@snokam/auth 3.1.0 → 3.2.0

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.2.0](https://github.com/snokam/components/compare/@snokam/auth@3.1.1...@snokam/auth@3.2.0) (2026-10-02)
+
+### Features
+
+- **auth:** let MCP clients sign in through the Snøsky login ([#2542](https://github.com/snokam/components/issues/2542)) ([5ea6750](https://github.com/snokam/components/commit/5ea67501bde43d999d518e41f98611af2536ff23))
+
+## [3.1.1](https://github.com/snokam/components/compare/@snokam/auth@3.1.0...@snokam/auth@3.1.1) (2026-10-01)
+
+**Note:** Version bump only for package @snokam/auth
+
 # [3.1.0](https://github.com/snokam/components/compare/@snokam/auth@3.0.2...@snokam/auth@3.1.0) (2026-09-30)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.1.0",
+  "version": "3.2.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -25,11 +25,11 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
+    "@snokam/platform-client": "3.1.0",
+    "@snokam/tenant": "2.1.2",
+    "@snokam/react-query": "1.1.0",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "2.0.0",
-    "@snokam/tenant": "2.1.0",
-    "@snokam/ui": "2.0.3",
-    "@snokam/react-query": "1.1.0"
+    "@snokam/ui": "2.0.3"
   },
   "peerDependencies": {
     "next": "16.3.3",

package/src/oauth/consent.ts

@@ -0,0 +1,33 @@
+import { open, seal } from "../ticket/seal";
+
+export interface AuthorizationParams {
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  codeChallengeMethod: string;
+  resource: string;
+}
+
+export interface ConsentClaims extends AuthorizationParams {
+  business: string;
+  state: string;
+  clientName: string;
+  businessName: string;
+  email: string;
+}
+
+const PURPOSE = "oauth-consent";
+const TTL_SECONDS = 600;
+
+export function sealConsent(claims: ConsentClaims, secret: string): string {
+  return seal(claims, secret, TTL_SECONDS, PURPOSE);
+}
+
+export function readOAuthConsent(
+  ticket: string,
+  secret: string
+): ConsentClaims | null {
+  return open<ConsentClaims>(ticket, secret, PURPOSE, {
+    onReject: (reason) => console.warn(`[oauth] consent rejected: ${reason}`),
+  });
+}

package/src/oauth/handlers.ts

@@ -0,0 +1,136 @@
+import { getToken } from "next-auth/jwt";
+import {
+  getAuthUrl,
+  getSessionCookieSettings,
+  requestOrigin,
+} from "../session";
+import { resolveAccessToken } from "../route-handler/token";
+import type { Auth } from "../types";
+import {
+  type AuthorizationParams,
+  readOAuthConsent,
+  sealConsent,
+} from "./consent";
+import { approveAuthorization, previewAuthorization } from "./platform";
+
+const ACCESS_DENIED = "access_denied";
+
+function invalidRequest(): Response {
+  return new Response("Invalid authorization request", { status: 400 });
+}
+
+function readParams(query: URLSearchParams): AuthorizationParams | null {
+  const params = {
+    clientId: query.get("client_id") ?? "",
+    redirectUri: query.get("redirect_uri") ?? "",
+    codeChallenge: query.get("code_challenge") ?? "",
+    codeChallengeMethod: query.get("code_challenge_method") ?? "",
+    resource: query.get("resource") ?? "",
+  };
+  const complete =
+    query.get("response_type") === "code" &&
+    Object.values(params).every(Boolean);
+  return complete && URL.canParse(params.resource) ? params : null;
+}
+
+async function signedInEmail(
+  request: Request,
+  secret: string
+): Promise<string | null> {
+  const { name: cookieName } = getSessionCookieSettings(getAuthUrl());
+  const token = await getToken({ req: request as never, secret, cookieName });
+  return token?.refreshToken && token.email ? String(token.email) : null;
+}
+
+function loginRedirect(request: Request, resource: string, prompt?: string) {
+  const url = new URL(request.url);
+  const resume = new URLSearchParams(url.searchParams);
+  resume.set("returnTo", new URL(resource).origin);
+  const login = new URL("/auth/login", requestOrigin(request));
+  login.searchParams.set("callbackUrl", `${url.pathname}?${resume}`);
+  if (prompt) login.searchParams.set("prompt", prompt);
+  return Response.redirect(login.toString(), 302);
+}
+
+function clientRedirect(
+  redirectUri: string,
+  state: string,
+  result: Record<string, string>
+): Response {
+  const target = new URL(redirectUri);
+  for (const [key, value] of Object.entries(result)) {
+    target.searchParams.set(key, value);
+  }
+  if (state) target.searchParams.set("state", state);
+  return new Response(null, {
+    status: 303,
+    headers: { Location: target.toString() },
+  });
+}
+
+export function createOAuthAuthorizeHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    const query = new URL(request.url).searchParams;
+    const params = readParams(query);
+    if (!params) return invalidRequest();
+
+    const email = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (!email) return loginRedirect(request, params.resource);
+
+    const access = await resolveAccessToken(authConfig, request);
+    if ("error" in access) return loginRedirect(request, params.resource);
+
+    const preview = await previewAuthorization(params, access.accessToken);
+    if ("error" in preview) {
+      return preview.error === ACCESS_DENIED
+        ? loginRedirect(request, params.resource, "login")
+        : invalidRequest();
+    }
+
+    const ticket = sealConsent(
+      {
+        ...params,
+        ...preview.value,
+        business: new URL(params.resource).hostname,
+        state: query.get("state") ?? "",
+        email,
+      },
+      authConfig.nextAuthSecret
+    );
+    const consent = new URL("/oauth/consent", requestOrigin(request));
+    consent.searchParams.set("ticket", ticket);
+    return Response.redirect(consent.toString(), 302);
+  };
+}
+
+export function createOAuthApproveHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    const form = await request.formData();
+    const consent = readOAuthConsent(
+      String(form.get("ticket") ?? ""),
+      authConfig.nextAuthSecret
+    );
+    if (!consent) return invalidRequest();
+
+    const email = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (email !== consent.email) return invalidRequest();
+
+    if (form.get("decision") !== "approve") {
+      return clientRedirect(consent.redirectUri, consent.state, {
+        error: ACCESS_DENIED,
+      });
+    }
+
+    const access = await resolveAccessToken(authConfig, request);
+    if ("error" in access) return invalidRequest();
+
+    const approved = await approveAuthorization(consent, access.accessToken);
+    return "error" in approved
+      ? clientRedirect(consent.redirectUri, consent.state, {
+          error: approved.error,
+        })
+      : clientRedirect(consent.redirectUri, consent.state, {
+          code: approved.value.code,
+        });
+  };
+}

package/src/oauth/platform.ts

@@ -0,0 +1,53 @@
+import type { AuthorizationParams } from "./consent";
+
+export interface AuthorizationPreview {
+  clientName: string;
+  businessName: string;
+}
+
+type Outcome<T> = { value: T } | { error: string };
+
+function apiBase(): string {
+  return (process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "").replace(
+    /\/+$/,
+    ""
+  );
+}
+
+async function post<T>(
+  path: string,
+  params: AuthorizationParams,
+  accessToken: string
+): Promise<Outcome<T>> {
+  const response = await fetch(`${apiBase()}${path}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`,
+    },
+    body: JSON.stringify(params),
+    cache: "no-store",
+  });
+  const body = await response.json().catch(() => ({}));
+  return response.ok
+    ? { value: body as T }
+    : { error: String(body.error ?? "invalid_request") };
+}
+
+export function previewAuthorization(
+  params: AuthorizationParams,
+  accessToken: string
+): Promise<Outcome<AuthorizationPreview>> {
+  return post(
+    "/v1.0/protected/oauth/authorization/preview",
+    params,
+    accessToken
+  );
+}
+
+export function approveAuthorization(
+  params: AuthorizationParams,
+  accessToken: string
+): Promise<Outcome<{ code: string }>> {
+  return post("/v1.0/protected/oauth/authorization", params, accessToken);
+}

package/src/route-handler/index.ts

@@ -49,4 +49,9 @@ export {
   createHandoffFinishHandler,
   createHandoffLogoutHandler,
 } from "../handoff/handlers";
+export {
+  createOAuthAuthorizeHandler,
+  createOAuthApproveHandler,
+} from "../oauth/handlers";
+export { readOAuthConsent } from "../oauth/consent";
 export type { Auth } from "../types";