@djangocfg/api 2.1.621 → 2.1.622

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/api",
-  "version": "2.1.621",
+  "version": "2.1.622",
   "description": "Auto-generated TypeScript API client with React hooks, SWR integration, and Zod validation for Django REST Framework backends",
   "keywords": [
     "django",
@@ -91,7 +91,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@djangocfg/typescript-config": "^2.1.621",
+    "@djangocfg/typescript-config": "^2.1.622",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^25.9.5",
     "@types/react": "19.3.0",

package/src/auth/__tests__/sharedContext.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it, vi } from 'vitest';
+
+describe('sharedContext', () => {
+  it('returns one context object for a key, even from a second module copy', async () => {
+    const a = await import('../context/sharedContext');
+    vi.resetModules();
+    const b = await import('../context/sharedContext');
+    expect(a.sharedContext).not.toBe(b.sharedContext);
+    expect(a.sharedContext('k', 1)).toBe(b.sharedContext('k', 2));
+  });
+
+  it('keeps different keys apart', async () => {
+    const { sharedContext } = await import('../context/sharedContext');
+    expect(sharedContext('x', 1)).not.toBe(sharedContext('y', 1));
+  });
+});

package/src/auth/__tests__/trace.test.ts

@@ -0,0 +1,38 @@
+// @vitest-environment jsdom
+import { beforeEach, describe, expect, it } from 'vitest';
+
+import { authTrace, clearAuthTrace, dumpAuthTrace, readAuthTrace } from '../trace';
+
+describe('auth trace', () => {
+  beforeEach(() => {
+    localStorage.clear();
+    clearAuthTrace();
+  });
+
+  it('drops sensitive keys and cuts long strings', () => {
+    authTrace('x', { token: 'abc', email: 'a@b.c', otp: '123456', path: '/auth', long: 'y'.repeat(300), ok: true });
+    const f = readAuthTrace()[0]!.f!;
+    expect(Object.keys(f).sort()).toEqual(['long', 'ok', 'path']);
+    expect((f.long as string).length).toBeLessThan(130);
+    expect(localStorage.getItem('cfg.auth.trace')).not.toContain('123456');
+  });
+
+  it('collapses an identical repeat so a loop cannot flush the start of the chain', () => {
+    authTrace('start');
+    for (let i = 0; i < 500; i++) authTrace('guard.redirect', { from: '/', to: '/auth' });
+    const t = readAuthTrace();
+    expect(t.map((e) => e.ev)).toEqual(['start', 'guard.redirect']);
+    expect(t[1]!.n).toBe(500);
+    expect(dumpAuthTrace()).toContain('x500');
+  });
+
+  it('keeps at most 200 distinct events', () => {
+    for (let i = 0; i < 300; i++) authTrace('e', { i });
+    expect(readAuthTrace()).toHaveLength(200);
+  });
+
+  it('survives in storage for the next page', () => {
+    authTrace('a');
+    expect(JSON.parse(localStorage.getItem('cfg.auth.trace')!)).toHaveLength(1);
+  });
+});

package/src/auth/context/AccountsContext.tsx

@@ -14,7 +14,7 @@
 "use client";
 
 import {
-    createContext, ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState
+    ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState
 } from 'react';
 
 import { auth } from '../../_api/generated/helpers/auth';
@@ -61,6 +61,7 @@ import type {
     PasswordLoginResponse,
 } from '../../_api/generated/_cfg_accounts/types.gen';
 import { authTrace } from '../trace';
+import { sharedContext } from './sharedContext';
 
 export type { PatchedCfgUserUpdateRequest, User, CfgUserUpdateRequest as UserProfileUpdateRequest };
 
@@ -84,7 +85,7 @@ export interface AccountsContextValue {
   logout: () => void;
 }
 
-const AccountsContext = createContext<AccountsContextValue | undefined>(undefined);
+const AccountsContext = sharedContext<AccountsContextValue | undefined>('accounts', undefined);
 
 interface AccountsProviderProps {
   children: ReactNode;

package/src/auth/context/AuthContext.tsx

@@ -18,7 +18,6 @@
 
 import { usePathname } from 'next/navigation';
 import React, {
-  createContext,
   memo,
   useCallback,
   useContext,
@@ -43,6 +42,7 @@ import { authTrace } from '../trace';
 import { isDev, isBrowser } from '../utils/env';
 import { authLogger } from '../utils/logger';
 import { AccountsProvider, useAccountsContext } from './AccountsContext';
+import { sharedContext } from './sharedContext';
 
 import type { AuthContextType, AuthProviderProps, UserProfile } from './types';
 import type {
@@ -74,7 +74,7 @@ export const resolveAuthRoutes = (
 
 const EMAIL_STORAGE_KEY = CFG_KEYS.email.key;
 
-const AuthContext = createContext<AuthContextType | undefined>(undefined);
+const AuthContext = sharedContext<AuthContextType | undefined>('auth', undefined);
 
 const AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config }) => {
   const accounts = useAccountsContext();

package/src/auth/context/sharedContext.ts

@@ -0,0 +1,16 @@
+import { createContext, type Context } from 'react';
+
+/**
+ * A React context that stays ONE object even when the bundle holds several copies of this package.
+ *
+ * pnpm builds a separate physical copy of a package per distinct peer set, and a dual ESM/CJS load can do the same.
+ * Each copy would call `createContext` itself: the provider mounted from copy A and a `useAuth()` called from copy B
+ * would then never meet, B would read the empty default and the page guard would redirect a signed-in user forever
+ * (hub.reforms.ai, 5 Nov 2026). Registering the context on `globalThis` makes every copy share it. React itself must
+ * still be a single copy, which every Next.js app already requires.
+ */
+export function sharedContext<T>(key: string, initial: T): Context<T> {
+  const g = globalThis as Record<string, unknown>;
+  const registry = (g.__cfgAuthContexts ??= {}) as Record<string, Context<unknown>>;
+  return (registry[key] ??= createContext<unknown>(initial)) as Context<T>;
+}

package/src/auth/trace.ts

@@ -10,6 +10,7 @@
  *   __cfgAuth.dump()    // copy-ready text with a header; paste it into the report
  *   __cfgAuth.trace()   // the raw array
  *   __cfgAuth.clear()   // empty it before reproducing
+ *   __cfgAuth.copy()    // dump to the clipboard; __cfgAuth.download() saves the raw JSON
  *
  * What is recorded is the decision, never the secret: no token, code, address, cookie value or password.
  * Values are primitives, strings are cut, and keys that look sensitive are dropped (`SENSITIVE`).
@@ -27,6 +28,8 @@ export interface TraceEntry {
   tab: string;
   ev: string;
   f?: TraceFields;
+  /** Times this exact event repeated back to back (absent = once). A loop must not push the start of the chain out of the buffer. */
+  n?: number;
 }
 
 const KEY = 'cfg.auth.trace';
@@ -34,7 +37,11 @@ const MAX = 200;
 const MAX_STRING = 120;
 const SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;
 
-const TAB = Math.random().toString(36).slice(2, 6);
+// One id per page load, shared by every copy of this module on the page (a second copy must not look like a second tab).
+const TAB: string = (() => {
+  const g = globalThis as Record<string, unknown>;
+  return (g.__cfgAuthTab ??= Math.random().toString(36).slice(2, 6)) as string;
+})();
 const hasWindow = typeof window !== 'undefined';
 
 let memory: TraceEntry[] = [];
@@ -87,10 +94,32 @@ function clean(fields?: TraceFields): TraceFields | undefined {
   return Object.keys(out).length ? out : undefined;
 }
 
+/** Re-read storage before every write: another tab (or another copy) may have appended since this one last looked. */
+function refresh(): void {
+  try {
+    const raw = backend()?.getItem(KEY);
+    const parsed: unknown = raw ? JSON.parse(raw) : null;
+    if (Array.isArray(parsed)) memory = parsed.filter((e): e is TraceEntry => typeof e === 'object' && e !== null);
+  } catch {
+    /* keep the in-memory copy */
+  }
+}
+
 function record(at: number, ev: string, fields?: TraceFields): void {
-  const entries = load();
+  load();
+  refresh();
+  const entries = memory;
   const p = hasWindow && typeof performance !== 'undefined' ? Math.round(performance.now()) : 0;
-  entries.push({ t: at, p, tab: TAB, ev, f: clean(fields) });
+  const f = clean(fields);
+  const last = entries[entries.length - 1];
+  if (last && last.tab === TAB && last.ev === ev && JSON.stringify(last.f) === JSON.stringify(f)) {
+    last.n = (last.n ?? 1) + 1;
+    last.t = at;
+    last.p = p;
+    persist();
+    return;
+  }
+  entries.push({ t: at, p, tab: TAB, ev, f });
   if (entries.length > MAX) entries.splice(0, entries.length - MAX);
   persist();
 }
@@ -106,6 +135,12 @@ export function authTrace(ev: string, fields?: TraceFields): void {
 }
 
 /** The recorded events, oldest first. */
+/** @internal for tests */
+export function resetAuthTraceForTests(): void {
+  memory = [];
+  loaded = true;
+}
+
 export function readAuthTrace(): TraceEntry[] {
   return load().slice();
 }
@@ -123,7 +158,8 @@ export function clearAuthTrace(): void {
 
 function context(): string[] {
   if (!hasWindow) return [];
-  const lines = [`url: ${window.location.href.split('?')[0]}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
+  const copies = (globalThis as Record<string, unknown>).__cfgAuthCopies ?? 1;
+  const lines = [`url: ${window.location.href.split('?')[0]}`, `copies: ${String(copies)}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];
   try {
     const auth = (globalThis as Record<string, unknown>).__cfgAuthNow as (() => TraceFields) | undefined;
     const now = auth?.();
@@ -141,7 +177,7 @@ export function dumpAuthTrace(): string {
   const rows = entries.map((e) => {
     const fields = e.f ? ` ${Object.entries(e.f).map(([k, v]) => `${k}=${String(v)}`).join(' ')}` : '';
     const at = new Date(e.t).toISOString().slice(11, 23);
-    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}`;
+    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}${e.n && e.n > 1 ? ` x${e.n}` : ''}`;
   });
   return [`# cfg auth trace, ${entries.length} events`, ...context(), '', ...rows].join('\n');
 }
@@ -163,6 +199,20 @@ export function installAuthTrace(): void {
       return text;
     },
     clear: clearAuthTrace,
+    /** Put the dump on the clipboard (works when the console output is blocked or too long to select). */
+    copy: () => {
+      const text = dumpAuthTrace();
+      void navigator.clipboard?.writeText(text);
+      return `${text.split('\n').length} lines copied`;
+    },
+    /** Download the raw trace as a JSON file. */
+    download: () => {
+      const blob = new Blob([JSON.stringify(readAuthTrace(), null, 1)], { type: 'application/json' });
+      const a = document.createElement('a');
+      a.href = URL.createObjectURL(blob);
+      a.download = `auth-trace-${Date.now()}.json`;
+      a.click();
+    },
   };
   const queued = g.__cfgAuthTraceQ;
   if (Array.isArray(queued)) {
@@ -179,5 +229,25 @@ export function installAuthTrace(): void {
   }
 }
 
+/**
+ * Count the copies of this package in the page. More than one means the bundle holds duplicates (pnpm peer-set
+ * variants, a dual ESM/CJS load): the contexts are shared (`sharedContext`), but the build should still be fixed.
+ * Visible as `dup.copy` in the trace and once in the console.
+ */
+function registerCopy(): void {
+  if (!hasWindow) return;
+  const g = globalThis as Record<string, unknown>;
+  const n = ((g.__cfgAuthCopies as number | undefined) ?? 0) + 1;
+  g.__cfgAuthCopies = n;
+  if (n > 1) {
+    authTrace('dup.copy', { copies: n });
+    if (n === 2) {
+      // eslint-disable-next-line no-console
+      console.warn('[@djangocfg/api] more than one copy of the auth package is loaded; see __cfgAuth.dump() (dup.copy). Align the peer set so pnpm installs one instance.');
+    }
+  }
+}
+registerCopy();
+
 // The reader is installed as soon as the package loads, so a trace exists from the first event.
 installAuthTrace();