@micha.bigler/ui-core-micha 1.4.14 → 1.4.17

package/dist/auth/authApi.js

@@ -1,12 +1,8 @@
-import axios from 'axios';
+import apiClient from './apiClient';
 import { HEADLESS_BASE, USERS_BASE, ACCESS_CODES_BASE } from './authConfig';
 // -----------------------------
 // WebAuthn Serialization Helpers
 // -----------------------------
-/**
- * Converts an ArrayBuffer to a Base64URL encoded string.
- * Required for manual credential serialization when .toJSON() is missing.
- */
 function bufferToBase64URL(buffer) {
     const bytes = new Uint8Array(buffer);
     let str = '';
@@ -16,15 +12,10 @@ function bufferToBase64URL(buffer) {
     const base64 = btoa(str);
     return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
 }
-/**
- * Serializes a PublicKeyCredential into a JSON-compatible object.
- * Acts as a polyfill for environments where credential.toJSON() is missing (e.g., Proton Pass).
- */
 function serializeCredential(credential) {
     if (typeof credential.toJSON === 'function') {
         return credential.toJSON();
     }
-    // Manual serialization for extensions that return incomplete objects
     const p = {
         id: credential.id,
         rawId: bufferToBase64URL(credential.rawId),
@@ -34,22 +25,17 @@ function serializeCredential(credential) {
         },
     };
     if (credential.response.attestationObject) {
-        // Registration specific
         p.response.attestationObject = bufferToBase64URL(credential.response.attestationObject);
     }
     if (credential.response.authenticatorData) {
-        // Login specific
         p.response.authenticatorData = bufferToBase64URL(credential.response.authenticatorData);
     }
     if (credential.response.signature) {
-        // Login specific
         p.response.signature = bufferToBase64URL(credential.response.signature);
     }
     if (credential.response.userHandle) {
-        // Login specific
         p.response.userHandle = bufferToBase64URL(credential.response.userHandle);
     }
-    // Include clientExtensionResults if present
     if (typeof credential.getClientExtensionResults === 'function') {
         p.clientExtensionResults = credential.getClientExtensionResults();
     }
@@ -68,10 +54,6 @@ function normaliseApiError(error, defaultCode = 'Auth.GENERIC_ERROR') {
 function mapAllauthDetailToCode(detail) {
     if (!detail || typeof detail !== 'string')
         return null;
-    // Optional: bekannte allauth-Texte auf eigene Codes mappen
-    // if (detail.includes('Unable to log in with provided credentials')) {
-    //   return 'Auth.INVALID_CREDENTIALS';
-    // }
     return null;
 }
 function extractErrorInfo(error) {
@@ -79,47 +61,21 @@ function extractErrorInfo(error) {
     const status = (_b = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : null;
     const data = (_d = (_c = error.response) === null || _c === void 0 ? void 0 : _c.data) !== null && _d !== void 0 ? _d : null;
     if (!data) {
-        return {
-            status,
-            code: null,
-            message: error.message || null,
-            raw: null,
-        };
+        return { status, code: null, message: error.message || null, raw: null };
     }
     if (typeof data.code === 'string') {
-        return {
-            status,
-            code: data.code,
-            message: null,
-            raw: data,
-        };
+        return { status, code: data.code, message: null, raw: data };
     }
     if (typeof data.detail === 'string') {
         const mapped = mapAllauthDetailToCode(data.detail);
-        return {
-            status,
-            code: mapped,
-            message: data.detail,
-            raw: data,
-        };
+        return { status, code: mapped, message: data.detail, raw: data };
     }
-    if (Array.isArray(data.non_field_errors) &&
-        data.non_field_errors.length > 0) {
+    if (Array.isArray(data.non_field_errors) && data.non_field_errors.length > 0) {
         const msg = data.non_field_errors[0];
         const mapped = mapAllauthDetailToCode(msg);
-        return {
-            status,
-            code: mapped,
-            message: msg,
-            raw: data,
-        };
+        return { status, code: mapped, message: msg, raw: data };
     }
-    return {
-        status,
-        code: null,
-        message: null,
-        raw: data,
-    };
+    return { status, code: null, message: null, raw: data };
 }
 // -----------------------------
 // CSRF helper
@@ -128,7 +84,8 @@ function getCsrfToken() {
     if (typeof document === 'undefined' || !document.cookie) {
         return null;
     }
-    const match = document.cookie.match(/csrftoken=([^;]+)/);
+    // Robust regex for CSRF token
+    const match = document.cookie.match(/(?:^|; )csrftoken=([^;]+)/);
     return match ? match[1] : null;
 }
 // -----------------------------
@@ -150,16 +107,13 @@ function ensureWebAuthnSupport() {
 // User-related helpers
 // -----------------------------
 export async function fetchCurrentUser() {
-    const res = await axios.get(`${USERS_BASE}/current/`, {
-        withCredentials: true,
-    });
+    const res = await apiClient.get(`${USERS_BASE}/current/`);
     return res.data;
 }
 export async function updateUserProfile(data) {
     try {
-        const res = await axios.patch(`${USERS_BASE}/current/`, data, {
-            withCredentials: true,
-        });
+        // CHANGED: axios -> apiClient
+        const res = await apiClient.patch(`${USERS_BASE}/current/`, data);
         return res.data;
     }
     catch (error) {
@@ -169,38 +123,17 @@ export async function updateUserProfile(data) {
 // -----------------------------
 // Authentication: password
 // -----------------------------
-/*
-export async function loginWithPassword(email, password) {
-  try {
-    await axios.post(
-      `${HEADLESS_BASE}/auth/login`,
-      { email, password },
-      { withCredentials: true },
-    );
-  } catch (error) {
-    if (error.response && error.response.status === 409) {
-      // Already logged in: continue and fetch current user
-    } else {
-      throw new Error(extractErrorMessage(error));
-    }
-  }
-
-  const user = await fetchCurrentUser();
-  return { user };
-}
-*/
 export async function requestPasswordReset(email) {
     try {
-        await axios.post(`${USERS_BASE}/reset-request/`, { email }, { withCredentials: true });
+        await apiClient.post(`${USERS_BASE}/reset-request/`, { email });
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.RESET_REQUEST_FAILED');
     }
 }
-// (Falls du es noch brauchst: klassischer allauth-Key-Flow)
 export async function resetPasswordWithKey(key, newPassword) {
     try {
-        await axios.post(`${HEADLESS_BASE}/auth/password/reset/key`, { key, password: newPassword }, { withCredentials: true });
+        await apiClient.post(`${HEADLESS_BASE}/auth/password/reset/key`, { key, password: newPassword });
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.RESET_WITH_KEY_FAILED');
@@ -208,10 +141,10 @@ export async function resetPasswordWithKey(key, newPassword) {
 }
 export async function changePassword(currentPassword, newPassword) {
     try {
-        await axios.post(`${HEADLESS_BASE}/account/password/change`, {
+        await apiClient.post(`${HEADLESS_BASE}/account/password/change`, {
             current_password: currentPassword,
             new_password: newPassword,
-        }, { withCredentials: true });
+        });
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.PASSWORD_CHANGE_FAILED');
@@ -227,14 +160,11 @@ export async function logoutSession() {
         if (csrfToken) {
             headers['X-CSRFToken'] = csrfToken;
         }
-        await axios.delete(`${HEADLESS_BASE}/auth/session`, {
-            withCredentials: true,
-            headers,
-        });
+        // CHANGED: axios -> apiClient
+        await apiClient.delete(`${HEADLESS_BASE}/auth/session`, { headers });
     }
     catch (error) {
         if (error.response && [401, 404, 410].includes(error.response.status)) {
-            // Session already gone, nothing to do
             return;
         }
         // eslint-disable-next-line no-console
@@ -242,9 +172,7 @@ export async function logoutSession() {
     }
 }
 export async function fetchHeadlessSession() {
-    const res = await axios.get(`${HEADLESS_BASE}/auth/session`, {
-        withCredentials: true,
-    });
+    const res = await apiClient.get(`${HEADLESS_BASE}/auth/session`);
     return res.data;
 }
 // -----------------------------
@@ -254,7 +182,6 @@ export function startSocialLogin(provider) {
     if (typeof window === 'undefined') {
         throw normaliseApiError(new Error('Auth.SOCIAL_LOGIN_NOT_IN_BROWSER'), 'Auth.SOCIAL_LOGIN_NOT_IN_BROWSER');
     }
-    // Classic allauth HTML flow
     window.location.href = `/accounts/${provider}/login/?process=login`;
 }
 // -----------------------------
@@ -262,11 +189,10 @@ export function startSocialLogin(provider) {
 // -----------------------------
 export async function validateAccessCode(code) {
     try {
-        const res = await axios.post(`${ACCESS_CODES_BASE}/validate/`, { code }, { withCredentials: true });
+        const res = await apiClient.post(`${ACCESS_CODES_BASE}/validate/`, { code });
         return res.data;
     }
     catch (error) {
-        // Default für "irgendwas ist mit dem Code schief"
         throw normaliseApiError(error, 'Auth.ACCESS_CODE_INVALID_OR_INACTIVE');
     }
 }
@@ -276,11 +202,10 @@ export async function requestInviteWithCode(email, accessCode) {
         payload.access_code = accessCode;
     }
     try {
-        const res = await axios.post(`${USERS_BASE}/invite/`, payload, { withCredentials: true });
+        const res = await apiClient.post(`${USERS_BASE}/invite/`, payload);
         return res.data;
     }
     catch (error) {
-        // z.B. bei Netzwerkfehlern oder wenn Backend ausnahmsweise keinen code liefert
         throw normaliseApiError(error, 'Auth.INVITE_FAILED');
     }
 }
@@ -289,17 +214,16 @@ export async function requestInviteWithCode(email, accessCode) {
 // -----------------------------
 export async function verifyResetToken(uid, token) {
     try {
-        const res = await axios.get(`${USERS_BASE}/password-reset/${uid}/${token}/`, { withCredentials: true });
+        const res = await apiClient.get(`${USERS_BASE}/password-reset/${uid}/${token}/`);
         return res.data;
     }
     catch (error) {
-        // Wenn der Link nicht passt oder Netzwerkfehler: generisch als "Link invalid"
         throw normaliseApiError(error, 'Auth.RESET_LINK_INVALID');
     }
 }
 export async function setNewPassword(uid, token, newPassword) {
     try {
-        const res = await axios.post(`${USERS_BASE}/password-reset/${uid}/${token}/`, { new_password: newPassword }, { withCredentials: true });
+        const res = await apiClient.post(`${USERS_BASE}/password-reset/${uid}/${token}/`, { new_password: newPassword });
         return res.data;
     }
     catch (error) {
@@ -307,28 +231,22 @@ export async function setNewPassword(uid, token, newPassword) {
     }
 }
 // -----------------------------
-// WebAuthn / Passkeys: register
+// WebAuthn / Passkeys
 // -----------------------------
 async function registerPasskeyStart({ passwordless = true } = {}) {
     ensureWebAuthnSupport();
-    const res = await axios.get(`${HEADLESS_BASE}/account/authenticators/webauthn`, {
+    const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators/webauthn`, {
         params: passwordless ? { passwordless: true } : {},
-        withCredentials: true,
     });
     const responseBody = res.data || {};
-    // Handle nested 'data' wrapper if present, otherwise use body directly
     const payload = responseBody.data || responseBody;
-    // Extract the inner publicKey structure required by the browser API
     const publicKeyJson = (payload.creation_options && payload.creation_options.publicKey) ||
         payload.publicKey ||
         payload;
     return publicKeyJson;
 }
 async function registerPasskeyComplete(credentialJson, name = 'Passkey') {
-    const res = await axios.post(`${HEADLESS_BASE}/account/authenticators/webauthn`, {
-        credential: credentialJson,
-        name,
-    }, { withCredentials: true });
+    const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/webauthn`, { credential: credentialJson, name });
     return res.data;
 }
 export async function registerPasskey(name = 'Passkey') {
@@ -336,17 +254,13 @@ export async function registerPasskey(name = 'Passkey') {
     if (!hasJsonWebAuthn) {
         throw normaliseApiError(new Error('Auth.PASSKEY_JSON_HELPERS_UNAVAILABLE'), 'Auth.PASSKEY_JSON_HELPERS_UNAVAILABLE');
     }
-    // ... (previous logic for registerPasskeyStart) ...
     const publicKeyJson = await registerPasskeyStart({ passwordless: true });
     let credential;
     try {
         const publicKeyOptions = window.PublicKeyCredential.parseCreationOptionsFromJSON(publicKeyJson);
-        credential = await navigator.credentials.create({
-            publicKey: publicKeyOptions,
-        });
+        credential = await navigator.credentials.create({ publicKey: publicKeyOptions });
     }
     catch (err) {
-        // ... (error handling) ...
         if (err && err.name === 'NotAllowedError') {
             throw normaliseApiError(err, 'Auth.PASSKEY_CREATION_CANCELLED');
         }
@@ -355,27 +269,21 @@ export async function registerPasskey(name = 'Passkey') {
     if (!credential) {
         throw normaliseApiError(new Error('Auth.PASSKEY_CREATION_CANCELLED'), 'Auth.PASSKEY_CREATION_CANCELLED');
     }
-    // CHANGED: Use helper instead of direct .toJSON()
     const credentialJson = serializeCredential(credential);
     return registerPasskeyComplete(credentialJson, name);
 }
-// -----------------------------
-// WebAuthn / Passkeys: login
-// -----------------------------
 async function loginWithPasskeyStart() {
     ensureWebAuthnSupport();
-    const res = await axios.get(`${HEADLESS_BASE}/auth/webauthn/login`, { withCredentials: true });
+    const res = await apiClient.get(`${HEADLESS_BASE}/auth/webauthn/login`);
     const responseBody = res.data || {};
-    // Handle nested 'data' wrapper if present
     const payload = responseBody.data || responseBody;
-    // Extract request options for authentication
     const requestOptionsJson = (payload.request_options && payload.request_options.publicKey) ||
         payload.request_options ||
         payload;
     return requestOptionsJson;
 }
 async function loginWithPasskeyComplete(credentialJson) {
-    const res = await axios.post(`${HEADLESS_BASE}/auth/webauthn/login`, { credential: credentialJson }, { withCredentials: true });
+    const res = await apiClient.post(`${HEADLESS_BASE}/auth/webauthn/login`, { credential: credentialJson });
     return res.data;
 }
 export async function loginWithPasskey() {
@@ -390,7 +298,6 @@ export async function loginWithPasskey() {
         assertion = await navigator.credentials.get({ publicKey: publicKeyOptions });
     }
     catch (err) {
-        // Browser-interner Abbruch (z.B. Dialog weggeklickt)
         const e = new Error('Auth.PASSKEY_AUTH_CANCELLED');
         e.code = 'Auth.PASSKEY_AUTH_CANCELLED';
         throw e;
@@ -413,15 +320,14 @@ export async function loginWithPasskey() {
         return { user };
     }
     catch (err) {
-        if (postError) {
+        if (postError)
             throw normaliseApiError(postError, 'Auth.PASSKEY_FAILED');
-        }
         throw normaliseApiError(err, 'Auth.PASSKEY_FAILED');
     }
 }
 export async function fetchPasskeys() {
     try {
-        const res = await axios.get(`${USERS_BASE}/passkeys/`, { withCredentials: true });
+        const res = await apiClient.get(`${USERS_BASE}/passkeys/`);
         return Array.isArray(res.data) ? res.data : [];
     }
     catch (error) {
@@ -430,7 +336,8 @@ export async function fetchPasskeys() {
 }
 export async function deletePasskey(id) {
     try {
-        await axios.delete(`${USERS_BASE}/passkeys/${id}/`, { withCredentials: true });
+        // CHANGED: axios -> apiClient
+        await apiClient.delete(`${USERS_BASE}/passkeys/${id}/`);
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.PASSKEY_DELETE_FAILED');
@@ -446,7 +353,7 @@ export async function authenticateWithMFA({ code, credential }) {
     if (credential)
         payload.credential = credential;
     try {
-        const res = await axios.post(`${HEADLESS_BASE}/auth/2fa/authenticate`, payload, { withCredentials: true });
+        const res = await apiClient.post(`${HEADLESS_BASE}/auth/2fa/authenticate`, payload);
         return res.data;
     }
     catch (error) {
@@ -454,17 +361,16 @@ export async function authenticateWithMFA({ code, credential }) {
     }
 }
 // -----------------------------
-// Authentication: password (MODIFIZIERT)
+// Authentication: password
 // -----------------------------
 export async function loginWithPassword(email, password) {
     var _a, _b, _c;
     try {
-        await axios.post(`${HEADLESS_BASE}/auth/login`, { email, password }, { withCredentials: true });
+        await apiClient.post(`${HEADLESS_BASE}/auth/login`, { email, password });
     }
     catch (error) {
         const status = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status;
         const body = (_b = error.response) === null || _b === void 0 ? void 0 : _b.data;
-        // Flows können in body.data.flows oder body.flows liegen
         const flows = ((_c = body === null || body === void 0 ? void 0 : body.data) === null || _c === void 0 ? void 0 : _c.flows) || (body === null || body === void 0 ? void 0 : body.flows) || [];
         const mfaFlow = Array.isArray(flows)
             ? flows.find((f) => f.id === 'mfa_authenticate')
@@ -472,45 +378,42 @@ export async function loginWithPassword(email, password) {
         if (status === 401 && mfaFlow && mfaFlow.is_pending) {
             return {
                 needsMfa: true,
-                availableTypes: mfaFlow.types || [], // ["recovery_codes", "totp", "webauthn"]
+                availableTypes: mfaFlow.types || [],
             };
         }
         if (status === 409) {
-            // Already logged in – einfach weitermachen
+            // Already logged in
         }
         else {
             throw normaliseApiError(error, 'Auth.LOGIN_FAILED');
         }
     }
-    // Erfolg ohne MFA
     const user = await fetchCurrentUser();
     return { user, needsMfa: false };
 }
-// 1. Status prüfen (Liste der aktiven Authenticators)
+// -----------------------------
+// Authenticators & MFA
+// -----------------------------
 export async function fetchAuthenticators() {
-    const res = await axios.get(`${HEADLESS_BASE}/account/authenticators`, { withCredentials: true });
+    const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators`);
     const body = res.data || {};
-    // Headless gibt i.d.R. { status, data: [...] } zurück
     const items = Array.isArray(body.data) ? body.data : (Array.isArray(body) ? body : []);
     return items;
 }
-// 2. TOTP Einrichtung starten (liefert Secret & QR-URL)
 export async function requestTotpKey() {
     var _a;
     try {
-        const res = await axios.get(`${HEADLESS_BASE}/account/authenticators/totp`, { withCredentials: true });
-        // Fall: TOTP existiert bereits -> 200
+        const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators/totp`);
         const body = res.data || {};
         const data = body.data || body;
         return {
             exists: true,
-            authenticator: data, // z.B. { id, type, created_at, ... }
+            authenticator: data,
         };
     }
     catch (error) {
         const { response } = error;
         if ((response === null || response === void 0 ? void 0 : response.status) === 404) {
-            // Spezialfall von allauth: noch kein TOTP eingerichtet
             const meta = ((_a = response.data) === null || _a === void 0 ? void 0 : _a.meta) || {};
             return {
                 exists: false,
@@ -523,7 +426,7 @@ export async function requestTotpKey() {
 }
 export async function activateTotp(code) {
     try {
-        const res = await axios.post(`${HEADLESS_BASE}/account/authenticators/totp`, { code }, { withCredentials: true });
+        const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/totp`, { code });
         return res.data;
     }
     catch (error) {
@@ -532,30 +435,26 @@ export async function activateTotp(code) {
 }
 export async function deactivateTotp() {
     try {
-        const res = await axios.delete(`${HEADLESS_BASE}/account/authenticators/totp`, { withCredentials: true });
+        // CHANGED: axios -> apiClient
+        const res = await apiClient.delete(`${HEADLESS_BASE}/account/authenticators/totp`);
         return res.data;
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.TOTP_DEACTIVATE_FAILED');
     }
 }
-// -----------------------------
-// MFA: Recovery Codes
-// -----------------------------
 export async function fetchRecoveryCodes() {
     var _a;
     try {
-        const res = await axios.get(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, { withCredentials: true });
+        const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators/recovery-codes`);
         const body = res.data || {};
-        // Inneres "data" herausziehen, sonst direkt body verwenden
         const data = body.data || body;
-        return data; // { type, unused_codes, ... }
+        return data;
     }
     catch (error) {
         const status = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status;
         if (status === 404) {
-            // Noch keine Codes -> automatisch generieren
-            const resPost = await axios.post(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, {}, { withCredentials: true });
+            const resPost = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, {});
             const body = resPost.data || {};
             const data = body.data || body;
             return data;
@@ -565,7 +464,7 @@ export async function fetchRecoveryCodes() {
 }
 export async function generateRecoveryCodes() {
     try {
-        const res = await axios.post(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, {}, { withCredentials: true });
+        const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, {});
         const body = res.data || {};
         const data = body.data || body;
         return data;
@@ -576,14 +475,13 @@ export async function generateRecoveryCodes() {
 }
 export async function fetchOrGenerateRecoveryCodes() {
     try {
-        const res = await axios.get(`${HEADLESS_BASE}/mfa/recovery_codes`, { withCredentials: true });
+        const res = await apiClient.get(`${HEADLESS_BASE}/mfa/recovery_codes`);
         return res.data;
     }
     catch (error) {
         const { response } = error;
         if ((response === null || response === void 0 ? void 0 : response.status) === 404) {
-            // Noch keine Codes -> jetzt generieren
-            const resPost = await axios.post(`${HEADLESS_BASE}/mfa/recovery_codes`, {}, { withCredentials: true });
+            const resPost = await apiClient.post(`${HEADLESS_BASE}/mfa/recovery_codes`, {});
             return resPost.data;
         }
         throw normaliseApiError(error, 'Auth.RECOVERY_CODES_FETCH_FAILED');
@@ -592,34 +490,29 @@ export async function fetchOrGenerateRecoveryCodes() {
 export function isStrongSession(session) {
     const methods = (session === null || session === void 0 ? void 0 : session.methods) || [];
     const used = methods.map((m) => m.method);
-    // alles, was klar 2FA / starker Faktor ist:
     const strongMethods = ['totp', 'recovery_codes', 'webauthn'];
     return used.some((m) => strongMethods.includes(m));
 }
 export async function requestMfaSupportHelp(emailOrIdentifier, message = '') {
-    // Wir nutzen hier die Users-API, nicht HEADLESS_BASE
     const payload = { email: emailOrIdentifier, message };
-    const res = await axios.post(`${USERS_BASE}/mfa/support-help/`, payload, { withCredentials: true });
+    const res = await apiClient.post(`${USERS_BASE}/mfa/support-help/`, payload);
     return res.data;
 }
 export async function fetchRecoveryRequests(status = 'pending') {
-    const res = await axios.get('/api/support/recovery-requests/', {
-        params: { status },
-        withCredentials: true,
-    });
+    const res = await apiClient.get('/api/support/recovery-requests/', { params: { status } });
     return res.data;
 }
 export async function approveRecoveryRequest(id, supportNote) {
-    const res = await axios.post(`/api/support/recovery-requests/${id}/approve/`, { support_note: supportNote || '' }, { withCredentials: true });
+    const res = await apiClient.post(`/api/support/recovery-requests/${id}/approve/`, { support_note: supportNote || '' });
     return res.data;
 }
 export async function rejectRecoveryRequest(id, supportNote) {
-    const res = await axios.post(`/api/support/recovery-requests/${id}/reject/`, { support_note: supportNote || '' }, { withCredentials: true });
+    const res = await apiClient.post(`/api/support/recovery-requests/${id}/reject/`, { support_note: supportNote || '' });
     return res.data;
 }
 export async function loginWithRecoveryPassword(email, password, token) {
     try {
-        await axios.post(`/api/support/recovery-requests/recovery-login/${token}/`, { email, password }, { withCredentials: true });
+        await apiClient.post(`/api/support/recovery-requests/recovery-login/${token}/`, { email, password });
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.RECOVERY_LOGIN_FAILED');

package/dist/auth/webauthnClient.js

@@ -1,9 +1,10 @@
+//src/auth/webauthnclient.jsx
 export async function registerPasskeyStart() {
-    const res = await axios.post(`${HEADLESS_BASE}/mfa/webauthn/register/start`, {}, { withCredentials: true });
+    const res = await apiClient.post(`${HEADLESS_BASE}/mfa/webauthn/register/start`, {}, { withCredentials: true });
     return res.data; // enthält challenge, rpId etc.
 }
 export async function registerPasskeyComplete(publicKeyCredential) {
     const payload = serializePublicKeyCredential(publicKeyCredential);
-    const res = await axios.post(`${HEADLESS_BASE}/mfa/webauthn/register/complete`, payload, { withCredentials: true });
+    const res = await apiClient.post(`${HEADLESS_BASE}/mfa/webauthn/register/complete`, payload, { withCredentials: true });
     return res.data;
 }

package/dist/components/AccessCodeManager.js

@@ -27,7 +27,7 @@ export function AccessCodeManager() {
         setErrorKey(null);
         setSuccessKey(null);
         try {
-            const res = await axios.get(`${ACCESS_CODES_BASE}/`, {
+            const res = await apiClient.get(`${ACCESS_CODES_BASE}/`, {
                 withCredentials: true,
             });
             setCodes(res.data || []);
@@ -54,7 +54,7 @@ export function AccessCodeManager() {
         setErrorKey(null);
         setSuccessKey(null);
         try {
-            const res = await axios.post(`${ACCESS_CODES_BASE}/`, { code }, { withCredentials: true });
+            const res = await apiClient.post(`${ACCESS_CODES_BASE}/`, { code }, { withCredentials: true });
             setCodes((prev) => [...prev, res.data]);
             setSuccessKey('Auth.ACCESS_CODE_SAVE_SUCCESS');
         }
@@ -71,7 +71,7 @@ export function AccessCodeManager() {
     };
     const handleAddManual = async () => {
         if (!manualCode.trim()) {
-            setErrorKey('Auth.ACCESS_CODE_REQUIRED_ADMIN');
+            setErrorKey('Auth.SIGNUP_ACCESS_CODE_REQUIRED');
             return;
         }
         await handleCreateCode(manualCode.trim());
@@ -95,7 +95,7 @@ export function AccessCodeManager() {
         return (_jsx(Box, { sx: { py: 3, display: 'flex', justifyContent: 'center' }, children: _jsx(CircularProgress, {}) }));
     }
     return (_jsxs(Box, { sx: { mt: 2 }, children: [errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey) })), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey) })), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_ACTIVE') }), codes.length === 0 ? (_jsx(Typography, { variant: "body2", children: t('Auth.ACCESS_CODE_NONE') })) : (_jsx(Stack, { direction: "row", flexWrap: "wrap", gap: 1, children: codes.map((code) => (_jsx(Chip, { label: code.code, onDelete: () => handleDelete(code.id), deleteIcon: _jsx(CloseIcon, {}) }, code.id))) }))] }), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_GENERATE') }), _jsxs(Box, { sx: { maxWidth: 360 }, children: [_jsx(Typography, { variant: "body2", gutterBottom: true, children: t('Auth.ACCESS_CODE_LENGTH_LABEL', { length }) }), _jsx(Slider, { min: 6, max: 32, step: 1, value: length, onChange: (_, val) => setLength(val), valueLabelDisplay: "auto", disabled: submitting })] }), _jsx(Button, { variant: "contained", sx: { mt: 1 }, onClick: handleGenerateClick, disabled: submitting, children: submitting
-                            ? t('Auth.ACCESS_CODE_SAVING')
+                            ? t('Auth.SAVE_BUTTON_LOADING')
                             : t('Auth.ACCESS_CODE_GENERATE_BUTTON') })] }), _jsxs(Box, { sx: { mb: 2, maxWidth: 360 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_MANUAL') }), _jsxs(Box, { sx: { display: 'flex', gap: 1 }, children: [_jsx(TextField, { label: t('Auth.ACCESS_CODE_LABEL'), fullWidth: true, value: manualCode, onChange: (e) => setManualCode(e.target.value), disabled: submitting }), _jsx(Button, { variant: "outlined", onClick: handleAddManual, disabled: submitting, children: t('Auth.ACCESS_CODE_ADD_BUTTON') })] })] })] }));
 }
 export default AccessCodeManager;

package/dist/components/LoginForm.js

@@ -21,6 +21,6 @@ disabled = false, initialIdentifier = '', }) => {
     const supportsPasskey = !!onPasskeyLogin &&
         typeof window !== 'undefined' &&
         !!window.PublicKeyCredential;
-    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), _jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.LOGIN_SUBMIT') })] }), _jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin })] }), _jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", sx: { mb: 1 }, children: t('Auth.LOGIN_ACCOUNT_RECOVERY_TITLE') }), _jsxs(Box, { sx: { display: 'flex', gap: 1, flexWrap: 'wrap' }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), _jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') })] })] })] }));
+    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), _jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] }), _jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin })] }), _jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", sx: { mb: 1 }, children: t('Auth.LOGIN_ACCOUNT_RECOVERY_TITLE') }), _jsxs(Box, { sx: { display: 'flex', gap: 1, flexWrap: 'wrap' }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), _jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') })] })] })] }));
 };
 export default LoginForm;