@snokam/auth 3.1.1 → 3.2.1

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.2.1](https://github.com/snokam/components/compare/@snokam/auth@3.2.0...@snokam/auth@3.2.1) (2026-10-02)
+
+### Bug Fixes
+
+- **auth:** harden app sign-in after a security review, and give sign-in one home ([#2543](https://github.com/snokam/components/issues/2543)) ([7100eb7](https://github.com/snokam/components/commit/7100eb79ce278875eafe75228ab496dedc0ae151))
+
+# [3.2.0](https://github.com/snokam/components/compare/@snokam/auth@3.1.1...@snokam/auth@3.2.0) (2026-10-02)
+
+### Features
+
+- **auth:** let MCP clients sign in through the Snøsky login ([#2542](https://github.com/snokam/components/issues/2542)) ([5ea6750](https://github.com/snokam/components/commit/5ea67501bde43d999d518e41f98611af2536ff23))
+
 ## [3.1.1](https://github.com/snokam/components/compare/@snokam/auth@3.1.0...@snokam/auth@3.1.1) (2026-10-01)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.1.1",
+  "version": "3.2.1",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,9 +26,9 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "3.0.0",
+    "@snokam/platform-client": "3.1.1",
     "@snokam/react-query": "1.1.0",
-    "@snokam/tenant": "2.1.1",
+    "@snokam/tenant": "2.1.3",
     "@snokam/ui": "2.0.3"
   },
   "peerDependencies": {

package/src/app-sign-in/consent.ts

@@ -0,0 +1,35 @@
+import { open, seal } from "../ticket/seal";
+
+export interface AuthorizationParams {
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  codeChallengeMethod: string;
+  resource: string;
+}
+
+export interface ConsentClaims extends AuthorizationParams {
+  business: string;
+  state: string;
+  clientName: string;
+  businessName: string;
+  email: string;
+  nonce: string;
+}
+
+const PURPOSE = "app-sign-in-consent";
+export const CONSENT_TTL_SECONDS = 600;
+
+export function sealConsent(claims: ConsentClaims, secret: string): string {
+  return seal(claims, secret, CONSENT_TTL_SECONDS, PURPOSE);
+}
+
+export function readAppSignInConsent(
+  ticket: string,
+  secret: string
+): ConsentClaims | null {
+  return open<ConsentClaims>(ticket, secret, PURPOSE, {
+    onReject: (reason) =>
+      console.warn(`[app-sign-in] consent rejected: ${reason}`),
+  });
+}

package/src/app-sign-in/handlers.ts

@@ -0,0 +1,180 @@
+import { randomUUID } from "crypto";
+import { getToken } from "next-auth/jwt";
+import {
+  getAuthUrl,
+  getSessionCookieSettings,
+  requestOrigin,
+} from "../session";
+import { resolveAccessToken } from "../route-handler/token";
+import type { Auth } from "../types";
+import {
+  type AuthorizationParams,
+  CONSENT_TTL_SECONDS,
+  readAppSignInConsent,
+  sealConsent,
+} from "./consent";
+import { approveAuthorization, previewAuthorization } from "./platform";
+
+const ACCESS_DENIED = "access_denied";
+const NONCE_COOKIE = "app-sign-in";
+
+function invalidRequest(): Response {
+  return new Response("Invalid authorization request", { status: 400 });
+}
+
+function readParams(query: URLSearchParams): AuthorizationParams | null {
+  const params = {
+    clientId: query.get("client_id") ?? "",
+    redirectUri: query.get("redirect_uri") ?? "",
+    codeChallenge: query.get("code_challenge") ?? "",
+    codeChallengeMethod: query.get("code_challenge_method") ?? "",
+    resource: query.get("resource") ?? "",
+  };
+  const complete =
+    query.get("response_type") === "code" &&
+    Object.values(params).every(Boolean);
+  return complete && URL.canParse(params.resource) ? params : null;
+}
+
+async function signedInEmail(
+  request: Request,
+  secret: string
+): Promise<string | null> {
+  const { name: cookieName } = getSessionCookieSettings(getAuthUrl());
+  const token = await getToken({ req: request as never, secret, cookieName });
+  return token?.refreshToken && token.email ? String(token.email) : null;
+}
+
+function loginRedirect(request: Request, resource: string, prompt?: string) {
+  const url = new URL(request.url);
+  const resume = new URLSearchParams(url.searchParams);
+  resume.set("returnTo", new URL(resource).origin);
+  const login = new URL("/auth/login", requestOrigin(request));
+  login.searchParams.set("callbackUrl", `${url.pathname}?${resume}`);
+  if (prompt) login.searchParams.set("prompt", prompt);
+  return Response.redirect(login.toString(), 302);
+}
+
+function nonceCookie(request: Request, value: string, maxAge: number): string {
+  const secure = requestOrigin(request).startsWith("https://");
+  return [
+    `${NONCE_COOKIE}=${value}`,
+    "Path=/oauth",
+    `Max-Age=${maxAge}`,
+    "HttpOnly",
+    "SameSite=Lax",
+    secure ? "Secure" : "",
+  ]
+    .filter(Boolean)
+    .join("; ");
+}
+
+function nonceFrom(request: Request): string | null {
+  const cookies = request.headers.get("cookie") ?? "";
+  const match = cookies.match(new RegExp(`(?:^|;\\s*)${NONCE_COOKIE}=([^;]+)`));
+  return match ? match[1] : null;
+}
+
+function sameOrigin(request: Request): boolean {
+  return request.headers.get("origin") === requestOrigin(request);
+}
+
+function clientRedirect(
+  request: Request,
+  redirectUri: string,
+  state: string,
+  result: Record<string, string>
+): Response {
+  const target = new URL(redirectUri);
+  for (const [key, value] of Object.entries(result)) {
+    target.searchParams.set(key, value);
+  }
+  if (state) target.searchParams.set("state", state);
+  return new Response(null, {
+    status: 303,
+    headers: {
+      Location: target.toString(),
+      "Set-Cookie": nonceCookie(request, "", 0),
+    },
+  });
+}
+
+export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    const query = new URL(request.url).searchParams;
+    const params = readParams(query);
+    if (!params) return invalidRequest();
+
+    const email = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (!email) return loginRedirect(request, params.resource);
+
+    const access = await resolveAccessToken(authConfig, request);
+    if ("error" in access) return loginRedirect(request, params.resource);
+
+    const preview = await previewAuthorization(params, access.accessToken);
+    if ("error" in preview) {
+      return preview.error === ACCESS_DENIED
+        ? loginRedirect(request, params.resource, "login")
+        : invalidRequest();
+    }
+
+    const nonce = randomUUID();
+    const ticket = sealConsent(
+      {
+        ...params,
+        ...preview.value,
+        business: new URL(params.resource).hostname,
+        state: query.get("state") ?? "",
+        email,
+        nonce,
+      },
+      authConfig.nextAuthSecret
+    );
+    const consent = new URL("/oauth/consent", requestOrigin(request));
+    consent.searchParams.set("ticket", ticket);
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: consent.toString(),
+        "Set-Cookie": nonceCookie(request, nonce, CONSENT_TTL_SECONDS),
+      },
+    });
+  };
+}
+
+export function createAppSignInApproveHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    if (!sameOrigin(request)) return invalidRequest();
+
+    const form = await request.formData();
+    const consent = readAppSignInConsent(
+      String(form.get("ticket") ?? ""),
+      authConfig.nextAuthSecret
+    );
+    if (!consent || consent.nonce !== nonceFrom(request)) {
+      return invalidRequest();
+    }
+
+    const email = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (email !== consent.email) return invalidRequest();
+
+    if (form.get("decision") !== "approve") {
+      return clientRedirect(request, consent.redirectUri, consent.state, {
+        error: ACCESS_DENIED,
+      });
+    }
+
+    const access = await resolveAccessToken(authConfig, request);
+    if ("error" in access) return invalidRequest();
+
+    const approved = await approveAuthorization(consent, access.accessToken);
+    return clientRedirect(
+      request,
+      consent.redirectUri,
+      consent.state,
+      "error" in approved
+        ? { error: approved.error }
+        : { code: approved.value.code }
+    );
+  };
+}

package/src/app-sign-in/platform.ts

@@ -0,0 +1,52 @@
+import { getManagedBearer } from "@snokam/identity";
+import type { AuthorizationParams } from "./consent";
+
+export interface AuthorizationPreview {
+  clientName: string;
+  businessName: string;
+}
+
+type Outcome<T> = { value: T } | { error: string };
+
+const UNAVAILABLE = "temporarily_unavailable";
+
+function apiBase(): string {
+  return (process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "").replace(
+    /\/+$/,
+    ""
+  );
+}
+
+async function post<T>(
+  path: string,
+  params: AuthorizationParams,
+  userToken: string
+): Promise<Outcome<T>> {
+  const loginSite = await getManagedBearer();
+  if (!loginSite) return { error: UNAVAILABLE };
+
+  const response = await fetch(`${apiBase()}${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: loginSite },
+    body: JSON.stringify({ ...params, userToken }),
+    cache: "no-store",
+  });
+  const body = await response.json().catch(() => ({}));
+  return response.ok
+    ? { value: body as T }
+    : { error: String(body.error ?? "invalid_request") };
+}
+
+export function previewAuthorization(
+  params: AuthorizationParams,
+  userToken: string
+): Promise<Outcome<AuthorizationPreview>> {
+  return post("/v1.0/protected/oauth/authorization/preview", params, userToken);
+}
+
+export function approveAuthorization(
+  params: AuthorizationParams,
+  userToken: string
+): Promise<Outcome<{ code: string }>> {
+  return post("/v1.0/protected/oauth/authorization", params, userToken);
+}

package/src/route-handler/index.ts

@@ -49,4 +49,9 @@ export {
   createHandoffFinishHandler,
   createHandoffLogoutHandler,
 } from "../handoff/handlers";
+export {
+  createAppSignInAuthorizeHandler,
+  createAppSignInApproveHandler,
+} from "../app-sign-in/handlers";
+export { readAppSignInConsent } from "../app-sign-in/consent";
 export type { Auth } from "../types";