@snokam/auth 3.2.0 → 3.2.2

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.2.2](https://github.com/snokam/components/compare/@snokam/auth@3.2.1...@snokam/auth@3.2.2) (2026-10-02)
+
+**Note:** Version bump only for package @snokam/auth
+
+## [3.2.1](https://github.com/snokam/components/compare/@snokam/auth@3.2.0...@snokam/auth@3.2.1) (2026-10-02)
+
+### Bug Fixes
+
+- **auth:** harden app sign-in after a security review, and give sign-in one home ([#2543](https://github.com/snokam/components/issues/2543)) ([7100eb7](https://github.com/snokam/components/commit/7100eb79ce278875eafe75228ab496dedc0ae151))
+
 # [3.2.0](https://github.com/snokam/components/compare/@snokam/auth@3.1.1...@snokam/auth@3.2.0) (2026-10-02)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -25,11 +25,11 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/platform-client": "3.1.0",
-    "@snokam/tenant": "2.1.2",
+    "@snokam/platform-client": "3.2.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/identity": "1.1.0",
-    "@snokam/ui": "2.0.3"
+    "@snokam/ui": "2.0.3",
+    "@snokam/tenant": "2.1.4",
+    "@snokam/identity": "1.1.0"
   },
   "peerDependencies": {
     "next": "16.3.3",

package/src/{oauth → app-sign-in}/consent.ts

@@ -14,20 +14,22 @@ export interface ConsentClaims extends AuthorizationParams {
   clientName: string;
   businessName: string;
   email: string;
+  nonce: string;
 }
 
-const PURPOSE = "oauth-consent";
-const TTL_SECONDS = 600;
+const PURPOSE = "app-sign-in-consent";
+export const CONSENT_TTL_SECONDS = 600;
 
 export function sealConsent(claims: ConsentClaims, secret: string): string {
-  return seal(claims, secret, TTL_SECONDS, PURPOSE);
+  return seal(claims, secret, CONSENT_TTL_SECONDS, PURPOSE);
 }
 
-export function readOAuthConsent(
+export function readAppSignInConsent(
   ticket: string,
   secret: string
 ): ConsentClaims | null {
   return open<ConsentClaims>(ticket, secret, PURPOSE, {
-    onReject: (reason) => console.warn(`[oauth] consent rejected: ${reason}`),
+    onReject: (reason) =>
+      console.warn(`[app-sign-in] consent rejected: ${reason}`),
   });
 }

package/src/{oauth → app-sign-in}/handlers.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "crypto";
 import { getToken } from "next-auth/jwt";
 import {
   getAuthUrl,
@@ -8,12 +9,14 @@ import { resolveAccessToken } from "../route-handler/token";
 import type { Auth } from "../types";
 import {
   type AuthorizationParams,
-  readOAuthConsent,
+  CONSENT_TTL_SECONDS,
+  readAppSignInConsent,
   sealConsent,
 } from "./consent";
 import { approveAuthorization, previewAuthorization } from "./platform";
 
 const ACCESS_DENIED = "access_denied";
+const NONCE_COOKIE = "app-sign-in";
 
 function invalidRequest(): Response {
   return new Response("Invalid authorization request", { status: 400 });
@@ -52,7 +55,32 @@ function loginRedirect(request: Request, resource: string, prompt?: string) {
   return Response.redirect(login.toString(), 302);
 }
 
+function nonceCookie(request: Request, value: string, maxAge: number): string {
+  const secure = requestOrigin(request).startsWith("https://");
+  return [
+    `${NONCE_COOKIE}=${value}`,
+    "Path=/oauth",
+    `Max-Age=${maxAge}`,
+    "HttpOnly",
+    "SameSite=Lax",
+    secure ? "Secure" : "",
+  ]
+    .filter(Boolean)
+    .join("; ");
+}
+
+function nonceFrom(request: Request): string | null {
+  const cookies = request.headers.get("cookie") ?? "";
+  const match = cookies.match(new RegExp(`(?:^|;\\s*)${NONCE_COOKIE}=([^;]+)`));
+  return match ? match[1] : null;
+}
+
+function sameOrigin(request: Request): boolean {
+  return request.headers.get("origin") === requestOrigin(request);
+}
+
 function clientRedirect(
+  request: Request,
   redirectUri: string,
   state: string,
   result: Record<string, string>
@@ -64,11 +92,14 @@ function clientRedirect(
   if (state) target.searchParams.set("state", state);
   return new Response(null, {
     status: 303,
-    headers: { Location: target.toString() },
+    headers: {
+      Location: target.toString(),
+      "Set-Cookie": nonceCookie(request, "", 0),
+    },
   });
 }
 
-export function createOAuthAuthorizeHandler(authConfig: Auth.Config) {
+export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
   return async function GET(request: Request) {
     const query = new URL(request.url).searchParams;
     const params = readParams(query);
@@ -87,6 +118,7 @@ export function createOAuthAuthorizeHandler(authConfig: Auth.Config) {
         : invalidRequest();
     }
 
+    const nonce = randomUUID();
     const ticket = sealConsent(
       {
         ...params,
@@ -94,29 +126,40 @@ export function createOAuthAuthorizeHandler(authConfig: Auth.Config) {
         business: new URL(params.resource).hostname,
         state: query.get("state") ?? "",
         email,
+        nonce,
       },
       authConfig.nextAuthSecret
     );
     const consent = new URL("/oauth/consent", requestOrigin(request));
     consent.searchParams.set("ticket", ticket);
-    return Response.redirect(consent.toString(), 302);
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: consent.toString(),
+        "Set-Cookie": nonceCookie(request, nonce, CONSENT_TTL_SECONDS),
+      },
+    });
   };
 }
 
-export function createOAuthApproveHandler(authConfig: Auth.Config) {
+export function createAppSignInApproveHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
+    if (!sameOrigin(request)) return invalidRequest();
+
     const form = await request.formData();
-    const consent = readOAuthConsent(
+    const consent = readAppSignInConsent(
       String(form.get("ticket") ?? ""),
       authConfig.nextAuthSecret
     );
-    if (!consent) return invalidRequest();
+    if (!consent || consent.nonce !== nonceFrom(request)) {
+      return invalidRequest();
+    }
 
     const email = await signedInEmail(request, authConfig.nextAuthSecret);
     if (email !== consent.email) return invalidRequest();
 
     if (form.get("decision") !== "approve") {
-      return clientRedirect(consent.redirectUri, consent.state, {
+      return clientRedirect(request, consent.redirectUri, consent.state, {
         error: ACCESS_DENIED,
       });
     }
@@ -125,12 +168,13 @@ export function createOAuthApproveHandler(authConfig: Auth.Config) {
     if ("error" in access) return invalidRequest();
 
     const approved = await approveAuthorization(consent, access.accessToken);
-    return "error" in approved
-      ? clientRedirect(consent.redirectUri, consent.state, {
-          error: approved.error,
-        })
-      : clientRedirect(consent.redirectUri, consent.state, {
-          code: approved.value.code,
-        });
+    return clientRedirect(
+      request,
+      consent.redirectUri,
+      consent.state,
+      "error" in approved
+        ? { error: approved.error }
+        : { code: approved.value.code }
+    );
   };
 }

package/src/{oauth → app-sign-in}/platform.ts

@@ -1,3 +1,4 @@
+import { getManagedBearer } from "@snokam/identity";
 import type { AuthorizationParams } from "./consent";
 
 export interface AuthorizationPreview {
@@ -7,6 +8,8 @@ export interface AuthorizationPreview {
 
 type Outcome<T> = { value: T } | { error: string };
 
+const UNAVAILABLE = "temporarily_unavailable";
+
 function apiBase(): string {
   return (process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "").replace(
     /\/+$/,
@@ -17,15 +20,15 @@ function apiBase(): string {
 async function post<T>(
   path: string,
   params: AuthorizationParams,
-  accessToken: string
+  userToken: string
 ): Promise<Outcome<T>> {
+  const loginSite = await getManagedBearer();
+  if (!loginSite) return { error: UNAVAILABLE };
+
   const response = await fetch(`${apiBase()}${path}`, {
     method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${accessToken}`,
-    },
-    body: JSON.stringify(params),
+    headers: { "Content-Type": "application/json", Authorization: loginSite },
+    body: JSON.stringify({ ...params, userToken }),
     cache: "no-store",
   });
   const body = await response.json().catch(() => ({}));
@@ -36,18 +39,14 @@ async function post<T>(
 
 export function previewAuthorization(
   params: AuthorizationParams,
-  accessToken: string
+  userToken: string
 ): Promise<Outcome<AuthorizationPreview>> {
-  return post(
-    "/v1.0/protected/oauth/authorization/preview",
-    params,
-    accessToken
-  );
+  return post("/v1.0/protected/oauth/authorization/preview", params, userToken);
 }
 
 export function approveAuthorization(
   params: AuthorizationParams,
-  accessToken: string
+  userToken: string
 ): Promise<Outcome<{ code: string }>> {
-  return post("/v1.0/protected/oauth/authorization", params, accessToken);
+  return post("/v1.0/protected/oauth/authorization", params, userToken);
 }

package/src/route-handler/index.ts

@@ -50,8 +50,8 @@ export {
   createHandoffLogoutHandler,
 } from "../handoff/handlers";
 export {
-  createOAuthAuthorizeHandler,
-  createOAuthApproveHandler,
-} from "../oauth/handlers";
-export { readOAuthConsent } from "../oauth/consent";
+  createAppSignInAuthorizeHandler,
+  createAppSignInApproveHandler,
+} from "../app-sign-in/handlers";
+export { readAppSignInConsent } from "../app-sign-in/consent";
 export type { Auth } from "../types";