@snokam/auth 2.2.22 → 2.3.1

package/src/hooks.ts

@@ -0,0 +1,146 @@
+import { useSession, signIn, signOut } from "next-auth/react";
+import { useMemo } from "react";
+import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
+import { useImpersonation } from "./impersonation/context";
+
+class ConsentRequiredError extends Error {}
+
+const REFRESH_MARGIN_SECONDS = 60;
+
+interface CachedToken {
+  bearer: string;
+  expiresOn: number;
+  impKey: string;
+}
+
+let cachedToken: CachedToken | null = null;
+let inFlight: { impKey: string; promise: Promise<string> } | null = null;
+
+/**
+ * Identifies which principal the next token belongs to: the active impersonation
+ * tokenId, or "" for the admin's own token. Changing this (Vis som start/exit)
+ * invalidates the cache so the swap in the token route is never served stale.
+ */
+function readImpersonationKey(): string {
+  if (typeof document === "undefined") return "";
+  const match = document.cookie
+    .split(";")
+    .map((part) => part.trim())
+    .find((part) => part.startsWith(`${IMP_ACTIVE_COOKIE}=`));
+  if (!match) return "";
+  try {
+    const value = decodeURIComponent(match.slice(IMP_ACTIVE_COOKIE.length + 1));
+    const parsed = JSON.parse(value) as {
+      tokenId?: string;
+      expiresOn?: number;
+    };
+    if (parsed.expiresOn && parsed.expiresOn * 1000 <= Date.now()) return "";
+    return parsed.tokenId ?? "";
+  } catch {
+    return "";
+  }
+}
+
+export function clearAuthTokenCache(): void {
+  cachedToken = null;
+  inFlight = null;
+}
+
+async function fetchToken(impKey: string): Promise<string> {
+  const res = await fetch("/api/auth/token", {
+    method: "POST",
+    body: JSON.stringify({}),
+    credentials: "include",
+    headers: {
+      "Content-Type": "application/json",
+    },
+  });
+
+  if (res.status === 403) {
+    const body = await res.json().catch(() => null);
+    if (body?.error === "consent_required") {
+      throw new ConsentRequiredError();
+    }
+  }
+
+  if (!res.ok) {
+    throw new Error("Token fetch failed");
+  }
+
+  const token = await res.json();
+  const { accessToken, expiresOn } = token;
+
+  sessionStorage.removeItem("auth-consent-retried");
+  const bearer = `Bearer ${accessToken}`;
+  cachedToken = { bearer, expiresOn, impKey };
+  return bearer;
+}
+
+async function getFreshToken(): Promise<string> {
+  const impKey = readImpersonationKey();
+  const now = Date.now() / 1000;
+
+  if (
+    cachedToken &&
+    cachedToken.impKey === impKey &&
+    now < cachedToken.expiresOn - REFRESH_MARGIN_SECONDS
+  ) {
+    return cachedToken.bearer;
+  }
+
+  if (inFlight && inFlight.impKey === impKey) {
+    return inFlight.promise;
+  }
+
+  const promise = fetchToken(impKey);
+  inFlight = { impKey, promise };
+  promise
+    .catch(() => undefined)
+    .finally(() => {
+      if (inFlight?.promise === promise) inFlight = null;
+    });
+  return promise;
+}
+
+export function useAuth() {
+  const { data: rawSession, status, update } = useSession();
+  const { active } = useImpersonation();
+
+  const session = useMemo(() => {
+    if (!active || !rawSession?.user) return rawSession;
+    return {
+      ...rawSession,
+      user: {
+        ...rawSession.user,
+        name: active.targetName || active.targetEmail,
+        email: active.targetEmail,
+        image: active.targetImage ?? null,
+      },
+    };
+  }, [rawSession, active]);
+
+  const value = useMemo(
+    () => ({
+      update,
+      signIn,
+      signOut,
+      session,
+      getToken: () =>
+        getFreshToken().catch((error) => {
+          console.error(error);
+          const onAuthPage = window.location.pathname.startsWith("/auth/");
+          if (onAuthPage) return;
+          const reason =
+            error instanceof ConsentRequiredError ? "consent" : "true";
+          window.location.href = `/auth/login?error=${reason}`;
+        }) as Promise<string>,
+      inProgress: status === "loading",
+      isAuthenticated:
+        status === "authenticated" || (status === "loading" && !!session),
+    }),
+
+    [update, status, session]
+  );
+
+  return value;
+}

package/src/impersonation/context.tsx

@@ -0,0 +1,185 @@
+"use client";
+
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useState,
+  type ReactNode,
+} from "react";
+import { IMP_ACTIVE_COOKIE, type ImpersonationActive } from "./cookies";
+import { clearAuthTokenCache } from "../hooks";
+
+interface ImpersonationContextValue {
+  active: ImpersonationActive | null;
+  starting: boolean;
+  exiting: boolean;
+  start: (input: {
+    targetEmail: string;
+    targetName?: string;
+    targetImage?: string;
+    reason: string;
+    redirectTo?: string;
+    returnTo?: string;
+    landingUrl?: string;
+  }) => Promise<{ ok: boolean; error?: string }>;
+  exit: () => Promise<void>;
+}
+
+const ImpersonationContext = createContext<ImpersonationContextValue | null>(
+  null
+);
+
+/** Registrable base domain of the platform (last two labels of the API host). */
+function platformBaseDomain(): string {
+  const api = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
+  if (!api) {
+    throw new Error("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured");
+  }
+  return new URL(api).hostname.split(".").slice(-2).join(".");
+}
+
+/** Guards the exit redirect against open-redirect: same-origin, or https on the platform base domain. */
+function isSafeReturnTo(returnTo: string): boolean {
+  if (typeof window === "undefined") return false;
+  const base = platformBaseDomain();
+  try {
+    const url = new URL(returnTo, window.location.origin);
+    if (url.origin === window.location.origin) return true;
+    if (url.protocol !== "https:") return false;
+    return url.hostname === base || url.hostname.endsWith(`.${base}`);
+  } catch {
+    return false;
+  }
+}
+
+function readActiveCookie(): ImpersonationActive | null {
+  if (typeof document === "undefined") return null;
+  const match = document.cookie
+    .split(";")
+    .map((part) => part.trim())
+    .find((part) => part.startsWith(`${IMP_ACTIVE_COOKIE}=`));
+  if (!match) return null;
+  try {
+    const value = decodeURIComponent(match.slice(IMP_ACTIVE_COOKIE.length + 1));
+    const parsed = JSON.parse(value) as ImpersonationActive;
+    if (parsed.expiresOn * 1000 <= Date.now()) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export function ImpersonationProvider({ children }: { children: ReactNode }) {
+  const [active, setActive] = useState<ImpersonationActive | null>(null);
+  const [starting, setStarting] = useState(false);
+  const [exiting, setExiting] = useState(false);
+
+  useEffect(() => {
+    setActive(readActiveCookie());
+  }, []);
+
+  // Auto-exit at token expiry so a stale banner/token never lingers.
+  useEffect(() => {
+    if (!active) return;
+    const ms = active.expiresOn * 1000 - Date.now();
+    if (ms <= 0) {
+      setActive(null);
+      return;
+    }
+    const timer = setTimeout(() => setActive(null), ms);
+    return () => clearTimeout(timer);
+  }, [active]);
+
+  const start = useCallback(
+    async (input: {
+      targetEmail: string;
+      targetName?: string;
+      targetImage?: string;
+      reason: string;
+      redirectTo?: string;
+      returnTo?: string;
+      landingUrl?: string;
+    }) => {
+      setStarting(true);
+      try {
+        const { redirectTo, landingUrl } = input;
+        const res = await fetch("/api/impersonation/start", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          credentials: "include",
+          body: JSON.stringify(input),
+        });
+        if (!res.ok) {
+          return {
+            ok: false,
+            error: (await res.text()) || `HTTP ${res.status}`,
+          };
+        }
+        clearAuthTokenCache();
+        const data = (await res.json().catch(() => ({}))) as {
+          adoptUrl?: string;
+        };
+        if (data.adoptUrl) window.location.assign(data.adoptUrl);
+        else if (landingUrl) window.location.assign(landingUrl);
+        else if (redirectTo) window.location.assign(redirectTo);
+        else window.location.reload();
+        return { ok: true };
+      } finally {
+        setStarting(false);
+      }
+    },
+    []
+  );
+
+  const exit = useCallback(async () => {
+    setExiting(true);
+    try {
+      await fetch("/api/impersonation/end", {
+        method: "POST",
+        credentials: "include",
+      }).catch(() => undefined);
+      clearAuthTokenCache();
+      const returnTo = active?.returnTo;
+      setActive(null);
+      if (returnTo && isSafeReturnTo(returnTo)) {
+        window.location.assign(returnTo);
+      } else {
+        window.location.reload();
+      }
+    } finally {
+      setExiting(false);
+    }
+  }, [active]);
+
+  const value = useMemo<ImpersonationContextValue>(
+    () => ({ active, starting, exiting, start, exit }),
+    [active, starting, exiting, start, exit]
+  );
+
+  return (
+    <ImpersonationContext.Provider value={value}>
+      {children}
+    </ImpersonationContext.Provider>
+  );
+}
+
+export function useImpersonation(): ImpersonationContextValue {
+  const context = useContext(ImpersonationContext);
+  if (!context) {
+    // Safe no-op default so the shared banner can mount in apps that haven't wired the provider yet.
+    return {
+      active: null,
+      starting: false,
+      exiting: false,
+      start: async () => ({
+        ok: false,
+        error: "Impersonation ikke tilgjengelig her.",
+      }),
+      exit: async () => undefined,
+    };
+  }
+  return context;
+}

package/src/impersonation/cookies.ts

@@ -0,0 +1,124 @@
+import { resolveCookieDomain } from "../utils/cookies";
+
+/** HttpOnly — carries the impersonation bearer; only the token handler ever reads it. */
+export const IMP_SESSION_COOKIE = "imp_session";
+/** Readable — non-sensitive session facts that drive the banner + provider (no token). */
+export const IMP_ACTIVE_COOKIE = "imp_active";
+
+export interface ImpersonationSession {
+  accessToken: string;
+  expiresOn: number;
+  tokenId: string;
+}
+
+export interface ImpersonationActive {
+  targetEmail: string;
+  targetName?: string | null;
+  targetImage?: string | null;
+  finance: boolean;
+  tokenId: string;
+  expiresOn: number;
+  returnTo?: string;
+}
+
+interface MintedToken {
+  accessToken: string;
+  expiresOn: number;
+  tokenId: string;
+  targetEmail: string;
+  targetName?: string | null;
+  targetImage?: string | null;
+  finance: boolean;
+  returnTo?: string;
+}
+
+function parseCookieHeader(header: string | null): Record<string, string> {
+  const jar: Record<string, string> = {};
+  if (!header) return jar;
+  for (const part of header.split(";")) {
+    const index = part.indexOf("=");
+    if (index < 0) continue;
+    const name = part.slice(0, index).trim();
+    if (name) jar[name] = decodeURIComponent(part.slice(index + 1).trim());
+  }
+  return jar;
+}
+
+export function readImpersonationSession(
+  request: Request
+): ImpersonationSession | null {
+  const raw = parseCookieHeader(request.headers.get("cookie"))[
+    IMP_SESSION_COOKIE
+  ];
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as ImpersonationSession;
+  } catch {
+    return null;
+  }
+}
+
+function serialize(
+  name: string,
+  value: string,
+  {
+    host,
+    httpOnly,
+    maxAge,
+  }: { host?: string | null; httpOnly: boolean; maxAge: number }
+): string {
+  const domain = resolveCookieDomain(host ?? undefined);
+  const secure = host ? !host.includes("localhost") : true;
+  const parts = [
+    `${name}=${encodeURIComponent(value)}`,
+    "Path=/",
+    "SameSite=Lax",
+    `Max-Age=${maxAge}`,
+  ];
+  if (domain) parts.push(`Domain=${domain}`);
+  if (httpOnly) parts.push("HttpOnly");
+  if (secure) parts.push("Secure");
+  return parts.join("; ");
+}
+
+/** Set-Cookie values that open a session (server-side, on mint success). */
+export function buildImpersonationCookies(
+  minted: MintedToken,
+  host: string | null
+): string[] {
+  const maxAge = Math.max(0, Math.floor(minted.expiresOn - Date.now() / 1000));
+  const session: ImpersonationSession = {
+    accessToken: minted.accessToken,
+    expiresOn: minted.expiresOn,
+    tokenId: minted.tokenId,
+  };
+  const active: ImpersonationActive = {
+    targetEmail: minted.targetEmail,
+    targetName: minted.targetName,
+    targetImage: minted.targetImage,
+    finance: minted.finance,
+    tokenId: minted.tokenId,
+    expiresOn: minted.expiresOn,
+    returnTo: minted.returnTo,
+  };
+  return [
+    serialize(IMP_SESSION_COOKIE, JSON.stringify(session), {
+      host,
+      httpOnly: true,
+      maxAge,
+    }),
+    serialize(IMP_ACTIVE_COOKIE, JSON.stringify(active), {
+      host,
+      httpOnly: false,
+      maxAge,
+    }),
+  ];
+}
+
+/** Set-Cookie values that clear the session (exit or after posting the end record). */
+export function clearImpersonationCookies(host: string | null): string[] {
+  return [
+    serialize(IMP_SESSION_COOKIE, "", { host, httpOnly: true, maxAge: 0 }),
+    serialize(IMP_ACTIVE_COOKIE, "", { host, httpOnly: false, maxAge: 0 }),
+  ];
+}

package/src/impersonation/handlers.ts

@@ -0,0 +1,234 @@
+import { Auth } from "../utils/types";
+import { resolveAccessToken } from "../route-handler/token";
+import {
+  buildImpersonationCookies,
+  clearImpersonationCookies,
+  readImpersonationSession,
+} from "./cookies";
+import { sealImpersonationTicket, openImpersonationTicket } from "./ticket";
+import { requestOrigin } from "../utils/url";
+
+function platformBase(): string | null {
+  return (
+    process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL?.replace(/\/$/, "") ?? null
+  );
+}
+
+function requestHost(request: Request): string | null {
+  return request.headers.get("x-forwarded-host") ?? request.headers.get("host");
+}
+
+function registrable(host: string): string {
+  return host.split(":")[0].toLowerCase().split(".").slice(-2).join(".");
+}
+
+function platformBaseDomain(): string {
+  const api = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
+  if (!api) {
+    throw new Error("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured");
+  }
+  return new URL(api).hostname.split(".").slice(-2).join(".");
+}
+
+// The adopt sets the tenant-domain cookie, then hands back to a same-origin path OR the platform
+// hub (/manage on snosky.no) — anything else falls back to "/" so it can never open-redirect.
+function resolveLanding(returnTo: string, origin: string): string {
+  const base = platformBaseDomain();
+  try {
+    const url = new URL(returnTo, origin);
+    if (url.origin === origin) return url.toString();
+    if (
+      url.protocol === "https:" &&
+      (url.hostname === base || url.hostname.endsWith(`.${base}`))
+    )
+      return url.toString();
+  } catch {
+    // Fall through to the safe default.
+  }
+  return new URL("/", origin).toString();
+}
+
+/** True when the redirect target lives on a different registrable domain than this request. */
+function isCrossDomain(request: Request, target: string): boolean {
+  const here = requestHost(request);
+  if (!here) return false;
+  try {
+    return registrable(new URL(target).host) !== registrable(here);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Starts a view-as-employee session: authenticates as the admin, calls the platform mint endpoint
+ * (which enforces the platform.impersonate gate + required reason + audit server-side), and, on
+ * success, sets the impersonation cookies so subsequent product calls ride the minted token.
+ */
+export function createImpersonationStartHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    const base = platformBase();
+    if (!base) {
+      return new Response(
+        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
+        { status: 500 }
+      );
+    }
+
+    const caller = await resolveAccessToken(authConfig, request);
+    if ("error" in caller) return caller.error;
+
+    let body: {
+      targetEmail?: string;
+      targetName?: string;
+      targetImage?: string;
+      reason?: string;
+      redirectTo?: string;
+      returnTo?: string;
+      landingUrl?: string;
+    };
+    try {
+      body = await request.json();
+    } catch {
+      return new Response("Invalid request body", { status: 400 });
+    }
+
+    const minted = await fetch(`${base}/v1.0/protected/impersonate`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${caller.accessToken}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify({
+        targetEmail: body.targetEmail,
+        targetName: body.targetName,
+        reason: body.reason,
+      }),
+    });
+
+    if (!minted.ok) {
+      const raw = await minted.text();
+      let message = raw;
+      try {
+        const parsed = JSON.parse(raw) as { message?: unknown };
+        if (typeof parsed.message === "string") message = parsed.message;
+      } catch {
+        // Non-JSON error body — pass the raw text through unchanged.
+      }
+      return new Response(message, { status: minted.status });
+    }
+
+    const result = await minted.json();
+    result.targetImage = body.targetImage ?? null;
+    const summary = {
+      targetEmail: result.targetEmail,
+      targetName: result.targetName,
+      finance: result.finance,
+      tokenId: result.tokenId,
+      expiresOn: result.expiresOn,
+    };
+
+    // Custom-domain tenant: hand the session to the tenant domain's adopt route (login's pattern).
+    if (body.redirectTo && isCrossDomain(request, body.redirectTo)) {
+      const target = new URL(body.redirectTo);
+      const ticket = sealImpersonationTicket(
+        { ...result, business: target.host, returnTo: body.returnTo },
+        authConfig.nextAuthSecret
+      );
+      const adopt = new URL("/api/impersonation/adopt", target.origin);
+      adopt.searchParams.set("t", ticket);
+      adopt.searchParams.set(
+        "returnTo",
+        body.landingUrl ?? target.pathname + target.search
+      );
+      const crossDomain = Response.json({
+        ...summary,
+        adoptUrl: adopt.toString(),
+      });
+      for (const cookie of buildImpersonationCookies(
+        { ...result, returnTo: body.returnTo },
+        requestHost(request)
+      )) {
+        crossDomain.headers.append("Set-Cookie", cookie);
+      }
+      return crossDomain;
+    }
+
+    const out = Response.json(summary);
+    for (const cookie of buildImpersonationCookies(
+      { ...result, returnTo: body.returnTo },
+      requestHost(request)
+    )) {
+      out.headers.append("Set-Cookie", cookie);
+    }
+    return out;
+  };
+}
+
+// Runs on the tenant domain: opens the sealed ticket and sets the impersonation cookie here.
+export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    const url = new URL(request.url);
+    const origin = requestOrigin(request);
+    const ticket = url.searchParams.get("t");
+    const host = requestHost(request);
+    const claims = ticket
+      ? openImpersonationTicket(
+          ticket,
+          authConfig.nextAuthSecret,
+          host ?? undefined
+        )
+      : null;
+
+    if (!claims) {
+      const dest = new URL("/", origin);
+      dest.searchParams.set("impersonation_error", "1");
+      return new Response(null, {
+        status: 302,
+        headers: { Location: dest.toString() },
+      });
+    }
+
+    const dest = resolveLanding(
+      url.searchParams.get("returnTo") || "/",
+      origin
+    );
+    const out = new Response(null, {
+      status: 302,
+      headers: { Location: dest },
+    });
+    for (const cookie of buildImpersonationCookies(claims, host)) {
+      out.headers.append("Set-Cookie", cookie);
+    }
+    return out;
+  };
+}
+
+/**
+ * Ends a session: writes the append-only session-end audit record (best effort) and clears the
+ * cookies so the admin's own token is restored. Token expiry auto-ends too.
+ */
+export function createImpersonationEndHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    const session = readImpersonationSession(request);
+    const base = platformBase();
+
+    if (session?.tokenId && base) {
+      const caller = await resolveAccessToken(authConfig, request);
+      if (!("error" in caller)) {
+        await fetch(
+          `${base}/v1.0/protected/impersonate/${encodeURIComponent(session.tokenId)}/end`,
+          {
+            method: "POST",
+            headers: { Authorization: `Bearer ${caller.accessToken}` },
+          }
+        ).catch(() => undefined);
+      }
+    }
+
+    const out = Response.json({ ok: true });
+    for (const cookie of clearImpersonationCookies(requestHost(request))) {
+      out.headers.append("Set-Cookie", cookie);
+    }
+    return out;
+  };
+}