@snokam/auth 2.3.3 → 3.0.2

package/src/options/employee-profile.ts

@@ -0,0 +1,90 @@
+import { ConfidentialClientApplication } from "@azure/msal-node";
+import { Configuration, EmployeesClient } from "@snokam/employees-client";
+import { backendUrl } from "@snokam/tenant/server";
+import { getSanityImageUrl } from "@snokam/ui/media/sanity";
+import { exchangePasswordToken } from "../password/api";
+import { exchangeSsoToken } from "../sso/exchange";
+import { Auth } from "../types";
+
+async function resolveEmployeesBackend(
+  config: Auth.Config
+): Promise<{ base: string; scope: string }> {
+  const scope = config.clientId
+    ? `api://${config.clientId}/user_impersonation`
+    : "";
+  return {
+    base: await backendUrl("employees", {
+      app: "employees",
+      entraTenantIdFallback: config.tenantId,
+    }),
+    scope,
+  };
+}
+
+export type ColorScheme = "light" | "dark" | "system";
+
+export function isColorScheme(value: unknown): value is ColorScheme {
+  return value === "light" || value === "dark" || value === "system";
+}
+interface EmployeeProfile {
+  colorScheme?: ColorScheme;
+  imageUrl?: string;
+}
+
+export async function fetchEmployeeProfile(
+  config: Auth.Config,
+  refreshToken?: string,
+  authMethod?: string
+): Promise<EmployeeProfile> {
+  if (!refreshToken) {
+    return {};
+  }
+  try {
+    const { base, scope } = await resolveEmployeesBackend(config);
+    if (!base || !scope) return {};
+
+    let accessToken: string | undefined;
+    if (authMethod === "password") {
+      accessToken = (await exchangePasswordToken(refreshToken))?.accessToken;
+    } else {
+      const entra = (
+        await new ConfidentialClientApplication({
+          auth: {
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            authority: `https://login.microsoftonline.com/${config.tenantId}`,
+          },
+        }).acquireTokenByRefreshToken({ scopes: [scope], refreshToken })
+      )?.accessToken;
+      accessToken = entra
+        ? (await exchangeSsoToken(entra))?.accessToken
+        : undefined;
+    }
+
+    if (!accessToken) return {};
+    const client = new EmployeesClient(
+      new Configuration({
+        basePath: base,
+        accessToken: `Bearer ${accessToken}`,
+      })
+    );
+    const me = await client.getMeProtected();
+    const profile = {
+      colorScheme: isColorScheme(me.settings?.colorScheme)
+        ? me.settings.colorScheme
+        : undefined,
+      imageUrl: getSanityImageUrl(me.image?.asset?.url, {
+        width: 128,
+        height: 128,
+        fit: "crop",
+      }),
+    };
+    if (!profile.imageUrl) {
+      console.warn("[auth] employee profile resolved without an image");
+    }
+    return profile;
+  } catch (error) {
+    console.warn("[auth] employee profile fetch failed", error);
+    return {};
+  }
+}

package/src/options/index.tsx

@@ -0,0 +1,19 @@
+import NextAuth, { NextAuthOptions } from "next-auth";
+import { callbacks } from "./callbacks";
+import { cookies } from "./cookies";
+import { providers } from "./providers";
+import { Auth } from "../types";
+
+const WEEK_IN_SECONDS = 7 * 24 * 60 * 60;
+const DAY_IN_SECONDS = 24 * 60 * 60;
+
+export const getNextAuthOptions = (config: Auth.Config): NextAuthOptions => ({
+  secret: config.nextAuthSecret,
+  session: { maxAge: WEEK_IN_SECONDS, updateAge: DAY_IN_SECONDS },
+  pages: { signIn: "/auth/login" },
+  providers: providers(config),
+  cookies: cookies(),
+  callbacks: callbacks(config),
+});
+
+export default (config: Auth.Config) => NextAuth(getNextAuthOptions(config));

package/src/options/providers.ts

@@ -0,0 +1,117 @@
+import type { Provider } from "next-auth/providers/index";
+import AzureADProvider from "next-auth/providers/azure-ad";
+import CredentialsProvider from "next-auth/providers/credentials";
+import { getDefaultAuthParams } from "../options/params";
+import { openHandoff } from "../handoff/ticket";
+import { passwordLogin, redeemBootstrapToken } from "../password/api";
+import { requestClientIp, requestHost } from "./request";
+import { Auth } from "../types";
+
+type AuthorizedUser = { id: string };
+
+export function providers(config: Auth.Config): Provider[] {
+  return [entraId(config), handoff(config), password()];
+}
+
+function entraId(config: Auth.Config) {
+  return AzureADProvider({
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    tenantId: config.tenantId,
+    authorization: { params: getDefaultAuthParams(config.tenantId) },
+    checks: ["pkce", "state"],
+    profile(profile) {
+      return {
+        id: profile.sub,
+        name: profile.name,
+        email: profile.email,
+        image: null,
+      };
+    },
+  });
+}
+
+function handoff(config: Auth.Config) {
+  return CredentialsProvider({
+    id: "handoff",
+    name: "Snokam",
+    credentials: { ticket: { label: "ticket", type: "text" } },
+    async authorize(credentials, req) {
+      const expectedBusiness = requestHost(req);
+      if (!credentials?.ticket || !expectedBusiness) return null;
+
+      const claims = openHandoff(
+        credentials.ticket,
+        config.nextAuthSecret,
+        expectedBusiness
+      );
+      if (!claims) return null;
+
+      return {
+        id: claims.oid,
+        email: claims.email,
+        name: claims.name,
+        image: claims.image ?? null,
+        oid: claims.oid,
+        tid: claims.tid,
+        refreshToken: claims.refreshToken,
+        authMethod: claims.authMethod || undefined,
+      } as unknown as AuthorizedUser;
+    },
+  });
+}
+
+function password() {
+  return CredentialsProvider({
+    id: "password",
+    name: "Passord",
+    credentials: {
+      email: { label: "email", type: "text" },
+      password: { label: "password", type: "password" },
+      code: { label: "code", type: "text" },
+      host: { label: "host", type: "text" },
+      bootstrap: { label: "bootstrap", type: "text" },
+    },
+    async authorize(credentials, req) {
+      if (credentials?.bootstrap) {
+        const redeemed = await redeemBootstrapToken(credentials.bootstrap);
+        if (!redeemed) return null;
+
+        return {
+          id: redeemed.userId,
+          email: redeemed.email,
+          name: redeemed.name,
+          oid: redeemed.userId,
+          tid: redeemed.businessId,
+          refreshToken: redeemed.refreshToken,
+          authMethod: "password",
+        } as unknown as AuthorizedUser;
+      }
+
+      if (!credentials?.email || !credentials.password || !credentials.host)
+        return null;
+
+      const outcome = await passwordLogin(
+        {
+          host: credentials.host,
+          email: credentials.email,
+          password: credentials.password,
+          code: credentials.code || undefined,
+        },
+        requestClientIp(req)
+      );
+      if (!outcome.login)
+        throw new Error(outcome.error ?? "invalid_credentials");
+
+      return {
+        id: outcome.login.userId,
+        email: outcome.login.email,
+        name: outcome.login.name,
+        oid: outcome.login.userId,
+        tid: outcome.login.businessId,
+        refreshToken: outcome.login.refreshToken,
+        authMethod: "password",
+      } as unknown as AuthorizedUser;
+    },
+  });
+}

package/src/options/request.ts

@@ -0,0 +1,42 @@
+import { headers } from "next/headers";
+
+type HeaderBag = Record<string, string | string[] | undefined>;
+
+function first(bag: HeaderBag | undefined, name: string): string | undefined {
+  const header = bag?.[name];
+  const value = Array.isArray(header) ? header[0] : header;
+  return value?.split(",")[0].trim() || undefined;
+}
+
+export function requestHost(req?: { headers?: HeaderBag }): string | undefined {
+  const header = req?.headers?.["x-forwarded-host"] ?? req?.headers?.host;
+  const value = Array.isArray(header) ? header[0] : header;
+  return value?.split(",")[0].trim().split(":")[0] || undefined;
+}
+
+export function requestClientIp(req?: {
+  headers?: HeaderBag;
+}): string | undefined {
+  // Trusted edge headers first (Front Door, unspoofable); rightmost XFF entry as a fallback.
+  const edge =
+    first(req?.headers, "x-azure-clientip") ??
+    first(req?.headers, "x-azure-socketip");
+  if (edge) return edge;
+
+  const forwarded = req?.headers?.["x-forwarded-for"];
+  const value = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  return value?.split(",").pop()?.trim() || undefined;
+}
+
+export async function requestOrigin(): Promise<string | undefined> {
+  const incoming = await headers();
+  const host = (incoming.get("x-forwarded-host") ?? incoming.get("host") ?? "")
+    .split(",")[0]
+    .trim();
+  if (!host) return undefined;
+
+  const scheme =
+    incoming.get("x-forwarded-proto") ??
+    (host.startsWith("localhost") ? "http" : "https");
+  return `${scheme}://${host}`;
+}

package/src/{route-handler.ts → route-handler/index.ts}

@@ -1,6 +1,6 @@
 import NextAuth from "next-auth";
 import type { NextAuthOptions } from "next-auth";
-import { resolveCookieDomain } from "./utils/cookies";
+import { resolveCookieDomain } from "../session";
 
 type AuthOptionsFor = NextAuthOptions | ((req: Request) => NextAuthOptions);
 
@@ -36,17 +36,17 @@ export function createAuthHandler(options: AuthOptionsFor) {
   };
 }
 
-export { getNextAuthOptions } from "./options";
-export { createTokenHandler } from "./route-handler/token";
+export { getNextAuthOptions } from "../options";
+export { createTokenHandler } from "./token";
 export {
   createImpersonationStartHandler,
   createImpersonationEndHandler,
   createImpersonationAdoptHandler,
-} from "./impersonation/handlers";
-export { createImpersonationRouteHandlers } from "./impersonation/routes";
+} from "../impersonation/handlers";
+export { createImpersonationRouteHandlers } from "../impersonation/routes";
 export {
   createHandoffStartHandler,
   createHandoffFinishHandler,
   createHandoffLogoutHandler,
-} from "./handoff/handlers";
-export type { Auth } from "./utils/types";
+} from "../handoff/handlers";
+export type { Auth } from "../types";

package/src/route-handler/token.ts

@@ -3,16 +3,14 @@ import {
   ConfidentialClientApplication,
   InteractionRequiredAuthError,
 } from "@azure/msal-node";
-import { Auth } from "../utils/types";
-import { getAuthUrl } from "../utils/url";
-import { getSessionCookieSettings } from "../utils/cookies";
+import { Auth } from "../types";
+import { getAuthUrl, getSessionCookieSettings } from "../session";
 import { exchangePasswordToken } from "../password/api";
 import { readImpersonationSession } from "../impersonation/cookies";
 import { exchangeSsoToken } from "../sso/exchange";
 
 export type TokenResult =
-  | { accessToken: string; expiresOn: number }
-  | { error: Response };
+  { accessToken: string; expiresOn: number } | { error: Response };
 
 /**
  * Resolves the SIGNED-IN admin's own product access token (never the impersonation token). Shared

package/src/scopes/index.ts

@@ -0,0 +1,8 @@
+export { ScopesProvider, useScopes, useHasScope } from "./context";
+export type { ScopesState } from "./context";
+
+export {
+  scopeGranted,
+  resolveEmployeeScopes,
+  type ScopeAccess,
+} from "./matcher";

package/src/scopes/matcher.ts

@@ -19,7 +19,10 @@ export function scopeGranted(
 
     const grantedAction = separator < 0 ? "*" : scope.slice(separator + 1);
     if (grantedAction === "*") return true;
-    if (access === "read" && (grantedAction === "read" || grantedAction === "write"))
+    if (
+      access === "read" &&
+      (grantedAction === "read" || grantedAction === "write")
+    )
       return true;
     if (access === "write" && grantedAction === "write") return true;
   }

package/src/session/index.ts

@@ -0,0 +1,3 @@
+export { resolveCookieDomain, getSessionCookieSettings } from "./cookies";
+export { getAuthUrl, requestOrigin } from "./url";
+export { safeCallbackTarget } from "./callback-url";

package/src/theme/employee-theme-sync.tsx

@@ -2,7 +2,7 @@
 
 import { useEffect, useMemo, useRef } from "react";
 import { Configuration, EmployeesClient } from "@snokam/employees-client";
-import { useOptionalConfig } from "@snokam/config";
+import { useOptionalConfig } from "@snokam/tenant";
 import { useClientQuery } from "@snokam/react-query";
 import { useAdminTheme } from "@snokam/ui/theme/admin";
 import type { ColorSchemeMode } from "@snokam/ui/theme/admin";

package/src/ticket/seal.ts

@@ -0,0 +1,95 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from "crypto";
+
+const ALGORITHM = "aes-256-gcm";
+
+interface OpenOptions {
+  expectedBusiness?: string;
+  now?: number;
+  onReject?: (reason: string) => void;
+}
+
+function keyFromSecret(secret: string, purpose: string): Buffer {
+  if (!secret)
+    throw new Error(
+      `NEXTAUTH_SECRET is empty; refusing to seal/open a forgeable ${purpose} ticket.`
+    );
+  return createHash("sha256").update(secret).digest();
+}
+
+export function seal<T extends object>(
+  claims: T,
+  secret: string,
+  ttlSeconds: number,
+  purpose: string
+): string {
+  const payload = JSON.stringify({
+    ...claims,
+    exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+  });
+  const iv = randomBytes(12);
+  const cipher = createCipheriv(ALGORITHM, keyFromSecret(secret, purpose), iv);
+  const ciphertext = Buffer.concat([
+    cipher.update(payload, "utf8"),
+    cipher.final(),
+  ]);
+
+  return [iv, cipher.getAuthTag(), ciphertext]
+    .map((part) => part.toString("base64url"))
+    .join(".");
+}
+
+export function open<T extends { business: string }>(
+  ticket: string,
+  secret: string,
+  purpose: string,
+  options: OpenOptions = {}
+): T | null {
+  const { expectedBusiness, now = Date.now(), onReject } = options;
+  const reject = (reason: string): null => {
+    onReject?.(reason);
+    return null;
+  };
+
+  const parts = ticket.split(".");
+  if (parts.length !== 3)
+    return reject("malformed ticket (expected iv.tag.ciphertext)");
+
+  try {
+    const [iv, tag, ciphertext] = parts.map((part) =>
+      Buffer.from(part, "base64url")
+    );
+    const decipher = createDecipheriv(
+      ALGORITHM,
+      keyFromSecret(secret, purpose),
+      iv
+    );
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]).toString("utf8");
+
+    const payload = JSON.parse(plaintext) as T & { exp: number };
+    if (payload.exp * 1000 < now)
+      return reject(
+        `expired (exp ${payload.exp}, now ${Math.floor(now / 1000)})`
+      );
+
+    if (expectedBusiness && payload.business !== expectedBusiness)
+      return reject(
+        `business mismatch (ticket "${payload.business}" vs host "${expectedBusiness}")`
+      );
+
+    const { exp: _exp, ...claims } = payload;
+    return claims as unknown as T;
+  } catch (error) {
+    return reject(
+      `decrypt failed (secret mismatch or tampered): ${(error as Error).message}`
+    );
+  }
+}

package/src/index.tsx

@@ -1,31 +0,0 @@
-import { Provider } from "./page-router/components/Provider";
-import { Authenticate } from "./components/Authenticate";
-import { Login } from "./page-router/components/Login";
-import { Auth } from "./utils/types";
-import { Error } from "./components/Error";
-
-export { Unauthenticated } from "./components/Unauthenticated";
-export { Authenticated } from "./components/Authenticated";
-
-export { useAuth, clearAuthTokenCache } from "./hooks";
-export { ScopesProvider, useScopes, useHasScope } from "./scopes/context";
-export type { ScopesState } from "./scopes/context";
-export {
-  scopeGranted,
-  resolveEmployeeScopes,
-  type ScopeAccess,
-} from "./scopes/matcher";
-export { Consent } from "./components/Consent";
-export { buildAdminConsentUrl } from "./utils/consent";
-export type { AdminConsentParams } from "./utils/consent";
-export { default as middleware } from "next-auth/middleware";
-export { signIn } from "next-auth/react";
-
-export default {
-  Login,
-  Error,
-  Provider,
-  Authenticate,
-};
-
-export type { Auth };