@snokam/auth 2.2.22-alpha.0 → 2.3.0

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "2.2.22-alpha.0",
-  "main": "lib/index.js",
-  "typings": "lib/index.d.ts",
+  "version": "2.3.0",
+  "main": "src/index.tsx",
+  "types": "src/index.tsx",
   "files": [
-    "lib",
+    "src",
     "package.json",
     "CHANGELOG.md"
   ],
@@ -14,58 +14,46 @@
     "url": "ssh://git@github.com:snokam/components.git",
     "directory": "@snokam/auth"
   },
-  "scripts": {
-    "start": "webpack --watch --config=../../../webpack/webpack.dev.js",
-    "build": "webpack --config=../../../webpack/webpack.prod.js",
-    "build:doc": "webpack --config=../../../webpack/webpack.dev.js",
-    "clean": "rm -rf lib"
-  },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@azure/msal-node": "^3.7.3",
+    "@azure/msal-node": "^5.4.2",
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.1",
-    "@mui/material": "^7.3.2",
-    "@snokam/core": "^1.4.5",
-    "next-auth": "^4.24.11",
-    "path-to-regexp": "^8.3.0"
+    "@mui/material": "^9.2.0",
+    "next-auth": "4.24.15",
+    "path-to-regexp": "^8.4.2",
+    "@snokam/employees-client": "1.0.0",
+    "@snokam/identity": "1.1.0",
+    "@snokam/config": "1.1.0",
+    "@snokam/platform-client": "1.0.0",
+    "@snokam/react-query": "1.1.0",
+    "@snokam/ui": "1.1.0"
   },
   "peerDependencies": {
-    "next": "*",
-    "react": "*",
-    "react-dom": "*"
+    "next": "16.2.11",
+    "react": "19.2.8",
+    "react-dom": "19.2.8"
   },
-  "exports": {
-    ".": {
-      "import": "./lib/index.js",
-      "require": "./lib/index.js",
-      "types": "./lib/index.d.ts"
-    },
-    "./server": {
-      "import": "./lib/server.js",
-      "require": "./lib/server.js",
-      "types": "./lib/server.d.ts"
-    },
-    "./middleware": {
-      "import": "./lib/middleware.js",
-      "require": "./lib/middleware.js",
-      "types": "./lib/middleware.d.ts"
-    }
+  "devDependencies": {
+    "@types/react": "^19.2.17",
+    "@types/react-dom": "^19.2.3"
   },
-  "typesVersions": {
-    "*": {
-      "*": [
-        "lib/index.d.ts"
-      ],
-      "server": [
-        "lib/server.d.ts"
-      ],
-      "middleware": [
-        "lib/middleware.d.ts"
-      ]
-    }
+  "exports": {
+    ".": "./src/index.tsx",
+    "./config": "./src/config.ts",
+    "./server": "./src/server.tsx",
+    "./middleware": "./src/build-proxy.tsx",
+    "./route-handler": "./src/route-handler.ts",
+    "./page-router": "./src/page-router/index.tsx",
+    "./page-router/server": "./src/page-router/server.ts",
+    "./app-router": "./src/app-router/index.tsx",
+    "./app-router/server": "./src/app-router/server.ts",
+    "./password": "./src/password/api.ts",
+    "./sso-tenant": "./src/sso/tenant-cookie.ts"
   },
-  "gitHead": "97d0b6543286e059de634fd63fc25d5da612d7a0"
-}
+  "scripts": {
+    "lint": "eslint ."
+  }
+}

package/src/app-router/components/AuthComplete.styled.tsx

@@ -0,0 +1,17 @@
+import styled from "@emotion/styled";
+
+export const RetryLink = styled.a`
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.6rem 1.4rem;
+  border-radius: 999px;
+  background: var(--o-cyan);
+  color: var(--o-cyan-ink);
+  font-weight: 600;
+  text-decoration: none;
+
+  &:hover {
+    filter: brightness(0.95);
+  }
+`;

package/src/app-router/components/AuthComplete.tsx

@@ -0,0 +1,52 @@
+"use client";
+
+import { useEffect, useRef, useState } from "react";
+import { useSearchParams } from "next/navigation";
+import { signIn } from "next-auth/react";
+import { PageLoader } from "@snokam/ui";
+import Error from "../../components/Error";
+import { RetryLink } from "./AuthComplete.styled";
+
+export const AuthComplete = () => {
+  const params = useSearchParams();
+  const done = useRef(false);
+  const [failed, setFailed] = useState(false);
+
+  useEffect(() => {
+    if (done.current) {
+      return;
+    }
+    const ticket = params.get("ticket");
+    if (!ticket) {
+      return;
+    }
+    done.current = true;
+    signIn("handoff", {
+      ticket,
+      callbackUrl: params.get("callbackUrl") || "/",
+      redirect: false,
+    }).then((result) => {
+      if (result?.ok && result.url) {
+        window.location.href = result.url;
+      } else {
+        setFailed(true);
+      }
+    });
+  }, [params]);
+
+  if (failed) {
+    return (
+      <Error
+        heading="Innlogging mislyktes"
+        message="Vi klarte ikke å fullføre innloggingen. Prøv igjen, eller ta kontakt med support hvis problemet vedvarer."
+        action={
+          <RetryLink href="/auth/login?callbackUrl=%2F">Prøv igjen</RetryLink>
+        }
+      />
+    );
+  }
+
+  return <PageLoader />;
+};
+
+export default AuthComplete;

package/src/app-router/components/Login.tsx

@@ -0,0 +1,120 @@
+"use client";
+
+import { useEffect, useState, useRef } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { useAuth } from "../../hooks";
+import { signIn } from "next-auth/react";
+import { PageLoader } from "@snokam/ui";
+import { useOptionalConfig } from "@snokam/config";
+import { safeCallbackTarget } from "../../utils/callback-url";
+import Error from "../../components/Error";
+import Consent from "../../components/Consent";
+import LoggedOut from "../../components/LoggedOut";
+
+export const Login = () => {
+  const { inProgress, isAuthenticated } = useAuth();
+  const [callbackUrl, setCallbackUrl] = useState<string | null>(null);
+  const [authParams, setAuthParams] = useState<Record<string, string>>({});
+  const [errorKind, setErrorKind] = useState<string | null>(null);
+  const [loggedOut, setLoggedOut] = useState(false);
+  const hasSignedIn = useRef(false);
+  const router = useRouter();
+  const searchParams = useSearchParams();
+  const config = useOptionalConfig();
+  const central = config?.NEXT_PUBLIC_CENTRAL_AUTH_URL;
+  const isError = !!errorKind;
+
+  useEffect(() => {
+    const rawCallbackUrl = searchParams.get("callbackUrl");
+    setCallbackUrl(rawCallbackUrl ? safeCallbackTarget(rawCallbackUrl) : null);
+    setErrorKind(searchParams.get("error"));
+    setLoggedOut(searchParams.get("loggedOut") === "1");
+
+    const authParamsObj: Record<string, string> = {};
+    searchParams.forEach((value, key) => {
+      if (key !== "error" && key !== "callbackUrl" && key !== "loggedOut") {
+        authParamsObj[key] = value;
+      }
+    });
+    setAuthParams(authParamsObj);
+  }, [searchParams]);
+
+  const startSignIn = (extraParams: Record<string, string> = {}) => {
+    const target = callbackUrl || "/";
+    const onLocalhost = window.location.hostname === "localhost";
+    const onCentral =
+      onLocalhost || (central && central.startsWith(window.location.origin));
+    if (central && !onCentral) {
+      const returnTo = `${window.location.origin}${target}`;
+      const prompt = extraParams.prompt
+        ? `&prompt=${encodeURIComponent(extraParams.prompt)}`
+        : "";
+      window.location.href = `${central}/handoff/start?returnTo=${encodeURIComponent(
+        returnTo
+      )}${prompt}`;
+    } else {
+      signIn(
+        "azure-ad",
+        { callbackUrl: target },
+        { ...authParams, ...extraParams }
+      );
+    }
+  };
+
+  useEffect(() => {
+    if (!callbackUrl) {
+      return;
+    }
+    if (isError) {
+      return;
+    }
+    if (hasSignedIn.current) {
+      return;
+    }
+    if (inProgress) {
+      return;
+    }
+
+    if (isAuthenticated) {
+      router.replace(callbackUrl || "/");
+    } else if (!loggedOut) {
+      hasSignedIn.current = true;
+      startSignIn();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [
+    inProgress,
+    isAuthenticated,
+    callbackUrl,
+    router,
+    isError,
+    central,
+    loggedOut,
+  ]);
+
+  if (loggedOut && !isAuthenticated && !isError) {
+    return (
+      <LoggedOut onLogin={() => startSignIn({ prompt: "select_account" })} />
+    );
+  }
+
+  if (errorKind === "consent") {
+    if (
+      typeof window !== "undefined" &&
+      !sessionStorage.getItem("auth-consent-retried")
+    ) {
+      sessionStorage.setItem("auth-consent-retried", "1");
+      signIn("azure-ad", { callbackUrl: callbackUrl || "/" }, authParams);
+      return <PageLoader />;
+    }
+    return <Consent />;
+  }
+
+  if (isError) {
+    return <Error />;
+  }
+
+  return <PageLoader />;
+};
+
+export default Login;

package/src/app-router/components/Provider/index.tsx

@@ -0,0 +1,55 @@
+"use client";
+
+import { memo, ReactNode, Suspense, useEffect } from "react";
+import { useSearchParams } from "next/navigation";
+import { Auth } from "../../../utils/types";
+import { Authenticate } from "../../../components/Authenticate";
+import { SessionProvider } from "next-auth/react";
+import { useAuth } from "../../../hooks";
+import { EmployeeThemeSync } from "../../../theme/employee-theme-sync";
+
+export const Provider = memo((props: Auth.Provider.Props) => {
+  const { session, children } = props;
+
+  return (
+    <SessionProvider session={session ?? undefined}>
+      <EmployeeThemeSync />
+      <Suspense fallback={<>{children}</>}>
+        <ProviderInner {...props}>{children}</ProviderInner>
+      </Suspense>
+    </SessionProvider>
+  );
+});
+
+const ProviderInner = (props: Auth.Provider.Props) => {
+  const { children, enforceLogin } = props;
+  const searchParams = useSearchParams();
+  const enforceLoginParam = searchParams?.get("enforceLogin");
+
+  if (enforceLoginParam || enforceLogin) {
+    return (
+      <Authenticate provider="azure-ad" {...props}>
+        {children}
+      </Authenticate>
+    );
+  }
+
+  return <Wrapper>{children}</Wrapper>;
+};
+
+const Wrapper = ({ children }: { children: ReactNode }) => {
+  const { signOut } = useAuth();
+  const searchParams = useSearchParams();
+
+  useEffect(() => {
+    if (searchParams?.get("logout") === "true") {
+      signOut({
+        callbackUrl: "/auth/login?callbackUrl=/",
+      });
+    }
+  }, [searchParams, signOut]);
+
+  return <>{children}</>;
+};
+
+export default Provider;

package/src/app-router/index.tsx

@@ -0,0 +1,56 @@
+"use client";
+
+import { Provider } from "./components/Provider";
+import { Authenticate } from "../components/Authenticate";
+import { Login } from "./components/Login";
+import { AuthComplete } from "./components/AuthComplete";
+import { Error } from "../components/Error";
+import { NotProvisioned } from "../components/NotProvisioned";
+import { EmployeeGate } from "../components/EmployeeGate";
+
+export { Unauthenticated } from "../components/Unauthenticated";
+export { Authenticated } from "../components/Authenticated";
+export { useAuth } from "../hooks";
+export { EmployeeThemeSync } from "../theme/employee-theme-sync";
+export { ScopesProvider, useScopes, useHasScope } from "../scopes/context";
+export {
+  usePlatformRoles,
+  useHasPlatformRole,
+  PLATFORM_ADMIN,
+  PLATFORM_OPERATOR,
+} from "../roles/context";
+export type { RolesState } from "../roles/context";
+export type { ScopesState } from "../scopes/context";
+export {
+  scopeGranted,
+  resolveEmployeeScopes,
+  type ScopeAccess,
+} from "../scopes/matcher";
+export {
+  ImpersonationProvider,
+  useImpersonation,
+} from "../impersonation/context";
+export type { ImpersonationActive } from "../impersonation/cookies";
+export { signIn, SessionProvider } from "next-auth/react";
+export {
+  Login,
+  AuthComplete,
+  Error,
+  Provider,
+  Authenticate,
+  NotProvisioned,
+  EmployeeGate,
+};
+
+export default {
+  Login,
+  AuthComplete,
+  Error,
+  Provider,
+  Authenticate,
+  NotProvisioned,
+  EmployeeGate,
+};
+
+export type { Session } from "next-auth";
+export type { Auth } from "../utils/types";

package/src/app-router/server.ts

@@ -0,0 +1,93 @@
+import {
+  getServerSession as nextAuthGetServerSession,
+  type Session,
+} from "next-auth";
+import type { NextAuthOptions } from "next-auth";
+import { headers } from "next/headers";
+import { getTenantDomains } from "@snokam/config";
+import { getManagedBearer } from "@snokam/identity";
+
+export { getServerToken } from "../server/token";
+export { getNextAuthOptions } from "../options";
+export type { Auth } from "../utils/types";
+
+export async function serverTenantToken(): Promise<string | undefined> {
+  const scope = serverApiScope();
+  if (!scope) return undefined;
+  return getManagedBearer(scope);
+}
+
+export async function resolveServerApiBase(service: string): Promise<string> {
+  if (!service) return "";
+  const envKey = `NEXT_PUBLIC_${service.toUpperCase().replace(/-/g, "_")}_API_BASE_URL`;
+  const override = process.env[envKey];
+  if (
+    override &&
+    (override.includes("localhost") || override.includes("127.0.0.1"))
+  ) {
+    return override;
+  }
+
+  const requestHeaders = await headers();
+  const host =
+    requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
+  const domains = await getTenantDomains({
+    host,
+    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
+    authToken: await serverTenantToken(),
+  });
+  const custom = domains.find(
+    (domain) => domain.type === "backend" && domain.env === envKey
+  );
+  if (custom?.url) return custom.url;
+
+  const bare = host?.split(":")[0];
+  const tenantHost = (
+    bare === "localhost" || bare === "127.0.0.1"
+      ? process.env.NEXT_PUBLIC_TENANT_HOST
+      : host
+  )?.split(":")[0];
+  return tenantHost ? `https://${tenantHost}/api/${service}` : (override ?? "");
+}
+
+export function serverApiScope(): string {
+  const clientId = process.env.NEXT_PUBLIC_AZURE_AD_CLIENT_ID ?? "";
+  return clientId ? `api://${clientId}/user_impersonation` : "";
+}
+
+export async function resolveServerAppUrl(app: string): Promise<string> {
+  const requestHeaders = await headers();
+  const host =
+    requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
+  const domains = await getTenantDomains({
+    host,
+    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
+    authToken: await serverTenantToken(),
+  });
+  const match = domains.find(
+    (domain) => domain.type === "frontend" && domain.app === app
+  );
+  if (match?.url) return match.url;
+
+  const bare = host?.split(":")[0];
+  const effective =
+    !bare || bare === "localhost" || bare === "127.0.0.1"
+      ? process.env.NEXT_PUBLIC_TENANT_HOST?.split(":")[0]
+      : host;
+  return effective ? `https://${effective}` : "";
+}
+
+export async function getServerSession(
+  authOptions: NextAuthOptions
+): Promise<Session | null> {
+  return nextAuthGetServerSession(authOptions);
+}
+
+export async function getAuth(authOptions: NextAuthOptions) {
+  const session = await getServerSession(authOptions);
+  return {
+    isAuthenticated: !!session,
+    session,
+    user: session?.user,
+  };
+}

package/src/build-proxy.tsx

@@ -0,0 +1,160 @@
+import { match } from "path-to-regexp";
+import { getToken } from "next-auth/jwt";
+import { type NextRequestWithAuth } from "next-auth/middleware";
+import { NextResponse, NextFetchEvent } from "next/server";
+import { Auth } from "./utils/types";
+import { getSessionCookieSettings } from "./utils/cookies";
+import { addCorsHeaders } from "./utils/cors";
+import { getAuthUrl } from "./utils/url";
+
+export function buildAuthMiddleware({
+  matcher = [],
+  callbacks = {},
+  protectAllRoutes,
+  cors = {},
+  ...rest
+}: Auth.Middleware.Props = {}): Auth.Middleware.Builder {
+  const requireLogin = process.env.IS_PR === "true";
+  const { name } = getSessionCookieSettings(getAuthUrl());
+
+  const shouldProtectPath = (pathname: string): boolean => {
+    if (pathname.startsWith("/api/healthy")) {
+      return false;
+    }
+
+    if (pathname.startsWith("/api/ready")) {
+      return false;
+    }
+
+    if (pathname.startsWith("/auth/")) {
+      return false;
+    }
+
+    if (requireLogin) {
+      return !pathname.startsWith("/_next") && !/\.[^/]+$/.test(pathname);
+    }
+
+    if (protectAllRoutes && matcher?.length === 0) {
+      return true;
+    }
+
+    return matcher.some((pattern) => {
+      if (!pattern) {
+        return false;
+      }
+
+      if (pattern.startsWith("/") && pattern.endsWith(")")) {
+        const cleanPattern = pattern.substring(1);
+        let fixedPattern = cleanPattern;
+        if (cleanPattern.startsWith("((?!") && !cleanPattern.startsWith("^")) {
+          fixedPattern = "^" + cleanPattern;
+        }
+
+        const regex = new RegExp(fixedPattern);
+        const cleanPathname = pathname.startsWith("/")
+          ? pathname.substring(1)
+          : pathname;
+        return regex.test(cleanPathname);
+      }
+
+      if (pattern.endsWith(":path*")) {
+        const base = pattern.replace(/\/:path\*$/, "");
+        return pathname.startsWith(base);
+      }
+
+      try {
+        return match(pattern, { end: true })(pathname) !== false;
+      } catch (error) {
+        console.warn(`Invalid path pattern in auth middleware: ${error}`);
+        return false;
+      }
+    });
+  };
+
+  const signInPage = "/auth/login";
+  const errorPage = "/api/auth/error";
+  const publicPaths = ["/api/auth", "/_next", "/favicon.ico"];
+
+  const authorized =
+    callbacks.authorized ??
+    (({ req, token }: { req: NextRequestWithAuth; token: unknown }) => {
+      return shouldProtectPath(req.nextUrl.pathname) ? !!token : true;
+    });
+
+  const authMiddleware = async (req: NextRequestWithAuth) => {
+    const { pathname, search, origin, basePath } = req.nextUrl;
+
+    if (
+      [signInPage, errorPage].includes(pathname) ||
+      publicPaths.some((p) => pathname.startsWith(p))
+    ) {
+      return;
+    }
+
+    const secret =
+      rest.secret ?? process.env.NEXTAUTH_SECRET ?? process.env.AUTH_SECRET;
+    if (!secret) {
+      console.error("[next-auth][error][NO_SECRET]");
+      const errorUrl = new URL(`${basePath}${errorPage}`, origin);
+      errorUrl.searchParams.append("error", "Configuration");
+      return NextResponse.redirect(errorUrl);
+    }
+
+    const token = await getToken({
+      req,
+      decode: rest.jwt?.decode,
+      cookieName: rest.cookies?.sessionToken?.name ?? name,
+      secret,
+    });
+
+    const isAuthorized = (await authorized({ req, token })) ?? !!token;
+    if (isAuthorized) {
+      req.nextauth = { token };
+      return;
+    }
+
+    const signInUrl = new URL(`${basePath}${signInPage}`, origin);
+    signInUrl.searchParams.append(
+      "callbackUrl",
+      `${basePath}${pathname}${search}`
+    );
+    return NextResponse.redirect(signInUrl);
+  };
+
+  const corsEnabled = cors.enabled !== false;
+  const corsAllRoutes = cors.allRoutes === true;
+
+  const middleware = async (
+    request: NextRequestWithAuth,
+    _event: NextFetchEvent
+  ) => {
+    const origin = request.headers.get("origin");
+    const isApiRoute = request.nextUrl.pathname.startsWith("/api/");
+    const applyCors = corsEnabled && (isApiRoute || corsAllRoutes);
+
+    if (applyCors && request.method === "OPTIONS") {
+      const response = new NextResponse(null, { status: 204 });
+      return addCorsHeaders(response, origin, cors);
+    }
+
+    const authResponse = await authMiddleware(request);
+
+    if (applyCors) {
+      const response =
+        authResponse instanceof NextResponse
+          ? authResponse
+          : NextResponse.next();
+      return addCorsHeaders(response, origin, cors);
+    }
+
+    return authResponse;
+  };
+
+  const config = matcher?.length > 0 ? { matcher } : undefined;
+
+  return { proxy: middleware, config };
+}
+
+const { proxy, config } = buildAuthMiddleware();
+export { config };
+export default proxy;