@djangocfg/api 2.1.618 → 2.1.619

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.618",
+  "version": "2.1.619",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -91,7 +91,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.618",
+    "@djangocfg/typescript-config": "^2.1.619",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^25.9.5",
     "@types/react": "19.3.0",

package/src/_api/generated/helpers/auth.ts

@@ -849,6 +849,12 @@ export function installAuthOnClient(client: HeyClient): void {
   client.interceptors.response.use(async (response, request) => {
     if (response.status !== 401) return response;
 
+    // A refusal from the sign-in endpoints themselves (wrong OTP / password, bad OAuth code) is a credential error, not
+    // a dead session: expiring here reloads the sign-in page and wipes the error the user is reading.
+    if (/\/accounts\/(otp|oauth|login|register|token)\b/.test(request.url)) {
+      return response;
+    }
+
     // Already retried once — give up to avoid loops.
     if (request.headers.get(RETRY_MARKER)) {
       expireSession(response);

package/src/auth/__tests__/signInRefusal.test.ts

@@ -0,0 +1,52 @@
+/**
+ * A 401 from a sign-in endpoint (wrong OTP / password, bad OAuth code) is not a dead session:
+ * it must not fire `onSessionExpired`, which hard-reloads the sign-in page and wipes the error the user is reading.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+function installBrowserStorage() {
+  const map = new Map<string, string>();
+  const storage = {
+    getItem: (k: string) => (map.has(k) ? map.get(k)! : null),
+    setItem: (k: string, v: string) => void map.set(k, v),
+    removeItem: (k: string) => void map.delete(k),
+    clear: () => map.clear(),
+  };
+  vi.stubGlobal('window', { localStorage: storage, location: { protocol: 'http:' } });
+  vi.stubGlobal('localStorage', storage);
+}
+
+async function setup() {
+  installBrowserStorage();
+  const { auth, installAuthOnClient } = await import('../../_api/generated/helpers/auth');
+  const handlers: Array<(res: Response, req: Request) => Promise<Response>> = [];
+  const noop = { use: () => 0 };
+  installAuthOnClient({
+    setConfig: () => undefined,
+    interceptors: { request: noop, error: noop, response: { use: (fn: never) => handlers.push(fn) } },
+  } as never);
+  const expired = vi.fn();
+  auth.onSessionExpired(expired);
+  return { handler: handlers[handlers.length - 1]!, expired };
+}
+
+describe('401 that is not a session expiry', () => {
+  beforeEach(() => {
+    vi.unstubAllGlobals();
+    vi.resetModules();
+  });
+
+  it('wrong OTP: no session-expired event', async () => {
+    const { handler, expired } = await setup();
+    const req = new Request('https://api.example.com/cfg/accounts/otp/verify/', { method: 'POST', headers: { Authorization: 'Bearer stale' } });
+    await handler(new Response('{}', { status: 401 }), req);
+    expect(expired).not.toHaveBeenCalled();
+  });
+
+  it('signed-in request that cannot be refreshed still expires the session', async () => {
+    const { handler, expired } = await setup();
+    const req = new Request('https://api.example.com/apix/crm/me/');
+    await handler(new Response('{}', { status: 401 }), req);
+    expect(expired).toHaveBeenCalledTimes(1);
+  });
+});

package/src/auth/context/AuthContext.tsx

@@ -152,6 +152,10 @@ const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config })
         purgeLegacyTokenStorage();
         if (accountsRef.current.profile) accountsRef.current.logout();
       }
+      // The hydration commit serves the SERVER snapshot ('anonymous') even when the store holds a live session. Settling
+      // now would let the page guard read "loaded and signed out" and bounce to /auth; the snapshot flips on the next
+      // render and this effect runs again with the real value.
+      if (auth.isAuthenticated()) return;
       setProfileSettled(true);
       return;
     }