUTH_EXCHANGE_FAILED"] = "oauth_exchange_failed";
+  OAuthErrorCodeEnum2["INVALID_ID_TOKEN"] = "invalid_id_token";
+  OAuthErrorCodeEnum2["EMAIL_MISSING"] = "email_missing";
+  OAuthErrorCodeEnum2["EMAIL_NOT_VERIFIED"] = "email_not_verified";
+  OAuthErrorCodeEnum2["HOSTED_DOMAIN_NOT_ALLOWED"] = "hosted_domain_not_allowed";
+  OAuthErrorCodeEnum2["ACCOUNT_INACTIVE"] = "account_inactive";
+  OAuthErrorCodeEnum2["LINK_NOT_ALLOWED"] = "link_not_allowed";
+  OAuthErrorCodeEnum2["RATE_LIMITED"] = "rate_limited";
+  OAuthErrorCodeEnum2["PROVIDER_UNAVAILABLE"] = "provider_unavailable";
+  OAuthErrorCodeEnum2["SERVER_ERROR"] = "server_error";
+  OAuthErrorCodeEnum2["NOT_FOUND"] = "not_found";
+  return OAuthErrorCodeEnum2;
+})(OAuthErrorCodeEnum || {});
+
 // src/auth/utils/errors.ts
 var prop = /* @__PURE__ */ __name((value, key) => typeof value === "object" && value !== null ? value[key] : void 0, "prop");
 var TRANSPORT_FALLBACK = /^HTTP \d{3}:\s*/;
@@ -3121,126 +3173,24 @@ var logAuthFailure = /* @__PURE__ */ __name((log, message, error) => {
   log.error(message, error);
 }, "logAuthFailure");
 
-// src/auth/hooks/useGithubAuth.ts
-var OAUTH_STATE_KEY = CFG_KEYS.oauthState.key;
-var OAUTH_PROVIDER_KEY = CFG_KEYS.oauthProvider.key;
-var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
-  const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
-  const router = useCfgRouter();
-  const [isLoading, setIsLoading] = useState3(false);
-  const [error, setError] = useState3(null);
-  const startGithubAuth = useCallback6(async () => {
-    setIsLoading(true);
-    setError(null);
-    auth.clearSession();
-    try {
-      authLogger.info("Starting GitHub OAuth flow...");
-      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({
-        body: {
-          source_url: sourceUrl || (typeof window !== "undefined" ? window.location.href : "")
-        },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (!response.authorization_url) {
-        throw new Error("Failed to get authorization URL");
-      }
-      authLogger.info("Redirecting to GitHub...", response.authorization_url);
-      if (typeof window !== "undefined") {
-        sessionStorage.setItem(OAUTH_STATE_KEY, response.state);
-        sessionStorage.setItem(OAUTH_PROVIDER_KEY, "github");
-      }
-      window.location.href = response.authorization_url;
-    } catch (err) {
-      const errorMessage = formatAuthError(err, "Failed to start GitHub authentication");
-      authLogger.error("GitHub OAuth start error:", err);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-    } finally {
-      setIsLoading(false);
-    }
-  }, [sourceUrl, onError]);
-  const handleGithubCallback = useCallback6(async (code, state) => {
-    setIsLoading(true);
-    setError(null);
-    try {
-      authLogger.info("Processing GitHub OAuth callback...");
-      if (typeof window !== "undefined") {
-        const storedState = sessionStorage.getItem(OAUTH_STATE_KEY);
-        if (storedState && storedState !== state) {
-          throw new Error("Invalid OAuth state - possible CSRF attack");
-        }
-        sessionStorage.removeItem(OAUTH_STATE_KEY);
-        sessionStorage.removeItem(OAUTH_PROVIDER_KEY);
-      }
-      const result = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({
-        body: { code, state },
-        throwOnError: true
-      });
-      const response = result.data;
-      if (response.requires_2fa && response.session_id) {
-        authLogger.info("GitHub OAuth requires 2FA, session:", response.session_id);
-        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
-          category: "auth" /* AUTH */,
-          label: "github-2fa-required"
-        });
-        onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
-        return;
-      }
-      if (!response.access || !response.refresh) {
-        throw new Error("Invalid response from OAuth callback");
-      }
-      authLogger.info("GitHub OAuth successful, user:", response.user);
-      auth.setSession({ access: response.access, refresh: response.refresh });
-      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-      if (response.user?.id) {
-        Analytics.setUser(String(response.user.id));
-      }
-      if (response.user) {
-        onSuccess?.(response.user, response.is_new_user || false);
-      }
-      if (!skipRedirect) {
-        const finalRedirectUrl = redirectUrl || "/private";
-        router.hardPush(finalRedirectUrl);
-      }
-      return;
-    } catch (err) {
-      const errorMessage = formatAuthError(err, "GitHub authentication failed");
-      authLogger.error("GitHub OAuth callback error:", err);
-      setError(errorMessage);
-      onError?.(errorMessage);
-      Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
-        category: "auth" /* AUTH */,
-        label: "github"
-      });
-    } finally {
-      setIsLoading(false);
-    }
-  }, [onSuccess, onError, onRequires2FA, redirectUrl, router, skipRedirect]);
-  return {
-    isLoading,
-    error,
-    startGithubAuth,
-    handleGithubCallback
-  };
-}, "useGithubAuth");
-
-// src/auth/hooks/useTwoFactorVerify.ts
-import { useCallback as useCallback7, useState as useState5 } from "react";
+// src/auth/utils/oauthErrors.ts
+var SERVER_CODES = new Set(Object.values(OAuthErrorCodeEnum));
+var record = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null ? value : null, "record");
+var readOAuthFailure = /* @__PURE__ */ __name((err, fallback) => {
+  const body = record(record(err)?.response);
+  const code = body?.error;
+  if (typeof code === "string" && SERVER_CODES.has(code)) {
+    const description = body?.error_description;
+    return {
+      code,
+      message: typeof description === "string" && description ? description : fallback
+    };
+  }
+  return { message: formatAuthError(err, fallback) };
+}, "readOAuthFailure");
 
 // src/auth/hooks/useSessionStorage.ts
-import { useState as useState4 } from "react";
+import { useState as useState3 } from "react";
 
 // src/auth/utils/storage.ts
 var MAX_ITEM_KB = 1024;
@@ -3269,7 +3219,7 @@ __name(isWithinSizeLimit, "isWithinSizeLimit");
 
 // src/auth/hooks/useSessionStorage.ts
 function useSessionStorage(key, initialValue) {
-  const [storedValue, setStoredValue] = useState4(() => {
+  const [storedValue, setStoredValue] = useState3(() => {
     if (typeof window === "undefined") {
       return initialValue;
     }
@@ -3457,6 +3407,243 @@ var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAuthRedirectManager");
 
+// src/auth/hooks/useOAuthLogin.ts
+var ADAPTERS = {
+  github: {
+    authorize: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({ body, throwOnError: true })).data, "authorize"),
+    callback: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({ body, throwOnError: true })).data, "callback")
+  },
+  google: {
+    authorize: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGoogleAuthorizeCreate({ body, throwOnError: true })).data, "authorize"),
+    callback: /* @__PURE__ */ __name(async (body) => (await CfgAccountsOauth.cfgAccountsOauthGoogleCallbackCreate({ body, throwOnError: true })).data, "callback")
+  }
+};
+var OAUTH_PROVIDER_IDS = Object.keys(ADAPTERS);
+var isOAuthProviderId = /* @__PURE__ */ __name((value) => typeof value === "string" && Object.hasOwn(ADAPTERS, value), "isOAuthProviderId");
+var STATE_KEY = CFG_KEYS.oauthState.key;
+var PROVIDER_KEY = CFG_KEYS.oauthProvider.key;
+var clearOAuthAttempt = /* @__PURE__ */ __name(() => {
+  cfgStorage.remove(STATE_KEY);
+  cfgStorage.remove(PROVIDER_KEY);
+}, "clearOAuthAttempt");
+var useOAuthLogin = /* @__PURE__ */ __name((options = {}) => {
+  const router = useCfgRouter();
+  const optionsRef = useRef5(options);
+  optionsRef.current = options;
+  const routerRef = useRef5(router);
+  routerRef.current = router;
+  const [loadingProvider, setLoadingProvider] = useState4(null);
+  const [error, setError] = useState4(null);
+  const [errorCode, setErrorCode] = useState4(null);
+  useEffect5(() => {
+    const onShow = /* @__PURE__ */ __name((event) => {
+      if (event.persisted) setLoadingProvider(null);
+    }, "onShow");
+    window.addEventListener("pageshow", onShow);
+    return () => window.removeEventListener("pageshow", onShow);
+  }, []);
+  const fail = useCallback6((provider, message, code) => {
+    setError(message);
+    setErrorCode(code ?? null);
+    setLoadingProvider(null);
+    optionsRef.current.onError?.(message, code);
+    Analytics.event("auth_oauth_fail" /* AUTH_OAUTH_FAIL */, {
+      category: "auth" /* AUTH */,
+      label: provider
+    });
+  }, []);
+  const start = useCallback6(async (provider) => {
+    setLoadingProvider(provider);
+    setError(null);
+    setErrorCode(null);
+    auth.clearSession();
+    try {
+      Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+        category: "auth" /* AUTH */,
+        label: provider
+      });
+      const sourceUrl = optionsRef.current.sourceUrl || window.location.href;
+      const response = await ADAPTERS[provider].authorize({ source_url: sourceUrl });
+      if (!response.authorization_url || !response.state) {
+        throw new Error("Failed to get authorization URL");
+      }
+      cfgStorage.write(STATE_KEY, response.state);
+      cfgStorage.write(PROVIDER_KEY, provider);
+      authLogger.info(`Redirecting to ${provider}...`);
+      window.location.href = response.authorization_url;
+    } catch (err) {
+      authLogger.error(`${provider} OAuth start error:`, err);
+      const failure = readOAuthFailure(err, "Failed to start authentication");
+      fail(provider, failure.message, failure.code);
+    }
+  }, [fail]);
+  const complete = useCallback6(async (provider, code, state) => {
+    setLoadingProvider(provider);
+    setError(null);
+    setErrorCode(null);
+    const storedState = cfgStorage.read(STATE_KEY);
+    const storedProvider = cfgStorage.read(PROVIDER_KEY);
+    clearOAuthAttempt();
+    if (!storedState || storedState !== state || storedProvider && storedProvider !== provider) {
+      authLogger.warn(`${provider} OAuth callback rejected: state does not match this browser`);
+      fail(provider, "Invalid sign-in attempt. Please try again.", "invalid_state");
+      return;
+    }
+    try {
+      const response = await ADAPTERS[provider].callback({ code, state });
+      if (response.requires_2fa && response.session_id) {
+        Analytics.event("auth_oauth_start" /* AUTH_OAUTH_START */, {
+          category: "auth" /* AUTH */,
+          label: `${provider}-2fa-required`
+        });
+        optionsRef.current.onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);
+        setLoadingProvider(null);
+        return;
+      }
+      if (!response.access || !response.refresh) {
+        throw new Error("Invalid response from OAuth callback");
+      }
+      auth.setSession({ access: response.access, refresh: response.refresh });
+      Analytics.event("auth_login_success" /* AUTH_LOGIN_SUCCESS */, {
+        category: "auth" /* AUTH */,
+        label: provider
+      });
+      if (response.user?.id) {
+        Analytics.setUser(String(response.user.id));
+      }
+      if (response.user) {
+        optionsRef.current.onSuccess?.(response.user, response.is_new_user || false, provider);
+      }
+      setLoadingProvider(null);
+      if (!optionsRef.current.skipRedirect) {
+        routerRef.current.hardPush(consumeSavedRedirect() || optionsRef.current.redirectUrl || "/private");
+      }
+    } catch (err) {
+      authLogger.error(`${provider} OAuth callback error:`, err);
+      const failure = readOAuthFailure(err, "Authentication failed");
+      fail(provider, failure.message, failure.code);
+    }
+  }, [fail]);
+  return {
+    isLoading: loadingProvider !== null,
+    loadingProvider,
+    error,
+    errorCode,
+    start,
+    complete
+  };
+}, "useOAuthLogin");
+
+// src/auth/hooks/useOAuthProviders.ts
+import { useMemo as useMemo2, useSyncExternalStore as useSyncExternalStore4 } from "react";
+
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
+import useSWR from "swr";
+function useCfgAccountsOauthProvidersRetrieve(args, config) {
+  const { enabled = true, ...swrConfig } = config ?? {};
+  const key = enabled ? ["cfg_accounts_oauth_providers_retrieve", args ?? {}] : null;
+  return useSWR(
+    key,
+    async () => {
+      const res = await CfgAccountsOauth.cfgAccountsOauthProvidersRetrieve({ ...args ?? {}, throwOnError: true });
+      const data = res.data;
+      void import("./OAuthProvidersResponse-QZ566OYR.mjs").then(({ OAuthProvidersResponseSchema }) => {
+        const parsed = OAuthProvidersResponseSchema.safeParse(data);
+        if (parsed.success) return;
+        console.warn(
+          "[zod] response did not match schema",
+          {
+            operation: "cfg_accounts_oauth_providers_retrieve",
+            method: "GET",
+            path: "/cfg/accounts/oauth/providers/",
+            issues: parsed.error.issues,
+            data
+          }
+        );
+        if (typeof window !== "undefined") {
+          try {
+            window.dispatchEvent(
+              new CustomEvent("zod-validation-error", {
+                detail: {
+                  operation: "cfg_accounts_oauth_providers_retrieve",
+                  method: "GET",
+                  path: "/cfg/accounts/oauth/providers/",
+                  issues: parsed.error.issues,
+                  data,
+                  timestamp: /* @__PURE__ */ new Date()
+                },
+                bubbles: true,
+                cancelable: false
+              })
+            );
+          } catch {
+          }
+        }
+      }).catch(() => {
+      });
+      return data;
+    },
+    swrConfig
+  );
+}
+__name(useCfgAccountsOauthProvidersRetrieve, "useCfgAccountsOauthProvidersRetrieve");
+
+// src/auth/hooks/useOAuthProviders.ts
+var EMPTY = [];
+var CACHE_KEY = CFG_KEYS.oauthProviders.key;
+var isInfo = /* @__PURE__ */ __name((value) => typeof value === "object" && value !== null && typeof value.id === "string", "isInfo");
+var lastRaw = null;
+var lastParsed;
+var readCached = /* @__PURE__ */ __name(() => {
+  const raw = cfgStorage.read(CACHE_KEY);
+  if (raw === lastRaw) return lastParsed;
+  lastRaw = raw;
+  try {
+    const parsed = raw === null ? null : JSON.parse(raw);
+    lastParsed = Array.isArray(parsed) && parsed.every(isInfo) ? parsed : void 0;
+  } catch {
+    lastParsed = void 0;
+  }
+  return lastParsed;
+}, "readCached");
+var subscribe3 = /* @__PURE__ */ __name(() => () => {
+}, "subscribe");
+var serverSnapshot = /* @__PURE__ */ __name(() => void 0, "serverSnapshot");
+var useOAuthProviders = /* @__PURE__ */ __name(() => {
+  const cached = useSyncExternalStore4(subscribe3, readCached, serverSnapshot);
+  const { data, error, isLoading } = useCfgAccountsOauthProvidersRetrieve(void 0, {
+    revalidateOnFocus: false,
+    revalidateOnReconnect: false,
+    revalidateOnMount: true,
+    shouldRetryOnError: false,
+    dedupingInterval: 60 * 60 * 1e3,
+    fallbackData: cached && { providers: cached },
+    onSuccess: /* @__PURE__ */ __name((response) => {
+      cfgStorage.writeJSON(CACHE_KEY, response.providers);
+    }, "onSuccess")
+  });
+  const providers = useMemo2(
+    () => data?.providers.filter((p) => OAUTH_PROVIDER_IDS.includes(p.id)) ?? EMPTY,
+    [data]
+  );
+  return { providers, isReady: !isLoading || Boolean(error) || cached !== void 0 };
+}, "useOAuthProviders");
+
+// src/auth/hooks/useGithubAuth.ts
+import { useCallback as useCallback7 } from "react";
+var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
+  const { isLoading, error, start, complete } = useOAuthLogin(options);
+  const startGithubAuth = useCallback7(() => start("github"), [start]);
+  const handleGithubCallback = useCallback7(
+    (code, state) => complete("github", code, state),
+    [complete]
+  );
+  return { isLoading, error, startGithubAuth, handleGithubCallback };
+}, "useGithubAuth");
+
+// src/auth/hooks/useTwoFactorVerify.ts
+import { useCallback as useCallback8, useState as useState5 } from "react";
+
 // src/auth/hooks/twoFactor.shared.ts
 var TOTP_CODE_LENGTH = 6;
 function extractAttemptsRemaining(err) {
@@ -3481,10 +3668,10 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
   const [warning, setWarning] = useState5(null);
   const [remainingBackupCodes, setRemainingBackupCodes] = useState5(null);
   const [attemptsRemaining, setAttemptsRemaining] = useState5(null);
-  const clearError = useCallback7(() => {
+  const clearError = useCallback8(() => {
     setError(null);
   }, []);
-  const handleSuccess = useCallback7((response) => {
+  const handleSuccess = useCallback8((response) => {
     auth.setSession({ access: response.access_token, refresh: response.refresh_token });
     if (response.warning) {
       setWarning(response.warning);
@@ -3506,7 +3693,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       router.hardPush(finalRedirectUrl);
     }
   }, [onSuccess, redirectUrl, router, skipRedirect]);
-  const verifyTOTP = useCallback7(async (sessionId, code) => {
+  const verifyTOTP = useCallback8(async (sessionId, code) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -3549,7 +3736,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [handleSuccess, onError]);
-  const verifyBackupCode = useCallback7(async (sessionId, backupCode) => {
+  const verifyBackupCode = useCallback8(async (sessionId, backupCode) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -3608,7 +3795,7 @@ var useTwoFactorVerify = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorVerify");
 
 // src/auth/hooks/useTwoFactorSetup.ts
-import { useCallback as useCallback8, useState as useState6 } from "react";
+import { useCallback as useCallback9, useState as useState6 } from "react";
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const { onComplete, onError } = options;
   const [isLoading, setIsLoading] = useState6(false);
@@ -3617,17 +3804,17 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const [backupCodes, setBackupCodes] = useState6(null);
   const [backupCodesWarning, setBackupCodesWarning] = useState6(null);
   const [setupStep, setSetupStep] = useState6("idle");
-  const clearError = useCallback8(() => {
+  const clearError = useCallback9(() => {
     setError(null);
   }, []);
-  const resetSetup = useCallback8(() => {
+  const resetSetup = useCallback9(() => {
     setSetupData(null);
     setBackupCodes(null);
     setBackupCodesWarning(null);
     setSetupStep("idle");
     setError(null);
   }, []);
-  const startSetup = useCallback8(async (deviceName) => {
+  const startSetup = useCallback9(async (deviceName) => {
     setIsLoading(true);
     setError(null);
     setSetupStep("scanning");
@@ -3659,7 +3846,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [onError]);
-  const confirmSetup = useCallback8(async (code) => {
+  const confirmSetup = useCallback9(async (code) => {
     if (!setupData) {
       const msg = "Setup not started. Call startSetup() first.";
       setError(msg);
@@ -3715,16 +3902,16 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorSetup");
 
 // src/auth/hooks/useTwoFactorStatus.ts
-import { useCallback as useCallback9, useState as useState7 } from "react";
+import { useCallback as useCallback10, useState as useState7 } from "react";
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
   const [isLoading, setIsLoading] = useState7(false);
   const [error, setError] = useState7(null);
   const [has2FAEnabled, setHas2FAEnabled] = useState7(null);
   const [devices, setDevices] = useState7([]);
-  const clearError = useCallback9(() => {
+  const clearError = useCallback10(() => {
     setError(null);
   }, []);
-  const fetchStatus = useCallback9(async () => {
+  const fetchStatus = useCallback10(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -3749,7 +3936,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setIsLoading(false);
     }
   }, []);
-  const disable2FA = useCallback9(async (code) => {
+  const disable2FA = useCallback10(async (code) => {
     if (!isValidTotpCode(code)) {
       setError("Please enter a 6-digit code");
       return false;
@@ -3986,13 +4173,13 @@ function useBase64() {
 __name(useBase64, "useBase64");
 
 // src/auth/hooks/useProfileCache.ts
-var CACHE_KEY = CFG_KEYS.profileCache.key;
+var CACHE_KEY2 = CFG_KEYS.profileCache.key;
 var CACHE_VERSION = 1;
 var DEFAULT_TTL = 144e5;
 function getCachedProfile() {
   try {
     if (typeof window === "undefined") return null;
-    const cached = localStorage.getItem(CACHE_KEY);
+    const cached = localStorage.getItem(CACHE_KEY2);
     if (!cached) {
       authLogger.debug("No cached profile found");
       return null;
@@ -4030,7 +4217,7 @@ function setCachedProfile(profile, options) {
       ttl: options?.ttl || DEFAULT_TTL
     };
     const encoded = encodeBase64(JSON.stringify(cachedData));
-    localStorage.setItem(CACHE_KEY, encoded);
+    localStorage.setItem(CACHE_KEY2, encoded);
     authLogger.debug("Profile cached, TTL:", cachedData.ttl / 1e3, "seconds");
   } catch (error) {
     authLogger.error("Error writing cache:", error);
@@ -4040,7 +4227,7 @@ __name(setCachedProfile, "setCachedProfile");
 function clearProfileCache() {
   try {
     if (typeof window === "undefined") return;
-    localStorage.removeItem(CACHE_KEY);
+    localStorage.removeItem(CACHE_KEY2);
     authLogger.debug("Cache cleared");
   } catch (error) {
     authLogger.error("Error clearing cache:", error);
@@ -4054,7 +4241,7 @@ __name(hasValidCache, "hasValidCache");
 function getCacheMetadata() {
   try {
     if (typeof window === "undefined") return null;
-    const cached = localStorage.getItem(CACHE_KEY);
+    const cached = localStorage.getItem(CACHE_KEY2);
     if (!cached) return { exists: false };
     const decoded = decodeBase64(cached);
     const cachedData = JSON.parse(decoded);
@@ -4075,15 +4262,15 @@ function getCacheMetadata() {
 __name(getCacheMetadata, "getCacheMetadata");
 
 // src/auth/hooks/useDeleteAccount.ts
-import { useCallback as useCallback10, useState as useState9 } from "react";
+import { useCallback as useCallback11, useState as useState9 } from "react";
 var useDeleteAccount = /* @__PURE__ */ __name(() => {
   const [isLoading, setIsLoading] = useState9(false);
   const [error, setError] = useState9(null);
   const { logout } = useAuth();
-  const clearError = useCallback10(() => {
+  const clearError = useCallback11(() => {
     setError(null);
   }, []);
-  const deleteAccount = useCallback10(async () => {
+  const deleteAccount = useCallback11(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -4115,11 +4302,11 @@ var useDeleteAccount = /* @__PURE__ */ __name(() => {
 // src/auth/context/AccountsContext.tsx
 import {
   createContext,
-  useCallback as useCallback11,
+  useCallback as useCallback12,
   useContext,
-  useEffect as useEffect5,
-  useMemo as useMemo2,
-  useRef as useRef5,
+  useEffect as useEffect6,
+  useMemo as useMemo3,
+  useRef as useRef6,
   useState as useState10
 } from "react";
 
@@ -4127,7 +4314,7 @@ import {
 import useSWRMutation from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve.ts
-import useSWR from "swr";
+import useSWR2 from "swr";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRevealCreate.ts
 import useSWRMutation2 from "swr/mutation";
@@ -4136,7 +4323,7 @@ import useSWRMutation2 from "swr/mutation";
 import useSWRMutation3 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthConnectionsList.ts
-import useSWR2 from "swr";
+import useSWR3 from "swr";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthDisconnectCreate.ts
 import useSWRMutation4 from "swr/mutation";
@@ -4147,16 +4334,19 @@ import useSWRMutation5 from "swr/mutation";
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubCallbackCreate.ts
 import useSWRMutation6 from "swr/mutation";
 
-// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts
-import useSWR3 from "swr";
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleAuthorizeCreate.ts
+import useSWRMutation7 from "swr/mutation";
+
+// src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleCallbackCreate.ts
+import useSWRMutation8 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpConsentPolicyRetrieve.ts
 import useSWR4 from "swr";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts
-import useSWRMutation7 from "swr/mutation";
+import useSWRMutation9 from "swr/mutation";
 function useCfgAccountsOtpRequestCreate(config) {
-  return useSWRMutation7(
+  return useSWRMutation9(
     ["cfg_accounts_otp_request_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true });
@@ -4203,9 +4393,9 @@ function useCfgAccountsOtpRequestCreate(config) {
 __name(useCfgAccountsOtpRequestCreate, "useCfgAccountsOtpRequestCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts
-import useSWRMutation8 from "swr/mutation";
+import useSWRMutation10 from "swr/mutation";
 function useCfgAccountsOtpVerifyCreate(config) {
-  return useSWRMutation8(
+  return useSWRMutation10(
     ["cfg_accounts_otp_verify_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsOtp.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true });
@@ -4252,9 +4442,9 @@ function useCfgAccountsOtpVerifyCreate(config) {
 __name(useCfgAccountsOtpVerifyCreate, "useCfgAccountsOtpVerifyCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileAvatarCreate.ts
-import useSWRMutation9 from "swr/mutation";
+import useSWRMutation11 from "swr/mutation";
 function useCfgAccountsProfileAvatarCreate(config) {
-  return useSWRMutation9(
+  return useSWRMutation11(
     ["cfg_accounts_profile_avatar_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsProfile.cfgAccountsProfileAvatarCreate({ ...arg, throwOnError: true });
@@ -4301,15 +4491,15 @@ function useCfgAccountsProfileAvatarCreate(config) {
 __name(useCfgAccountsProfileAvatarCreate, "useCfgAccountsProfileAvatarCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileDeleteCreate.ts
-import useSWRMutation10 from "swr/mutation";
+import useSWRMutation12 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts
-import useSWRMutation11 from "swr/mutation";
+import useSWRMutation13 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialUpdate.ts
-import useSWRMutation12 from "swr/mutation";
+import useSWRMutation14 from "swr/mutation";
 function useCfgAccountsProfilePartialUpdate(config) {
-  return useSWRMutation12(
+  return useSWRMutation14(
     ["cfg_accounts_profile_partial_update"],
     async (_key, { arg }) => {
       const res = await CfgAccountsProfile.cfgAccountsProfilePartialUpdate({ ...arg, throwOnError: true });
@@ -4359,12 +4549,12 @@ __name(useCfgAccountsProfilePartialUpdate, "useCfgAccountsProfilePartialUpdate")
 import useSWR5 from "swr";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdatePartialUpdate.ts
-import useSWRMutation13 from "swr/mutation";
+import useSWRMutation15 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdateUpdate.ts
-import useSWRMutation14 from "swr/mutation";
+import useSWRMutation16 from "swr/mutation";
 function useCfgAccountsProfileUpdateUpdate(config) {
-  return useSWRMutation14(
+  return useSWRMutation16(
     ["cfg_accounts_profile_update_update"],
     async (_key, { arg }) => {
       const res = await CfgAccountsProfile.cfgAccountsProfileUpdateUpdate({ ...arg, throwOnError: true });
@@ -4411,12 +4601,12 @@ function useCfgAccountsProfileUpdateUpdate(config) {
 __name(useCfgAccountsProfileUpdateUpdate, "useCfgAccountsProfileUpdateUpdate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts
-import useSWRMutation15 from "swr/mutation";
+import useSWRMutation17 from "swr/mutation";
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts
-import useSWRMutation16 from "swr/mutation";
+import useSWRMutation18 from "swr/mutation";
 function useCfgAccountsTokenCreate(config) {
-  return useSWRMutation16(
+  return useSWRMutation18(
     ["cfg_accounts_token_create"],
     async (_key, { arg }) => {
       const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true });
@@ -4463,7 +4653,7 @@ function useCfgAccountsTokenCreate(config) {
 __name(useCfgAccountsTokenCreate, "useCfgAccountsTokenCreate");
 
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
-import useSWRMutation17 from "swr/mutation";
+import useSWRMutation19 from "swr/mutation";
 
 // src/auth/context/AccountsContext.tsx
 import { jsx } from "react/jsx-runtime";
@@ -4486,13 +4676,13 @@ function AccountsProvider({ children }) {
   });
   const [isLoadingProfile, setIsLoadingProfile] = useState10(false);
   const [profileError, setProfileError] = useState10(null);
-  const profileRef = useRef5(profile);
-  const isLoadingRef = useRef5(false);
-  const fetchSeqRef = useRef5(0);
-  useEffect5(() => {
+  const profileRef = useRef6(profile);
+  const isLoadingRef = useRef6(false);
+  const fetchSeqRef = useRef6(0);
+  useEffect6(() => {
     profileRef.current = profile;
   }, [profile]);
-  useEffect5(() => {
+  useEffect6(() => {
     isLoadingRef.current = isLoadingProfile;
   }, [isLoadingProfile]);
   const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();
@@ -4501,7 +4691,7 @@ function AccountsProvider({ children }) {
   const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();
   const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();
   const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();
-  const refreshProfile = useCallback11(async (options) => {
+  const refreshProfile = useCallback12(async (options) => {
     const { callerId, force } = options || {};
     if (!hasApiOrigin()) {
       authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);
@@ -4535,26 +4725,26 @@ function AccountsProvider({ children }) {
       }
     }
   }, []);
-  const updateProfile = useCallback11(async (data) => {
+  const updateProfile = useCallback12(async (data) => {
     await triggerProfileUpdate({ body: data });
     const user = await refreshProfile({ callerId: "updateProfile", force: true });
     return user;
   }, [triggerProfileUpdate, refreshProfile]);
-  const partialUpdateProfile = useCallback11(async (data) => {
+  const partialUpdateProfile = useCallback12(async (data) => {
     await triggerProfilePartialUpdate({ body: data });
     const user = await refreshProfile({ callerId: "partialUpdateProfile", force: true });
     return user;
   }, [triggerProfilePartialUpdate, refreshProfile]);
-  const uploadAvatar = useCallback11(async (avatar) => {
+  const uploadAvatar = useCallback12(async (avatar) => {
     await triggerAvatar({ body: { avatar } });
     const user = await refreshProfile({ callerId: "uploadAvatar", force: true });
     return user;
   }, [triggerAvatar, refreshProfile]);
-  const requestOTP = useCallback11(async (data) => {
+  const requestOTP = useCallback12(async (data) => {
     const result = await triggerOtpRequest({ body: data });
     return result;
   }, [triggerOtpRequest]);
-  const settleLoginEnvelope = useCallback11(async (result, callerId) => {
+  const settleLoginEnvelope = useCallback12(async (result, callerId) => {
     if (result.requires_2fa && result.session_id) {
       authLogger.info("2FA required, session:", result.session_id);
       return;
@@ -4568,17 +4758,17 @@ function AccountsProvider({ children }) {
       }
     }
   }, [refreshProfile]);
-  const verifyOTP = useCallback11(async (data) => {
+  const verifyOTP = useCallback12(async (data) => {
     const result = await triggerOtpVerify({ body: data });
     await settleLoginEnvelope(result, "verifyOTP");
     return result;
   }, [triggerOtpVerify, settleLoginEnvelope]);
-  const loginWithPassword = useCallback11(async (data) => {
+  const loginWithPassword = useCallback12(async (data) => {
     const result = await triggerPasswordLogin({ body: data });
     await settleLoginEnvelope(result, "loginWithPassword");
     return result;
   }, [triggerPasswordLogin, settleLoginEnvelope]);
-  const logout = useCallback11(() => {
+  const logout = useCallback12(() => {
     const refresh = auth.getRefreshToken();
     if (refresh) {
       CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
@@ -4590,7 +4780,7 @@ function AccountsProvider({ children }) {
     setProfileError(null);
     clearProfileCache();
   }, []);
-  const value = useMemo2(() => ({
+  const value = useMemo3(() => ({
     profile,
     isLoadingProfile,
     profileError,
@@ -4652,28 +4842,28 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     EMAIL_STORAGE_KEY,
     null
   );
-  const routes = useMemo3(() => resolveAuthRoutes(config?.routes), [config?.routes]);
-  const routesRef = useRef6(routes);
-  useEffect6(() => {
+  const routes = useMemo4(() => resolveAuthRoutes(config?.routes), [config?.routes]);
+  const routesRef = useRef7(routes);
+  useEffect7(() => {
     routesRef.current = routes;
   }, [routes]);
   const redirectManager = useAuthRedirectManager({
     fallbackUrl: routes.defaultCallback,
     clearOnUse: true
   });
-  const configRef = useRef6(config);
-  useEffect6(() => {
+  const configRef = useRef7(config);
+  useEffect7(() => {
     configRef.current = config;
   }, [config]);
-  const accountsRef = useRef6(accounts);
-  useEffect6(() => {
+  const accountsRef = useRef7(accounts);
+  useEffect7(() => {
     accountsRef.current = accounts;
   }, [accounts]);
-  const pendingManualNavRef = useRef6(false);
+  const pendingManualNavRef = useRef7(false);
   const [profileSettled, setProfileSettled] = useState11(false);
   const hasProfile = Boolean(accounts.profile);
-  const profileAttemptedRef = useRef6(false);
-  useEffect6(() => {
+  const profileAttemptedRef = useRef7(false);
+  useEffect7(() => {
     if (!isAuthenticated) {
       profileAttemptedRef.current = false;
       const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());
@@ -4701,8 +4891,8 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     };
   }, [isAuthenticated, hasProfile]);
   const isLoading = !profileSettled;
-  const expiredHandledRef = useRef6(false);
-  useEffect6(() => {
+  const expiredHandledRef = useRef7(false);
+  useEffect7(() => {
     const unsubscribe = auth.onSessionExpired(() => {
       if (expiredHandledRef.current) return;
       expiredHandledRef.current = true;
@@ -4715,7 +4905,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return unsubscribe;
   }, [router]);
-  useEffect6(() => {
+  useEffect7(() => {
     if (!isAuthenticated || pendingManualNavRef.current) return;
     if (pathname === routes.auth && !queryParams.get("flow")) {
       const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;
@@ -4723,7 +4913,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(saved || routes.defaultCallback);
     }
   }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);
-  const loadCurrentProfile = useCallback12(async (callerId) => {
+  const loadCurrentProfile = useCallback13(async (callerId) => {
     if (!auth.isAuthenticated()) {
       throw new Error("No valid authentication token");
     }
@@ -4731,7 +4921,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       callerId: callerId || "AuthContext.loadCurrentProfile"
     });
   }, []);
-  const checkAuthAndRedirect = useCallback12(async () => {
+  const checkAuthAndRedirect = useCallback13(async () => {
     if (auth.isAuthenticated()) {
       try {
         await loadCurrentProfile("checkAuthAndRedirect");
@@ -4743,7 +4933,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(routesRef.current.defaultAuthCallback);
     }
   }, [loadCurrentProfile, router]);
-  const requestOTP = useCallback12(
+  const requestOTP = useCallback13(
     async (identifier, sourceUrl, consent) => {
       auth.clearSession();
       try {
@@ -4785,7 +4975,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     []
   );
-  const verifyOTP = useCallback12(
+  const verifyOTP = useCallback13(
     async (identifier, otpCode, sourceUrl, redirectUrl, skipRedirect) => {
       try {
         pendingManualNavRef.current = Boolean(skipRedirect);
@@ -4845,7 +5035,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const login = useCallback12(
+  const login = useCallback13(
     async (email, password, options) => {
       const { redirectUrl, skipRedirect } = options || {};
       try {
@@ -4910,7 +5100,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, redirectManager, router]
   );
-  const refreshToken = useCallback12(async () => {
+  const refreshToken = useCallback13(async () => {
     const access = await auth.refreshNow();
     if (access) {
       Analytics.event("auth_token_refresh" /* AUTH_TOKEN_REFRESH */, {
@@ -4923,7 +5113,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     });
     return { success: false, message: "Error refreshing token" };
   }, []);
-  const logout = useCallback12(() => {
+  const logout = useCallback13(() => {
     Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
       category: "auth" /* AUTH */
     });
@@ -4932,21 +5122,21 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   }, [router]);
   const user = accounts.profile ?? null;
   const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);
-  useEffect6(() => {
+  useEffect7(() => {
     applyRoleLogPolicy({ isAdmin: isAdminUser });
   }, [isAdminUser]);
-  const updateProfile = useCallback12(
+  const updateProfile = useCallback13(
     async (data) => {
       const result = await accountsRef.current.partialUpdateProfile(data);
       return result;
     },
     []
   );
-  const uploadAvatar = useCallback12(async (avatar) => {
+  const uploadAvatar = useCallback13(async (avatar) => {
     const result = await accountsRef.current.uploadAvatar(avatar);
     return result;
   }, []);
-  const value = useMemo3(
+  const value = useMemo4(
     () => ({
       user,
       isLoading,
@@ -5106,8 +5296,10 @@ export {
   AnalyticsEvent,
   AuthContext_default as AuthContext,
   AuthProvider,
+  OAUTH_PROVIDER_IDS,
   authLogger,
   beginTwoFactorChallenge,
+  clearOAuthAttempt,
   clearProfileCache,
   consumeSavedRedirect,
   decodeBase64,
@@ -5119,10 +5311,12 @@ export {
   hasValidCache,
   isAllowedAuthPath,
   isForbidden,
+  isOAuthProviderId,
   logAuthFailure,
   logger,
   normalizePath,
   peekSavedRedirect,
+  readOAuthFailure,
   resolveAuthError,
   resolveGuardIsAuthenticated,
   resolveGuardIsLoading,
@@ -5141,6 +5335,8 @@ export {
   useDeleteAccount,
   useGithubAuth,
   useLocalStorage,
+  useOAuthLogin,
+  useOAuthProviders,
   useQueryParams,
   useSession,
   useSessionStorage,