@djangocfg/api 2.1.86 → 2.1.88

package/dist/auth.mjs

@@ -9,11 +9,11 @@ var __export = (target, all) => {
 import { usePathname } from "next/navigation";
 import {
   createContext as createContext2,
-  useCallback as useCallback2,
+  useCallback as useCallback3,
   useContext as useContext2,
-  useEffect as useEffect2,
+  useEffect as useEffect3,
   useMemo,
-  useRef as useRef2,
+  useRef as useRef3,
   useState as useState3
 } from "react";
 import { useCfgRouter, useLocalStorage, useQueryParams } from "@djangocfg/ui-nextjs/hooks";
@@ -3618,7 +3618,7 @@ __name(useBase64, "useBase64");
 // src/auth/hooks/useProfileCache.ts
 var CACHE_KEY = "user_profile_cache";
 var CACHE_VERSION = 1;
-var DEFAULT_TTL = 36e5;
+var DEFAULT_TTL = 144e5;
 function getCachedProfile() {
   try {
     if (typeof window === "undefined") return null;
@@ -3904,6 +3904,106 @@ var useAuthRedirectManager = /* @__PURE__ */ __name((options = {}) => {
   };
 }, "useAuthRedirectManager");
 
+// src/auth/hooks/useTokenRefresh.ts
+import { useCallback, useEffect, useRef } from "react";
+var TOKEN_REFRESH_THRESHOLD_MS = 10 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 5 * 60 * 1e3;
+function getTokenExpiry(token) {
+  try {
+    const payload = JSON.parse(atob(token.split(".")[1]));
+    return payload.exp * 1e3;
+  } catch {
+    return null;
+  }
+}
+__name(getTokenExpiry, "getTokenExpiry");
+function isTokenExpiringSoon(token, thresholdMs) {
+  const expiry = getTokenExpiry(token);
+  if (!expiry) return false;
+  const timeUntilExpiry = expiry - Date.now();
+  return timeUntilExpiry < thresholdMs;
+}
+__name(isTokenExpiringSoon, "isTokenExpiringSoon");
+function useTokenRefresh(options = {}) {
+  const { enabled = true, onRefresh, onRefreshError } = options;
+  const isRefreshingRef = useRef(false);
+  const refreshToken = useCallback(async () => {
+    if (isRefreshingRef.current) {
+      authLogger.debug("Token refresh already in progress");
+      return false;
+    }
+    const refreshTokenValue = api.getRefreshToken();
+    if (!refreshTokenValue) {
+      authLogger.warn("No refresh token available");
+      return false;
+    }
+    isRefreshingRef.current = true;
+    authLogger.info("Refreshing token...");
+    try {
+      const response = await fetch("/api/accounts/token/refresh/", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh: refreshTokenValue })
+      });
+      if (!response.ok) {
+        throw new Error(`Token refresh failed: ${response.status}`);
+      }
+      const data = await response.json();
+      const newAccessToken = data.access;
+      if (!newAccessToken) {
+        throw new Error("No access token in refresh response");
+      }
+      api.setToken(newAccessToken, refreshTokenValue);
+      authLogger.info("Token refreshed successfully");
+      onRefresh?.(newAccessToken);
+      return true;
+    } catch (error) {
+      authLogger.error("Token refresh error:", error);
+      onRefreshError?.(error instanceof Error ? error : new Error(String(error)));
+      return false;
+    } finally {
+      isRefreshingRef.current = false;
+    }
+  }, [onRefresh, onRefreshError]);
+  const checkAndRefresh = useCallback(async () => {
+    const token = api.getToken();
+    if (!token) return;
+    if (isTokenExpiringSoon(token, TOKEN_REFRESH_THRESHOLD_MS)) {
+      authLogger.info("Token expiring soon, refreshing proactively");
+      await refreshToken();
+    }
+  }, [refreshToken]);
+  useEffect(() => {
+    if (!enabled) return;
+    checkAndRefresh();
+    const intervalId = setInterval(checkAndRefresh, CHECK_INTERVAL_MS);
+    return () => clearInterval(intervalId);
+  }, [enabled, checkAndRefresh]);
+  useEffect(() => {
+    if (!enabled) return;
+    const handleFocus = /* @__PURE__ */ __name(() => {
+      authLogger.debug("Window focused, checking token...");
+      checkAndRefresh();
+    }, "handleFocus");
+    window.addEventListener("focus", handleFocus);
+    return () => window.removeEventListener("focus", handleFocus);
+  }, [enabled, checkAndRefresh]);
+  useEffect(() => {
+    if (!enabled) return;
+    const handleOnline = /* @__PURE__ */ __name(() => {
+      authLogger.info("Network reconnected, checking token...");
+      checkAndRefresh();
+    }, "handleOnline");
+    window.addEventListener("online", handleOnline);
+    return () => window.removeEventListener("online", handleOnline);
+  }, [enabled, checkAndRefresh]);
+  return {
+    refreshToken,
+    checkAndRefresh
+  };
+}
+__name(useTokenRefresh, "useTokenRefresh");
+
 // src/auth/utils/analytics.ts
 var AnalyticsEvent = /* @__PURE__ */ ((AnalyticsEvent2) => {
   AnalyticsEvent2["AUTH_OTP_REQUEST"] = "auth_otp_request";
@@ -3943,10 +4043,10 @@ var Analytics = {
 // src/auth/context/AccountsContext.tsx
 import {
   createContext,
-  useCallback,
+  useCallback as useCallback2,
   useContext,
-  useEffect,
-  useRef,
+  useEffect as useEffect2,
+  useRef as useRef2,
   useState as useState2
 } from "react";
 
@@ -4028,12 +4128,12 @@ function AccountsProvider({ children }) {
   });
   const [isLoadingProfile, setIsLoadingProfile] = useState2(false);
   const [profileError, setProfileError] = useState2(null);
-  const profileRef = useRef(profile);
-  const isLoadingRef = useRef(false);
-  useEffect(() => {
+  const profileRef = useRef2(profile);
+  const isLoadingRef = useRef2(false);
+  useEffect2(() => {
     profileRef.current = profile;
   }, [profile]);
-  useEffect(() => {
+  useEffect2(() => {
     isLoadingRef.current = isLoadingProfile;
   }, [isLoadingProfile]);
   const updateMutation = useUpdateAccountsProfileUpdateUpdate();
@@ -4042,7 +4142,7 @@ function AccountsProvider({ children }) {
   const otpRequestMutation = useCreateAccountsOtpRequestCreate();
   const otpVerifyMutation = useCreateAccountsOtpVerifyCreate();
   const tokenRefreshMutation = useCreateAccountsTokenRefreshCreate();
-  const refreshProfile = useCallback(async (callerId) => {
+  const refreshProfile = useCallback2(async (callerId) => {
     const currentProfile = profileRef.current;
     const currentLoading = isLoadingRef.current;
     if (currentProfile && !currentLoading) {
@@ -4108,7 +4208,7 @@ function AccountsProvider({ children }) {
     }
     return result;
   }, "refreshToken");
-  const logout = useCallback(() => {
+  const logout = useCallback2(() => {
     api.clearTokens();
     setProfile(void 0);
     setProfileError(null);
@@ -4172,32 +4272,45 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
   const queryParams = useQueryParams();
   const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage(EMAIL_STORAGE_KEY, null);
   const [storedPhone, setStoredPhone, clearStoredPhone] = useLocalStorage(PHONE_STORAGE_KEY, null);
+  useTokenRefresh({
+    enabled: true,
+    onRefresh: /* @__PURE__ */ __name((newToken) => {
+      authLogger.info("Token auto-refreshed successfully");
+    }, "onRefresh"),
+    onRefreshError: /* @__PURE__ */ __name((error) => {
+      authLogger.warn("Token auto-refresh failed:", error.message);
+    }, "onRefreshError")
+  });
   const user = accounts.profile;
-  const userRef = useRef2(user);
-  const configRef = useRef2(config);
-  const isLoadingProfileRef = useRef2(false);
-  useEffect2(() => {
+  const userRef = useRef3(user);
+  const configRef = useRef3(config);
+  const isLoadingProfileRef = useRef3(false);
+  useEffect3(() => {
     userRef.current = user;
   }, [user]);
-  useEffect2(() => {
+  useEffect3(() => {
     configRef.current = config;
   }, [config]);
-  const clearAuthState = useCallback2((caller) => {
+  const clearAuthState = useCallback3((caller) => {
     authLogger.info("clearAuthState >> caller", caller);
     api.clearTokens();
     clearProfileCache();
     setInitialized(true);
     setIsLoading(false);
   }, []);
-  const handleGlobalAuthError = useCallback2((error, context = "API Request") => {
-    if (error?.success === false) {
-      authLogger.warn(`Error detected in ${context}, clearing tokens`);
+  const handleGlobalAuthError = useCallback3((error, context = "API Request") => {
+    const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
+    if (isAuthError) {
+      authLogger.warn(`Authentication error in ${context}, clearing tokens`);
       clearAuthState(`globalAuthError:${context}`);
       return true;
     }
+    if (error?.success === false) {
+      authLogger.warn(`Non-auth error in ${context} (not clearing session):`, error?.message || error);
+    }
     return false;
   }, [clearAuthState]);
-  const loadCurrentProfile = useCallback2(async (callerId) => {
+  const loadCurrentProfile = useCallback3(async (callerId) => {
     const finalCallerId = callerId || "AuthContext.loadCurrentProfile";
     if (isLoadingProfileRef.current) {
       authLogger.debug(`Profile loading already in progress, skipping duplicate call from: ${finalCallerId}`);
@@ -4226,14 +4339,19 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       setInitialized(true);
     } catch (error) {
       authLogger.error("Failed to load profile:", error);
-      if (!handleGlobalAuthError(error, "loadCurrentProfile")) {
-        clearAuthState("loadCurrentProfile:error");
+      const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
+      if (isAuthError) {
+        authLogger.warn("Authentication error, clearing session");
+        clearAuthState("loadCurrentProfile:authError");
+      } else {
+        authLogger.warn("Profile load failed but keeping session (non-auth error)");
+        setInitialized(true);
       }
     } finally {
       isLoadingProfileRef.current = false;
     }
   }, [clearAuthState, handleGlobalAuthError, accounts]);
-  useEffect2(() => {
+  useEffect3(() => {
     if (initialized) return;
     const initializeAuth = /* @__PURE__ */ __name(async () => {
       authLogger.info("Initializing auth...");
@@ -4273,7 +4391,13 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
           await loadCurrentProfile("AuthContext.initializeAuth");
         } catch (error) {
           authLogger.error("Failed to load profile during initialization:", error);
-          clearAuthState("initializeAuth:loadProfileFailed");
+          const isAuthError = error?.status === 401 || error?.statusCode === 401 || error?.code === "token_not_valid" || error?.code === "authentication_failed";
+          if (isAuthError) {
+            clearAuthState("initializeAuth:authError");
+          } else {
+            authLogger.warn("Init profile load failed but keeping session");
+            setInitialized(true);
+          }
         }
         setIsLoading(false);
       } else {
@@ -4283,7 +4407,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     }, "initializeAuth");
     initializeAuth();
   }, [initialized]);
-  useEffect2(() => {
+  useEffect3(() => {
     if (!initialized) return;
     const isAuthenticated = api.isAuthenticated();
     const authRoute = config?.routes?.auth || defaultRoutes.auth;
@@ -4294,15 +4418,15 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       router.push(callbackUrl);
     }
   }, [initialized, pathname, queryParams, config?.routes]);
-  const pushToDefaultCallbackUrl = useCallback2(() => {
+  const pushToDefaultCallbackUrl = useCallback3(() => {
     const callbackUrl = config?.routes?.defaultCallback || defaultRoutes.defaultCallback;
     router.push(callbackUrl);
   }, [config?.routes, router]);
-  const pushToDefaultAuthCallbackUrl = useCallback2(() => {
+  const pushToDefaultAuthCallbackUrl = useCallback3(() => {
     const authCallbackUrl = config?.routes?.defaultAuthCallback || defaultRoutes.defaultAuthCallback;
     router.push(authCallbackUrl);
   }, [config?.routes, router]);
-  const checkAuthAndRedirect = useCallback2(async () => {
+  const checkAuthAndRedirect = useCallback3(async () => {
     try {
       setIsLoading(true);
       const isAuthenticated = api.isAuthenticated();
@@ -4324,7 +4448,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       setIsLoading(false);
     }
   }, [loadCurrentProfile, clearAuthState, pushToDefaultCallbackUrl, pushToDefaultAuthCallbackUrl, handleGlobalAuthError]);
-  const requestOTP = useCallback2(
+  const requestOTP = useCallback3(
     async (identifier, channel, sourceUrl) => {
       api.clearTokens();
       try {
@@ -4352,7 +4476,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [accounts]
   );
-  const verifyOTP = useCallback2(
+  const verifyOTP = useCallback3(
     async (identifier, otpCode, channel, sourceUrl, redirectUrl, skipRedirect) => {
       try {
         const channelValue = channel === "phone" ? enums_exports.OTPVerifyRequestChannel.PHONE : enums_exports.OTPVerifyRequestChannel.EMAIL;
@@ -4419,7 +4543,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
     },
     [setStoredEmail, setStoredPhone, clearStoredEmail, clearStoredPhone, config?.routes?.defaultCallback, accounts, router]
   );
-  const refreshToken = useCallback2(async () => {
+  const refreshToken = useCallback3(async () => {
     try {
       const refreshTokenValue = api.getRefreshToken();
       if (!refreshTokenValue) {
@@ -4452,7 +4576,7 @@ var AuthProviderInternal = /* @__PURE__ */ __name(({ children, config }) => {
       };
     }
   }, [clearAuthState, accounts]);
-  const logout = useCallback2(async () => {
+  const logout = useCallback3(async () => {
     const performLogout = /* @__PURE__ */ __name(() => {
       Analytics.event("auth_logout" /* AUTH_LOGOUT */, {
         category: "auth" /* AUTH */
@@ -4544,7 +4668,7 @@ var useAuth = /* @__PURE__ */ __name(() => {
 }, "useAuth");
 
 // src/auth/hooks/useAuthFormState.ts
-import { useCallback as useCallback3, useState as useState4 } from "react";
+import { useCallback as useCallback4, useState as useState4 } from "react";
 var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "", initialChannel = "email") => {
   const [identifier, setIdentifier] = useState4(initialIdentifier);
   const [channel, setChannel] = useState4(initialChannel);
@@ -4557,7 +4681,7 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "", initialCh
   const [shouldPrompt2FA, setShouldPrompt2FA] = useState4(false);
   const [twoFactorCode, setTwoFactorCode] = useState4("");
   const [useBackupCode, setUseBackupCode] = useState4(false);
-  const clearError = useCallback3(() => setError(""), []);
+  const clearError = useCallback4(() => setError(""), []);
   return {
     // State
     identifier,
@@ -4588,11 +4712,11 @@ var useAuthFormState = /* @__PURE__ */ __name((initialIdentifier = "", initialCh
 }, "useAuthFormState");
 
 // src/auth/hooks/useAuthValidation.ts
-import { useCallback as useCallback4 } from "react";
+import { useCallback as useCallback5 } from "react";
 var EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var PHONE_REGEX = /^\+[1-9]\d{6,14}$/;
 var useAuthValidation = /* @__PURE__ */ __name(() => {
-  const detectChannelFromIdentifier2 = useCallback4((id) => {
+  const detectChannelFromIdentifier2 = useCallback5((id) => {
     if (!id) return null;
     if (id.includes("@")) {
       return "email";
@@ -4602,7 +4726,7 @@ var useAuthValidation = /* @__PURE__ */ __name(() => {
     }
     return null;
   }, []);
-  const validateIdentifier2 = useCallback4((id, channelType) => {
+  const validateIdentifier2 = useCallback5((id, channelType) => {
     if (!id) return false;
     const channel = channelType || detectChannelFromIdentifier2(id);
     if (channel === "email") {
@@ -4633,11 +4757,11 @@ var validateIdentifier = /* @__PURE__ */ __name((id, channelType) => {
 }, "validateIdentifier");
 
 // src/auth/hooks/useAuthForm.ts
-import { useCallback as useCallback6, useEffect as useEffect4, useRef as useRef3 } from "react";
+import { useCallback as useCallback7, useEffect as useEffect5, useRef as useRef4 } from "react";
 
 // src/auth/hooks/useAutoAuth.ts
 import { usePathname as usePathname2 } from "next/navigation";
-import { useEffect as useEffect3 } from "react";
+import { useEffect as useEffect4 } from "react";
 import { useCfgRouter as useCfgRouter2, useQueryParams as useQueryParams2 } from "@djangocfg/ui-nextjs/hooks";
 var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const { onOTPDetected, cleanupUrl = true, allowedPaths = ["/auth"] } = options;
@@ -4647,7 +4771,7 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
   const isAllowedPath = allowedPaths.some((path) => pathname === path || pathname?.startsWith(path + "/"));
   const hasOTP = !!queryParams.get("otp");
   const isReady = !!pathname && hasOTP && isAllowedPath;
-  useEffect3(() => {
+  useEffect4(() => {
     if (!isReady) return;
     const queryOtp = queryParams.get("otp");
     if (queryOtp && typeof queryOtp === "string" && queryOtp.length === 6) {
@@ -4669,7 +4793,7 @@ var useAutoAuth = /* @__PURE__ */ __name((options = {}) => {
 }, "useAutoAuth");
 
 // src/auth/hooks/useTwoFactor.ts
-import { useCallback as useCallback5, useState as useState5 } from "react";
+import { useCallback as useCallback6, useState as useState5 } from "react";
 import { useCfgRouter as useCfgRouter3 } from "@djangocfg/ui-nextjs/hooks";
 
 // src/generated/cfg_totp/totp__backup_codes/client.ts
@@ -5714,10 +5838,10 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
   const [error, setError] = useState5(null);
   const [warning, setWarning] = useState5(null);
   const [remainingBackupCodes, setRemainingBackupCodes] = useState5(null);
-  const clearError = useCallback5(() => {
+  const clearError = useCallback6(() => {
     setError(null);
   }, []);
-  const handleSuccess = useCallback5((response) => {
+  const handleSuccess = useCallback6((response) => {
     apiAccounts.setToken(response.access_token, response.refresh_token);
     if (response.warning) {
       setWarning(response.warning);
@@ -5739,7 +5863,7 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
       router.hardPush(finalRedirectUrl);
     }
   }, [onSuccess, redirectUrl, router, skipRedirect]);
-  const verifyTOTP = useCallback5(async (sessionId, code) => {
+  const verifyTOTP = useCallback6(async (sessionId, code) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -5779,7 +5903,7 @@ var useTwoFactor = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [handleSuccess, onError]);
-  const verifyBackupCode = useCallback5(async (sessionId, backupCode) => {
+  const verifyBackupCode = useCallback6(async (sessionId, backupCode) => {
     if (!sessionId) {
       const msg = "Missing 2FA session ID";
       setError(msg);
@@ -5845,7 +5969,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
   } = options;
   const formState = useAuthFormState();
   const validation = useAuthValidation();
-  const isAutoSubmitFromUrlRef = useRef3(false);
+  const isAutoSubmitFromUrlRef = useRef4(false);
   const {
     requestOTP,
     verifyOTP,
@@ -5892,7 +6016,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     // We handle navigation via success step
   });
   const { detectChannelFromIdentifier: detectChannelFromIdentifier2, validateIdentifier: validateIdentifier2 } = validation;
-  const saveIdentifierToStorage = useCallback6((id, ch) => {
+  const saveIdentifierToStorage = useCallback7((id, ch) => {
     if (ch === "email") {
       saveEmail(id);
       clearSavedPhone();
@@ -5901,7 +6025,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       clearSavedEmail();
     }
   }, [saveEmail, savePhone, clearSavedEmail, clearSavedPhone]);
-  useEffect4(() => {
+  useEffect5(() => {
     const savedPhone = getSavedPhone();
     const savedEmail = getSavedEmail();
     if (savedPhone) {
@@ -5912,7 +6036,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       setChannel("email");
     }
   }, [getSavedEmail, getSavedPhone, setIdentifier, setChannel]);
-  useEffect4(() => {
+  useEffect5(() => {
     if (identifier) {
       const detected = detectChannelFromIdentifier2(identifier);
       if (detected && detected !== channel) {
@@ -5920,7 +6044,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       }
     }
   }, [identifier, channel, detectChannelFromIdentifier2, setChannel]);
-  const handleIdentifierSubmit = useCallback6(async (e) => {
+  const handleIdentifierSubmit = useCallback7(async (e) => {
     e.preventDefault();
     if (!identifier) {
       const msg = channel === "phone" ? "Please enter your phone number" : "Please enter your email address";
@@ -5975,7 +6099,7 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
     onError,
     sourceUrl
   ]);
-  const submitOTP = useCallback6(async (submitIdentifier, submitOtp, submitChannel) => {
+  const submitOTP = useCallback7(async (submitIdentifier, submitOtp, submitChannel) => {
     if (!submitOtp || submitOtp.length < 6) {
       const msg = "Please enter the 6-digit verification code";
       setError(msg);
@@ -6025,11 +6149,11 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       setIsLoading(false);
     }
   }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setTwoFactorSessionId, setShouldPrompt2FA, setStep, enable2FASetup]);
-  const handleOTPSubmit = useCallback6(async (e) => {
+  const handleOTPSubmit = useCallback7(async (e) => {
     e.preventDefault();
     await submitOTP(identifier, otp, channel);
   }, [identifier, otp, channel, submitOTP]);
-  const handleResendOTP = useCallback6(async () => {
+  const handleResendOTP = useCallback7(async () => {
     setIsLoading(true);
     clearError();
     try {
@@ -6049,15 +6173,15 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       setIsLoading(false);
     }
   }, [identifier, channel, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, onError, sourceUrl]);
-  const handleBackToIdentifier = useCallback6(() => {
+  const handleBackToIdentifier = useCallback7(() => {
     setStep("identifier");
     clearError();
   }, [setStep, clearError]);
-  const forceOTPStep = useCallback6(() => {
+  const forceOTPStep = useCallback7(() => {
     setStep("otp");
     clearError();
   }, [setStep, clearError]);
-  const handle2FASubmit = useCallback6(async (e) => {
+  const handle2FASubmit = useCallback7(async (e) => {
     e.preventDefault();
     if (!twoFactorSessionId) {
       const msg = "Missing 2FA session";
@@ -6071,12 +6195,12 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
       await twoFactor.verifyTOTP(twoFactorSessionId, twoFactorCode);
     }
   }, [twoFactorSessionId, twoFactorCode, useBackupCode, twoFactor, setError, onError]);
-  const handleUseBackupCode = useCallback6(() => {
+  const handleUseBackupCode = useCallback7(() => {
     setUseBackupCode(true);
     setTwoFactorCode("");
     clearError();
   }, [setUseBackupCode, setTwoFactorCode, clearError]);
-  const handleUseTOTP = useCallback6(() => {
+  const handleUseTOTP = useCallback7(() => {
     setUseBackupCode(false);
     setTwoFactorCode("");
     clearError();
@@ -6141,14 +6265,14 @@ var useAuthForm = /* @__PURE__ */ __name((options) => {
 }, "useAuthForm");
 
 // src/auth/hooks/useGithubAuth.ts
-import { useCallback as useCallback7, useState as useState6 } from "react";
+import { useCallback as useCallback8, useState as useState6 } from "react";
 import { useCfgRouter as useCfgRouter4 } from "@djangocfg/ui-nextjs/hooks";
 var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
   const { sourceUrl, onSuccess, onError, onRequires2FA, redirectUrl, skipRedirect = false } = options;
   const router = useCfgRouter4();
   const [isLoading, setIsLoading] = useState6(false);
   const [error, setError] = useState6(null);
-  const startGithubAuth = useCallback7(async () => {
+  const startGithubAuth = useCallback8(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -6182,7 +6306,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [sourceUrl, onError]);
-  const handleGithubCallback = useCallback7(async (code, state) => {
+  const handleGithubCallback = useCallback8(async (code, state) => {
     setIsLoading(true);
     setError(null);
     try {
@@ -6247,7 +6371,7 @@ var useGithubAuth = /* @__PURE__ */ __name((options = {}) => {
 }, "useGithubAuth");
 
 // src/auth/hooks/useTwoFactorSetup.ts
-import { useCallback as useCallback8, useState as useState7 } from "react";
+import { useCallback as useCallback9, useState as useState7 } from "react";
 var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const { onComplete, onError } = options;
   const [isLoading, setIsLoading] = useState7(false);
@@ -6256,17 +6380,17 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
   const [backupCodes, setBackupCodes] = useState7(null);
   const [backupCodesWarning, setBackupCodesWarning] = useState7(null);
   const [setupStep, setSetupStep] = useState7("idle");
-  const clearError = useCallback8(() => {
+  const clearError = useCallback9(() => {
     setError(null);
   }, []);
-  const resetSetup = useCallback8(() => {
+  const resetSetup = useCallback9(() => {
     setSetupData(null);
     setBackupCodes(null);
     setBackupCodesWarning(null);
     setSetupStep("idle");
     setError(null);
   }, []);
-  const startSetup = useCallback8(async (deviceName) => {
+  const startSetup = useCallback9(async (deviceName) => {
     setIsLoading(true);
     setError(null);
     setSetupStep("scanning");
@@ -6296,7 +6420,7 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
       setIsLoading(false);
     }
   }, [onError]);
-  const confirmSetup = useCallback8(async (code) => {
+  const confirmSetup = useCallback9(async (code) => {
     if (!setupData) {
       const msg = "Setup not started. Call startSetup() first.";
       setError(msg);
@@ -6351,16 +6475,16 @@ var useTwoFactorSetup = /* @__PURE__ */ __name((options = {}) => {
 }, "useTwoFactorSetup");
 
 // src/auth/hooks/useTwoFactorStatus.ts
-import { useCallback as useCallback9, useState as useState8 } from "react";
+import { useCallback as useCallback10, useState as useState8 } from "react";
 var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
   const [isLoading, setIsLoading] = useState8(false);
   const [error, setError] = useState8(null);
   const [has2FAEnabled, setHas2FAEnabled] = useState8(null);
   const [devices, setDevices] = useState8([]);
-  const clearError = useCallback9(() => {
+  const clearError = useCallback10(() => {
     setError(null);
   }, []);
-  const fetchStatus = useCallback9(async () => {
+  const fetchStatus = useCallback10(async () => {
     setIsLoading(true);
     setError(null);
     try {
@@ -6385,7 +6509,7 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
       setIsLoading(false);
     }
   }, []);
-  const disable2FA = useCallback9(async (code) => {
+  const disable2FA = useCallback10(async (code) => {
     if (!code || code.length !== 6) {
       setError("Please enter a 6-digit code");
       return false;
@@ -6420,14 +6544,14 @@ var useTwoFactorStatus = /* @__PURE__ */ __name(() => {
 }, "useTwoFactorStatus");
 
 // src/auth/hooks/useAuthGuard.ts
-import { useEffect as useEffect5, useState as useState9 } from "react";
+import { useEffect as useEffect6, useState as useState9 } from "react";
 import { useCfgRouter as useCfgRouter5 } from "@djangocfg/ui-nextjs/hooks";
 var useAuthGuard = /* @__PURE__ */ __name((options = {}) => {
   const { redirectTo = "/auth", requireAuth = true, saveRedirectUrl: shouldSaveUrl = true } = options;
   const { isAuthenticated, isLoading, saveRedirectUrl } = useAuth();
   const router = useCfgRouter5();
   const [isRedirecting, setIsRedirecting] = useState9(false);
-  useEffect5(() => {
+  useEffect6(() => {
     if (!isLoading && requireAuth && !isAuthenticated && !isRedirecting) {
       if (shouldSaveUrl && typeof window !== "undefined") {
         const currentUrl = window.location.pathname + window.location.search;
@@ -6652,6 +6776,7 @@ export {
   useGithubAuth,
   useLocalStorage2 as useLocalStorage,
   useSessionStorage,
+  useTokenRefresh,
   useTwoFactor,
   useTwoFactorSetup,
   useTwoFactorStatus,