@snokam/auth 2.2.22 → 2.3.0

package/src/password/api.ts

@@ -0,0 +1,183 @@
+export interface PasswordLoginResult {
+  userId: string;
+  businessId: string;
+  email: string;
+  name: string;
+  refreshToken: string;
+  refreshTokenExpiresAt: string;
+  siteHost?: string;
+}
+
+export interface PasswordEnrolment {
+  email: string;
+  enrolmentToken: string;
+  otpauthUri: string;
+}
+
+export interface PasswordLoginOutcome {
+  login?: PasswordLoginResult;
+  enrolment?: PasswordEnrolment;
+  error?: string;
+  retryAfterSeconds?: number;
+}
+
+export interface TotpEnrollOutcome {
+  recoveryCodes?: string[];
+  bootstrapToken?: string;
+  siteHost?: string;
+  error?: string;
+}
+
+export interface TokenExchangeResult {
+  accessToken: string;
+  expiresOn: number;
+}
+
+export interface PasswordLoginConfig {
+  businessDisplayName: string;
+  passwordEnabled: boolean;
+  entraEnabled: boolean;
+  ssoActive: boolean;
+  ssoProvider?: string;
+  logoUrl?: string;
+  ssoDirectoryId?: string;
+}
+
+function apiBase(): string {
+  return (process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "").replace(
+    /\/+$/,
+    ""
+  );
+}
+
+async function post(
+  path: string,
+  body: unknown,
+  clientIp?: string
+): Promise<{ status: number; data: Record<string, unknown> | null }> {
+  const response = await fetch(`${apiBase()}/v1.0/public/auth${path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...(clientIp ? { "X-Forwarded-For": clientIp } : {}),
+    },
+    body: JSON.stringify(body),
+    cache: "no-store",
+  });
+
+  let data: Record<string, unknown> | null = null;
+  try {
+    data = (await response.json()) as Record<string, unknown>;
+  } catch {
+    data = null;
+  }
+  return { status: response.status, data };
+}
+
+export async function passwordLogin(
+  request: {
+    host: string;
+    email: string;
+    password: string;
+    code?: string;
+  },
+  clientIp?: string
+): Promise<PasswordLoginOutcome> {
+  const { status, data } = await post("/password/login", request, clientIp);
+  if (status === 200 && data) {
+    return { login: data as unknown as PasswordLoginResult };
+  }
+  return {
+    error: typeof data?.error === "string" ? data.error : "invalid_credentials",
+    enrolment: (data?.enrolment as PasswordEnrolment | undefined) ?? undefined,
+    retryAfterSeconds: status === 429 ? 60 : undefined,
+  };
+}
+
+export async function passwordActivate(
+  request: { token: string; password: string },
+  clientIp?: string
+): Promise<{ enrolment?: PasswordEnrolment; error?: string }> {
+  const { status, data } = await post("/password/activate", request, clientIp);
+  if (status === 200 && data) {
+    return { enrolment: data as unknown as PasswordEnrolment };
+  }
+  return {
+    error: typeof data?.error === "string" ? data.error : "invalid_token",
+  };
+}
+
+export async function passwordEnrollTotp(
+  request: { enrolmentToken: string; code: string },
+  clientIp?: string
+): Promise<TotpEnrollOutcome> {
+  const { status, data } = await post(
+    "/password/totp/enroll",
+    request,
+    clientIp
+  );
+  if (status === 200 && data) {
+    return data as unknown as TotpEnrollOutcome;
+  }
+  return {
+    error: typeof data?.error === "string" ? data.error : "invalid_token",
+  };
+}
+
+export async function passwordResetRequest(
+  request: { host: string; email: string },
+  clientIp?: string
+): Promise<void> {
+  await post("/password/reset/request", request, clientIp);
+}
+
+export async function passwordResetConfirm(
+  request: { token: string; password: string; code?: string },
+  clientIp?: string
+): Promise<{ ok: boolean; error?: string }> {
+  const { status, data } = await post(
+    "/password/reset/confirm",
+    request,
+    clientIp
+  );
+  if (status === 204) return { ok: true };
+  return {
+    ok: false,
+    error: typeof data?.error === "string" ? data.error : "invalid_token",
+  };
+}
+
+export async function exchangePasswordToken(
+  refreshToken: string
+): Promise<TokenExchangeResult | null> {
+  const { status, data } = await post("/password/token", { refreshToken });
+  if (status !== 200 || !data?.accessToken) return null;
+  return data as unknown as TokenExchangeResult;
+}
+
+export async function redeemBootstrapToken(
+  bootstrapToken: string
+): Promise<PasswordLoginResult | null> {
+  const { status, data } = await post("/password/session", { bootstrapToken });
+  if (status !== 200 || !data?.refreshToken) return null;
+  return data as unknown as PasswordLoginResult;
+}
+
+export async function revokePasswordToken(refreshToken: string): Promise<void> {
+  await post("/password/revoke", { refreshToken });
+}
+
+export async function fetchPasswordLoginConfig(
+  host: string
+): Promise<PasswordLoginConfig | null> {
+  try {
+    const response = await fetch(
+      `${apiBase()}/v1.0/public/auth/login-config?host=${encodeURIComponent(host)}`,
+      { next: { revalidate: 60 } } as RequestInit
+    );
+    if (!response.ok) return null;
+    return (await response.json()) as PasswordLoginConfig;
+  } catch {
+    return null;
+  }
+}

package/src/roles/context.tsx

@@ -0,0 +1,54 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import { useAuth } from "../hooks";
+import { decodeJwtClaims } from "../token/claims";
+
+export const PLATFORM_OPERATOR = "platform-operator";
+export const PLATFORM_ADMIN = "platform-admin";
+
+export interface RolesState {
+  roles: string[];
+  isLoading: boolean;
+}
+
+function decodeTokenRoles(bearer: string): string[] {
+  const claims = decodeJwtClaims<{ roles?: string[] | string }>(bearer);
+  if (!claims) return [];
+  if (Array.isArray(claims.roles)) return claims.roles;
+  if (typeof claims.roles === "string") return [claims.roles];
+  return [];
+}
+
+export function usePlatformRoles(): RolesState {
+  const { getToken, isAuthenticated } = useAuth();
+  const [roles, setRoles] = useState<string[] | null>(null);
+
+  useEffect(() => {
+    if (!isAuthenticated) {
+      setRoles(null);
+      return;
+    }
+    let cancelled = false;
+    getToken()
+      .then((bearer) => {
+        if (!cancelled) setRoles(decodeTokenRoles(bearer));
+      })
+      .catch(() => {
+        if (!cancelled) setRoles([]);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [isAuthenticated, getToken]);
+
+  return useMemo(
+    () => ({ roles: roles ?? [], isLoading: roles === null }),
+    [roles]
+  );
+}
+
+export function useHasPlatformRole(role: string): boolean {
+  const { roles } = usePlatformRoles();
+  return useMemo(() => roles.includes(role), [roles, role]);
+}

package/src/route-handler/token.ts

@@ -0,0 +1,124 @@
+import { getToken } from "next-auth/jwt";
+import {
+  ConfidentialClientApplication,
+  InteractionRequiredAuthError,
+} from "@azure/msal-node";
+import { Auth } from "../utils/types";
+import { getAuthUrl } from "../utils/url";
+import { getSessionCookieSettings } from "../utils/cookies";
+import { exchangePasswordToken } from "../password/api";
+import { readImpersonationSession } from "../impersonation/cookies";
+import { exchangeSsoToken } from "../sso/exchange";
+
+export type TokenResult =
+  | { accessToken: string; expiresOn: number }
+  | { error: Response };
+
+/**
+ * Resolves the SIGNED-IN admin's own product access token (never the impersonation token). Shared
+ * by the token handler and the impersonation start/end handlers so the mint/end calls to the
+ * platform are authenticated as the real admin.
+ */
+export async function resolveAccessToken(
+  authConfig: Auth.Config,
+  request: Request
+): Promise<TokenResult> {
+  const { name: cookieName } = getSessionCookieSettings(getAuthUrl());
+  const token = await getToken({
+    req: request as any,
+    secret: authConfig.nextAuthSecret,
+    cookieName,
+  });
+
+  if (!token?.refreshToken) {
+    return { error: new Response("Not authenticated", { status: 401 }) };
+  }
+
+  if ((token as { authMethod?: string }).authMethod === "password") {
+    const exchanged = await exchangePasswordToken(token.refreshToken as string);
+    if (!exchanged) {
+      return { error: new Response("Not authenticated", { status: 401 }) };
+    }
+    return {
+      accessToken: exchanged.accessToken,
+      expiresOn: exchanged.expiresOn,
+    };
+  }
+
+  const scope = process.env.IDENTITY_AD_SCOPE;
+  if (!scope) {
+    return {
+      error: new Response("IDENTITY_AD_SCOPE is not configured", {
+        status: 500,
+      }),
+    };
+  }
+
+  const tenantId = (token as { tid?: string }).tid || authConfig.tenantId;
+
+  try {
+    const cca = new ConfidentialClientApplication({
+      auth: {
+        clientId: authConfig.clientId,
+        clientSecret: authConfig.clientSecret,
+        authority: `https://login.microsoftonline.com/${tenantId}`,
+      },
+    });
+
+    const accessTokenResult = await cca.acquireTokenByRefreshToken({
+      scopes: [scope],
+      refreshToken: token.refreshToken as string,
+    });
+
+    if (!accessTokenResult) {
+      return {
+        error: new Response("Failed to get access token", { status: 500 }),
+      };
+    }
+
+    const provider = {
+      accessToken: accessTokenResult.accessToken,
+      expiresOn: Math.floor(accessTokenResult.expiresOn!.getTime() / 1000),
+    };
+
+    const exchanged = await exchangeSsoToken(provider.accessToken);
+    if (!exchanged) {
+      return {
+        error: new Response("SSO token exchange failed", { status: 502 }),
+      };
+    }
+    return exchanged;
+  } catch (e) {
+    console.error("Token exchange error:", e);
+    if (e instanceof InteractionRequiredAuthError) {
+      return {
+        error: Response.json(
+          { error: "consent_required", tenantId },
+          { status: 403 }
+        ),
+      };
+    }
+    return { error: new Response("Token exchange failed", { status: 500 }) };
+  }
+}
+
+export function createTokenHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    // While a view-as-employee session is active, every product API call transparently receives the
+    // short-lived impersonation token instead of the admin's own — the single swap point the design
+    // relies on. A clean exit (or expiry) discards the cookie and this falls back to the admin token.
+    const impersonation = readImpersonationSession(request);
+    if (impersonation && impersonation.expiresOn * 1000 > Date.now()) {
+      return Response.json({
+        accessToken: impersonation.accessToken,
+        expiresOn: impersonation.expiresOn,
+      });
+    }
+
+    const result = await resolveAccessToken(authConfig, request);
+    if ("error" in result) {
+      return result.error;
+    }
+    return Response.json(result);
+  };
+}

package/src/route-handler.ts

@@ -0,0 +1,52 @@
+import NextAuth from "next-auth";
+import type { NextAuthOptions } from "next-auth";
+import { resolveCookieDomain } from "./utils/cookies";
+
+type AuthOptionsFor = NextAuthOptions | ((req: Request) => NextAuthOptions);
+
+export function createAuthHandler(options: AuthOptionsFor) {
+  return async function handler(req: Request, ctx: unknown) {
+    const authOptions = typeof options === "function" ? options(req) : options;
+    const host =
+      req.headers.get("x-forwarded-host") ??
+      req.headers.get("host") ??
+      undefined;
+    const domain = resolveCookieDomain(host);
+
+    const sessionToken = authOptions.cookies?.sessionToken;
+    const perRequest: NextAuthOptions = sessionToken
+      ? {
+          ...authOptions,
+          cookies: {
+            ...authOptions.cookies,
+            sessionToken: {
+              ...sessionToken,
+              options: { ...sessionToken.options, domain },
+            },
+          },
+        }
+      : authOptions;
+
+    return (
+      NextAuth(perRequest) as unknown as (
+        req: Request,
+        ctx: unknown
+      ) => Promise<Response>
+    )(req, ctx);
+  };
+}
+
+export { getNextAuthOptions } from "./options";
+export { createTokenHandler } from "./route-handler/token";
+export {
+  createImpersonationStartHandler,
+  createImpersonationEndHandler,
+  createImpersonationAdoptHandler,
+} from "./impersonation/handlers";
+export { createImpersonationRouteHandlers } from "./impersonation/routes";
+export {
+  createHandoffStartHandler,
+  createHandoffFinishHandler,
+  createHandoffLogoutHandler,
+} from "./handoff/handlers";
+export type { Auth } from "./utils/types";

package/src/scopes/context.tsx

@@ -0,0 +1,127 @@
+"use client";
+
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from "react";
+import { useAuth } from "../hooks";
+import { IMP_ACTIVE_COOKIE } from "../impersonation/cookies";
+import { scopeGranted, type ScopeAccess } from "./matcher";
+import { decodeJwtClaims } from "../token/claims";
+
+export interface ScopesState {
+  scopes: string[];
+  isImpersonating: boolean;
+  isAuthoritative: boolean;
+  isLoading: boolean;
+}
+
+const ScopesContext = createContext<ScopesState | null>(null);
+
+function isImpersonationActive(): boolean {
+  if (typeof document === "undefined") return false;
+  const match = document.cookie
+    .split(";")
+    .map((part) => part.trim())
+    .find((part) => part.startsWith(`${IMP_ACTIVE_COOKIE}=`));
+  if (!match) return false;
+  try {
+    const value = decodeURIComponent(match.slice(IMP_ACTIVE_COOKIE.length + 1));
+    const parsed = JSON.parse(value) as { expiresOn?: number };
+    if (parsed.expiresOn && parsed.expiresOn * 1000 <= Date.now()) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function decodeTokenScopes(bearer: string): string[] {
+  const claims = decodeJwtClaims<{ scope?: string | string[] }>(bearer);
+  if (!claims) return [];
+  if (Array.isArray(claims.scope)) return claims.scope;
+  if (typeof claims.scope === "string")
+    return claims.scope.split(" ").filter(Boolean);
+  return [];
+}
+
+interface ScopesProviderProps {
+  scopes?: string[] | null;
+  ready?: boolean;
+  children: ReactNode;
+}
+
+export function ScopesProvider({
+  scopes: normalScopes,
+  ready,
+  children,
+}: ScopesProviderProps) {
+  const { getToken, isAuthenticated } = useAuth();
+  const [impersonating] = useState(isImpersonationActive);
+  const [tokenScopes, setTokenScopes] = useState<string[] | null>(null);
+
+  useEffect(() => {
+    if (!impersonating || !isAuthenticated) {
+      setTokenScopes(null);
+      return;
+    }
+    let cancelled = false;
+    getToken()
+      .then((bearer) => {
+        if (!cancelled) setTokenScopes(decodeTokenScopes(bearer));
+      })
+      .catch(() => {
+        if (!cancelled) setTokenScopes([]);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [impersonating, isAuthenticated, getToken]);
+
+  const value = useMemo<ScopesState>(() => {
+    if (impersonating) {
+      return {
+        scopes: tokenScopes ?? [],
+        isImpersonating: true,
+        isAuthoritative: tokenScopes !== null,
+        isLoading: tokenScopes === null,
+      };
+    }
+    const authoritative = ready ?? normalScopes != null;
+    return {
+      scopes: normalScopes ?? [],
+      isImpersonating: false,
+      isAuthoritative: authoritative,
+      isLoading: ready === false,
+    };
+  }, [impersonating, tokenScopes, normalScopes, ready]);
+
+  return (
+    <ScopesContext.Provider value={value}>{children}</ScopesContext.Provider>
+  );
+}
+
+export function useScopes(): ScopesState {
+  return (
+    useContext(ScopesContext) ?? {
+      scopes: [],
+      isImpersonating: false,
+      isAuthoritative: false,
+      isLoading: false,
+    }
+  );
+}
+
+export function useHasScope(
+  scope: string,
+  access: ScopeAccess = "read"
+): boolean {
+  const { scopes } = useScopes();
+  return useMemo(
+    () => scopeGranted(scopes, scope, access),
+    [scopes, scope, access]
+  );
+}

package/src/scopes/matcher.ts

@@ -0,0 +1,47 @@
+export type ScopeAccess = "read" | "write";
+
+function resourceCovers(granted: string, required: string): boolean {
+  return (
+    granted === required ||
+    required.toLowerCase().startsWith(`${granted.toLowerCase()}.`)
+  );
+}
+
+export function scopeGranted(
+  grantedScopes: readonly string[],
+  resource: string,
+  access: ScopeAccess = "read"
+): boolean {
+  for (const scope of grantedScopes) {
+    const separator = scope.indexOf(":");
+    const grantedResource = separator < 0 ? scope : scope.slice(0, separator);
+    if (!resourceCovers(grantedResource, resource)) continue;
+
+    const grantedAction = separator < 0 ? "*" : scope.slice(separator + 1);
+    if (grantedAction === "*") return true;
+    if (access === "read" && (grantedAction === "read" || grantedAction === "write"))
+      return true;
+    if (access === "write" && grantedAction === "write") return true;
+  }
+  return false;
+}
+
+interface EmployeeLikeGroup {
+  scopeGrants?: string[] | null;
+}
+
+interface EmployeeLike {
+  scopeGrants?: string[] | null;
+  groups?: EmployeeLikeGroup[] | null;
+}
+
+export function resolveEmployeeScopes(
+  employee: EmployeeLike | null | undefined
+): string[] {
+  if (!employee) return [];
+  const scopes = new Set<string>();
+  for (const grant of employee.scopeGrants ?? []) scopes.add(grant);
+  for (const group of employee.groups ?? [])
+    for (const grant of group.scopeGrants ?? []) scopes.add(grant);
+  return [...scopes];
+}

package/src/server/auth.tsx

@@ -0,0 +1,30 @@
+import { GetServerSidePropsContext, GetStaticPropsContext } from "next";
+import { getServerSession as nextAuthGetServerSession } from "next-auth";
+import { Auth } from "../utils/types";
+import { getNextAuthOptions } from "../options";
+
+export const getAuth = async (
+  context: GetServerSidePropsContext | GetStaticPropsContext,
+  authConfig: Auth.Config
+) => {
+  if (!("req" in context && "res" in context)) {
+    return {
+      isAuthenticated: false,
+      session: null,
+      user: null,
+    };
+  }
+
+  const options = getNextAuthOptions(authConfig);
+  const session = await nextAuthGetServerSession(
+    context.req,
+    context.res,
+    options
+  );
+
+  return {
+    isAuthenticated: !!session?.user,
+    user: session?.user || null,
+    session,
+  };
+};

package/src/server/handler.tsx

@@ -0,0 +1,68 @@
+import { getToken } from "next-auth/jwt";
+import { ConfidentialClientApplication } from "@azure/msal-node";
+import type { NextApiRequest, NextApiResponse } from "next";
+import { getServerSession } from "next-auth";
+import { Auth } from "../utils/types";
+import { getNextAuthOptions } from "../options";
+import { exchangeSsoToken } from "../sso/exchange";
+
+export interface Props {
+  req: NextApiRequest;
+  res: NextApiResponse<{ accessToken: string; expiresOn: number } | string>;
+  authConfig: Auth.Config;
+}
+
+export default async function handler(props: Props) {
+  const { req, res, authConfig } = props;
+  const options = getNextAuthOptions(authConfig);
+  const session = await getServerSession(req, res, options);
+
+  if (!session?.user) {
+    return res.status(401).end("Not authenticated");
+  }
+
+  const scope = process.env.IDENTITY_AD_SCOPE;
+  if (!scope) {
+    return res.status(500).end("IDENTITY_AD_SCOPE is not configured");
+  }
+
+  try {
+    const { nextAuthSecret } = authConfig;
+    const refetchTokenResult = await getToken({
+      req,
+      secret: nextAuthSecret,
+      cookieName: options.cookies?.sessionToken?.name,
+    });
+
+    if (!refetchTokenResult) {
+      return res.status(500).end("Failed to get refetch token");
+    }
+
+    const cca = new ConfidentialClientApplication({
+      auth: {
+        clientId: authConfig.clientId,
+        clientSecret: authConfig.clientSecret,
+        authority: `https://login.microsoftonline.com/${authConfig.tenantId}`,
+      },
+    });
+
+    const accessTokenResult = await cca.acquireTokenByRefreshToken({
+      scopes: [scope],
+      refreshToken: refetchTokenResult?.refreshToken as string,
+    });
+
+    if (!accessTokenResult) {
+      return res.status(500).end("Failed to get access token");
+    }
+
+    const exchanged = await exchangeSsoToken(accessTokenResult.accessToken);
+    if (!exchanged) {
+      return res.status(502).end("SSO token exchange failed");
+    }
+
+    return res.status(200).json(exchanged);
+  } catch (e) {
+    console.error("Token exchange error:", e);
+    res.status(500).end("Token exchange failed");
+  }
+}

package/src/server/token.tsx

@@ -0,0 +1,10 @@
+import { getManagedToken } from "@snokam/identity";
+
+interface Config {
+  scopes: string[];
+}
+
+export const getServerToken = async ({ scopes }: Config) => {
+  const token = await getManagedToken(scopes[0]);
+  return `Bearer ${token}`;
+};