@startsimpli/auth 0.4.5 → 0.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/__tests__/auth-functions.test.ts

@@ -85,18 +85,15 @@ function makeJwt(payload: object): string {
 
 const VALID_TOKEN = makeJwt({ exp: Math.floor(Date.now() / 1000) + 3600, user_id: '1' });
 
-describe('CSRF token on signin/register', () => {
+describe('CSRF not required for signin/register (endpoints are @csrf_exempt)', () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockSessionStorage.clear();
     mockLocalStorage.clear();
   });
 
-  it('signInWithCredentials sends X-CSRFToken header', async () => {
-    mockFetch.mockImplementation((url: string) => {
-      if (url.includes('/csrf/')) {
-        return Promise.resolve({ ok: true });
-      }
+  it('signInWithCredentials does not fetch or send CSRF token', async () => {
+    mockFetch.mockImplementation(() => {
       return Promise.resolve({
         ok: true,
         status: 200,
@@ -106,20 +103,23 @@ describe('CSRF token on signin/register', () => {
 
     await signInWithCredentials('test@test.com', 'password');
 
-    // Find the token endpoint call (not the csrf call)
+    // Should NOT call the CSRF endpoint
+    const csrfCall = mockFetch.mock.calls.find(
+      (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/csrf/')
+    );
+    expect(csrfCall).toBeUndefined();
+
+    // Token endpoint call should not include X-CSRFToken header
     const tokenCall = mockFetch.mock.calls.find(
       (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/auth/token/') && !(c[0] as string).includes('csrf') && !(c[0] as string).includes('refresh')
     );
     expect(tokenCall).toBeDefined();
     const headers = tokenCall![1]?.headers;
-    expect(headers['X-CSRFToken']).toBe('test-csrf');
+    expect(headers['X-CSRFToken']).toBeUndefined();
   });
 
-  it('registerAccount sends X-CSRFToken header', async () => {
-    mockFetch.mockImplementation((url: string) => {
-      if (url.includes('/csrf/')) {
-        return Promise.resolve({ ok: true });
-      }
+  it('registerAccount does not fetch or send CSRF token', async () => {
+    mockFetch.mockImplementation(() => {
       return Promise.resolve({
         ok: true,
         status: 200,
@@ -133,12 +133,18 @@ describe('CSRF token on signin/register', () => {
       passwordConfirm: 'securepassword',
     });
 
+    // Should NOT call the CSRF endpoint
+    const csrfCall = mockFetch.mock.calls.find(
+      (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/csrf/')
+    );
+    expect(csrfCall).toBeUndefined();
+
     const registerCall = mockFetch.mock.calls.find(
       (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/auth/register/')
     );
     expect(registerCall).toBeDefined();
     const headers = registerCall![1]?.headers;
-    expect(headers['X-CSRFToken']).toBe('test-csrf');
+    expect(headers['X-CSRFToken']).toBeUndefined();
   });
 });
 

package/src/client/functions.ts

@@ -243,13 +243,11 @@ function parseAuthResponse(data: unknown): { access?: string; user?: AuthUser }
 // --- Auth functions ---
 
 export async function signInWithCredentials(email: string, password: string) {
-  await fetchCsrfToken();
-  const csrfToken = getCsrfToken();
+  // No CSRF needed — Django's /auth/token/ is @csrf_exempt (JWT endpoint)
   const response = await fetchWithTimeout(resolveAuthUrl(AUTH_PATHS.TOKEN), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
-      ...(csrfToken ? { 'X-CSRFToken': csrfToken } : {}),
     },
     credentials: 'include',
     body: JSON.stringify({ email, password }),
@@ -286,13 +284,11 @@ export async function registerAccount(payload: {
   const [firstFromName, ...rest] = rawName ? rawName.split(/\s+/) : [];
   const lastFromName = rest.length ? rest.join(' ') : undefined;
 
-  await fetchCsrfToken();
-  const csrfToken = getCsrfToken();
+  // No CSRF needed — Django's /auth/register/ is @csrf_exempt
   const response = await fetchWithTimeout(resolveAuthUrl(AUTH_PATHS.REGISTER), {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
-      ...(csrfToken ? { 'X-CSRFToken': csrfToken } : {}),
     },
     credentials: 'include',
     body: JSON.stringify({