@snokam/auth 3.3.12 → 3.5.0

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.5.0](https://github.com/snokam/components/compare/@snokam/auth@3.4.0...@snokam/auth@3.5.0) (2026-10-06)
+
+### Features
+
+- **test:** pick a test user straight after sign-in, on snosky.no and for MCP sign-in too ([#2680](https://github.com/snokam/components/issues/2680)) ([eea727a](https://github.com/snokam/components/commit/eea727ae1a607139c7c30610109e877eaa20dae9))
+
+# [3.4.0](https://github.com/snokam/components/compare/@snokam/auth@3.3.12...@snokam/auth@3.4.0) (2026-10-06)
+
+### Features
+
+- require Vis som in test, and renew view-as sessions while the operator is signed in ([#2676](https://github.com/snokam/components/issues/2676)) ([e9c7bc9](https://github.com/snokam/components/commit/e9c7bc986508d9664bfcc78161c10381981c9c49))
+
 ## [3.3.12](https://github.com/snokam/components/compare/@snokam/auth@3.3.11...@snokam/auth@3.3.12) (2026-10-05)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.3.12",
+  "version": "3.5.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -27,11 +27,11 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "3.5.1",
+    "@snokam/platform-client": "3.6.0",
+    "@snokam/tenant": "2.1.13",
+    "@snokam/ui": "4.0.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "4.4.1",
-    "@snokam/tenant": "2.1.12",
-    "@snokam/ui": "4.0.0"
+    "@snokam/sanity-page-content": "4.4.2"
   },
   "peerDependencies": {
     "next": "16.3.3",
@@ -53,6 +53,7 @@
     "./sso-tenant": "./src/sso/tenant-cookie.ts"
   },
   "scripts": {
-    "lint": "eslint ."
+    "lint": "eslint .",
+    "test": "node --test \"src/**/*.test.ts\""
   }
 }

package/src/app-router/index.tsx

@@ -33,6 +33,7 @@ export {
   useImpersonation,
 } from "../impersonation/context";
 export type { ImpersonationActive } from "../impersonation/cookies";
+export { impersonationRequired } from "../impersonation/required";
 export { signIn, SessionProvider } from "next-auth/react";
 export {
   Login,

package/src/app-sign-in/handlers.ts

@@ -6,6 +6,14 @@ import {
   requestOrigin,
 } from "../session";
 import { resolveAccessToken } from "../route-handler/token";
+import {
+  readImpersonationActive,
+  readImpersonationSession,
+} from "../impersonation/cookies";
+import {
+  impersonationPickerUrl,
+  impersonationRequired,
+} from "../impersonation/required";
 import type { Auth } from "../types";
 import {
   type AuthorizationParams,
@@ -45,6 +53,47 @@ async function signedInEmail(
   return token?.refreshToken && token.email ? String(token.email) : null;
 }
 
+interface Signer {
+  email: string;
+  accessToken: string;
+}
+
+function personaSigner(request: Request): Signer | null {
+  const session = readImpersonationSession(request);
+  const active = readImpersonationActive(request);
+  if (!session || !active || session.expiresOn * 1000 <= Date.now()) {
+    return null;
+  }
+  return { email: active.targetEmail, accessToken: session.accessToken };
+}
+
+async function ownSigner(
+  authConfig: Auth.Config,
+  request: Request,
+  email: string
+): Promise<Signer | null> {
+  const access = await resolveAccessToken(authConfig, request);
+  return "error" in access ? null : { email, accessToken: access.accessToken };
+}
+
+function signerFor(
+  authConfig: Auth.Config,
+  request: Request,
+  email: string
+): Promise<Signer | null> {
+  if (impersonationRequired(authConfig.environment)) {
+    return Promise.resolve(personaSigner(request));
+  }
+  return ownSigner(authConfig, request, email);
+}
+
+function pickerRedirect(request: Request): Response {
+  const url = new URL(request.url);
+  const origin = requestOrigin(request);
+  const resume = `${origin}${url.pathname}${url.search}`;
+  return Response.redirect(impersonationPickerUrl(origin, resume), 302);
+}
+
 function loginRedirect(request: Request, resource: string, prompt?: string) {
   const url = new URL(request.url);
   const resume = new URLSearchParams(url.searchParams);
@@ -105,13 +154,17 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
     const params = readParams(query);
     if (!params) return invalidRequest();
 
-    const email = await signedInEmail(request, authConfig.nextAuthSecret);
-    if (!email) return loginRedirect(request, params.resource);
+    const signedIn = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (!signedIn) return loginRedirect(request, params.resource);
 
-    const access = await resolveAccessToken(authConfig, request);
-    if ("error" in access) return loginRedirect(request, params.resource);
+    const signer = await signerFor(authConfig, request, signedIn);
+    if (!signer) {
+      return impersonationRequired(authConfig.environment)
+        ? pickerRedirect(request)
+        : loginRedirect(request, params.resource);
+    }
 
-    const preview = await previewAuthorization(params, access.accessToken);
+    const preview = await previewAuthorization(params, signer.accessToken);
     if ("error" in preview) {
       return preview.error === ACCESS_DENIED
         ? loginRedirect(request, params.resource, "login")
@@ -125,7 +178,7 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
         ...preview.value,
         business: new URL(params.resource).hostname,
         state: query.get("state") ?? "",
-        email,
+        email: signer.email,
         nonce,
       },
       authConfig.nextAuthSecret
@@ -155,8 +208,11 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
       return invalidRequest();
     }
 
-    const email = await signedInEmail(request, authConfig.nextAuthSecret);
-    if (email !== consent.email) return invalidRequest();
+    const signedIn = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (!signedIn) return invalidRequest();
+
+    const signer = await signerFor(authConfig, request, signedIn);
+    if (!signer || signer.email !== consent.email) return invalidRequest();
 
     if (form.get("decision") !== "approve") {
       return clientRedirect(request, consent.redirectUri, consent.state, {
@@ -164,10 +220,7 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
       });
     }
 
-    const access = await resolveAccessToken(authConfig, request);
-    if ("error" in access) return invalidRequest();
-
-    const approved = await approveAuthorization(consent, access.accessToken);
+    const approved = await approveAuthorization(consent, signer.accessToken);
     return clientRedirect(
       request,
       consent.redirectUri,

package/src/hooks.ts

@@ -3,9 +3,12 @@ import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useSession } from "./session/useSession";
+import { IMPERSONATION_REQUIRED_ERROR } from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
 
+class ImpersonationRequiredError extends Error {}
+
 const REFRESH_MARGIN_SECONDS = 60;
 
 interface CachedToken {
@@ -62,6 +65,9 @@ async function fetchToken(impKey: string): Promise<string> {
     if (body?.error === "consent_required") {
       throw new ConsentRequiredError();
     }
+    if (body?.error === IMPERSONATION_REQUIRED_ERROR) {
+      throw new ImpersonationRequiredError();
+    }
   }
 
   if (!res.ok) {
@@ -128,6 +134,7 @@ export function useAuth() {
       session,
       getToken: () =>
         getFreshToken().catch((error) => {
+          if (error instanceof ImpersonationRequiredError) throw error;
           console.error(error);
           const onAuthPage = window.location.pathname.startsWith("/auth/");
           if (onAuthPage) return;

package/src/impersonation/RequiredImpersonationGate.tsx

@@ -0,0 +1,51 @@
+"use client";
+
+import { useEffect, type ReactNode } from "react";
+import { usePathname } from "next/navigation";
+import { PageLoader } from "@snokam/ui";
+import { useOptionalConfig } from "@snokam/tenant";
+import { useSession } from "../session/useSession";
+import {
+  impersonationPickerUrl,
+  impersonationRequired,
+  isExemptRoute,
+  sendsToPicker,
+  withholdsApp,
+} from "./required";
+
+interface Props {
+  sessionActive: boolean;
+  cookieRead: boolean;
+  children: ReactNode;
+}
+
+export function RequiredImpersonationGate({
+  sessionActive,
+  cookieRead,
+  children,
+}: Props) {
+  const config = useOptionalConfig();
+  const { status, data: session } = useSession();
+  const pathname = usePathname();
+  const platformUrl = config?.NEXT_PUBLIC_PLATFORM_BASE_URL;
+
+  const state = {
+    required: impersonationRequired(config?.NEXT_PUBLIC_ENVIRONMENT),
+    authenticated:
+      status === "authenticated" || (status === "loading" && !!session),
+    sessionActive,
+    cookieRead,
+    exemptRoute: isExemptRoute(pathname),
+  };
+  const redirect = sendsToPicker(state);
+
+  useEffect(() => {
+    if (!redirect || !platformUrl) return;
+    window.location.assign(
+      impersonationPickerUrl(platformUrl, window.location.href)
+    );
+  }, [redirect, platformUrl]);
+
+  if (withholdsApp(state)) return <PageLoader />;
+  return <>{children}</>;
+}

package/src/impersonation/context.tsx

@@ -11,6 +11,8 @@ import {
 } from "react";
 import { IMP_ACTIVE_COOKIE, type ImpersonationActive } from "./cookies";
 import { clearAuthTokenCache } from "../hooks";
+import { useSessionRenewal } from "./renewal";
+import { RequiredImpersonationGate } from "./RequiredImpersonationGate";
 
 interface ImpersonationContextValue {
   active: ImpersonationActive | null;
@@ -24,6 +26,7 @@ interface ImpersonationContextValue {
     redirectTo?: string;
     returnTo?: string;
     landingUrl?: string;
+    handOffOnly?: boolean;
   }) => Promise<{ ok: boolean; error?: string }>;
   exit: () => Promise<void>;
 }
@@ -74,24 +77,18 @@ function readActiveCookie(): ImpersonationActive | null {
 
 export function ImpersonationProvider({ children }: { children: ReactNode }) {
   const [active, setActive] = useState<ImpersonationActive | null>(null);
+  const [cookieRead, setCookieRead] = useState(false);
   const [starting, setStarting] = useState(false);
   const [exiting, setExiting] = useState(false);
 
-  useEffect(() => {
-    setActive(readActiveCookie());
-  }, []);
+  const rereadCookie = useCallback(() => setActive(readActiveCookie()), []);
 
-  // Auto-exit at token expiry so a stale banner/token never lingers.
   useEffect(() => {
-    if (!active) return;
-    const ms = active.expiresOn * 1000 - Date.now();
-    if (ms <= 0) {
-      setActive(null);
-      return;
-    }
-    const timer = setTimeout(() => setActive(null), ms);
-    return () => clearTimeout(timer);
-  }, [active]);
+    rereadCookie();
+    setCookieRead(true);
+  }, [rereadCookie]);
+
+  useSessionRenewal(active, rereadCookie);
 
   const start = useCallback(
     async (input: {
@@ -102,6 +99,7 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
       redirectTo?: string;
       returnTo?: string;
       landingUrl?: string;
+      handOffOnly?: boolean;
     }) => {
       setStarting(true);
       try {
@@ -161,7 +159,12 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   return (
     <ImpersonationContext.Provider value={value}>
-      {children}
+      <RequiredImpersonationGate
+        sessionActive={!!active}
+        cookieRead={cookieRead}
+      >
+        {children}
+      </RequiredImpersonationGate>
     </ImpersonationContext.Provider>
   );
 }

package/src/impersonation/cookies.ts

@@ -44,20 +44,28 @@ function parseCookieHeader(header: string | null): Record<string, string> {
   return jar;
 }
 
-export function readImpersonationSession(
-  request: Request
-): ImpersonationSession | null {
-  const raw = parseCookieHeader(request.headers.get("cookie"))[
-    IMP_SESSION_COOKIE
-  ];
+function readCookieJson<T>(request: Request, name: string): T | null {
+  const raw = parseCookieHeader(request.headers.get("cookie"))[name];
   if (!raw) return null;
   try {
-    return JSON.parse(raw) as ImpersonationSession;
+    return JSON.parse(raw) as T;
   } catch {
     return null;
   }
 }
 
+export function readImpersonationSession(
+  request: Request
+): ImpersonationSession | null {
+  return readCookieJson<ImpersonationSession>(request, IMP_SESSION_COOKIE);
+}
+
+export function readImpersonationActive(
+  request: Request
+): ImpersonationActive | null {
+  return readCookieJson<ImpersonationActive>(request, IMP_ACTIVE_COOKIE);
+}
+
 function serialize(
   name: string,
   value: string,

package/src/impersonation/handlers.ts

@@ -6,17 +6,8 @@ import {
   readImpersonationSession,
 } from "./cookies";
 import { sealImpersonationTicket, openImpersonationTicket } from "./ticket";
-import { requestOrigin } from "../session";
-
-function platformBase(): string | null {
-  return (
-    process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL?.replace(/\/$/, "") ?? null
-  );
-}
-
-function requestHost(request: Request): string | null {
-  return request.headers.get("x-forwarded-host") ?? request.headers.get("host");
-}
+import { requestOrigin, resolveCookieDomain } from "../session";
+import { platformBase, platformErrorResponse, requestHost } from "./request";
 
 function registrable(host: string): string {
   return host.split(":")[0].toLowerCase().split(".").slice(-2).join(".");
@@ -48,12 +39,19 @@ function resolveLanding(returnTo: string, origin: string): string {
   return new URL("/", origin).toString();
 }
 
-/** True when the redirect target lives on a different registrable domain than this request. */
-function isCrossDomain(request: Request, target: string): boolean {
+function cookieScope(host: string): string {
+  return resolveCookieDomain(host) ?? host.split(":")[0].toLowerCase();
+}
+
+function handsOffToTarget(request: Request, target: string): boolean {
   const here = requestHost(request);
   if (!here) return false;
   try {
-    return registrable(new URL(target).host) !== registrable(here);
+    const there = new URL(target).host;
+    return (
+      registrable(there) !== registrable(here) ||
+      cookieScope(there) !== cookieScope(here)
+    );
   } catch {
     return false;
   }
@@ -85,6 +83,7 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
       redirectTo?: string;
       returnTo?: string;
       landingUrl?: string;
+      handOffOnly?: boolean;
     };
     try {
       body = await request.json();
@@ -105,17 +104,7 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
       }),
     });
 
-    if (!minted.ok) {
-      const raw = await minted.text();
-      let message = raw;
-      try {
-        const parsed = JSON.parse(raw) as { message?: unknown };
-        if (typeof parsed.message === "string") message = parsed.message;
-      } catch {
-        // Non-JSON error body — pass the raw text through unchanged.
-      }
-      return new Response(message, { status: minted.status });
-    }
+    if (!minted.ok) return platformErrorResponse(minted);
 
     const result = await minted.json();
     result.targetImage = body.targetImage ?? null;
@@ -128,7 +117,7 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
     };
 
     // Custom-domain tenant: hand the session to the tenant domain's adopt route (login's pattern).
-    if (body.redirectTo && isCrossDomain(request, body.redirectTo)) {
+    if (body.redirectTo && handsOffToTarget(request, body.redirectTo)) {
       const target = new URL(body.redirectTo);
       const ticket = sealImpersonationTicket(
         { ...result, business: target.host, returnTo: body.returnTo },
@@ -144,6 +133,7 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
         ...summary,
         adoptUrl: adopt.toString(),
       });
+      if (body.handOffOnly) return crossDomain;
       for (const cookie of buildImpersonationCookies(
         { ...result, returnTo: body.returnTo },
         requestHost(request)

package/src/impersonation/personas.ts

@@ -0,0 +1,52 @@
+import { Auth } from "../types";
+import { resolveAccessToken } from "../route-handler/token";
+import { platformBase, platformErrorResponse } from "./request";
+import { impersonationRequired } from "./required";
+
+function businessOf(accessToken: string): string | null {
+  try {
+    const payload = accessToken.split(".")[1] ?? "";
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8")
+    ) as { biz?: string };
+    return claims.biz ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function createImpersonationPersonasHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    if (!impersonationRequired(authConfig.environment)) {
+      return new Response("Not found", { status: 404 });
+    }
+
+    const base = platformBase();
+    if (!base) {
+      return new Response(
+        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
+        { status: 500 }
+      );
+    }
+
+    const caller = await resolveAccessToken(authConfig, request);
+    if ("error" in caller) return caller.error;
+
+    const businessId = businessOf(caller.accessToken);
+    if (!businessId) {
+      return new Response("The signed-in account has no business", {
+        status: 409,
+      });
+    }
+
+    const employees = await fetch(
+      `${base}/v1.0/protected/businesses/${encodeURIComponent(businessId)}/employees`,
+      { headers: { Authorization: `Bearer ${caller.accessToken}` } }
+    );
+    if (!employees.ok) return platformErrorResponse(employees);
+
+    return new Response(await employees.text(), {
+      headers: { "Content-Type": "application/json" },
+    });
+  };
+}

package/src/impersonation/renew.ts

@@ -0,0 +1,75 @@
+import {
+  Configuration,
+  PlatformClient,
+  ResponseError,
+} from "@snokam/platform-client";
+import { Auth } from "../types";
+import { resolveAccessToken } from "../route-handler/token";
+import {
+  buildImpersonationCookies,
+  readImpersonationActive,
+  readImpersonationSession,
+} from "./cookies";
+import { platformBase, platformErrorResponse, requestHost } from "./request";
+
+export function createImpersonationRenewHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    const session = readImpersonationSession(request);
+    const active = readImpersonationActive(request);
+    if (!session?.tokenId || !active) {
+      return new Response("No impersonation session", { status: 404 });
+    }
+
+    const basePath = platformBase();
+    if (!basePath) {
+      return new Response(
+        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
+        {
+          status: 500,
+        }
+      );
+    }
+
+    const caller = await resolveAccessToken(authConfig, request);
+    if ("error" in caller) return caller.error;
+
+    const client = new PlatformClient(
+      new Configuration({
+        basePath,
+        accessToken: async () => caller.accessToken,
+      })
+    );
+
+    try {
+      const renewed = await client.renewImpersonation({
+        tokenId: session.tokenId,
+      });
+      if (!renewed.accessToken || !renewed.expiresOn) {
+        return new Response("Incomplete impersonation renewal", {
+          status: 502,
+        });
+      }
+
+      const out = Response.json({
+        tokenId: session.tokenId,
+        expiresOn: renewed.expiresOn,
+      });
+      const cookies = buildImpersonationCookies(
+        {
+          ...active,
+          accessToken: renewed.accessToken,
+          expiresOn: renewed.expiresOn,
+          finance: renewed.finance ?? false,
+        },
+        requestHost(request)
+      );
+      for (const cookie of cookies) out.headers.append("Set-Cookie", cookie);
+      return out;
+    } catch (error) {
+      if (error instanceof ResponseError) {
+        return platformErrorResponse(error.response);
+      }
+      throw error;
+    }
+  };
+}

package/src/impersonation/renewal.ts

@@ -0,0 +1,42 @@
+"use client";
+
+import { useEffect } from "react";
+import { clearAuthTokenCache } from "../hooks";
+import type { ImpersonationActive } from "./cookies";
+import { renewDelayMs } from "./required";
+
+async function renewSession(): Promise<boolean> {
+  const res = await fetch("/api/impersonation/renew", {
+    method: "POST",
+    credentials: "include",
+  }).catch(() => null);
+  return res?.ok ?? false;
+}
+
+export function useSessionRenewal(
+  active: ImpersonationActive | null,
+  rereadCookie: () => void
+) {
+  useEffect(() => {
+    if (!active) return;
+
+    const renewal = setTimeout(
+      async () => {
+        if (!(await renewSession())) return;
+        clearAuthTokenCache();
+        rereadCookie();
+      },
+      renewDelayMs(active.expiresOn, Date.now())
+    );
+
+    const expiry = setTimeout(
+      rereadCookie,
+      Math.max(0, active.expiresOn * 1000 - Date.now())
+    );
+
+    return () => {
+      clearTimeout(renewal);
+      clearTimeout(expiry);
+    };
+  }, [active, rereadCookie]);
+}

package/src/impersonation/request.ts

@@ -0,0 +1,26 @@
+export function platformBase(): string | null {
+  return (
+    process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL?.replace(/\/$/, "") ?? null
+  );
+}
+
+export function requestHost(request: Request): string | null {
+  return request.headers.get("x-forwarded-host") ?? request.headers.get("host");
+}
+
+function messageOf(raw: string): string {
+  try {
+    const parsed = JSON.parse(raw) as { message?: unknown };
+    return typeof parsed.message === "string" ? parsed.message : raw;
+  } catch {
+    return raw;
+  }
+}
+
+export async function platformErrorResponse(
+  response: Response
+): Promise<Response> {
+  return new Response(messageOf(await response.text()), {
+    status: response.status,
+  });
+}

package/src/impersonation/required.test.ts

@@ -0,0 +1,86 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+  impersonationPickerUrl,
+  impersonationRequired,
+  isExemptRoute,
+  renewDelayMs,
+  sendsToPicker,
+  withholdsApp,
+} from "./required.ts";
+
+const signedInAlone = {
+  authenticated: true,
+  sessionActive: false,
+  cookieRead: true,
+  exemptRoute: false,
+};
+
+describe("impersonation required gate", () => {
+  it("is off in production and everywhere that is not the test environment", () => {
+    for (const environment of ["p", "test", "production", "", undefined]) {
+      assert.equal(impersonationRequired(environment), false);
+    }
+  });
+
+  it("is on in test", () => {
+    assert.equal(impersonationRequired("t"), true);
+  });
+
+  it("never withholds the app or redirects when not required", () => {
+    const state = { required: false, ...signedInAlone };
+    assert.equal(withholdsApp(state), false);
+    assert.equal(sendsToPicker(state), false);
+  });
+
+  it("sends a signed-in person without a session to the picker when required", () => {
+    const state = { required: true, ...signedInAlone };
+    assert.equal(withholdsApp(state), true);
+    assert.equal(sendsToPicker(state), true);
+  });
+
+  it("lets the app render once someone is being viewed as", () => {
+    const state = { required: true, ...signedInAlone, sessionActive: true };
+    assert.equal(withholdsApp(state), false);
+    assert.equal(sendsToPicker(state), false);
+  });
+
+  it("holds the app without redirecting until the session cookie is read", () => {
+    const state = { required: true, ...signedInAlone, cookieRead: false };
+    assert.equal(withholdsApp(state), true);
+    assert.equal(sendsToPicker(state), false);
+  });
+
+  it("leaves sign-in routes, the picker and anonymous visitors alone", () => {
+    const base = { required: true, ...signedInAlone };
+    assert.equal(withholdsApp({ ...base, exemptRoute: true }), false);
+    assert.equal(withholdsApp({ ...base, authenticated: false }), false);
+  });
+
+  it("points the picker back at the page the person asked for", () => {
+    const url = new URL(
+      impersonationPickerUrl(
+        "https://www.test.snosky.no",
+        "https://snokam.test.snosky.no/minside/okonomi?x=1"
+      )
+    );
+    assert.equal(url.pathname, "/velg-bruker");
+    assert.equal(
+      url.searchParams.get("returnTo"),
+      "https://snokam.test.snosky.no/minside/okonomi?x=1"
+    );
+  });
+
+  it("exempts sign-in routes and the picker, and nothing else", () => {
+    assert.equal(isExemptRoute("/auth/login"), true);
+    assert.equal(isExemptRoute("/velg-bruker"), true);
+    assert.equal(isExemptRoute("/manage"), false);
+    assert.equal(isExemptRoute("/"), false);
+    assert.equal(isExemptRoute(null), false);
+  });
+
+  it("renews two minutes before the token expires, and at once when already late", () => {
+    assert.equal(renewDelayMs(1_000, 0), 880_000);
+    assert.equal(renewDelayMs(1_000, 999_000), 0);
+  });
+});

package/src/impersonation/required.ts

@@ -0,0 +1,55 @@
+export const IMPERSONATION_REQUIRED_ERROR = "impersonation_required";
+
+const TEST_ENVIRONMENT = "t";
+
+export const IMPERSONATION_PICKER_PATH = "/velg-bruker";
+
+const RENEW_MARGIN_SECONDS = 120;
+
+export function impersonationRequired(
+  environment: string | undefined
+): boolean {
+  return environment === TEST_ENVIRONMENT;
+}
+
+export interface ImpersonationGateState {
+  required: boolean;
+  authenticated: boolean;
+  sessionActive: boolean;
+  cookieRead: boolean;
+  exemptRoute: boolean;
+}
+
+function gated({
+  required,
+  authenticated,
+  exemptRoute,
+}: ImpersonationGateState) {
+  return required && authenticated && !exemptRoute;
+}
+
+export function isExemptRoute(pathname: string | null): boolean {
+  if (!pathname) return false;
+  return pathname.startsWith("/auth") || pathname === IMPERSONATION_PICKER_PATH;
+}
+
+export function withholdsApp(state: ImpersonationGateState): boolean {
+  return gated(state) && (!state.cookieRead || !state.sessionActive);
+}
+
+export function sendsToPicker(state: ImpersonationGateState): boolean {
+  return gated(state) && state.cookieRead && !state.sessionActive;
+}
+
+export function impersonationPickerUrl(
+  platformBaseUrl: string,
+  returnTo: string
+): string {
+  const picker = new URL(IMPERSONATION_PICKER_PATH, platformBaseUrl);
+  picker.searchParams.set("returnTo", returnTo);
+  return picker.toString();
+}
+
+export function renewDelayMs(expiresOn: number, nowMs: number): number {
+  return Math.max(0, (expiresOn - RENEW_MARGIN_SECONDS) * 1000 - nowMs);
+}

package/src/impersonation/routes.ts

@@ -4,26 +4,30 @@ import {
   createImpersonationEndHandler,
   createImpersonationAdoptHandler,
 } from "./handlers";
+import { createImpersonationRenewHandler } from "./renew";
+import { createImpersonationPersonasHandler } from "./personas";
 
 type OpContext = { params: Promise<{ op: string }> };
 
-// One catch-all mount per app: api/impersonation/[op]/route.ts re-exports { GET, POST }.
-// POST /start + /end, GET /adopt — so every app supports view-as with a single file.
 export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
   const start = createImpersonationStartHandler(authConfig);
   const end = createImpersonationEndHandler(authConfig);
   const adopt = createImpersonationAdoptHandler(authConfig);
+  const renew = createImpersonationRenewHandler(authConfig);
+  const personas = createImpersonationPersonasHandler(authConfig);
 
   return {
     async GET(request: Request, ctx: OpContext) {
       const { op } = await ctx.params;
       if (op === "adopt") return adopt(request);
+      if (op === "personas") return personas(request);
       return new Response("Not found", { status: 404 });
     },
     async POST(request: Request, ctx: OpContext) {
       const { op } = await ctx.params;
       if (op === "start") return start(request);
       if (op === "end") return end(request);
+      if (op === "renew") return renew(request);
       return new Response("Not found", { status: 404 });
     },
   };

package/src/route-handler/token.ts

@@ -8,6 +8,10 @@ import { getAuthUrl, getSessionCookieSettings } from "../session";
 import { exchangePasswordToken } from "../password/api";
 import { readImpersonationSession } from "../impersonation/cookies";
 import { exchangeSsoToken } from "../sso/exchange";
+import {
+  IMPERSONATION_REQUIRED_ERROR,
+  impersonationRequired,
+} from "../impersonation/required";
 
 export type TokenResult =
   { accessToken: string; expiresOn: number } | { error: Response };
@@ -102,9 +106,6 @@ export async function resolveAccessToken(
 
 export function createTokenHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
-    // While a view-as-employee session is active, every product API call transparently receives the
-    // short-lived impersonation token instead of the admin's own — the single swap point the design
-    // relies on. A clean exit (or expiry) discards the cookie and this falls back to the admin token.
     const impersonation = readImpersonationSession(request);
     if (impersonation && impersonation.expiresOn * 1000 > Date.now()) {
       return Response.json({
@@ -113,6 +114,13 @@ export function createTokenHandler(authConfig: Auth.Config) {
       });
     }
 
+    if (impersonationRequired(authConfig.environment)) {
+      return Response.json(
+        { error: IMPERSONATION_REQUIRED_ERROR },
+        { status: 403 }
+      );
+    }
+
     const result = await resolveAccessToken(authConfig, request);
     if ("error" in result) {
       return result.error;