@djangocfg/api 2.1.621 → 2.1.622

package/dist/auth.d.cts

@@ -29,6 +29,7 @@ declare const AUTH_CONSTANTS: {
  *   __cfgAuth.dump()    // copy-ready text with a header; paste it into the report
  *   __cfgAuth.trace()   // the raw array
  *   __cfgAuth.clear()   // empty it before reproducing
+ *   __cfgAuth.copy()    // dump to the clipboard; __cfgAuth.download() saves the raw JSON
  *
  * What is recorded is the decision, never the secret: no token, code, address, cookie value or password.
  * Values are primitives, strings are cut, and keys that look sensitive are dropped (`SENSITIVE`).
@@ -44,10 +45,14 @@ interface TraceEntry {
     tab: string;
     ev: string;
     f?: TraceFields;
+    /** Times this exact event repeated back to back (absent = once). A loop must not push the start of the chain out of the buffer. */
+    n?: number;
 }
 /** Record one auth event. Safe anywhere: it never throws and does nothing on the server. */
 declare function authTrace(ev: string, fields?: TraceFields): void;
 /** The recorded events, oldest first. */
+/** @internal for tests */
+declare function resetAuthTraceForTests(): void;
 declare function readAuthTrace(): TraceEntry[];
 /** Empty the trace. */
 declare function clearAuthTrace(): void;
@@ -1604,5 +1609,5 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, AccountsProvider, Analytics, AnalyticsCategory, AnalyticsEvent, AuthContext, AuthProvider, OAUTH_PROVIDER_IDS, authLogger, authTrace, beginTwoFactorChallenge, clearAuthTrace, clearOAuthAttempt, clearProfileCache, consumeSavedRedirect, decodeBase64, dumpAuthTrace, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, installAuthTrace, isAllowedAuthPath, isForbidden, isOAuthProviderId, logAuthFailure, logger, normalizePath, peekSavedRedirect, readAuthTrace, readOAuthFailure, resolveAuthError, resolveAuthStatus, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useOAuthLogin, useOAuthProviders, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, AccountsProvider, Analytics, AnalyticsCategory, AnalyticsEvent, AuthContext, AuthProvider, OAUTH_PROVIDER_IDS, authLogger, authTrace, beginTwoFactorChallenge, clearAuthTrace, clearOAuthAttempt, clearProfileCache, consumeSavedRedirect, decodeBase64, dumpAuthTrace, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, installAuthTrace, isAllowedAuthPath, isForbidden, isOAuthProviderId, logAuthFailure, logger, normalizePath, peekSavedRedirect, readAuthTrace, readOAuthFailure, resetAuthTraceForTests, resolveAuthError, resolveAuthStatus, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useOAuthLogin, useOAuthProviders, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
 export type { AccountsContextValue, AnalyticsCategoryType, AnalyticsEventType, AnalyticsSink, AuthConfig, AuthContextType, AuthErrorCopy, AuthErrorKey, AuthFormAutoSubmit, AuthFormReturn, AuthFormState, AuthFormStateHandlers, AuthFormSubmitHandlers, AuthFormValidation, AuthProviderProps, AuthStateInput, AuthStatus, AuthStep, DeleteAccountResult, GuardInput, OAuthClientErrorCode, OAuthErrorCode, OAuthFailure, OAuthFailureCode, OAuthProviderId, OAuthUser, OTPRequestConsent, OTPRequestResult, PasswordLoginOptions, PasswordLoginResult, PatchedCfgUserUpdateRequest, ProfileCacheOptions, SessionSnapshot, SessionStatus, TraceEntry, TraceFields, TwoFactorChallenge, TwoFactorDevice, TwoFactorSetupData, UseAuthFormOptions, UseAuthFormStateReturn, UseAutoAuthOptions, UseDeleteAccountReturn, UseGithubAuthOptions, UseGithubAuthReturn, UseOAuthLoginOptions, UseOAuthLoginReturn, UseOAuthProvidersReturn, UseTimezoneReturn, UseTwoFactorOptions, UseTwoFactorReturn, UseTwoFactorSetupOptions, UseTwoFactorSetupReturn, UseTwoFactorStatusReturn, UseTwoFactorVerifyOptions, UseTwoFactorVerifyReturn, UserProfile, WebmailLink };

package/dist/auth.d.ts

@@ -29,6 +29,7 @@ declare const AUTH_CONSTANTS: {
  *   __cfgAuth.dump()    // copy-ready text with a header; paste it into the report
  *   __cfgAuth.trace()   // the raw array
  *   __cfgAuth.clear()   // empty it before reproducing
+ *   __cfgAuth.copy()    // dump to the clipboard; __cfgAuth.download() saves the raw JSON
  *
  * What is recorded is the decision, never the secret: no token, code, address, cookie value or password.
  * Values are primitives, strings are cut, and keys that look sensitive are dropped (`SENSITIVE`).
@@ -44,10 +45,14 @@ interface TraceEntry {
     tab: string;
     ev: string;
     f?: TraceFields;
+    /** Times this exact event repeated back to back (absent = once). A loop must not push the start of the chain out of the buffer. */
+    n?: number;
 }
 /** Record one auth event. Safe anywhere: it never throws and does nothing on the server. */
 declare function authTrace(ev: string, fields?: TraceFields): void;
 /** The recorded events, oldest first. */
+/** @internal for tests */
+declare function resetAuthTraceForTests(): void;
 declare function readAuthTrace(): TraceEntry[];
 /** Empty the trace. */
 declare function clearAuthTrace(): void;
@@ -1604,5 +1609,5 @@ declare const Analytics: {
     setUser(userId: string | null): void;
 };
 
-export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, AccountsProvider, Analytics, AnalyticsCategory, AnalyticsEvent, AuthContext, AuthProvider, OAUTH_PROVIDER_IDS, authLogger, authTrace, beginTwoFactorChallenge, clearAuthTrace, clearOAuthAttempt, clearProfileCache, consumeSavedRedirect, decodeBase64, dumpAuthTrace, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, installAuthTrace, isAllowedAuthPath, isForbidden, isOAuthProviderId, logAuthFailure, logger, normalizePath, peekSavedRedirect, readAuthTrace, readOAuthFailure, resolveAuthError, resolveAuthStatus, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useOAuthLogin, useOAuthProviders, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
+export { AUTH_CONSTANTS, AUTH_ERROR_KEYS, AccountsProvider, Analytics, AnalyticsCategory, AnalyticsEvent, AuthContext, AuthProvider, OAUTH_PROVIDER_IDS, authLogger, authTrace, beginTwoFactorChallenge, clearAuthTrace, clearOAuthAttempt, clearProfileCache, consumeSavedRedirect, decodeBase64, dumpAuthTrace, encodeBase64, endTwoFactorChallenge, formatAuthError, getCacheMetadata, getCachedProfile, hasValidCache, installAuthTrace, isAllowedAuthPath, isForbidden, isOAuthProviderId, logAuthFailure, logger, normalizePath, peekSavedRedirect, readAuthTrace, readOAuthFailure, resetAuthTraceForTests, resolveAuthError, resolveAuthStatus, resolveGuardIsAuthenticated, resolveGuardIsLoading, setAnalyticsSink, setCachedProfile, shouldRedirectToAuth, useAccountsContext, useAuth, useAuthForm, useAuthFormState, useAuthRedirectManager, useAuthValidation, useAutoAuth, useBase64, useCfgRouter, useDeleteAccount, useGithubAuth, useLocalStorage, useOAuthLogin, useOAuthProviders, useQueryParams, useSession, useSessionStorage, useTimezone, useTwoFactor, useTwoFactorChallenge, useTwoFactorSetup, useTwoFactorStatus, useTwoFactorVerify, validateEmail, validateIdentifier };
 export type { AccountsContextValue, AnalyticsCategoryType, AnalyticsEventType, AnalyticsSink, AuthConfig, AuthContextType, AuthErrorCopy, AuthErrorKey, AuthFormAutoSubmit, AuthFormReturn, AuthFormState, AuthFormStateHandlers, AuthFormSubmitHandlers, AuthFormValidation, AuthProviderProps, AuthStateInput, AuthStatus, AuthStep, DeleteAccountResult, GuardInput, OAuthClientErrorCode, OAuthErrorCode, OAuthFailure, OAuthFailureCode, OAuthProviderId, OAuthUser, OTPRequestConsent, OTPRequestResult, PasswordLoginOptions, PasswordLoginResult, PatchedCfgUserUpdateRequest, ProfileCacheOptions, SessionSnapshot, SessionStatus, TraceEntry, TraceFields, TwoFactorChallenge, TwoFactorDevice, TwoFactorSetupData, UseAuthFormOptions, UseAuthFormStateReturn, UseAutoAuthOptions, UseDeleteAccountReturn, UseGithubAuthOptions, UseGithubAuthReturn, UseOAuthLoginOptions, UseOAuthLoginReturn, UseOAuthProvidersReturn, UseTimezoneReturn, UseTwoFactorOptions, UseTwoFactorReturn, UseTwoFactorSetupOptions, UseTwoFactorSetupReturn, UseTwoFactorStatusReturn, UseTwoFactorVerifyOptions, UseTwoFactorVerifyReturn, UserProfile, WebmailLink };

package/dist/auth.mjs

@@ -20,7 +20,10 @@ var KEY = "cfg.auth.trace";
 var MAX = 200;
 var MAX_STRING = 120;
 var SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;
-var TAB = Math.random().toString(36).slice(2, 6);
+var TAB = (() => {
+  const g = globalThis;
+  return g.__cfgAuthTab ??= Math.random().toString(36).slice(2, 6);
+})();
 var hasWindow = typeof window !== "undefined";
 var memory = [];
 var loaded = false;
@@ -69,10 +72,30 @@ function clean(fields) {
   return Object.keys(out).length ? out : void 0;
 }
 __name(clean, "clean");
+function refresh() {
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed = raw ? JSON.parse(raw) : null;
+    if (Array.isArray(parsed)) memory = parsed.filter((e) => typeof e === "object" && e !== null);
+  } catch {
+  }
+}
+__name(refresh, "refresh");
 function record(at, ev, fields) {
-  const entries = load();
+  load();
+  refresh();
+  const entries = memory;
   const p = hasWindow && typeof performance !== "undefined" ? Math.round(performance.now()) : 0;
-  entries.push({ t: at, p, tab: TAB, ev, f: clean(fields) });
+  const f2 = clean(fields);
+  const last = entries[entries.length - 1];
+  if (last && last.tab === TAB && last.ev === ev && JSON.stringify(last.f) === JSON.stringify(f2)) {
+    last.n = (last.n ?? 1) + 1;
+    last.t = at;
+    last.p = p;
+    persist();
+    return;
+  }
+  entries.push({ t: at, p, tab: TAB, ev, f: f2 });
   if (entries.length > MAX) entries.splice(0, entries.length - MAX);
   persist();
 }
@@ -85,6 +108,11 @@ function authTrace(ev, fields) {
   }
 }
 __name(authTrace, "authTrace");
+function resetAuthTraceForTests() {
+  memory = [];
+  loaded = true;
+}
+__name(resetAuthTraceForTests, "resetAuthTraceForTests");
 function readAuthTrace() {
   return load().slice();
 }
@@ -100,7 +128,8 @@ function clearAuthTrace() {
 __name(clearAuthTrace, "clearAuthTrace");
 function context() {
   if (!hasWindow) return [];
-  const lines = [`url: ${window.location.href.split("?")[0]}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
+  const copies = globalThis.__cfgAuthCopies ?? 1;
+  const lines = [`url: ${window.location.href.split("?")[0]}`, `copies: ${String(copies)}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
   try {
     const auth2 = globalThis.__cfgAuthNow;
     const now = auth2?.();
@@ -116,7 +145,7 @@ function dumpAuthTrace() {
   const rows = entries.map((e) => {
     const fields = e.f ? ` ${Object.entries(e.f).map(([k2, v]) => `${k2}=${String(v)}`).join(" ")}` : "";
     const at = new Date(e.t).toISOString().slice(11, 23);
-    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}`;
+    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}${e.n && e.n > 1 ? ` x${e.n}` : ""}`;
   });
   return [`# cfg auth trace, ${entries.length} events`, ...context(), "", ...rows].join("\n");
 }
@@ -132,7 +161,21 @@ function installAuthTrace() {
       console.log(text);
       return text;
     }, "dump"),
-    clear: clearAuthTrace
+    clear: clearAuthTrace,
+    /** Put the dump on the clipboard (works when the console output is blocked or too long to select). */
+    copy: /* @__PURE__ */ __name(() => {
+      const text = dumpAuthTrace();
+      void navigator.clipboard?.writeText(text);
+      return `${text.split("\n").length} lines copied`;
+    }, "copy"),
+    /** Download the raw trace as a JSON file. */
+    download: /* @__PURE__ */ __name(() => {
+      const blob = new Blob([JSON.stringify(readAuthTrace(), null, 1)], { type: "application/json" });
+      const a = document.createElement("a");
+      a.href = URL.createObjectURL(blob);
+      a.download = `auth-trace-${Date.now()}.json`;
+      a.click();
+    }, "download")
   };
   const queued = g.__cfgAuthTraceQ;
   if (Array.isArray(queued)) {
@@ -148,12 +191,25 @@ function installAuthTrace() {
   }
 }
 __name(installAuthTrace, "installAuthTrace");
+function registerCopy() {
+  if (!hasWindow) return;
+  const g = globalThis;
+  const n = (g.__cfgAuthCopies ?? 0) + 1;
+  g.__cfgAuthCopies = n;
+  if (n > 1) {
+    authTrace("dup.copy", { copies: n });
+    if (n === 2) {
+      console.warn("[@djangocfg/api] more than one copy of the auth package is loaded; see __cfgAuth.dump() (dup.copy). Align the peer set so pnpm installs one instance.");
+    }
+  }
+}
+__name(registerCopy, "registerCopy");
+registerCopy();
 installAuthTrace();
 
 // src/auth/context/AuthContext.tsx
 import { usePathname as usePathname3 } from "next/navigation";
 import {
-  createContext as createContext2,
   memo,
   useCallback as useCallback13,
   useContext as useContext2,
@@ -563,10 +619,10 @@ function adoptLegacySession() {
     if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;
     const legacy = backendFor("localStorage");
     const access = legacy.get(ACCESS_KEY);
-    const refresh = legacy.get(REFRESH_KEY);
-    if (access === null && refresh === null) return;
+    const refresh2 = legacy.get(REFRESH_KEY);
+    if (access === null && refresh2 === null) return;
     if (access !== null) _storage.set(ACCESS_KEY, access);
-    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);
+    if (refresh2 !== null) _storage.set(REFRESH_KEY, refresh2);
     legacy.set(ACCESS_KEY, null);
     legacy.set(REFRESH_KEY, null);
   } catch {
@@ -651,12 +707,12 @@ function jwtExpMs(token) {
 __name(jwtExpMs, "jwtExpMs");
 function computeSnapshot() {
   const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
+  const refresh2 = _storage.get(REFRESH_KEY);
   const now = Date.now();
   const accessExp = access ? jwtExpMs(access) : null;
   const accessAlive = access !== null && (accessExp === null || accessExp > now);
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
-  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);
+  const refreshExp = refresh2 ? jwtExpMs(refresh2) : null;
+  const refreshAlive = refresh2 !== null && (refreshExp === null || refreshExp > now);
   return {
     status: accessAlive || refreshAlive ? "authenticated" : "anonymous",
     accessExpiresAt: accessExp
@@ -679,9 +735,9 @@ function scheduleExpiryFlip() {
   const now = Date.now();
   const exps = [];
   const access = _storage.get(ACCESS_KEY);
-  const refresh = _storage.get(REFRESH_KEY);
+  const refresh2 = _storage.get(REFRESH_KEY);
   const accessExp = access ? jwtExpMs(access) : null;
-  const refreshExp = refresh ? jwtExpMs(refresh) : null;
+  const refreshExp = refresh2 ? jwtExpMs(refresh2) : null;
   if (accessExp !== null && accessExp > now) exps.push(accessExp);
   if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);
   if (!exps.length) return;
@@ -950,9 +1006,9 @@ async function tryRefresh() {
   if (_refreshInflight) return _refreshInflight;
   if (!_refreshHandler) return null;
   const runRefresh = /* @__PURE__ */ __name(async () => {
-    const refresh = auth.getRefreshToken();
-    if (!refresh) return null;
-    const result = await _refreshHandler(refresh);
+    const refresh2 = auth.getRefreshToken();
+    if (!refresh2) return null;
+    const result = await _refreshHandler(refresh2);
     if (!result?.access) {
       trace("refresh", { ok: false, why: "no-access" });
       return null;
@@ -1153,7 +1209,7 @@ function installAuthOnClient(client2) {
 }
 __name(installAuthOnClient, "installAuthOnClient");
 var REFRESH_ENDPOINT = "/cfg/accounts/token/refresh/";
-auth.setRefreshHandler(async (refresh) => {
+auth.setRefreshHandler(async (refresh2) => {
   try {
     const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;
     const headers = { "Content-Type": "application/json" };
@@ -1165,11 +1221,11 @@ auth.setRefreshHandler(async (refresh) => {
       method: "POST",
       headers,
       credentials: auth.getWithCredentials() ? "include" : "same-origin",
-      body: JSON.stringify({ refresh })
+      body: JSON.stringify({ refresh: refresh2 })
     });
     if (!res.ok) return null;
     const data = await res.json();
-    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh } : null;
+    return data?.access ? { access: data.access, refresh: data.refresh ?? refresh2 } : null;
   } catch {
     return null;
   }
@@ -1440,7 +1496,7 @@ function useCfgRouter() {
   const forward = useCallback2(() => {
     router.forward();
   }, [router]);
-  const refresh = useCallback2(() => {
+  const refresh2 = useCallback2(() => {
     router.refresh();
   }, [router]);
   return {
@@ -1451,7 +1507,7 @@ function useCfgRouter() {
     prefetch,
     back,
     forward,
-    refresh
+    refresh: refresh2
   };
 }
 __name(useCfgRouter, "useCfgRouter");
@@ -4631,7 +4687,6 @@ __name(resolveAuthStatus, "resolveAuthStatus");
 
 // src/auth/context/AccountsContext.tsx
 import {
-  createContext,
   useCallback as useCallback12,
   useContext,
   useEffect as useEffect6,
@@ -4985,6 +5040,15 @@ __name(useCfgAccountsTokenCreate, "useCfgAccountsTokenCreate");
 // src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts
 import useSWRMutation19 from "swr/mutation";
 
+// src/auth/context/sharedContext.ts
+import { createContext } from "react";
+function sharedContext(key, initial) {
+  const g = globalThis;
+  const registry = g.__cfgAuthContexts ??= {};
+  return registry[key] ??= createContext(initial);
+}
+__name(sharedContext, "sharedContext");
+
 // src/auth/context/AccountsContext.tsx
 import { jsx } from "react/jsx-runtime";
 function hasApiOrigin() {
@@ -4998,7 +5062,7 @@ function hasApiOrigin() {
   }
 }
 __name(hasApiOrigin, "hasApiOrigin");
-var AccountsContext = createContext(void 0);
+var AccountsContext = sharedContext("accounts", void 0);
 function AccountsProvider({ children }) {
   const [profile, setProfile] = useState11(() => {
     if (!auth.isAuthenticated()) {
@@ -5104,9 +5168,9 @@ function AccountsProvider({ children }) {
     return result;
   }, [triggerPasswordLogin, settleLoginEnvelope]);
   const logout = useCallback12(() => {
-    const refresh = auth.getRefreshToken();
-    if (refresh) {
-      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {
+    const refresh2 = auth.getRefreshToken();
+    if (refresh2) {
+      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh: refresh2 } }).catch(() => {
         authLogger.warn("Refresh-token blacklist failed (logged out locally anyway)");
       });
     }
@@ -5166,7 +5230,7 @@ var resolveAuthRoutes = /* @__PURE__ */ __name((routes) => ({
   defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback
 }), "resolveAuthRoutes");
 var EMAIL_STORAGE_KEY = CFG_KEYS.email.key;
-var AuthContext = createContext2(void 0);
+var AuthContext = sharedContext("auth", void 0);
 var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const accounts = useAccountsContext();
   const session = useSession();
@@ -5712,6 +5776,7 @@ export {
   peekSavedRedirect,
   readAuthTrace,
   readOAuthFailure,
+  resetAuthTraceForTests,
   resolveAuthError,
   resolveAuthStatus,
   resolveGuardIsAuthenticated,