@snokam/auth 2.3.3 → 3.0.1

package/src/options.tsx

@@ -1,389 +0,0 @@
-import NextAuth, { NextAuthOptions } from "next-auth";
-import AzureADProvider from "next-auth/providers/azure-ad";
-import CredentialsProvider from "next-auth/providers/credentials";
-import { getDefaultAuthParams } from "./utils/params";
-import { ConfidentialClientApplication } from "@azure/msal-node";
-import { Configuration, EmployeesClient } from "@snokam/employees-client";
-import { headers } from "next/headers";
-import {
-  getTenantDomains,
-  getTenantDomainsByEntraTenantId,
-  type TenantDomain,
-} from "@snokam/config";
-import { getManagedBearer } from "@snokam/identity";
-import { exchangePasswordToken } from "./password/api";
-import { exchangeSsoToken } from "./sso/exchange";
-import { getSanityImageUrl } from "@snokam/ui/media/sanity";
-import { getSessionCookieSettings } from "./utils/cookies";
-import { getAuthUrl } from "./utils/url";
-import { openHandoff } from "./handoff/ticket";
-import { passwordLogin, redeemBootstrapToken } from "./password/api";
-import { Auth } from "./utils/types";
-
-async function resolveEmployeesBackend(
-  config: Auth.Config
-): Promise<{ base: string; scope: string }> {
-  const scope = config.clientId
-    ? `api://${config.clientId}/user_impersonation`
-    : "";
-  const requestHeaders = await headers();
-  const host =
-    requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
-  const platformApiBase = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "";
-  const authToken = await getManagedBearer(scope);
-  const employeesBackend = (domains: TenantDomain[]) =>
-    domains.find(
-      (domain) => domain.type === "backend" && domain.app === "employees"
-    );
-
-  let match = employeesBackend(
-    await getTenantDomains({ host, platformApiBase, authToken })
-  );
-  if (!match?.url && config.tenantId) {
-    match = employeesBackend(
-      await getTenantDomainsByEntraTenantId({
-        entraTenantId: config.tenantId,
-        platformApiBase,
-        authToken,
-      })
-    );
-  }
-  if (match?.url) return { base: match.url, scope };
-
-  const bare = host?.split(":")[0];
-  const effective =
-    !bare || bare === "localhost" || bare === "127.0.0.1"
-      ? process.env.NEXT_PUBLIC_TENANT_HOST?.split(":")[0]
-      : host;
-  return { base: effective ? `https://${effective}/api/employees` : "", scope };
-}
-
-type ColorScheme = "light" | "dark" | "system";
-
-function isColorScheme(value: unknown): value is ColorScheme {
-  return value === "light" || value === "dark" || value === "system";
-}
-
-function requestHost(req?: {
-  headers?: Record<string, string | string[] | undefined>;
-}): string | undefined {
-  const header = req?.headers?.["x-forwarded-host"] ?? req?.headers?.host;
-  const value = Array.isArray(header) ? header[0] : header;
-  return value?.split(",")[0].trim().split(":")[0] || undefined;
-}
-
-function requestClientIp(req?: {
-  headers?: Record<string, string | string[] | undefined>;
-}): string | undefined {
-  const pick = (name: string): string | undefined => {
-    const header = req?.headers?.[name];
-    const value = Array.isArray(header) ? header[0] : header;
-    return value?.split(",")[0].trim() || undefined;
-  };
-  // Trusted edge headers first (Front Door, unspoofable); rightmost XFF entry as a fallback.
-  const edge = pick("x-azure-clientip") ?? pick("x-azure-socketip");
-  if (edge) return edge;
-  const forwarded = req?.headers?.["x-forwarded-for"];
-  const value = Array.isArray(forwarded) ? forwarded[0] : forwarded;
-  return value?.split(",").pop()?.trim() || undefined;
-}
-
-async function requestOrigin(): Promise<string | undefined> {
-  const h = await headers();
-  const host = (h.get("x-forwarded-host") ?? h.get("host") ?? "")
-    .split(",")[0]
-    .trim();
-  if (!host) return undefined;
-  const scheme =
-    h.get("x-forwarded-proto") ??
-    (host.startsWith("localhost") ? "http" : "https");
-  return `${scheme}://${host}`;
-}
-
-interface EmployeeProfile {
-  colorScheme?: ColorScheme;
-  imageUrl?: string;
-}
-
-async function fetchEmployeeProfile(
-  config: Auth.Config,
-  refreshToken?: string,
-  authMethod?: string
-): Promise<EmployeeProfile> {
-  if (!refreshToken) {
-    return {};
-  }
-  try {
-    const { base, scope } = await resolveEmployeesBackend(config);
-    if (!base || !scope) return {};
-
-    let accessToken: string | undefined;
-    if (authMethod === "password") {
-      accessToken = (await exchangePasswordToken(refreshToken))?.accessToken;
-    } else {
-      const entra = (
-        await new ConfidentialClientApplication({
-          auth: {
-            clientId: config.clientId,
-            clientSecret: config.clientSecret,
-            authority: `https://login.microsoftonline.com/${config.tenantId}`,
-          },
-        }).acquireTokenByRefreshToken({ scopes: [scope], refreshToken })
-      )?.accessToken;
-      accessToken = entra
-        ? (await exchangeSsoToken(entra))?.accessToken
-        : undefined;
-    }
-
-    if (!accessToken) return {};
-    const client = new EmployeesClient(
-      new Configuration({
-        basePath: base,
-        accessToken: `Bearer ${accessToken}`,
-      })
-    );
-    const me = await client.getMeProtected();
-    const profile = {
-      colorScheme: isColorScheme(me.settings?.colorScheme)
-        ? me.settings.colorScheme
-        : undefined,
-      imageUrl: getSanityImageUrl(me.image?.asset?.url, {
-        width: 128,
-        height: 128,
-        fit: "crop",
-      }),
-    };
-    if (!profile.imageUrl) {
-      console.warn("[auth] employee profile resolved without an image");
-    }
-    return profile;
-  } catch (error) {
-    console.warn("[auth] employee profile fetch failed", error);
-    return {};
-  }
-}
-
-export const getNextAuthOptions = (config: Auth.Config): NextAuthOptions => {
-  const authUrl = getAuthUrl();
-  const { name, domain, secure } = getSessionCookieSettings(authUrl);
-
-  return {
-    secret: config.nextAuthSecret,
-    session: {
-      maxAge: 7 * 24 * 60 * 60,
-      updateAge: 24 * 60 * 60,
-    },
-    pages: {
-      signIn: "/auth/login",
-    },
-    providers: [
-      AzureADProvider({
-        clientId: config.clientId,
-        clientSecret: config.clientSecret,
-        tenantId: config.tenantId,
-        authorization: {
-          params: getDefaultAuthParams(config.tenantId),
-        },
-        checks: ["pkce", "state"],
-        profile(profile) {
-          return {
-            id: profile.sub,
-            name: profile.name,
-            email: profile.email,
-            image: null,
-          };
-        },
-      }),
-      CredentialsProvider({
-        id: "handoff",
-        name: "Snokam",
-        credentials: { ticket: { label: "ticket", type: "text" } },
-        async authorize(credentials, req) {
-          const expectedBusiness = requestHost(req);
-          const claims =
-            credentials?.ticket && expectedBusiness
-              ? openHandoff(
-                  credentials.ticket,
-                  config.nextAuthSecret,
-                  expectedBusiness
-                )
-              : null;
-          if (!claims) {
-            return null;
-          }
-          return {
-            id: claims.oid,
-            email: claims.email,
-            name: claims.name,
-            image: claims.image ?? null,
-            oid: claims.oid,
-            tid: claims.tid,
-            refreshToken: claims.refreshToken,
-            authMethod: claims.authMethod || undefined,
-          } as unknown as { id: string };
-        },
-      }),
-      CredentialsProvider({
-        id: "password",
-        name: "Passord",
-        credentials: {
-          email: { label: "email", type: "text" },
-          password: { label: "password", type: "password" },
-          code: { label: "code", type: "text" },
-          host: { label: "host", type: "text" },
-          bootstrap: { label: "bootstrap", type: "text" },
-        },
-        async authorize(credentials, req) {
-          if (credentials?.bootstrap) {
-            const redeemed = await redeemBootstrapToken(credentials.bootstrap);
-            if (!redeemed) {
-              return null;
-            }
-            return {
-              id: redeemed.userId,
-              email: redeemed.email,
-              name: redeemed.name,
-              oid: redeemed.userId,
-              tid: redeemed.businessId,
-              refreshToken: redeemed.refreshToken,
-              authMethod: "password",
-            } as unknown as { id: string };
-          }
-
-          if (
-            !credentials?.email ||
-            !credentials.password ||
-            !credentials.host
-          ) {
-            return null;
-          }
-
-          const outcome = await passwordLogin(
-            {
-              host: credentials.host,
-              email: credentials.email,
-              password: credentials.password,
-              code: credentials.code || undefined,
-            },
-            requestClientIp(req)
-          );
-          if (!outcome.login) {
-            throw new Error(outcome.error ?? "invalid_credentials");
-          }
-
-          return {
-            id: outcome.login.userId,
-            email: outcome.login.email,
-            name: outcome.login.name,
-            oid: outcome.login.userId,
-            tid: outcome.login.businessId,
-            refreshToken: outcome.login.refreshToken,
-            authMethod: "password",
-          } as unknown as { id: string };
-        },
-      }),
-    ],
-    cookies: {
-      sessionToken: {
-        name,
-        options: {
-          path: "/",
-          httpOnly: true,
-          sameSite: "lax",
-          secure,
-          domain,
-        },
-      },
-    },
-    callbacks: {
-      async redirect({ url, baseUrl }) {
-        const origin = (await requestOrigin()) ?? baseUrl;
-        const { pathname, search, hash } = new URL(url, origin);
-        return origin + pathname + search + hash;
-      },
-      async jwt({ token, account, profile, user, trigger, session }) {
-        if (account?.access_token) {
-          token.refreshToken = account.refresh_token;
-          token.expiresAt = account.expires_at;
-          const claims = profile as { oid?: string; tid?: string } | undefined;
-          if (claims?.oid) token.oid = claims.oid;
-          if (claims?.tid) token.tid = claims.tid;
-          const employee = await fetchEmployeeProfile(
-            { ...config, tenantId: claims?.tid ?? config.tenantId },
-            account.refresh_token as string | undefined
-          );
-          if (employee.colorScheme) token.colorScheme = employee.colorScheme;
-          token.picture = employee.imageUrl ?? null;
-        }
-
-        const handoff = user as
-          | {
-              oid?: string;
-              tid?: string;
-              refreshToken?: string;
-              authMethod?: string;
-            }
-          | undefined;
-        if (handoff?.refreshToken) {
-          token.oid = handoff.oid;
-          token.tid = handoff.tid;
-          token.refreshToken = handoff.refreshToken;
-          if (handoff.authMethod) {
-            token.authMethod = handoff.authMethod;
-          }
-          const employee = await fetchEmployeeProfile(
-            { ...config, tenantId: handoff.tid ?? config.tenantId },
-            handoff.refreshToken,
-            handoff.authMethod
-          );
-          if (employee.colorScheme) token.colorScheme = employee.colorScheme;
-          if (employee.imageUrl) token.picture = employee.imageUrl;
-        }
-
-        if (trigger === "update") {
-          if (isColorScheme(session?.colorScheme)) {
-            token.colorScheme = session.colorScheme;
-          }
-          if (session?.refreshProfile && token.refreshToken) {
-            const employee = await fetchEmployeeProfile(
-              {
-                ...config,
-                tenantId: (token.tid as string | undefined) ?? config.tenantId,
-              },
-              token.refreshToken as string,
-              token.authMethod as string | undefined
-            );
-            if (employee.imageUrl) token.picture = employee.imageUrl;
-          }
-        }
-
-        return token;
-      },
-      async session({ session, token }) {
-        const claims = token as {
-          colorScheme?: unknown;
-          oid?: string;
-          tid?: string;
-          authMethod?: string;
-        };
-        const target = session as {
-          colorScheme?: ColorScheme;
-          oid?: string;
-          tid?: string;
-          authMethod?: string;
-        };
-        if (isColorScheme(claims.colorScheme)) {
-          target.colorScheme = claims.colorScheme;
-        }
-        target.oid = claims.oid;
-        target.tid = claims.tid;
-        if (claims.authMethod) {
-          target.authMethod = claims.authMethod;
-        }
-        return session;
-      },
-    },
-  };
-};
-
-export default (config: Auth.Config) => NextAuth(getNextAuthOptions(config));

package/src/page-router/components/Login.tsx

@@ -1,50 +0,0 @@
-import { useEffect, useState, useRef } from "react";
-import { useRouter } from "next/router";
-import { useAuth } from "../../hooks";
-import { signIn } from "next-auth/react";
-import { PageLoader } from "@snokam/ui";
-import Error from "../../components/Error";
-
-export const Login = () => {
-  const { isAuthenticated } = useAuth();
-  const [callbackUrl, setCallbackUrl] = useState<string | null>(null);
-  const [authParams, setAuthParams] = useState<Record<string, string>>({});
-  const [isError, setIsError] = useState<boolean>(false);
-  const hasSignedIn = useRef(false);
-  const router = useRouter();
-
-  useEffect(() => {
-    const params = new URLSearchParams(window.location.search);
-    setCallbackUrl(params.get("callbackUrl"));
-    setIsError(!!params.get("error"));
-
-    const authParamsObj: Record<string, string> = {};
-    params.forEach((value, key) => {
-      if (key !== "error" && key !== "callbackUrl") {
-        authParamsObj[key] = value;
-      }
-    });
-    setAuthParams(authParamsObj);
-  }, []);
-
-  useEffect(() => {
-    if (!callbackUrl) return;
-    if (isError) return;
-    if (hasSignedIn.current) return;
-
-    if (isAuthenticated) {
-      router.replace(callbackUrl || "/");
-    } else {
-      hasSignedIn.current = true;
-      signIn("azure-ad", { callbackUrl }, authParams);
-    }
-  }, [isAuthenticated, callbackUrl, authParams, isError, router, signIn]);
-
-  if (isError) {
-    return <Error />;
-  }
-
-  return <PageLoader />;
-};
-
-export default Login;

package/src/page-router/components/Provider/index.tsx

@@ -1,45 +0,0 @@
-import { memo, ReactNode, useEffect } from "react";
-import { useRouter } from "next/router";
-import { Auth } from "../../../utils/types";
-import { Authenticate } from "../../../components/Authenticate";
-import { SessionProvider } from "next-auth/react";
-import { useAuth } from "../../../hooks";
-
-export const Provider = memo((props: Auth.Provider.Props) => {
-  const { session, children, enforceLogin } = props;
-  const router = useRouter();
-  const query = router?.query;
-
-  if (query?.enforceLogin || enforceLogin) {
-    return (
-      <SessionProvider session={session}>
-        <Authenticate provider="azure-ad" {...props}>
-          {children}
-        </Authenticate>
-      </SessionProvider>
-    );
-  }
-
-  return (
-    <SessionProvider session={session}>
-      <Wrapper>{children}</Wrapper>
-    </SessionProvider>
-  );
-});
-
-export const Wrapper = ({ children }: { children: ReactNode }) => {
-  const { signOut } = useAuth();
-  const router = useRouter();
-
-  useEffect(() => {
-    if (router?.query?.logout === "true") {
-      signOut({
-        callbackUrl: "/auth/login?callbackUrl=/",
-      });
-    }
-  }, [router?.query?.logout]);
-
-  return <>{children}</>;
-};
-
-export default Provider;

package/src/page-router/index.tsx

@@ -1,22 +0,0 @@
-"use client";
-
-import { Provider } from "./components/Provider";
-import { Authenticate } from "../components/Authenticate";
-import { Login } from "./components/Login";
-import { Error } from "../components/Error";
-
-export { Unauthenticated } from "../components/Unauthenticated";
-export { Authenticated } from "../components/Authenticated";
-export { useAuth } from "../hooks";
-export { signIn, SessionProvider } from "next-auth/react";
-export { Login, Error, Provider, Authenticate };
-
-export default {
-  Login,
-  Error,
-  Provider,
-  Authenticate,
-};
-
-export type { Session } from "next-auth";
-export type { Auth } from "../utils/types";

package/src/page-router/server.ts

@@ -1,6 +0,0 @@
-export { getServerToken } from "../server/token";
-export { getServerSession } from "next-auth/next";
-export { getNextAuthOptions } from "../options";
-export { getAuth } from "../server/auth";
-
-export type { Auth } from "../utils/types";

package/src/server/auth.tsx

@@ -1,30 +0,0 @@
-import { GetServerSidePropsContext, GetStaticPropsContext } from "next";
-import { getServerSession as nextAuthGetServerSession } from "next-auth";
-import { Auth } from "../utils/types";
-import { getNextAuthOptions } from "../options";
-
-export const getAuth = async (
-  context: GetServerSidePropsContext | GetStaticPropsContext,
-  authConfig: Auth.Config
-) => {
-  if (!("req" in context && "res" in context)) {
-    return {
-      isAuthenticated: false,
-      session: null,
-      user: null,
-    };
-  }
-
-  const options = getNextAuthOptions(authConfig);
-  const session = await nextAuthGetServerSession(
-    context.req,
-    context.res,
-    options
-  );
-
-  return {
-    isAuthenticated: !!session?.user,
-    user: session?.user || null,
-    session,
-  };
-};

package/src/server/handler.tsx

@@ -1,68 +0,0 @@
-import { getToken } from "next-auth/jwt";
-import { ConfidentialClientApplication } from "@azure/msal-node";
-import type { NextApiRequest, NextApiResponse } from "next";
-import { getServerSession } from "next-auth";
-import { Auth } from "../utils/types";
-import { getNextAuthOptions } from "../options";
-import { exchangeSsoToken } from "../sso/exchange";
-
-export interface Props {
-  req: NextApiRequest;
-  res: NextApiResponse<{ accessToken: string; expiresOn: number } | string>;
-  authConfig: Auth.Config;
-}
-
-export default async function handler(props: Props) {
-  const { req, res, authConfig } = props;
-  const options = getNextAuthOptions(authConfig);
-  const session = await getServerSession(req, res, options);
-
-  if (!session?.user) {
-    return res.status(401).end("Not authenticated");
-  }
-
-  const scope = process.env.IDENTITY_AD_SCOPE;
-  if (!scope) {
-    return res.status(500).end("IDENTITY_AD_SCOPE is not configured");
-  }
-
-  try {
-    const { nextAuthSecret } = authConfig;
-    const refetchTokenResult = await getToken({
-      req,
-      secret: nextAuthSecret,
-      cookieName: options.cookies?.sessionToken?.name,
-    });
-
-    if (!refetchTokenResult) {
-      return res.status(500).end("Failed to get refetch token");
-    }
-
-    const cca = new ConfidentialClientApplication({
-      auth: {
-        clientId: authConfig.clientId,
-        clientSecret: authConfig.clientSecret,
-        authority: `https://login.microsoftonline.com/${authConfig.tenantId}`,
-      },
-    });
-
-    const accessTokenResult = await cca.acquireTokenByRefreshToken({
-      scopes: [scope],
-      refreshToken: refetchTokenResult?.refreshToken as string,
-    });
-
-    if (!accessTokenResult) {
-      return res.status(500).end("Failed to get access token");
-    }
-
-    const exchanged = await exchangeSsoToken(accessTokenResult.accessToken);
-    if (!exchanged) {
-      return res.status(502).end("SSO token exchange failed");
-    }
-
-    return res.status(200).json(exchanged);
-  } catch (e) {
-    console.error("Token exchange error:", e);
-    res.status(500).end("Token exchange failed");
-  }
-}

package/src/server.tsx

@@ -1,16 +0,0 @@
-import { getServerToken } from "./server/token";
-import { default as Routes } from "./options";
-import { default as Token } from "./server/handler";
-import { Auth } from "./utils/types";
-
-export { getServerToken };
-export { getServerSession } from "next-auth/next";
-export { getNextAuthOptions } from "./options";
-export { getAuth } from "./server/auth";
-
-export type { Auth };
-
-export default {
-  Routes,
-  Token,
-};