@djangocfg/api 2.1.619 → 2.1.622

package/dist/index.mjs

@@ -1,6 +1,193 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
+// src/auth/trace.ts
+var KEY = "cfg.auth.trace";
+var MAX = 200;
+var MAX_STRING = 120;
+var SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;
+var TAB = (() => {
+  const g = globalThis;
+  return g.__cfgAuthTab ??= Math.random().toString(36).slice(2, 6);
+})();
+var hasWindow = typeof window !== "undefined";
+var memory = [];
+var loaded = false;
+function backend() {
+  if (!hasWindow) return null;
+  for (const name of ["localStorage", "sessionStorage"]) {
+    try {
+      const s = window[name];
+      s.setItem("__cfg_probe", "1");
+      s.removeItem("__cfg_probe");
+      return s;
+    } catch {
+    }
+  }
+  return null;
+}
+__name(backend, "backend");
+function load() {
+  if (loaded) return memory;
+  loaded = true;
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed = raw ? JSON.parse(raw) : [];
+    if (Array.isArray(parsed)) memory = parsed.filter((e) => typeof e === "object" && e !== null);
+  } catch {
+    memory = [];
+  }
+  return memory;
+}
+__name(load, "load");
+function persist() {
+  try {
+    backend()?.setItem(KEY, JSON.stringify(memory));
+  } catch {
+  }
+}
+__name(persist, "persist");
+function clean(fields) {
+  if (!fields) return void 0;
+  const out = {};
+  for (const [k2, v] of Object.entries(fields)) {
+    if (SENSITIVE.test(k2)) continue;
+    if (typeof v === "string") out[k2] = v.length > MAX_STRING ? `${v.slice(0, MAX_STRING)}\u2026` : v;
+    else if (typeof v === "number" || typeof v === "boolean" || v === null) out[k2] = v;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+__name(clean, "clean");
+function refresh() {
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed = raw ? JSON.parse(raw) : null;
+    if (Array.isArray(parsed)) memory = parsed.filter((e) => typeof e === "object" && e !== null);
+  } catch {
+  }
+}
+__name(refresh, "refresh");
+function record(at, ev, fields) {
+  load();
+  refresh();
+  const entries = memory;
+  const p = hasWindow && typeof performance !== "undefined" ? Math.round(performance.now()) : 0;
+  const f2 = clean(fields);
+  const last = entries[entries.length - 1];
+  if (last && last.tab === TAB && last.ev === ev && JSON.stringify(last.f) === JSON.stringify(f2)) {
+    last.n = (last.n ?? 1) + 1;
+    last.t = at;
+    last.p = p;
+    persist();
+    return;
+  }
+  entries.push({ t: at, p, tab: TAB, ev, f: f2 });
+  if (entries.length > MAX) entries.splice(0, entries.length - MAX);
+  persist();
+}
+__name(record, "record");
+function authTrace(ev, fields) {
+  if (!hasWindow) return;
+  try {
+    record(Date.now(), ev, fields);
+  } catch {
+  }
+}
+__name(authTrace, "authTrace");
+function readAuthTrace() {
+  return load().slice();
+}
+__name(readAuthTrace, "readAuthTrace");
+function clearAuthTrace() {
+  memory = [];
+  loaded = true;
+  try {
+    backend()?.removeItem(KEY);
+  } catch {
+  }
+}
+__name(clearAuthTrace, "clearAuthTrace");
+function context() {
+  if (!hasWindow) return [];
+  const copies = globalThis.__cfgAuthCopies ?? 1;
+  const lines = [`url: ${window.location.href.split("?")[0]}`, `copies: ${String(copies)}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
+  try {
+    const auth2 = globalThis.__cfgAuthNow;
+    const now = auth2?.();
+    if (now) lines.push(`now: ${Object.entries(now).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}`);
+  } catch {
+  }
+  return lines;
+}
+__name(context, "context");
+function dumpAuthTrace() {
+  const entries = load();
+  const first = entries[0]?.t ?? Date.now();
+  const rows = entries.map((e) => {
+    const fields = e.f ? ` ${Object.entries(e.f).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}` : "";
+    const at = new Date(e.t).toISOString().slice(11, 23);
+    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}${e.n && e.n > 1 ? ` x${e.n}` : ""}`;
+  });
+  return [`# cfg auth trace, ${entries.length} events`, ...context(), "", ...rows].join("\n");
+}
+__name(dumpAuthTrace, "dumpAuthTrace");
+function installAuthTrace() {
+  if (!hasWindow) return;
+  const g = globalThis;
+  g.__cfgAuthTrace = authTrace;
+  g.__cfgAuth = {
+    trace: readAuthTrace,
+    dump: /* @__PURE__ */ __name(() => {
+      const text = dumpAuthTrace();
+      console.log(text);
+      return text;
+    }, "dump"),
+    clear: clearAuthTrace,
+    /** Put the dump on the clipboard (works when the console output is blocked or too long to select). */
+    copy: /* @__PURE__ */ __name(() => {
+      const text = dumpAuthTrace();
+      void navigator.clipboard?.writeText(text);
+      return `${text.split("\n").length} lines copied`;
+    }, "copy"),
+    /** Download the raw trace as a JSON file. */
+    download: /* @__PURE__ */ __name(() => {
+      const blob = new Blob([JSON.stringify(readAuthTrace(), null, 1)], { type: "application/json" });
+      const a = document.createElement("a");
+      a.href = URL.createObjectURL(blob);
+      a.download = `auth-trace-${Date.now()}.json`;
+      a.click();
+    }, "download")
+  };
+  const queued = g.__cfgAuthTraceQ;
+  if (Array.isArray(queued)) {
+    g.__cfgAuthTraceQ = [];
+    for (const item of queued) {
+      if (Array.isArray(item) && typeof item[1] === "string") {
+        try {
+          record(Number(item[0]) || Date.now(), item[1], item[2]);
+        } catch {
+        }
+      }
+    }
+  }
+}
+__name(installAuthTrace, "installAuthTrace");
+function registerCopy() {
+  if (!hasWindow) return;
+  const g = globalThis;
+  const n = (g.__cfgAuthCopies ?? 0) + 1;
+  g.__cfgAuthCopies = n;
+  if (n > 1) {
+    authTrace("dup.copy", { copies: n });
+    if (n === 2) {
+      console.warn("[@djangocfg/api] more than one copy of the auth package is loaded; see __cfgAuth.dump() (dup.copy). Align the peer set so pnpm installs one instance.");
+    }
+  }
+}
+__name(registerCopy, "registerCopy");
+registerCopy();
+installAuthTrace();
+
 // src/_api/generated/helpers/errors.ts
 var APIError = class extends Error {
   constructor(statusCode, statusText, response, url, message) {
@@ -117,10 +304,10 @@ function normalizeSegment(raw) {
   return raw.trim().toLowerCase().replace(/[^a-z0-9_]+/g, "_").replace(/^_+|_+$/g, "");
 }
 __name(normalizeSegment, "normalizeSegment");
-var hasWindow = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
+var hasWindow2 = /* @__PURE__ */ __name(() => typeof window !== "undefined", "hasWindow");
 var domainByHost = /* @__PURE__ */ new Map();
 function detectCookieDomain() {
-  if (!hasWindow() || typeof document === "undefined") return null;
+  if (!hasWindow2() || typeof document === "undefined") return null;
   const host = window.location.hostname.toLowerCase();
   if (!host || !host.includes(".") || host.includes(":") || /^[0-9.]+$/.test(host)) return null;
   const cached = domainByHost.get(host);
@@ -144,7 +331,7 @@ function detectCookieDomain() {
 }
 __name(detectCookieDomain, "detectCookieDomain");
 function nativeStorage(store) {
-  if (!hasWindow()) return null;
+  if (!hasWindow2()) return null;
   try {
     return store === "session" ? window.sessionStorage : window.localStorage;
   } catch {
@@ -153,7 +340,7 @@ function nativeStorage(store) {
 }
 __name(nativeStorage, "nativeStorage");
 function cookieNames() {
-  if (!hasWindow()) return [];
+  if (!hasWindow2()) return [];
   try {
     return document.cookie.split("; ").map((part) => decodeURIComponent(part.split("=")[0] ?? "")).filter(Boolean);
   } catch {
@@ -178,7 +365,7 @@ function createStorage(owner, options = {}) {
   const families = Object.values(options.families ?? {});
   const specByKey = /* @__PURE__ */ new Map();
   for (const spec of specs) specByKey.set(spec.key, [...specByKey.get(spec.key) ?? [], spec]);
-  const memory = {
+  const memory2 = {
     local: /* @__PURE__ */ new Map(),
     session: /* @__PURE__ */ new Map(),
     cookie: /* @__PURE__ */ new Map()
@@ -192,7 +379,7 @@ function createStorage(owner, options = {}) {
     if (!key.startsWith(prefix)) throw new TypeError(`storage key "${key}" is not owned by "${owner}"`);
   }, "assertOwned");
   function rawGet(store, key) {
-    if (!hasWindow()) return null;
+    if (!hasWindow2()) return null;
     if (store === "cookie") {
       try {
         const escaped = encodeURIComponent(key).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -200,18 +387,18 @@ function createStorage(owner, options = {}) {
         if (match?.[1] !== void 0) return decodeURIComponent(match[1]);
       } catch {
       }
-      return memory.cookie.get(key) ?? null;
+      return memory2.cookie.get(key) ?? null;
     }
     try {
       const value = nativeStorage(store)?.getItem(key) ?? null;
       if (value !== null) return value;
     } catch {
     }
-    return memory[store].get(key) ?? null;
+    return memory2[store].get(key) ?? null;
   }
   __name(rawGet, "rawGet");
   function rawSet(store, key, value, maxAgeSeconds) {
-    if (!hasWindow()) return false;
+    if (!hasWindow2()) return false;
     try {
       if (store === "cookie") {
         const secure = window.location.protocol === "https:" ? "; Secure" : "";
@@ -219,24 +406,24 @@ function createStorage(owner, options = {}) {
         const domainPart = domain ? `; Domain=${domain}` : "";
         document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;
         if (domain) expireCookie(key, null);
-        if (rawGet("cookie", key) === value && !memory.cookie.has(key)) return true;
-        memory.cookie.set(key, value);
+        if (rawGet("cookie", key) === value && !memory2.cookie.has(key)) return true;
+        memory2.cookie.set(key, value);
         return false;
       }
       const native = nativeStorage(store);
       if (!native) throw new Error("storage unavailable");
       native.setItem(key, value);
-      memory[store].delete(key);
+      memory2[store].delete(key);
       return true;
     } catch {
-      memory[store].set(key, value);
+      memory2[store].set(key, value);
       return false;
     }
   }
   __name(rawSet, "rawSet");
   function rawRemove(store, key) {
-    memory[store].delete(key);
-    if (!hasWindow()) return;
+    memory2[store].delete(key);
+    if (!hasWindow2()) return;
     try {
       if (store === "cookie") {
         expireCookie(key, null);
@@ -265,7 +452,7 @@ function createStorage(owner, options = {}) {
       }
     } catch {
     }
-    for (const name of memory[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);
+    for (const name of memory2[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);
     return out;
   }
   __name(listKeys, "listKeys");
@@ -337,7 +524,7 @@ function createStorage(owner, options = {}) {
     cookieDomain: resolveCookieDomain,
     onChange(key, listener, store = "local") {
       assertValid(key);
-      if (!hasWindow()) return () => {
+      if (!hasWindow2()) return () => {
       };
       const handler = /* @__PURE__ */ __name((event) => {
         if (event.storageArea !== nativeStorage(store)) return;
@@ -361,6 +548,29 @@ var REFRESH_KEY = "cfg.auth.refresh_token";
 var API_KEY_KEY = "cfg.auth.api_key";
 var storage = true ? cfgStorage : createStorage2("cfg");
 var isBrowser = typeof window !== "undefined";
+function trace(ev, fields) {
+  try {
+    const g = globalThis;
+    const sink = g.__cfgAuthTrace;
+    if (sink) {
+      sink(ev, fields);
+      return;
+    }
+    const queue = g.__cfgAuthTraceQ ?? [];
+    g.__cfgAuthTraceQ = queue;
+    if (queue.length < 100) queue.push([Date.now(), ev, fields]);
+  } catch {
+  }
+}
+__name(trace, "trace");
+function pathOf(url) {
+  try {
+    return new URL(url, "http://x").pathname;
+  } catch {
+    return "";
+  }
+}
+__name(pathOf, "pathOf");
 function secondsUntilExp(token) {
   const exp = jwtExpMs(token);
   return exp === null ? void 0 : Math.max(1, Math.floor((exp - Date.now()) / 1e3));
@@ -391,10 +601,10 @@ function adoptLegacySession() {
     if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;
     const legacy = backendFor("localStorage");
     const access = legacy.get(ACCESS_KEY);
-    const refresh = legacy.get(REFRESH_KEY);
-    if (access === null && refresh === null) return;
+    const refresh2 = legacy.get(REFRESH_KEY);
+    if (access === null && refresh2 === null) return;
     if (access !== null) _storage.set(ACCESS_KEY, access);
-    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);
+    if (refresh2 !== null) _storage.set(REFRESH_KEY, refresh2);
     legacy.set(ACCESS_KEY, null);
     legacy.set(REFRESH_KEY, null);
   } catch {
@@ -479,12 +689,12 @@ function jwtExpMs(token) {
 __name(jwtExpMs, "jwtExpMs");
 function computeSnapshot() {
   const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
+  const refresh2 = _storage.get(REFRESH_KEY);
   const now = Date.now();
   const accessExp = access ? jwtExpMs(access) : null;
   const accessAlive = access !== null && (accessExp === null || accessExp > now);
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
-  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
+  const refreshExp = refresh2 ? jwtExpMs(refresh2) : null;
+  const refreshAlive = refresh2 !== null && (refreshExp === null || refreshExp > now);
   return {
     status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
     accessExpiresAt: accessExp
@@ -507,9 +717,9 @@ function scheduleExpiryFlip() {
   const now = Date.now();
   const exps = [];
   const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
+  const refresh2 = _storage.get(REFRESH_KEY);
   const accessExp = access ? jwtExpMs(access) : null;
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  const refreshExp = refresh2 ? jwtExpMs(refresh2) : null;
   if (accessExp !== null && accessExp > now) exps.push(accessExp);
   if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
   if (!exps.length) return;
@@ -520,7 +730,10 @@ __name(scheduleExpiryFlip, "scheduleExpiryFlip");
 function notifySessionChanged() {
   const next = computeSnapshot();
   const changed = next.status !== _snapshot.status || next.accessExpiresAt !== _snapshot.accessExpiresAt;
-  if (changed) _snapshot = next;
+  if (changed) {
+    _snapshot = next;
+    trace("store.snapshot", { status: next.status });
+  }
   scheduleExpiryFlip();
   if (!changed) return;
   for (const listener of Array.from(_sessionListeners)) {
@@ -603,6 +816,7 @@ var auth = {
     return _storage.get(ACCESS_KEY);
   },
   setToken(token) {
+    trace("store.setToken", { present: token !== null });
     _storage.set(ACCESS_KEY, token);
     notifySessionChanged();
   },
@@ -610,14 +824,16 @@ var auth = {
     return _storage.get(REFRESH_KEY);
   },
   setRefreshToken(token) {
+    trace("store.setRefreshToken", { present: token !== null });
     _storage.set(REFRESH_KEY, token);
     notifySessionChanged();
   },
   clearTokens() {
+    trace("store.clearTokens");
     for (const mode of ["localStorage", "sessionStorage", "cookie"]) {
-      const backend = backendFor(mode);
-      backend.set(ACCESS_KEY, null);
-      backend.set(REFRESH_KEY, null);
+      const backend2 = backendFor(mode);
+      backend2.set(ACCESS_KEY, null);
+      backend2.set(REFRESH_KEY, null);
     }
     storage.clearAll();
     notifySessionChanged();
@@ -636,6 +852,7 @@ var auth = {
    * rotation); `refresh: null` explicitly drops it.
    */
   setSession(tokens) {
+    trace("store.setSession", { refresh: tokens.refresh === void 0 ? "kept" : tokens.refresh === null ? "dropped" : "set" });
     _storage.set(ACCESS_KEY, tokens.access);
     if (tokens.refresh !== void 0) _storage.set(REFRESH_KEY, tokens.refresh);
     notifySessionChanged();
@@ -771,10 +988,14 @@ async function tryRefresh() {
   if (_refreshInflight) return _refreshInflight;
   if (!_refreshHandler) return null;
   const runRefresh = /* @__PURE__ */ __name(async () => {
-    const refresh = auth.getRefreshToken();
-    if (!refresh) return null;
-    const result = await _refreshHandler(refresh);
-    if (!result?.access) return null;
+    const refresh2 = auth.getRefreshToken();
+    if (!refresh2) return null;
+    const result = await _refreshHandler(refresh2);
+    if (!result?.access) {
+      trace("refresh", { ok: false, why: "no-access" });
+      return null;
+    }
+    trace("refresh", { ok: true, rotated: Boolean(result.refresh) });
     auth.setToken(result.access);
     if (result.refresh) auth.setRefreshToken(result.refresh);
     return result.access;
@@ -787,6 +1008,7 @@ async function tryRefresh() {
       }
       return await runRefresh();
     } catch {
+      trace("refresh", { ok: false, why: "threw" });
       return null;
     } finally {
       _refreshInflight = null;
@@ -795,7 +1017,8 @@ async function tryRefresh() {
   return _refreshInflight;
 }
 __name(tryRefresh, "tryRefresh");
-function expireSession(response) {
+function expireSession(response, why) {
+  trace("store.expire", { why, status: response.status, path: pathOf(response.url), handlers: _sessionExpiredHandlers.size });
   auth.clearTokens();
   for (const cb of Array.from(_sessionExpiredHandlers)) {
     try {
@@ -938,15 +1161,16 @@ function installAuthOnClient(client2) {
   client2.interceptors.response.use(async (response, request) => {
     if (response.status !== 401) return response;
     if (/\/accounts\/(otp|oauth|login|register|token)\b/.test(request.url)) {
+      trace("401.passthrough", { path: pathOf(request.url) });
       return response;
     }
     if (request.headers.get(RETRY_MARKER)) {
-      expireSession(response);
+      expireSession(response, "retry-marker");
       return response;
     }
     const newToken = await tryRefresh();
     if (!newToken) {
-      expireSession(response);
+      expireSession(response, "refresh-failed");
       return response;
     }
     const retry = request.clone();
@@ -958,7 +1182,7 @@ function installAuthOnClient(client2) {
     }
     try {
       const retried = await fetch(retry);
-      if (retried.status === 401) expireSession(retried);
+      if (retried.status === 401) expireSession(retried, "retry-401");
       return retried;
     } catch {
       return response;
@@ -967,7 +1191,7 @@ function installAuthOnClient(client2) {
 }
 __name(installAuthOnClient, "installAuthOnClient");
 var REFRESH_ENDPOINT = "/cfg/accounts/token/refresh/";
-auth.setRefreshHandler(async (refresh) => {
+auth.setRefreshHandler(async (refresh2) => {
   try {
     const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
     const headers = { "Content-Type": "application/json" };
@@ -979,11 +1203,11 @@ auth.setRefreshHandler(async (refresh) => {
       method: "POST",
       headers,
       credentials: auth.getWithCredentials() ? "include" : "same-origin",
-      body: JSON.stringify({ refresh })
+      body: JSON.stringify({ refresh: refresh2 })
     });
     if (!res.ok) return null;
     const data = await res.json();
-    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
+    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh2 } : null;
   } catch {
     return null;
   }