@snokam/auth 2.2.22-alpha.0 → 2.3.0

package/src/impersonation/routes.ts

@@ -0,0 +1,30 @@
+import { Auth } from "../utils/types";
+import {
+  createImpersonationStartHandler,
+  createImpersonationEndHandler,
+  createImpersonationAdoptHandler,
+} from "./handlers";
+
+type OpContext = { params: Promise<{ op: string }> };
+
+// One catch-all mount per app: api/impersonation/[op]/route.ts re-exports { GET, POST }.
+// POST /start + /end, GET /adopt — so every app supports view-as with a single file.
+export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
+  const start = createImpersonationStartHandler(authConfig);
+  const end = createImpersonationEndHandler(authConfig);
+  const adopt = createImpersonationAdoptHandler(authConfig);
+
+  return {
+    async GET(request: Request, ctx: OpContext) {
+      const { op } = await ctx.params;
+      if (op === "adopt") return adopt(request);
+      return new Response("Not found", { status: 404 });
+    },
+    async POST(request: Request, ctx: OpContext) {
+      const { op } = await ctx.params;
+      if (op === "start") return start(request);
+      if (op === "end") return end(request);
+      return new Response("Not found", { status: 404 });
+    },
+  };
+}

package/src/impersonation/ticket.ts

@@ -0,0 +1,79 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from "crypto";
+
+// Cross-domain Vis som hand-off, sealed with the shared NEXTAUTH_SECRET — same trust model as login's ticket.
+export interface ImpersonationTicket {
+  accessToken: string;
+  expiresOn: number;
+  tokenId: string;
+  targetEmail: string;
+  targetName?: string | null;
+  finance: boolean;
+  business: string;
+  returnTo?: string;
+}
+
+const ALGORITHM = "aes-256-gcm";
+const TTL_SECONDS = 120;
+
+const keyFromSecret = (secret: string): Buffer => {
+  if (!secret)
+    throw new Error(
+      "NEXTAUTH_SECRET is empty; refusing to seal/open a forgeable impersonation ticket."
+    );
+  return createHash("sha256").update(secret).digest();
+};
+
+export function sealImpersonationTicket(
+  claims: ImpersonationTicket,
+  secret: string,
+  ttlSeconds: number = TTL_SECONDS
+): string {
+  const payload = JSON.stringify({
+    ...claims,
+    exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+  });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv(ALGORITHM, keyFromSecret(secret), iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(payload, "utf8"),
+    cipher.final(),
+  ]);
+  return [iv, cipher.getAuthTag(), ciphertext]
+    .map((part) => part.toString("base64url"))
+    .join(".");
+}
+
+export function openImpersonationTicket(
+  ticket: string,
+  secret: string,
+  expectedBusiness?: string,
+  now: number = Date.now()
+): ImpersonationTicket | null {
+  const parts = ticket.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const [iv, tag, ciphertext] = parts.map((part) =>
+      Buffer.from(part, "base64url")
+    );
+    const decipher = createDecipheriv(ALGORITHM, keyFromSecret(secret), iv);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]).toString("utf8");
+    const payload = JSON.parse(plaintext) as ImpersonationTicket & {
+      exp: number;
+    };
+    if (payload.exp * 1000 < now) return null;
+    if (expectedBusiness && payload.business !== expectedBusiness) return null;
+    const { exp: _exp, ...claims } = payload;
+    return claims;
+  } catch {
+    return null;
+  }
+}

package/src/index.tsx

@@ -0,0 +1,31 @@
+import { Provider } from "./page-router/components/Provider";
+import { Authenticate } from "./components/Authenticate";
+import { Login } from "./page-router/components/Login";
+import { Auth } from "./utils/types";
+import { Error } from "./components/Error";
+
+export { Unauthenticated } from "./components/Unauthenticated";
+export { Authenticated } from "./components/Authenticated";
+
+export { useAuth, clearAuthTokenCache } from "./hooks";
+export { ScopesProvider, useScopes, useHasScope } from "./scopes/context";
+export type { ScopesState } from "./scopes/context";
+export {
+  scopeGranted,
+  resolveEmployeeScopes,
+  type ScopeAccess,
+} from "./scopes/matcher";
+export { Consent } from "./components/Consent";
+export { buildAdminConsentUrl } from "./utils/consent";
+export type { AdminConsentParams } from "./utils/consent";
+export { default as middleware } from "next-auth/middleware";
+export { signIn } from "next-auth/react";
+
+export default {
+  Login,
+  Error,
+  Provider,
+  Authenticate,
+};
+
+export type { Auth };

package/src/options.tsx

@@ -0,0 +1,389 @@
+import NextAuth, { NextAuthOptions } from "next-auth";
+import AzureADProvider from "next-auth/providers/azure-ad";
+import CredentialsProvider from "next-auth/providers/credentials";
+import { getDefaultAuthParams } from "./utils/params";
+import { ConfidentialClientApplication } from "@azure/msal-node";
+import { Configuration, EmployeesClient } from "@snokam/employees-client";
+import { headers } from "next/headers";
+import {
+  getTenantDomains,
+  getTenantDomainsByEntraTenantId,
+  type TenantDomain,
+} from "@snokam/config";
+import { getManagedBearer } from "@snokam/identity";
+import { exchangePasswordToken } from "./password/api";
+import { exchangeSsoToken } from "./sso/exchange";
+import { getSanityImageUrl } from "@snokam/ui/media/sanity";
+import { getSessionCookieSettings } from "./utils/cookies";
+import { getAuthUrl } from "./utils/url";
+import { openHandoff } from "./handoff/ticket";
+import { passwordLogin, redeemBootstrapToken } from "./password/api";
+import { Auth } from "./utils/types";
+
+async function resolveEmployeesBackend(
+  config: Auth.Config
+): Promise<{ base: string; scope: string }> {
+  const scope = config.clientId
+    ? `api://${config.clientId}/user_impersonation`
+    : "";
+  const requestHeaders = await headers();
+  const host =
+    requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
+  const platformApiBase = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "";
+  const authToken = await getManagedBearer(scope);
+  const employeesBackend = (domains: TenantDomain[]) =>
+    domains.find(
+      (domain) => domain.type === "backend" && domain.app === "employees"
+    );
+
+  let match = employeesBackend(
+    await getTenantDomains({ host, platformApiBase, authToken })
+  );
+  if (!match?.url && config.tenantId) {
+    match = employeesBackend(
+      await getTenantDomainsByEntraTenantId({
+        entraTenantId: config.tenantId,
+        platformApiBase,
+        authToken,
+      })
+    );
+  }
+  if (match?.url) return { base: match.url, scope };
+
+  const bare = host?.split(":")[0];
+  const effective =
+    !bare || bare === "localhost" || bare === "127.0.0.1"
+      ? process.env.NEXT_PUBLIC_TENANT_HOST?.split(":")[0]
+      : host;
+  return { base: effective ? `https://${effective}/api/employees` : "", scope };
+}
+
+type ColorScheme = "light" | "dark" | "system";
+
+function isColorScheme(value: unknown): value is ColorScheme {
+  return value === "light" || value === "dark" || value === "system";
+}
+
+function requestHost(req?: {
+  headers?: Record<string, string | string[] | undefined>;
+}): string | undefined {
+  const header = req?.headers?.["x-forwarded-host"] ?? req?.headers?.host;
+  const value = Array.isArray(header) ? header[0] : header;
+  return value?.split(",")[0].trim().split(":")[0] || undefined;
+}
+
+function requestClientIp(req?: {
+  headers?: Record<string, string | string[] | undefined>;
+}): string | undefined {
+  const pick = (name: string): string | undefined => {
+    const header = req?.headers?.[name];
+    const value = Array.isArray(header) ? header[0] : header;
+    return value?.split(",")[0].trim() || undefined;
+  };
+  // Trusted edge headers first (Front Door, unspoofable); rightmost XFF entry as a fallback.
+  const edge = pick("x-azure-clientip") ?? pick("x-azure-socketip");
+  if (edge) return edge;
+  const forwarded = req?.headers?.["x-forwarded-for"];
+  const value = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  return value?.split(",").pop()?.trim() || undefined;
+}
+
+async function requestOrigin(): Promise<string | undefined> {
+  const h = await headers();
+  const host = (h.get("x-forwarded-host") ?? h.get("host") ?? "")
+    .split(",")[0]
+    .trim();
+  if (!host) return undefined;
+  const scheme =
+    h.get("x-forwarded-proto") ??
+    (host.startsWith("localhost") ? "http" : "https");
+  return `${scheme}://${host}`;
+}
+
+interface EmployeeProfile {
+  colorScheme?: ColorScheme;
+  imageUrl?: string;
+}
+
+async function fetchEmployeeProfile(
+  config: Auth.Config,
+  refreshToken?: string,
+  authMethod?: string
+): Promise<EmployeeProfile> {
+  if (!refreshToken) {
+    return {};
+  }
+  try {
+    const { base, scope } = await resolveEmployeesBackend(config);
+    if (!base || !scope) return {};
+
+    let accessToken: string | undefined;
+    if (authMethod === "password") {
+      accessToken = (await exchangePasswordToken(refreshToken))?.accessToken;
+    } else {
+      const entra = (
+        await new ConfidentialClientApplication({
+          auth: {
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            authority: `https://login.microsoftonline.com/${config.tenantId}`,
+          },
+        }).acquireTokenByRefreshToken({ scopes: [scope], refreshToken })
+      )?.accessToken;
+      accessToken = entra
+        ? (await exchangeSsoToken(entra))?.accessToken
+        : undefined;
+    }
+
+    if (!accessToken) return {};
+    const client = new EmployeesClient(
+      new Configuration({
+        basePath: base,
+        accessToken: `Bearer ${accessToken}`,
+      })
+    );
+    const me = await client.getMeProtected();
+    const profile = {
+      colorScheme: isColorScheme(me.settings?.colorScheme)
+        ? me.settings.colorScheme
+        : undefined,
+      imageUrl: getSanityImageUrl(me.image?.asset?.url, {
+        width: 128,
+        height: 128,
+        fit: "crop",
+      }),
+    };
+    if (!profile.imageUrl) {
+      console.warn("[auth] employee profile resolved without an image");
+    }
+    return profile;
+  } catch (error) {
+    console.warn("[auth] employee profile fetch failed", error);
+    return {};
+  }
+}
+
+export const getNextAuthOptions = (config: Auth.Config): NextAuthOptions => {
+  const authUrl = getAuthUrl();
+  const { name, domain, secure } = getSessionCookieSettings(authUrl);
+
+  return {
+    secret: config.nextAuthSecret,
+    session: {
+      maxAge: 7 * 24 * 60 * 60,
+      updateAge: 24 * 60 * 60,
+    },
+    pages: {
+      signIn: "/auth/login",
+    },
+    providers: [
+      AzureADProvider({
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        tenantId: config.tenantId,
+        authorization: {
+          params: getDefaultAuthParams(config.tenantId),
+        },
+        checks: ["pkce", "state"],
+        profile(profile) {
+          return {
+            id: profile.sub,
+            name: profile.name,
+            email: profile.email,
+            image: null,
+          };
+        },
+      }),
+      CredentialsProvider({
+        id: "handoff",
+        name: "Snokam",
+        credentials: { ticket: { label: "ticket", type: "text" } },
+        async authorize(credentials, req) {
+          const expectedBusiness = requestHost(req);
+          const claims =
+            credentials?.ticket && expectedBusiness
+              ? openHandoff(
+                  credentials.ticket,
+                  config.nextAuthSecret,
+                  expectedBusiness
+                )
+              : null;
+          if (!claims) {
+            return null;
+          }
+          return {
+            id: claims.oid,
+            email: claims.email,
+            name: claims.name,
+            image: claims.image ?? null,
+            oid: claims.oid,
+            tid: claims.tid,
+            refreshToken: claims.refreshToken,
+            authMethod: claims.authMethod || undefined,
+          } as unknown as { id: string };
+        },
+      }),
+      CredentialsProvider({
+        id: "password",
+        name: "Passord",
+        credentials: {
+          email: { label: "email", type: "text" },
+          password: { label: "password", type: "password" },
+          code: { label: "code", type: "text" },
+          host: { label: "host", type: "text" },
+          bootstrap: { label: "bootstrap", type: "text" },
+        },
+        async authorize(credentials, req) {
+          if (credentials?.bootstrap) {
+            const redeemed = await redeemBootstrapToken(credentials.bootstrap);
+            if (!redeemed) {
+              return null;
+            }
+            return {
+              id: redeemed.userId,
+              email: redeemed.email,
+              name: redeemed.name,
+              oid: redeemed.userId,
+              tid: redeemed.businessId,
+              refreshToken: redeemed.refreshToken,
+              authMethod: "password",
+            } as unknown as { id: string };
+          }
+
+          if (
+            !credentials?.email ||
+            !credentials.password ||
+            !credentials.host
+          ) {
+            return null;
+          }
+
+          const outcome = await passwordLogin(
+            {
+              host: credentials.host,
+              email: credentials.email,
+              password: credentials.password,
+              code: credentials.code || undefined,
+            },
+            requestClientIp(req)
+          );
+          if (!outcome.login) {
+            throw new Error(outcome.error ?? "invalid_credentials");
+          }
+
+          return {
+            id: outcome.login.userId,
+            email: outcome.login.email,
+            name: outcome.login.name,
+            oid: outcome.login.userId,
+            tid: outcome.login.businessId,
+            refreshToken: outcome.login.refreshToken,
+            authMethod: "password",
+          } as unknown as { id: string };
+        },
+      }),
+    ],
+    cookies: {
+      sessionToken: {
+        name,
+        options: {
+          path: "/",
+          httpOnly: true,
+          sameSite: "lax",
+          secure,
+          domain,
+        },
+      },
+    },
+    callbacks: {
+      async redirect({ url, baseUrl }) {
+        const origin = (await requestOrigin()) ?? baseUrl;
+        const { pathname, search, hash } = new URL(url, origin);
+        return origin + pathname + search + hash;
+      },
+      async jwt({ token, account, profile, user, trigger, session }) {
+        if (account?.access_token) {
+          token.refreshToken = account.refresh_token;
+          token.expiresAt = account.expires_at;
+          const claims = profile as { oid?: string; tid?: string } | undefined;
+          if (claims?.oid) token.oid = claims.oid;
+          if (claims?.tid) token.tid = claims.tid;
+          const employee = await fetchEmployeeProfile(
+            { ...config, tenantId: claims?.tid ?? config.tenantId },
+            account.refresh_token as string | undefined
+          );
+          if (employee.colorScheme) token.colorScheme = employee.colorScheme;
+          token.picture = employee.imageUrl ?? null;
+        }
+
+        const handoff = user as
+          | {
+              oid?: string;
+              tid?: string;
+              refreshToken?: string;
+              authMethod?: string;
+            }
+          | undefined;
+        if (handoff?.refreshToken) {
+          token.oid = handoff.oid;
+          token.tid = handoff.tid;
+          token.refreshToken = handoff.refreshToken;
+          if (handoff.authMethod) {
+            token.authMethod = handoff.authMethod;
+          }
+          const employee = await fetchEmployeeProfile(
+            { ...config, tenantId: handoff.tid ?? config.tenantId },
+            handoff.refreshToken,
+            handoff.authMethod
+          );
+          if (employee.colorScheme) token.colorScheme = employee.colorScheme;
+          if (employee.imageUrl) token.picture = employee.imageUrl;
+        }
+
+        if (trigger === "update") {
+          if (isColorScheme(session?.colorScheme)) {
+            token.colorScheme = session.colorScheme;
+          }
+          if (session?.refreshProfile && token.refreshToken) {
+            const employee = await fetchEmployeeProfile(
+              {
+                ...config,
+                tenantId: (token.tid as string | undefined) ?? config.tenantId,
+              },
+              token.refreshToken as string,
+              token.authMethod as string | undefined
+            );
+            if (employee.imageUrl) token.picture = employee.imageUrl;
+          }
+        }
+
+        return token;
+      },
+      async session({ session, token }) {
+        const claims = token as {
+          colorScheme?: unknown;
+          oid?: string;
+          tid?: string;
+          authMethod?: string;
+        };
+        const target = session as {
+          colorScheme?: ColorScheme;
+          oid?: string;
+          tid?: string;
+          authMethod?: string;
+        };
+        if (isColorScheme(claims.colorScheme)) {
+          target.colorScheme = claims.colorScheme;
+        }
+        target.oid = claims.oid;
+        target.tid = claims.tid;
+        if (claims.authMethod) {
+          target.authMethod = claims.authMethod;
+        }
+        return session;
+      },
+    },
+  };
+};
+
+export default (config: Auth.Config) => NextAuth(getNextAuthOptions(config));

package/src/page-router/components/Login.tsx

@@ -0,0 +1,50 @@
+import { useEffect, useState, useRef } from "react";
+import { useRouter } from "next/router";
+import { useAuth } from "../../hooks";
+import { signIn } from "next-auth/react";
+import { PageLoader } from "@snokam/ui";
+import Error from "../../components/Error";
+
+export const Login = () => {
+  const { isAuthenticated } = useAuth();
+  const [callbackUrl, setCallbackUrl] = useState<string | null>(null);
+  const [authParams, setAuthParams] = useState<Record<string, string>>({});
+  const [isError, setIsError] = useState<boolean>(false);
+  const hasSignedIn = useRef(false);
+  const router = useRouter();
+
+  useEffect(() => {
+    const params = new URLSearchParams(window.location.search);
+    setCallbackUrl(params.get("callbackUrl"));
+    setIsError(!!params.get("error"));
+
+    const authParamsObj: Record<string, string> = {};
+    params.forEach((value, key) => {
+      if (key !== "error" && key !== "callbackUrl") {
+        authParamsObj[key] = value;
+      }
+    });
+    setAuthParams(authParamsObj);
+  }, []);
+
+  useEffect(() => {
+    if (!callbackUrl) return;
+    if (isError) return;
+    if (hasSignedIn.current) return;
+
+    if (isAuthenticated) {
+      router.replace(callbackUrl || "/");
+    } else {
+      hasSignedIn.current = true;
+      signIn("azure-ad", { callbackUrl }, authParams);
+    }
+  }, [isAuthenticated, callbackUrl, authParams, isError, router, signIn]);
+
+  if (isError) {
+    return <Error />;
+  }
+
+  return <PageLoader />;
+};
+
+export default Login;

package/src/page-router/components/Provider/index.tsx

@@ -0,0 +1,45 @@
+import { memo, ReactNode, useEffect } from "react";
+import { useRouter } from "next/router";
+import { Auth } from "../../../utils/types";
+import { Authenticate } from "../../../components/Authenticate";
+import { SessionProvider } from "next-auth/react";
+import { useAuth } from "../../../hooks";
+
+export const Provider = memo((props: Auth.Provider.Props) => {
+  const { session, children, enforceLogin } = props;
+  const router = useRouter();
+  const query = router?.query;
+
+  if (query?.enforceLogin || enforceLogin) {
+    return (
+      <SessionProvider session={session}>
+        <Authenticate provider="azure-ad" {...props}>
+          {children}
+        </Authenticate>
+      </SessionProvider>
+    );
+  }
+
+  return (
+    <SessionProvider session={session}>
+      <Wrapper>{children}</Wrapper>
+    </SessionProvider>
+  );
+});
+
+export const Wrapper = ({ children }: { children: ReactNode }) => {
+  const { signOut } = useAuth();
+  const router = useRouter();
+
+  useEffect(() => {
+    if (router?.query?.logout === "true") {
+      signOut({
+        callbackUrl: "/auth/login?callbackUrl=/",
+      });
+    }
+  }, [router?.query?.logout]);
+
+  return <>{children}</>;
+};
+
+export default Provider;

package/src/page-router/index.tsx

@@ -0,0 +1,22 @@
+"use client";
+
+import { Provider } from "./components/Provider";
+import { Authenticate } from "../components/Authenticate";
+import { Login } from "./components/Login";
+import { Error } from "../components/Error";
+
+export { Unauthenticated } from "../components/Unauthenticated";
+export { Authenticated } from "../components/Authenticated";
+export { useAuth } from "../hooks";
+export { signIn, SessionProvider } from "next-auth/react";
+export { Login, Error, Provider, Authenticate };
+
+export default {
+  Login,
+  Error,
+  Provider,
+  Authenticate,
+};
+
+export type { Session } from "next-auth";
+export type { Auth } from "../utils/types";

package/src/page-router/server.ts

@@ -0,0 +1,6 @@
+export { getServerToken } from "../server/token";
+export { getServerSession } from "next-auth/next";
+export { getNextAuthOptions } from "../options";
+export { getAuth } from "../server/auth";
+
+export type { Auth } from "../utils/types";