@snokam/auth 2.3.3 → 3.0.2

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "2.3.3",
-  "main": "src/index.tsx",
-  "types": "src/index.tsx",
+  "version": "3.0.2",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
   "files": [
     "src",
     "package.json",
@@ -25,14 +25,14 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/config": "1.1.1",
+    "@snokam/platform-client": "2.0.0",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "1.0.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/ui": "1.1.2"
+    "@snokam/tenant": "2.0.1",
+    "@snokam/ui": "2.0.3"
   },
   "peerDependencies": {
-    "next": "^16.3.2",
+    "next": "16.3.3",
     "react": "19.2.8",
     "react-dom": "19.2.8"
   },
@@ -41,13 +41,10 @@
     "@types/react-dom": "^19.2.3"
   },
   "exports": {
-    ".": "./src/index.tsx",
+    ".": "./src/index.ts",
     "./config": "./src/config.ts",
-    "./server": "./src/server.tsx",
-    "./middleware": "./src/build-proxy.tsx",
-    "./route-handler": "./src/route-handler.ts",
-    "./page-router": "./src/page-router/index.tsx",
-    "./page-router/server": "./src/page-router/server.ts",
+    "./middleware": "./src/middleware.tsx",
+    "./route-handler": "./src/route-handler/index.ts",
     "./app-router": "./src/app-router/index.tsx",
     "./app-router/server": "./src/app-router/server.ts",
     "./password": "./src/password/api.ts",

package/src/app-router/components/Login.tsx

@@ -5,8 +5,8 @@ import { useRouter, useSearchParams } from "next/navigation";
 import { useAuth } from "../../hooks";
 import { signIn } from "next-auth/react";
 import { PageLoader } from "@snokam/ui";
-import { useOptionalConfig } from "@snokam/config";
-import { safeCallbackTarget } from "../../utils/callback-url";
+import { useOptionalConfig } from "@snokam/tenant";
+import { safeCallbackTarget } from "../../session";
 import Error from "../../components/Error";
 import Consent from "../../components/Consent";
 import LoggedOut from "../../components/LoggedOut";

package/src/app-router/components/Provider/index.tsx

@@ -2,7 +2,7 @@
 
 import { memo, ReactNode, Suspense, useEffect } from "react";
 import { useSearchParams } from "next/navigation";
-import { Auth } from "../../../utils/types";
+import { Auth } from "../../../types";
 import { Authenticate } from "../../../components/Authenticate";
 import { SessionProvider } from "next-auth/react";
 import { useAuth } from "../../../hooks";

package/src/app-router/index.tsx

@@ -12,7 +12,7 @@ export { Unauthenticated } from "../components/Unauthenticated";
 export { Authenticated } from "../components/Authenticated";
 export { useAuth } from "../hooks";
 export { EmployeeThemeSync } from "../theme/employee-theme-sync";
-export { ScopesProvider, useScopes, useHasScope } from "../scopes/context";
+export { ScopesProvider, useScopes, useHasScope } from "../scopes";
 export {
   usePlatformRoles,
   useHasPlatformRole,
@@ -20,12 +20,12 @@ export {
   PLATFORM_OPERATOR,
 } from "../roles/context";
 export type { RolesState } from "../roles/context";
-export type { ScopesState } from "../scopes/context";
+export type { ScopesState } from "../scopes";
 export {
   scopeGranted,
   resolveEmployeeScopes,
   type ScopeAccess,
-} from "../scopes/matcher";
+} from "../scopes";
 export {
   ImpersonationProvider,
   useImpersonation,
@@ -53,4 +53,4 @@ export default {
 };
 
 export type { Session } from "next-auth";
-export type { Auth } from "../utils/types";
+export type { Auth } from "../types";

package/src/app-router/server.ts

@@ -3,78 +3,30 @@ import {
   type Session,
 } from "next-auth";
 import type { NextAuthOptions } from "next-auth";
-import { headers } from "next/headers";
-import { getTenantDomains } from "@snokam/config";
-import { getManagedBearer } from "@snokam/identity";
+import {
+  apiScope,
+  appUrl,
+  backendUrl,
+  managedBearer,
+} from "@snokam/tenant/server";
 
-export { getServerToken } from "../server/token";
+export { getServerToken } from "./token";
 export { getNextAuthOptions } from "../options";
-export type { Auth } from "../utils/types";
-
-export async function serverTenantToken(): Promise<string | undefined> {
-  const scope = serverApiScope();
-  if (!scope) return undefined;
-  return getManagedBearer(scope);
-}
+export type { Auth } from "../types";
 
-export async function resolveServerApiBase(service: string): Promise<string> {
-  if (!service) return "";
-  const envKey = `NEXT_PUBLIC_${service.toUpperCase().replace(/-/g, "_")}_API_BASE_URL`;
-  const override = process.env[envKey];
-  if (
-    override &&
-    (override.includes("localhost") || override.includes("127.0.0.1"))
-  ) {
-    return override;
-  }
+export const serverApiScope = apiScope;
 
-  const requestHeaders = await headers();
-  const host =
-    requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
-  const domains = await getTenantDomains({
-    host,
-    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
-    authToken: await serverTenantToken(),
-  });
-  const custom = domains.find(
-    (domain) => domain.type === "backend" && domain.env === envKey
-  );
-  if (custom?.url) return custom.url;
-
-  const bare = host?.split(":")[0];
-  const tenantHost = (
-    bare === "localhost" || bare === "127.0.0.1"
-      ? process.env.NEXT_PUBLIC_TENANT_HOST
-      : host
-  )?.split(":")[0];
-  return tenantHost ? `https://${tenantHost}/api/${service}` : (override ?? "");
+export function serverTenantToken(): Promise<string | undefined> {
+  const scope = serverApiScope();
+  return scope ? managedBearer(scope) : Promise.resolve(undefined);
 }
 
-export function serverApiScope(): string {
-  const clientId = process.env.NEXT_PUBLIC_AZURE_AD_CLIENT_ID ?? "";
-  return clientId ? `api://${clientId}/user_impersonation` : "";
+export function resolveServerApiBase(service: string): Promise<string> {
+  return service ? backendUrl(service) : Promise.resolve("");
 }
 
-export async function resolveServerAppUrl(app: string): Promise<string> {
-  const requestHeaders = await headers();
-  const host =
-    requestHeaders.get("x-forwarded-host") ?? requestHeaders.get("host");
-  const domains = await getTenantDomains({
-    host,
-    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
-    authToken: await serverTenantToken(),
-  });
-  const match = domains.find(
-    (domain) => domain.type === "frontend" && domain.app === app
-  );
-  if (match?.url) return match.url;
-
-  const bare = host?.split(":")[0];
-  const effective =
-    !bare || bare === "localhost" || bare === "127.0.0.1"
-      ? process.env.NEXT_PUBLIC_TENANT_HOST?.split(":")[0]
-      : host;
-  return effective ? `https://${effective}` : "";
+export function resolveServerAppUrl(app: string): Promise<string> {
+  return appUrl(app);
 }
 
 export async function getServerSession(

package/src/components/Authenticate.tsx

@@ -1,9 +1,9 @@
 import { memo, useEffect } from "react";
-import { Auth } from "../utils/types";
+import { Auth } from "../types";
 import { signIn } from "next-auth/react";
 import { useAuth } from "../hooks";
 import { PageLoader } from "@snokam/ui";
-import { useOptionalConfig } from "@snokam/config";
+import { useOptionalConfig } from "@snokam/tenant";
 
 export const Authenticate = memo((props: Auth.Authenticate.Props) => {
   const { children, provider } = props;

package/src/components/Consent/index.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import Button from "@mui/material/Button";
-import { useOptionalConfig } from "@snokam/config";
+import { useOptionalConfig } from "@snokam/tenant";
 import { Error } from "../Error";
 
 export const Consent = () => {

package/src/components/Error/index.tsx

@@ -5,7 +5,7 @@ import Styled from "./styled";
 import { Layout } from "@snokam/ui";
 import { TransitionType } from "@snokam/ui/layout";
 import { useAuth } from "../../hooks";
-import { useOptionalConfig } from "@snokam/config";
+import { useOptionalConfig } from "@snokam/tenant";
 import Button from "@mui/material/Button";
 import { Avatar, Alert } from "@mui/material";
 

package/src/components/index.ts

@@ -0,0 +1,5 @@
+export { Authenticate } from "./Authenticate";
+export { Authenticated } from "./Authenticated";
+export { Unauthenticated } from "./Unauthenticated";
+export { Consent } from "./Consent";
+export { Error } from "./Error";

package/src/config.ts

@@ -1,4 +1,4 @@
-import type { Auth } from "./utils/types";
+import type { Auth } from "./types";
 
 export const getAuthConfig = (): Auth.Config => ({
   clientId: process.env.NEXT_PUBLIC_AZURE_AD_CLIENT_ID ?? "",

package/src/handoff/handlers.ts

@@ -1,9 +1,12 @@
 import { getToken } from "next-auth/jwt";
-import { getSessionCookieSettings } from "../utils/cookies";
-import { getAuthUrl, requestOrigin } from "../utils/url";
+import {
+  getSessionCookieSettings,
+  getAuthUrl,
+  requestOrigin,
+  safeCallbackTarget,
+} from "../session";
 import { sealHandoff } from "./ticket";
 import { isAllowedReturnTo } from "./return-to";
-import { safeCallbackTarget } from "../utils/callback-url";
 import { revokePasswordToken } from "../password/api";
 
 interface HandoffConfig {

package/src/handoff/return-to.ts

@@ -1,4 +1,4 @@
-import { isKnownTenantHost } from "@snokam/config";
+import { isKnownTenantHost } from "@snokam/tenant";
 import { getManagedBearer } from "@snokam/identity";
 
 interface ReturnToOptions {

package/src/handoff/ticket.ts

@@ -1,9 +1,4 @@
-import {
-  createCipheriv,
-  createDecipheriv,
-  createHash,
-  randomBytes,
-} from "crypto";
+import { open, seal } from "../ticket/seal";
 
 export interface HandoffClaims {
   oid: string;
@@ -16,40 +11,14 @@ export interface HandoffClaims {
   image?: string;
 }
 
-const ALGORITHM = "aes-256-gcm";
 const DEFAULT_TTL_SECONDS = 300;
 
-function rejectHandoff(reason: string): null {
-  console.warn(`[handoff] ticket rejected: ${reason}`);
-  return null;
-}
-
-const keyFromSecret = (secret: string): Buffer => {
-  if (!secret)
-    throw new Error(
-      "Hand-off secret (NEXTAUTH_SECRET) is empty; refusing to seal/open a forgeable ticket."
-    );
-  return createHash("sha256").update(secret).digest();
-};
-
 export function sealHandoff(
   claims: HandoffClaims,
   secret: string,
   ttlSeconds: number = DEFAULT_TTL_SECONDS
 ): string {
-  const payload = JSON.stringify({
-    ...claims,
-    exp: Math.floor(Date.now() / 1000) + ttlSeconds,
-  });
-  const iv = randomBytes(12);
-  const cipher = createCipheriv(ALGORITHM, keyFromSecret(secret), iv);
-  const ciphertext = Buffer.concat([
-    cipher.update(payload, "utf8"),
-    cipher.final(),
-  ]);
-  return [iv, cipher.getAuthTag(), ciphertext]
-    .map((part) => part.toString("base64url"))
-    .join(".");
+  return seal(claims, secret, ttlSeconds, "hand-off");
 }
 
 export function openHandoff(
@@ -58,40 +27,9 @@ export function openHandoff(
   expectedBusiness?: string,
   now: number = Date.now()
 ): HandoffClaims | null {
-  const parts = ticket.split(".");
-  if (parts.length !== 3) {
-    return rejectHandoff("malformed ticket (expected iv.tag.ciphertext)");
-  }
-
-  try {
-    const [iv, tag, ciphertext] = parts.map((part) =>
-      Buffer.from(part, "base64url")
-    );
-    const decipher = createDecipheriv(ALGORITHM, keyFromSecret(secret), iv);
-    decipher.setAuthTag(tag);
-    const plaintext = Buffer.concat([
-      decipher.update(ciphertext),
-      decipher.final(),
-    ]).toString("utf8");
-
-    const payload = JSON.parse(plaintext) as HandoffClaims & { exp: number };
-    if (payload.exp * 1000 < now) {
-      return rejectHandoff(
-        `expired (exp ${payload.exp}, now ${Math.floor(now / 1000)})`
-      );
-    }
-
-    if (expectedBusiness && payload.business !== expectedBusiness) {
-      return rejectHandoff(
-        `business mismatch (ticket "${payload.business}" vs host "${expectedBusiness}")`
-      );
-    }
-
-    const { exp: _exp, ...claims } = payload;
-    return claims;
-  } catch (error) {
-    return rejectHandoff(
-      `decrypt failed (secret mismatch or tampered): ${(error as Error).message}`
-    );
-  }
+  return open<HandoffClaims>(ticket, secret, "hand-off", {
+    expectedBusiness,
+    now,
+    onReject: (reason) => console.warn(`[handoff] ticket rejected: ${reason}`),
+  });
 }

package/src/impersonation/cookies.ts

@@ -1,4 +1,4 @@
-import { resolveCookieDomain } from "../utils/cookies";
+import { resolveCookieDomain } from "../session";
 
 /** HttpOnly — carries the impersonation bearer; only the token handler ever reads it. */
 export const IMP_SESSION_COOKIE = "imp_session";

package/src/impersonation/handlers.ts

@@ -1,4 +1,4 @@
-import { Auth } from "../utils/types";
+import { Auth } from "../types";
 import { resolveAccessToken } from "../route-handler/token";
 import {
   buildImpersonationCookies,
@@ -6,7 +6,7 @@ import {
   readImpersonationSession,
 } from "./cookies";
 import { sealImpersonationTicket, openImpersonationTicket } from "./ticket";
-import { requestOrigin } from "../utils/url";
+import { requestOrigin } from "../session";
 
 function platformBase(): string | null {
   return (

package/src/impersonation/routes.ts

@@ -1,4 +1,4 @@
-import { Auth } from "../utils/types";
+import { Auth } from "../types";
 import {
   createImpersonationStartHandler,
   createImpersonationEndHandler,

package/src/impersonation/ticket.ts

@@ -1,11 +1,5 @@
-import {
-  createCipheriv,
-  createDecipheriv,
-  createHash,
-  randomBytes,
-} from "crypto";
+import { open, seal } from "../ticket/seal";
 
-// Cross-domain Vis som hand-off, sealed with the shared NEXTAUTH_SECRET — same trust model as login's ticket.
 export interface ImpersonationTicket {
   accessToken: string;
   expiresOn: number;
@@ -17,35 +11,14 @@ export interface ImpersonationTicket {
   returnTo?: string;
 }
 
-const ALGORITHM = "aes-256-gcm";
 const TTL_SECONDS = 120;
 
-const keyFromSecret = (secret: string): Buffer => {
-  if (!secret)
-    throw new Error(
-      "NEXTAUTH_SECRET is empty; refusing to seal/open a forgeable impersonation ticket."
-    );
-  return createHash("sha256").update(secret).digest();
-};
-
 export function sealImpersonationTicket(
   claims: ImpersonationTicket,
   secret: string,
   ttlSeconds: number = TTL_SECONDS
 ): string {
-  const payload = JSON.stringify({
-    ...claims,
-    exp: Math.floor(Date.now() / 1000) + ttlSeconds,
-  });
-  const iv = randomBytes(12);
-  const cipher = createCipheriv(ALGORITHM, keyFromSecret(secret), iv);
-  const ciphertext = Buffer.concat([
-    cipher.update(payload, "utf8"),
-    cipher.final(),
-  ]);
-  return [iv, cipher.getAuthTag(), ciphertext]
-    .map((part) => part.toString("base64url"))
-    .join(".");
+  return seal(claims, secret, ttlSeconds, "impersonation");
 }
 
 export function openImpersonationTicket(
@@ -54,26 +27,8 @@ export function openImpersonationTicket(
   expectedBusiness?: string,
   now: number = Date.now()
 ): ImpersonationTicket | null {
-  const parts = ticket.split(".");
-  if (parts.length !== 3) return null;
-  try {
-    const [iv, tag, ciphertext] = parts.map((part) =>
-      Buffer.from(part, "base64url")
-    );
-    const decipher = createDecipheriv(ALGORITHM, keyFromSecret(secret), iv);
-    decipher.setAuthTag(tag);
-    const plaintext = Buffer.concat([
-      decipher.update(ciphertext),
-      decipher.final(),
-    ]).toString("utf8");
-    const payload = JSON.parse(plaintext) as ImpersonationTicket & {
-      exp: number;
-    };
-    if (payload.exp * 1000 < now) return null;
-    if (expectedBusiness && payload.business !== expectedBusiness) return null;
-    const { exp: _exp, ...claims } = payload;
-    return claims;
-  } catch {
-    return null;
-  }
+  return open<ImpersonationTicket>(ticket, secret, "impersonation", {
+    expectedBusiness,
+    now,
+  });
 }

package/src/index.ts

@@ -0,0 +1,11 @@
+export * from "./components";
+export * from "./scopes";
+
+export { useAuth, clearAuthTokenCache } from "./hooks";
+
+export { buildAdminConsentUrl } from "./consent";
+export type { AdminConsentParams } from "./consent";
+export type { Auth } from "./types";
+
+export { default as middleware } from "next-auth/middleware";
+export { signIn } from "next-auth/react";

package/src/{build-proxy.tsx → middleware.tsx}

@@ -2,10 +2,9 @@ import { match } from "path-to-regexp";
 import { getToken } from "next-auth/jwt";
 import { type NextRequestWithAuth } from "next-auth/middleware";
 import { NextResponse, NextFetchEvent } from "next/server";
-import { Auth } from "./utils/types";
-import { getSessionCookieSettings } from "./utils/cookies";
-import { addCorsHeaders } from "./utils/cors";
-import { getAuthUrl } from "./utils/url";
+import { Auth } from "./types";
+import { getSessionCookieSettings, getAuthUrl } from "./session";
+import { addCorsHeaders } from "./cors";
 
 export function buildAuthMiddleware({
   matcher = [],

package/src/options/callbacks.ts

@@ -0,0 +1,99 @@
+import type { NextAuthOptions } from "next-auth";
+import {
+  fetchEmployeeProfile,
+  isColorScheme,
+  type ColorScheme,
+} from "./employee-profile";
+import { requestOrigin } from "./request";
+import { Auth } from "../types";
+
+interface HandoffUser {
+  oid?: string;
+  tid?: string;
+  refreshToken?: string;
+  authMethod?: string;
+}
+
+export function callbacks(config: Auth.Config): NextAuthOptions["callbacks"] {
+  return {
+    async redirect({ url, baseUrl }) {
+      const origin = (await requestOrigin()) ?? baseUrl;
+      const { pathname, search, hash } = new URL(url, origin);
+      return origin + pathname + search + hash;
+    },
+
+    async jwt({ token, account, profile, user, trigger, session }) {
+      if (account?.access_token) {
+        token.refreshToken = account.refresh_token;
+        token.expiresAt = account.expires_at;
+        const claims = profile as { oid?: string; tid?: string } | undefined;
+        if (claims?.oid) token.oid = claims.oid;
+        if (claims?.tid) token.tid = claims.tid;
+        const employee = await fetchEmployeeProfile(
+          { ...config, tenantId: claims?.tid ?? config.tenantId },
+          account.refresh_token as string | undefined
+        );
+        if (employee.colorScheme) token.colorScheme = employee.colorScheme;
+        token.picture = employee.imageUrl ?? null;
+      }
+
+      const handoff = user as HandoffUser | undefined;
+      if (handoff?.refreshToken) {
+        token.oid = handoff.oid;
+        token.tid = handoff.tid;
+        token.refreshToken = handoff.refreshToken;
+        if (handoff.authMethod) token.authMethod = handoff.authMethod;
+
+        const employee = await fetchEmployeeProfile(
+          { ...config, tenantId: handoff.tid ?? config.tenantId },
+          handoff.refreshToken,
+          handoff.authMethod
+        );
+        if (employee.colorScheme) token.colorScheme = employee.colorScheme;
+        if (employee.imageUrl) token.picture = employee.imageUrl;
+      }
+
+      if (trigger === "update") {
+        if (isColorScheme(session?.colorScheme))
+          token.colorScheme = session.colorScheme;
+
+        if (session?.refreshProfile && token.refreshToken) {
+          const employee = await fetchEmployeeProfile(
+            {
+              ...config,
+              tenantId: (token.tid as string | undefined) ?? config.tenantId,
+            },
+            token.refreshToken as string,
+            token.authMethod as string | undefined
+          );
+          if (employee.imageUrl) token.picture = employee.imageUrl;
+        }
+      }
+
+      return token;
+    },
+
+    async session({ session, token }) {
+      const claims = token as {
+        colorScheme?: unknown;
+        oid?: string;
+        tid?: string;
+        authMethod?: string;
+      };
+      const target = session as {
+        colorScheme?: ColorScheme;
+        oid?: string;
+        tid?: string;
+        authMethod?: string;
+      };
+
+      if (isColorScheme(claims.colorScheme))
+        target.colorScheme = claims.colorScheme;
+      target.oid = claims.oid;
+      target.tid = claims.tid;
+      if (claims.authMethod) target.authMethod = claims.authMethod;
+
+      return session;
+    },
+  };
+}

package/src/options/cookies.ts

@@ -0,0 +1,13 @@
+import type { NextAuthOptions } from "next-auth";
+import { getSessionCookieSettings, getAuthUrl } from "../session";
+
+export function cookies(): NextAuthOptions["cookies"] {
+  const { name, domain, secure } = getSessionCookieSettings(getAuthUrl());
+
+  return {
+    sessionToken: {
+      name,
+      options: { path: "/", httpOnly: true, sameSite: "lax", secure, domain },
+    },
+  };
+}