@snokam/auth 3.4.0 → 3.5.0

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.5.0](https://github.com/snokam/components/compare/@snokam/auth@3.4.0...@snokam/auth@3.5.0) (2026-10-06)
+
+### Features
+
+- **test:** pick a test user straight after sign-in, on snosky.no and for MCP sign-in too ([#2680](https://github.com/snokam/components/issues/2680)) ([eea727a](https://github.com/snokam/components/commit/eea727ae1a607139c7c30610109e877eaa20dae9))
+
 # [3.4.0](https://github.com/snokam/components/compare/@snokam/auth@3.3.12...@snokam/auth@3.4.0) (2026-10-06)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -28,9 +28,9 @@
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
     "@snokam/platform-client": "3.6.0",
-    "@snokam/react-query": "1.1.0",
     "@snokam/tenant": "2.1.13",
     "@snokam/ui": "4.0.0",
+    "@snokam/react-query": "1.1.0",
     "@snokam/sanity-page-content": "4.4.2"
   },
   "peerDependencies": {

package/src/app-router/index.tsx

@@ -33,6 +33,7 @@ export {
   useImpersonation,
 } from "../impersonation/context";
 export type { ImpersonationActive } from "../impersonation/cookies";
+export { impersonationRequired } from "../impersonation/required";
 export { signIn, SessionProvider } from "next-auth/react";
 export {
   Login,

package/src/app-sign-in/handlers.ts

@@ -6,6 +6,14 @@ import {
   requestOrigin,
 } from "../session";
 import { resolveAccessToken } from "../route-handler/token";
+import {
+  readImpersonationActive,
+  readImpersonationSession,
+} from "../impersonation/cookies";
+import {
+  impersonationPickerUrl,
+  impersonationRequired,
+} from "../impersonation/required";
 import type { Auth } from "../types";
 import {
   type AuthorizationParams,
@@ -45,6 +53,47 @@ async function signedInEmail(
   return token?.refreshToken && token.email ? String(token.email) : null;
 }
 
+interface Signer {
+  email: string;
+  accessToken: string;
+}
+
+function personaSigner(request: Request): Signer | null {
+  const session = readImpersonationSession(request);
+  const active = readImpersonationActive(request);
+  if (!session || !active || session.expiresOn * 1000 <= Date.now()) {
+    return null;
+  }
+  return { email: active.targetEmail, accessToken: session.accessToken };
+}
+
+async function ownSigner(
+  authConfig: Auth.Config,
+  request: Request,
+  email: string
+): Promise<Signer | null> {
+  const access = await resolveAccessToken(authConfig, request);
+  return "error" in access ? null : { email, accessToken: access.accessToken };
+}
+
+function signerFor(
+  authConfig: Auth.Config,
+  request: Request,
+  email: string
+): Promise<Signer | null> {
+  if (impersonationRequired(authConfig.environment)) {
+    return Promise.resolve(personaSigner(request));
+  }
+  return ownSigner(authConfig, request, email);
+}
+
+function pickerRedirect(request: Request): Response {
+  const url = new URL(request.url);
+  const origin = requestOrigin(request);
+  const resume = `${origin}${url.pathname}${url.search}`;
+  return Response.redirect(impersonationPickerUrl(origin, resume), 302);
+}
+
 function loginRedirect(request: Request, resource: string, prompt?: string) {
   const url = new URL(request.url);
   const resume = new URLSearchParams(url.searchParams);
@@ -105,13 +154,17 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
     const params = readParams(query);
     if (!params) return invalidRequest();
 
-    const email = await signedInEmail(request, authConfig.nextAuthSecret);
-    if (!email) return loginRedirect(request, params.resource);
+    const signedIn = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (!signedIn) return loginRedirect(request, params.resource);
 
-    const access = await resolveAccessToken(authConfig, request);
-    if ("error" in access) return loginRedirect(request, params.resource);
+    const signer = await signerFor(authConfig, request, signedIn);
+    if (!signer) {
+      return impersonationRequired(authConfig.environment)
+        ? pickerRedirect(request)
+        : loginRedirect(request, params.resource);
+    }
 
-    const preview = await previewAuthorization(params, access.accessToken);
+    const preview = await previewAuthorization(params, signer.accessToken);
     if ("error" in preview) {
       return preview.error === ACCESS_DENIED
         ? loginRedirect(request, params.resource, "login")
@@ -125,7 +178,7 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
         ...preview.value,
         business: new URL(params.resource).hostname,
         state: query.get("state") ?? "",
-        email,
+        email: signer.email,
         nonce,
       },
       authConfig.nextAuthSecret
@@ -155,8 +208,11 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
       return invalidRequest();
     }
 
-    const email = await signedInEmail(request, authConfig.nextAuthSecret);
-    if (email !== consent.email) return invalidRequest();
+    const signedIn = await signedInEmail(request, authConfig.nextAuthSecret);
+    if (!signedIn) return invalidRequest();
+
+    const signer = await signerFor(authConfig, request, signedIn);
+    if (!signer || signer.email !== consent.email) return invalidRequest();
 
     if (form.get("decision") !== "approve") {
       return clientRedirect(request, consent.redirectUri, consent.state, {
@@ -164,10 +220,7 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
       });
     }
 
-    const access = await resolveAccessToken(authConfig, request);
-    if ("error" in access) return invalidRequest();
-
-    const approved = await approveAuthorization(consent, access.accessToken);
+    const approved = await approveAuthorization(consent, signer.accessToken);
     return clientRedirect(
       request,
       consent.redirectUri,

package/src/impersonation/RequiredImpersonationGate.tsx

@@ -8,6 +8,7 @@ import { useSession } from "../session/useSession";
 import {
   impersonationPickerUrl,
   impersonationRequired,
+  isExemptRoute,
   sendsToPicker,
   withholdsApp,
 } from "./required";
@@ -15,14 +16,12 @@ import {
 interface Props {
   sessionActive: boolean;
   cookieRead: boolean;
-  keepOwnIdentity: boolean;
   children: ReactNode;
 }
 
 export function RequiredImpersonationGate({
   sessionActive,
   cookieRead,
-  keepOwnIdentity,
   children,
 }: Props) {
   const config = useOptionalConfig();
@@ -31,15 +30,12 @@ export function RequiredImpersonationGate({
   const platformUrl = config?.NEXT_PUBLIC_PLATFORM_BASE_URL;
 
   const state = {
-    required: impersonationRequired(
-      config?.NEXT_PUBLIC_ENVIRONMENT,
-      keepOwnIdentity
-    ),
+    required: impersonationRequired(config?.NEXT_PUBLIC_ENVIRONMENT),
     authenticated:
       status === "authenticated" || (status === "loading" && !!session),
     sessionActive,
     cookieRead,
-    authRoute: pathname?.startsWith("/auth") ?? false,
+    exemptRoute: isExemptRoute(pathname),
   };
   const redirect = sendsToPicker(state);
 

package/src/impersonation/context.tsx

@@ -75,15 +75,7 @@ function readActiveCookie(): ImpersonationActive | null {
   }
 }
 
-interface ImpersonationProviderProps {
-  children: ReactNode;
-  keepOwnIdentity?: boolean;
-}
-
-export function ImpersonationProvider({
-  children,
-  keepOwnIdentity = false,
-}: ImpersonationProviderProps) {
+export function ImpersonationProvider({ children }: { children: ReactNode }) {
   const [active, setActive] = useState<ImpersonationActive | null>(null);
   const [cookieRead, setCookieRead] = useState(false);
   const [starting, setStarting] = useState(false);
@@ -170,7 +162,6 @@ export function ImpersonationProvider({
       <RequiredImpersonationGate
         sessionActive={!!active}
         cookieRead={cookieRead}
-        keepOwnIdentity={keepOwnIdentity}
       >
         {children}
       </RequiredImpersonationGate>

package/src/impersonation/personas.ts

@@ -0,0 +1,52 @@
+import { Auth } from "../types";
+import { resolveAccessToken } from "../route-handler/token";
+import { platformBase, platformErrorResponse } from "./request";
+import { impersonationRequired } from "./required";
+
+function businessOf(accessToken: string): string | null {
+  try {
+    const payload = accessToken.split(".")[1] ?? "";
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8")
+    ) as { biz?: string };
+    return claims.biz ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export function createImpersonationPersonasHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    if (!impersonationRequired(authConfig.environment)) {
+      return new Response("Not found", { status: 404 });
+    }
+
+    const base = platformBase();
+    if (!base) {
+      return new Response(
+        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
+        { status: 500 }
+      );
+    }
+
+    const caller = await resolveAccessToken(authConfig, request);
+    if ("error" in caller) return caller.error;
+
+    const businessId = businessOf(caller.accessToken);
+    if (!businessId) {
+      return new Response("The signed-in account has no business", {
+        status: 409,
+      });
+    }
+
+    const employees = await fetch(
+      `${base}/v1.0/protected/businesses/${encodeURIComponent(businessId)}/employees`,
+      { headers: { Authorization: `Bearer ${caller.accessToken}` } }
+    );
+    if (!employees.ok) return platformErrorResponse(employees);
+
+    return new Response(await employees.text(), {
+      headers: { "Content-Type": "application/json" },
+    });
+  };
+}

package/src/impersonation/required.test.ts

@@ -3,6 +3,7 @@ import { describe, it } from "node:test";
 import {
   impersonationPickerUrl,
   impersonationRequired,
+  isExemptRoute,
   renewDelayMs,
   sendsToPicker,
   withholdsApp,
@@ -12,19 +13,18 @@ const signedInAlone = {
   authenticated: true,
   sessionActive: false,
   cookieRead: true,
-  authRoute: false,
+  exemptRoute: false,
 };
 
 describe("impersonation required gate", () => {
   it("is off in production and everywhere that is not the test environment", () => {
     for (const environment of ["p", "test", "production", "", undefined]) {
-      assert.equal(impersonationRequired(environment, false), false);
+      assert.equal(impersonationRequired(environment), false);
     }
   });
 
-  it("is on in test, except where the app keeps its own identity", () => {
-    assert.equal(impersonationRequired("t", false), true);
-    assert.equal(impersonationRequired("t", true), false);
+  it("is on in test", () => {
+    assert.equal(impersonationRequired("t"), true);
   });
 
   it("never withholds the app or redirects when not required", () => {
@@ -51,9 +51,9 @@ describe("impersonation required gate", () => {
     assert.equal(sendsToPicker(state), false);
   });
 
-  it("leaves sign-in routes and anonymous visitors alone", () => {
+  it("leaves sign-in routes, the picker and anonymous visitors alone", () => {
     const base = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp({ ...base, authRoute: true }), false);
+    assert.equal(withholdsApp({ ...base, exemptRoute: true }), false);
     assert.equal(withholdsApp({ ...base, authenticated: false }), false);
   });
 
@@ -64,13 +64,21 @@ describe("impersonation required gate", () => {
         "https://snokam.test.snosky.no/minside/okonomi?x=1"
       )
     );
-    assert.equal(url.pathname, "/manage/users");
+    assert.equal(url.pathname, "/velg-bruker");
     assert.equal(
       url.searchParams.get("returnTo"),
       "https://snokam.test.snosky.no/minside/okonomi?x=1"
     );
   });
 
+  it("exempts sign-in routes and the picker, and nothing else", () => {
+    assert.equal(isExemptRoute("/auth/login"), true);
+    assert.equal(isExemptRoute("/velg-bruker"), true);
+    assert.equal(isExemptRoute("/manage"), false);
+    assert.equal(isExemptRoute("/"), false);
+    assert.equal(isExemptRoute(null), false);
+  });
+
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -2,13 +2,14 @@ export const IMPERSONATION_REQUIRED_ERROR = "impersonation_required";
 
 const TEST_ENVIRONMENT = "t";
 
+export const IMPERSONATION_PICKER_PATH = "/velg-bruker";
+
 const RENEW_MARGIN_SECONDS = 120;
 
 export function impersonationRequired(
-  environment: string | undefined,
-  keepOwnIdentity: boolean
+  environment: string | undefined
 ): boolean {
-  return !keepOwnIdentity && environment === TEST_ENVIRONMENT;
+  return environment === TEST_ENVIRONMENT;
 }
 
 export interface ImpersonationGateState {
@@ -16,11 +17,20 @@ export interface ImpersonationGateState {
   authenticated: boolean;
   sessionActive: boolean;
   cookieRead: boolean;
-  authRoute: boolean;
+  exemptRoute: boolean;
+}
+
+function gated({
+  required,
+  authenticated,
+  exemptRoute,
+}: ImpersonationGateState) {
+  return required && authenticated && !exemptRoute;
 }
 
-function gated({ required, authenticated, authRoute }: ImpersonationGateState) {
-  return required && authenticated && !authRoute;
+export function isExemptRoute(pathname: string | null): boolean {
+  if (!pathname) return false;
+  return pathname.startsWith("/auth") || pathname === IMPERSONATION_PICKER_PATH;
 }
 
 export function withholdsApp(state: ImpersonationGateState): boolean {
@@ -35,7 +45,7 @@ export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string
 ): string {
-  const picker = new URL("/manage/users", platformBaseUrl);
+  const picker = new URL(IMPERSONATION_PICKER_PATH, platformBaseUrl);
   picker.searchParams.set("returnTo", returnTo);
   return picker.toString();
 }

package/src/impersonation/routes.ts

@@ -5,6 +5,7 @@ import {
   createImpersonationAdoptHandler,
 } from "./handlers";
 import { createImpersonationRenewHandler } from "./renew";
+import { createImpersonationPersonasHandler } from "./personas";
 
 type OpContext = { params: Promise<{ op: string }> };
 
@@ -13,11 +14,13 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
   const end = createImpersonationEndHandler(authConfig);
   const adopt = createImpersonationAdoptHandler(authConfig);
   const renew = createImpersonationRenewHandler(authConfig);
+  const personas = createImpersonationPersonasHandler(authConfig);
 
   return {
     async GET(request: Request, ctx: OpContext) {
       const { op } = await ctx.params;
       if (op === "adopt") return adopt(request);
+      if (op === "personas") return personas(request);
       return new Response("Not found", { status: 404 });
     },
     async POST(request: Request, ctx: OpContext) {

package/src/route-handler/index.ts

@@ -38,7 +38,6 @@ export function createAuthHandler(options: AuthOptionsFor) {
 
 export { getNextAuthOptions } from "../options";
 export { createTokenHandler } from "./token";
-export type { TokenHandlerOptions } from "./token";
 export {
   createImpersonationStartHandler,
   createImpersonationEndHandler,

package/src/route-handler/token.ts

@@ -104,18 +104,8 @@ export async function resolveAccessToken(
   }
 }
 
-export interface TokenHandlerOptions {
-  keepOwnIdentity?: boolean;
-}
-
-export function createTokenHandler(
-  authConfig: Auth.Config,
-  { keepOwnIdentity = false }: TokenHandlerOptions = {}
-) {
+export function createTokenHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
-    // While a view-as-employee session is active, every product API call transparently receives the
-    // short-lived impersonation token instead of the admin's own — the single swap point the design
-    // relies on. A clean exit (or expiry) discards the cookie and this falls back to the admin token.
     const impersonation = readImpersonationSession(request);
     if (impersonation && impersonation.expiresOn * 1000 > Date.now()) {
       return Response.json({
@@ -124,7 +114,7 @@ export function createTokenHandler(
       });
     }
 
-    if (impersonationRequired(authConfig.environment, keepOwnIdentity)) {
+    if (impersonationRequired(authConfig.environment)) {
       return Response.json(
         { error: IMPERSONATION_REQUIRED_ERROR },
         { status: 403 }