@djangocfg/api 2.1.604 → 2.1.605

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.604",
+  "version": "2.1.605",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -91,7 +91,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.604",
+    "@djangocfg/typescript-config": "^2.1.605",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",

package/src/auth/__tests__/legacyStorage.test.ts

@@ -0,0 +1,21 @@
+// @vitest-environment jsdom
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import { purgeLegacyTokenStorage } from '../hooks/legacyStorage';
+
+describe('purgeLegacyTokenStorage', () => {
+  beforeEach(() => localStorage.clear());
+
+  it('removes the pre-cookie token entries and keeps everything else', () => {
+    localStorage.setItem('cfg.auth.access_token', 'a');
+    localStorage.setItem('cfg.auth.refresh_token', 'r');
+    localStorage.setItem('cfg.ui.sidebar_width', '240');
+    expect(purgeLegacyTokenStorage().sort()).toEqual(['cfg.auth.access_token', 'cfg.auth.refresh_token']);
+    expect(localStorage.getItem('cfg.ui.sidebar_width')).toBe('240');
+    expect(localStorage.getItem('cfg.auth.access_token')).toBeNull();
+  });
+
+  it('does nothing when there is nothing to remove', () => {
+    expect(purgeLegacyTokenStorage()).toEqual([]);
+  });
+});

package/src/auth/context/AccountsContext.tsx

@@ -91,6 +91,12 @@ interface AccountsProviderProps {
 
 export function AccountsProvider({ children }: AccountsProviderProps) {
   const [profile, setProfile] = useState<User | undefined>(() => {
+    // A cached profile is only a head start for a live session; with no session (tokens gone after the move to cookies,
+    // or signed out elsewhere) it would render the private UI with nothing behind it.
+    if (!auth.isAuthenticated()) {
+      clearProfileCache();
+      return undefined;
+    }
     const cached = getCachedProfile() as User | null;
     return cached || undefined;
   });

package/src/auth/context/AuthContext.tsx

@@ -34,6 +34,7 @@ import { CFG_KEYS } from '../../_api/generated/helpers/keys';
 import { applyRoleLogPolicy } from '../../log-control';
 import { useCfgRouter, useLocalStorage, useQueryParams, useSession } from '../hooks';
 import { clearProfileCache } from '../hooks/useProfileCache';
+import { purgeLegacyTokenStorage } from '../hooks/legacyStorage';
 import { useAuthRedirectManager } from '../hooks/useAuthRedirect';
 import { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';
 import { formatAuthError, logAuthFailure } from '../utils/errors';
@@ -144,6 +145,12 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
         authLogger.warn('Dead session in storage — clearing');
         auth.clearSession();
         clearProfileCache();
+      } else if (!hasTokens && !auth.isAuthenticated()) {
+        // No session at all: a leftover profile cache and the old localStorage tokens (pre-cookie auth) must not keep
+        // the private UI alive. Drop them; the page's own guard then sends the user to /auth.
+        clearProfileCache();
+        purgeLegacyTokenStorage();
+        if (accountsRef.current.profile) accountsRef.current.logout();
       }
       setProfileSettled(true);
       return;

package/src/auth/hooks/legacyStorage.ts

@@ -0,0 +1,32 @@
+/**
+ * One-time cleanup of what the pre-cookie auth left in the browser.
+ *
+ * Before 2.1.604 the session tokens lived in `localStorage`. They are cookies now (shared across subdomains), so the old
+ * entries are never read again; left alone they are harmless but misleading, and the 4 h profile cache next to them used
+ * to keep the UI looking signed in without any token (empty private pages). Cookies are untouched.
+ */
+
+const LEGACY_TOKEN_KEYS = [
+  'cfg.auth.access_token',
+  'cfg.auth.refresh_token',
+  'auth_token',
+  'refresh_token',
+  'access_token',
+] as const;
+
+/** Removes the old `localStorage` token entries. Safe on the server and with blocked storage. */
+export function purgeLegacyTokenStorage(): string[] {
+  const removed: string[] = [];
+  try {
+    if (typeof window === 'undefined') return removed;
+    for (const key of LEGACY_TOKEN_KEYS) {
+      if (window.localStorage.getItem(key) !== null) {
+        window.localStorage.removeItem(key);
+        removed.push(key);
+      }
+    }
+  } catch {
+    /* storage blocked: nothing to purge */
+  }
+  return removed;
+}