@snokam/auth 3.5.0 → 3.7.0

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.7.0](https://github.com/snokam/components/compare/@snokam/auth@3.6.0...@snokam/auth@3.7.0) (2026-10-06)
+
+### Features
+
+- **test:** every test page needs a login; pick a persona only when a page needs one ([#2705](https://github.com/snokam/components/issues/2705)) ([e086fb6](https://github.com/snokam/components/commit/e086fb63511e0f3f4f2002d0189e089c8cda6d30))
+
+# [3.6.0](https://github.com/snokam/components/compare/@snokam/auth@3.5.0...@snokam/auth@3.6.0) (2026-10-06)
+
+### Features
+
+- **snosky:** no prices, no terms page, unlinked /status in Snøkam look, better persona flow ([#2681](https://github.com/snokam/components/issues/2681)) ([b6dd5af](https://github.com/snokam/components/commit/b6dd5af68258c31f717888372fc7258d233c9e2e))
+
 # [3.5.0](https://github.com/snokam/components/compare/@snokam/auth@3.4.0...@snokam/auth@3.5.0) (2026-10-06)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -28,10 +28,10 @@
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
     "@snokam/platform-client": "3.6.0",
-    "@snokam/tenant": "2.1.13",
-    "@snokam/ui": "4.0.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "4.4.2"
+    "@snokam/sanity-page-content": "4.4.2",
+    "@snokam/tenant": "2.1.13",
+    "@snokam/ui": "4.0.0"
   },
   "peerDependencies": {
     "next": "16.3.3",

package/src/app-sign-in/handlers.ts

@@ -6,10 +6,8 @@ import {
   requestOrigin,
 } from "../session";
 import { resolveAccessToken } from "../route-handler/token";
-import {
-  readImpersonationActive,
-  readImpersonationSession,
-} from "../impersonation/cookies";
+import { readImpersonationSession } from "../impersonation/cookies";
+import { tokenClaims } from "../impersonation/claims";
 import {
   impersonationPickerUrl,
   impersonationRequired,
@@ -58,13 +56,18 @@ interface Signer {
   accessToken: string;
 }
 
-function personaSigner(request: Request): Signer | null {
+function sameEmail(a: string | undefined, b: string): boolean {
+  return !!a && a.toLowerCase() === b.toLowerCase();
+}
+
+function personaSigner(request: Request, operator: string): Signer | null {
   const session = readImpersonationSession(request);
-  const active = readImpersonationActive(request);
-  if (!session || !active || session.expiresOn * 1000 <= Date.now()) {
-    return null;
-  }
-  return { email: active.targetEmail, accessToken: session.accessToken };
+  if (!session || session.expiresOn * 1000 <= Date.now()) return null;
+
+  const claims = tokenClaims(session.accessToken);
+  if (!claims.email || !sameEmail(claims.act, operator)) return null;
+
+  return { email: claims.email, accessToken: session.accessToken };
 }
 
 async function ownSigner(
@@ -82,7 +85,7 @@ function signerFor(
   email: string
 ): Promise<Signer | null> {
   if (impersonationRequired(authConfig.environment)) {
-    return Promise.resolve(personaSigner(request));
+    return Promise.resolve(personaSigner(request, email));
   }
   return ownSigner(authConfig, request, email);
 }
@@ -175,7 +178,8 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
     const ticket = sealConsent(
       {
         ...params,
-        ...preview.value,
+        clientName: preview.value.clientName ?? "",
+        businessName: preview.value.businessName ?? "",
         business: new URL(params.resource).hostname,
         state: query.get("state") ?? "",
         email: signer.email,
@@ -227,7 +231,7 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
       consent.state,
       "error" in approved
         ? { error: approved.error }
-        : { code: approved.value.code }
+        : { code: approved.value.code ?? "" }
     );
   };
 }

package/src/app-sign-in/platform.ts

@@ -1,11 +1,13 @@
 import { getManagedBearer } from "@snokam/identity";
+import {
+  Configuration,
+  PlatformClient,
+  ResponseError,
+  type AuthorizationPreview,
+  type IssuedAuthorizationCode,
+} from "@snokam/platform-client";
 import type { AuthorizationParams } from "./consent";
 
-export interface AuthorizationPreview {
-  clientName: string;
-  businessName: string;
-}
-
 type Outcome<T> = { value: T } | { error: string };
 
 const UNAVAILABLE = "temporarily_unavailable";
@@ -17,36 +19,45 @@ function apiBase(): string {
   );
 }
 
-async function post<T>(
-  path: string,
-  params: AuthorizationParams,
-  userToken: string
+async function asLoginSite<T>(
+  call: (client: PlatformClient) => Promise<T>
 ): Promise<Outcome<T>> {
   const loginSite = await getManagedBearer();
   if (!loginSite) return { error: UNAVAILABLE };
 
-  const response = await fetch(`${apiBase()}${path}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Authorization: loginSite },
-    body: JSON.stringify({ ...params, userToken }),
-    cache: "no-store",
-  });
-  const body = await response.json().catch(() => ({}));
-  return response.ok
-    ? { value: body as T }
-    : { error: String(body.error ?? "invalid_request") };
+  const client = new PlatformClient(
+    new Configuration({
+      basePath: apiBase(),
+      accessToken: async () => loginSite,
+    })
+  );
+  try {
+    return { value: await call(client) };
+  } catch (error) {
+    if (!(error instanceof ResponseError)) throw error;
+    const body = await error.response.json().catch(() => ({}));
+    return { error: String(body.error ?? "invalid_request") };
+  }
 }
 
 export function previewAuthorization(
   params: AuthorizationParams,
   userToken: string
 ): Promise<Outcome<AuthorizationPreview>> {
-  return post("/v1.0/protected/oauth/authorization/preview", params, userToken);
+  return asLoginSite((client) =>
+    client.previewOAuthAuthorization({
+      authorizationRequest: { ...params, userToken },
+    })
+  );
 }
 
 export function approveAuthorization(
   params: AuthorizationParams,
   userToken: string
-): Promise<Outcome<{ code: string }>> {
-  return post("/v1.0/protected/oauth/authorization", params, userToken);
+): Promise<Outcome<IssuedAuthorizationCode>> {
+  return asLoginSite((client) =>
+    client.approveOAuthAuthorization({
+      authorizationRequest: { ...params, userToken },
+    })
+  );
 }

package/src/hooks.ts

@@ -3,11 +3,25 @@ import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useSession } from "./session/useSession";
-import { IMPERSONATION_REQUIRED_ERROR } from "./impersonation/required";
+import {
+  IMPERSONATION_REQUIRED_ERROR,
+  impersonationPickerUrl,
+} from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
 
-class ImpersonationRequiredError extends Error {}
+class ImpersonationRequiredError extends Error {
+  constructor(readonly platformUrl: string | undefined) {
+    super(IMPERSONATION_REQUIRED_ERROR);
+  }
+}
+
+function sendToPicker(error: ImpersonationRequiredError): void {
+  if (!error.platformUrl) return;
+  window.location.assign(
+    impersonationPickerUrl(error.platformUrl, window.location.href)
+  );
+}
 
 const REFRESH_MARGIN_SECONDS = 60;
 
@@ -20,11 +34,6 @@ interface CachedToken {
 let cachedToken: CachedToken | null = null;
 let inFlight: { impKey: string; promise: Promise<string> } | null = null;
 
-/**
- * Identifies which principal the next token belongs to: the active impersonation
- * tokenId, or "" for the admin's own token. Changing this (Vis som start/exit)
- * invalidates the cache so the swap in the token route is never served stale.
- */
 function readImpersonationKey(): string {
   if (typeof document === "undefined") return "";
   const match = document.cookie
@@ -66,7 +75,7 @@ async function fetchToken(impKey: string): Promise<string> {
       throw new ConsentRequiredError();
     }
     if (body?.error === IMPERSONATION_REQUIRED_ERROR) {
-      throw new ImpersonationRequiredError();
+      throw new ImpersonationRequiredError(body.platformUrl);
     }
   }
 
@@ -134,7 +143,10 @@ export function useAuth() {
       session,
       getToken: () =>
         getFreshToken().catch((error) => {
-          if (error instanceof ImpersonationRequiredError) throw error;
+          if (error instanceof ImpersonationRequiredError) {
+            sendToPicker(error);
+            throw error;
+          }
           console.error(error);
           const onAuthPage = window.location.pathname.startsWith("/auth/");
           if (onAuthPage) return;

package/src/impersonation/claims.ts

@@ -0,0 +1,16 @@
+export interface TokenClaims {
+  biz?: string;
+  email?: string;
+  act?: string;
+}
+
+export function tokenClaims(accessToken: string): TokenClaims {
+  try {
+    const payload = accessToken.split(".")[1] ?? "";
+    return JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8")
+    ) as TokenClaims;
+  } catch {
+    return {};
+  }
+}

package/src/impersonation/context.tsx

@@ -12,7 +12,6 @@ import {
 import { IMP_ACTIVE_COOKIE, type ImpersonationActive } from "./cookies";
 import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
-import { RequiredImpersonationGate } from "./RequiredImpersonationGate";
 
 interface ImpersonationContextValue {
   active: ImpersonationActive | null;
@@ -77,7 +76,6 @@ function readActiveCookie(): ImpersonationActive | null {
 
 export function ImpersonationProvider({ children }: { children: ReactNode }) {
   const [active, setActive] = useState<ImpersonationActive | null>(null);
-  const [cookieRead, setCookieRead] = useState(false);
   const [starting, setStarting] = useState(false);
   const [exiting, setExiting] = useState(false);
 
@@ -85,7 +83,6 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   useEffect(() => {
     rereadCookie();
-    setCookieRead(true);
   }, [rereadCookie]);
 
   useSessionRenewal(active, rereadCookie);
@@ -159,12 +156,7 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   return (
     <ImpersonationContext.Provider value={value}>
-      <RequiredImpersonationGate
-        sessionActive={!!active}
-        cookieRead={cookieRead}
-      >
-        {children}
-      </RequiredImpersonationGate>
+      {children}
     </ImpersonationContext.Provider>
   );
 }

package/src/impersonation/handlers.ts

@@ -7,7 +7,12 @@ import {
 } from "./cookies";
 import { sealImpersonationTicket, openImpersonationTicket } from "./ticket";
 import { requestOrigin, resolveCookieDomain } from "../session";
-import { platformBase, platformErrorResponse, requestHost } from "./request";
+import {
+  platformCall,
+  platformClient,
+  platformNotConfigured,
+  requestHost,
+} from "./request";
 
 function registrable(host: string): string {
   return host.split(":")[0].toLowerCase().split(".").slice(-2).join(".");
@@ -64,17 +69,12 @@ function handsOffToTarget(request: Request, target: string): boolean {
  */
 export function createImpersonationStartHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
-    const base = platformBase();
-    if (!base) {
-      return new Response(
-        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
-        { status: 500 }
-      );
-    }
-
     const caller = await resolveAccessToken(authConfig, request);
     if ("error" in caller) return caller.error;
 
+    const client = platformClient(caller.accessToken);
+    if (!client) return platformNotConfigured();
+
     let body: {
       targetEmail?: string;
       targetName?: string;
@@ -91,23 +91,26 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
       return new Response("Invalid request body", { status: 400 });
     }
 
-    const minted = await fetch(`${base}/v1.0/protected/impersonate`, {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${caller.accessToken}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({
-        targetEmail: body.targetEmail,
-        targetName: body.targetName,
-        reason: body.reason,
-      }),
-    });
-
-    if (!minted.ok) return platformErrorResponse(minted);
-
-    const result = await minted.json();
-    result.targetImage = body.targetImage ?? null;
+    const minted = await platformCall(
+      client.startImpersonation({
+        startImpersonationRequest: {
+          targetEmail: body.targetEmail,
+          targetName: body.targetName,
+          reason: body.reason,
+        },
+      })
+    );
+    if ("error" in minted) return minted.error;
+
+    const result = {
+      accessToken: minted.value.accessToken ?? "",
+      expiresOn: minted.value.expiresOn ?? 0,
+      tokenId: minted.value.tokenId ?? "",
+      targetEmail: minted.value.targetEmail ?? body.targetEmail ?? "",
+      targetName: minted.value.targetName,
+      targetImage: body.targetImage ?? null,
+      finance: minted.value.finance ?? false,
+    };
     const summary = {
       targetEmail: result.targetEmail,
       targetName: result.targetName,
@@ -200,19 +203,14 @@ export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
 export function createImpersonationEndHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
     const session = readImpersonationSession(request);
-    const base = platformBase();
 
-    if (session?.tokenId && base) {
+    if (session?.tokenId) {
       const caller = await resolveAccessToken(authConfig, request);
-      if (!("error" in caller)) {
-        await fetch(
-          `${base}/v1.0/protected/impersonate/${encodeURIComponent(session.tokenId)}/end`,
-          {
-            method: "POST",
-            headers: { Authorization: `Bearer ${caller.accessToken}` },
-          }
-        ).catch(() => undefined);
-      }
+      const client =
+        "error" in caller ? null : platformClient(caller.accessToken);
+      await client
+        ?.endImpersonation({ tokenId: session.tokenId })
+        .catch(() => undefined);
     }
 
     const out = Response.json({ ok: true });

package/src/impersonation/personas.ts

@@ -1,18 +1,25 @@
+import type { ProtectedEmployee } from "@snokam/platform-client";
 import { Auth } from "../types";
 import { resolveAccessToken } from "../route-handler/token";
-import { platformBase, platformErrorResponse } from "./request";
+import { tokenClaims } from "./claims";
+import { platformCall, platformClient, platformNotConfigured } from "./request";
 import { impersonationRequired } from "./required";
 
-function businessOf(accessToken: string): string | null {
-  try {
-    const payload = accessToken.split(".")[1] ?? "";
-    const claims = JSON.parse(
-      Buffer.from(payload, "base64url").toString("utf8")
-    ) as { biz?: string };
-    return claims.biz ?? null;
-  } catch {
-    return null;
-  }
+function persona(employee: ProtectedEmployee) {
+  return {
+    name: employee.name,
+    email: employee.email,
+    position: employee.position,
+    about: employee.about,
+    active: employee.active,
+    isBot: employee.isBot,
+    image: { asset: { url: employee.image?.asset?.url } },
+    scopeGrants: employee.scopeGrants,
+    groups: (employee.groups ?? []).map((group) => ({
+      name: group.name,
+      scopeGrants: group.scopeGrants,
+    })),
+  };
 }
 
 export function createImpersonationPersonasHandler(authConfig: Auth.Config) {
@@ -21,32 +28,29 @@ export function createImpersonationPersonasHandler(authConfig: Auth.Config) {
       return new Response("Not found", { status: 404 });
     }
 
-    const base = platformBase();
-    if (!base) {
-      return new Response(
-        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
-        { status: 500 }
-      );
-    }
-
     const caller = await resolveAccessToken(authConfig, request);
     if ("error" in caller) return caller.error;
 
-    const businessId = businessOf(caller.accessToken);
+    const client = platformClient(caller.accessToken);
+    if (!client) return platformNotConfigured();
+
+    const businessId = tokenClaims(caller.accessToken).biz;
     if (!businessId) {
       return new Response("The signed-in account has no business", {
         status: 409,
       });
     }
 
-    const employees = await fetch(
-      `${base}/v1.0/protected/businesses/${encodeURIComponent(businessId)}/employees`,
-      { headers: { Authorization: `Bearer ${caller.accessToken}` } }
-    );
-    if (!employees.ok) return platformErrorResponse(employees);
+    const [employees, apps] = await Promise.all([
+      platformCall(client.listBusinessEmployees({ id: businessId })),
+      platformCall(client.getMeApps()),
+    ]);
+    if ("error" in employees) return employees.error;
+    if ("error" in apps) return apps.error;
 
-    return new Response(await employees.text(), {
-      headers: { "Content-Type": "application/json" },
+    return Response.json({
+      personas: employees.value.map(persona),
+      apps: apps.value,
     });
   };
 }

package/src/impersonation/renew.ts

@@ -1,8 +1,3 @@
-import {
-  Configuration,
-  PlatformClient,
-  ResponseError,
-} from "@snokam/platform-client";
 import { Auth } from "../types";
 import { resolveAccessToken } from "../route-handler/token";
 import {
@@ -10,7 +5,12 @@ import {
   readImpersonationActive,
   readImpersonationSession,
 } from "./cookies";
-import { platformBase, platformErrorResponse, requestHost } from "./request";
+import {
+  platformCall,
+  platformClient,
+  platformNotConfigured,
+  requestHost,
+} from "./request";
 
 export function createImpersonationRenewHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
@@ -20,56 +20,36 @@ export function createImpersonationRenewHandler(authConfig: Auth.Config) {
       return new Response("No impersonation session", { status: 404 });
     }
 
-    const basePath = platformBase();
-    if (!basePath) {
-      return new Response(
-        "NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured",
-        {
-          status: 500,
-        }
-      );
-    }
-
     const caller = await resolveAccessToken(authConfig, request);
     if ("error" in caller) return caller.error;
 
-    const client = new PlatformClient(
-      new Configuration({
-        basePath,
-        accessToken: async () => caller.accessToken,
-      })
+    const client = platformClient(caller.accessToken);
+    if (!client) return platformNotConfigured();
+
+    const renewal = await platformCall(
+      client.renewImpersonation({ tokenId: session.tokenId })
     );
+    if ("error" in renewal) return renewal.error;
 
-    try {
-      const renewed = await client.renewImpersonation({
-        tokenId: session.tokenId,
-      });
-      if (!renewed.accessToken || !renewed.expiresOn) {
-        return new Response("Incomplete impersonation renewal", {
-          status: 502,
-        });
-      }
+    const renewed = renewal.value;
+    if (!renewed.accessToken || !renewed.expiresOn) {
+      return new Response("Incomplete impersonation renewal", { status: 502 });
+    }
 
-      const out = Response.json({
-        tokenId: session.tokenId,
+    const out = Response.json({
+      tokenId: session.tokenId,
+      expiresOn: renewed.expiresOn,
+    });
+    const cookies = buildImpersonationCookies(
+      {
+        ...active,
+        accessToken: renewed.accessToken,
         expiresOn: renewed.expiresOn,
-      });
-      const cookies = buildImpersonationCookies(
-        {
-          ...active,
-          accessToken: renewed.accessToken,
-          expiresOn: renewed.expiresOn,
-          finance: renewed.finance ?? false,
-        },
-        requestHost(request)
-      );
-      for (const cookie of cookies) out.headers.append("Set-Cookie", cookie);
-      return out;
-    } catch (error) {
-      if (error instanceof ResponseError) {
-        return platformErrorResponse(error.response);
-      }
-      throw error;
-    }
+        finance: renewed.finance ?? false,
+      },
+      requestHost(request)
+    );
+    for (const cookie of cookies) out.headers.append("Set-Cookie", cookie);
+    return out;
   };
 }

package/src/impersonation/request.ts

@@ -1,9 +1,32 @@
+import {
+  Configuration,
+  PlatformClient,
+  ResponseError,
+} from "@snokam/platform-client";
+
 export function platformBase(): string | null {
   return (
     process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL?.replace(/\/$/, "") ?? null
   );
 }
 
+export function platformClient(accessToken: string): PlatformClient | null {
+  const basePath = platformBase();
+  if (!basePath) return null;
+  return new PlatformClient(
+    new Configuration({
+      basePath,
+      accessToken: async () => `Bearer ${accessToken}`,
+    })
+  );
+}
+
+export function platformNotConfigured(): Response {
+  return new Response("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured", {
+    status: 500,
+  });
+}
+
 export function requestHost(request: Request): string | null {
   return request.headers.get("x-forwarded-host") ?? request.headers.get("host");
 }
@@ -24,3 +47,18 @@ export async function platformErrorResponse(
     status: response.status,
   });
 }
+
+export type PlatformResult<T> = { value: T } | { error: Response };
+
+export async function platformCall<T>(
+  call: Promise<T>
+): Promise<PlatformResult<T>> {
+  try {
+    return { value: await call };
+  } catch (error) {
+    if (error instanceof ResponseError) {
+      return { error: await platformErrorResponse(error.response) };
+    }
+    throw error;
+  }
+}

package/src/impersonation/required.test.ts

@@ -3,20 +3,10 @@ import { describe, it } from "node:test";
 import {
   impersonationPickerUrl,
   impersonationRequired,
-  isExemptRoute,
   renewDelayMs,
-  sendsToPicker,
-  withholdsApp,
 } from "./required.ts";
 
-const signedInAlone = {
-  authenticated: true,
-  sessionActive: false,
-  cookieRead: true,
-  exemptRoute: false,
-};
-
-describe("impersonation required gate", () => {
+describe("impersonation required", () => {
   it("is off in production and everywhere that is not the test environment", () => {
     for (const environment of ["p", "test", "production", "", undefined]) {
       assert.equal(impersonationRequired(environment), false);
@@ -27,58 +17,21 @@ describe("impersonation required gate", () => {
     assert.equal(impersonationRequired("t"), true);
   });
 
-  it("never withholds the app or redirects when not required", () => {
-    const state = { required: false, ...signedInAlone };
-    assert.equal(withholdsApp(state), false);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("sends a signed-in person without a session to the picker when required", () => {
-    const state = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp(state), true);
-    assert.equal(sendsToPicker(state), true);
-  });
-
-  it("lets the app render once someone is being viewed as", () => {
-    const state = { required: true, ...signedInAlone, sessionActive: true };
-    assert.equal(withholdsApp(state), false);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("holds the app without redirecting until the session cookie is read", () => {
-    const state = { required: true, ...signedInAlone, cookieRead: false };
-    assert.equal(withholdsApp(state), true);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("leaves sign-in routes, the picker and anonymous visitors alone", () => {
-    const base = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp({ ...base, exemptRoute: true }), false);
-    assert.equal(withholdsApp({ ...base, authenticated: false }), false);
-  });
-
   it("points the picker back at the page the person asked for", () => {
     const url = new URL(
       impersonationPickerUrl(
         "https://www.test.snosky.no",
-        "https://snokam.test.snosky.no/minside/okonomi?x=1"
+        "https://minside.test.snokam.no/okonomi?x=1"
       )
     );
+    assert.equal(url.origin, "https://www.test.snosky.no");
     assert.equal(url.pathname, "/velg-bruker");
     assert.equal(
       url.searchParams.get("returnTo"),
-      "https://snokam.test.snosky.no/minside/okonomi?x=1"
+      "https://minside.test.snokam.no/okonomi?x=1"
     );
   });
 
-  it("exempts sign-in routes and the picker, and nothing else", () => {
-    assert.equal(isExemptRoute("/auth/login"), true);
-    assert.equal(isExemptRoute("/velg-bruker"), true);
-    assert.equal(isExemptRoute("/manage"), false);
-    assert.equal(isExemptRoute("/"), false);
-    assert.equal(isExemptRoute(null), false);
-  });
-
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -12,35 +12,6 @@ export function impersonationRequired(
   return environment === TEST_ENVIRONMENT;
 }
 
-export interface ImpersonationGateState {
-  required: boolean;
-  authenticated: boolean;
-  sessionActive: boolean;
-  cookieRead: boolean;
-  exemptRoute: boolean;
-}
-
-function gated({
-  required,
-  authenticated,
-  exemptRoute,
-}: ImpersonationGateState) {
-  return required && authenticated && !exemptRoute;
-}
-
-export function isExemptRoute(pathname: string | null): boolean {
-  if (!pathname) return false;
-  return pathname.startsWith("/auth") || pathname === IMPERSONATION_PICKER_PATH;
-}
-
-export function withholdsApp(state: ImpersonationGateState): boolean {
-  return gated(state) && (!state.cookieRead || !state.sessionActive);
-}
-
-export function sendsToPicker(state: ImpersonationGateState): boolean {
-  return gated(state) && state.cookieRead && !state.sessionActive;
-}
-
 export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string

package/src/middleware.tsx

@@ -6,6 +6,15 @@ import { Auth } from "./types";
 import { getSessionCookieSettings, getAuthUrl } from "./session";
 import { addCorsHeaders } from "./cors";
 
+const TEST_ENVIRONMENT = "t";
+
+const LOGIN_FLOW_PATHS = [
+  "/auth/",
+  "/handoff/",
+  "/api/password/",
+  "/api/impersonation/adopt",
+];
+
 export function buildAuthMiddleware({
   matcher = [],
   callbacks = {},
@@ -13,7 +22,9 @@ export function buildAuthMiddleware({
   cors = {},
   ...rest
 }: Auth.Middleware.Props = {}): Auth.Middleware.Builder {
-  const requireLogin = process.env.IS_PR === "true";
+  const requireLogin =
+    process.env.IS_PR === "true" ||
+    process.env.ENVIRONMENT === TEST_ENVIRONMENT;
   const { name } = getSessionCookieSettings(getAuthUrl());
 
   const shouldProtectPath = (pathname: string): boolean => {
@@ -25,7 +36,7 @@ export function buildAuthMiddleware({
       return false;
     }
 
-    if (pathname.startsWith("/auth/")) {
+    if (LOGIN_FLOW_PATHS.some((path) => pathname.startsWith(path))) {
       return false;
     }
 

package/src/route-handler/token.ts

@@ -116,7 +116,10 @@ export function createTokenHandler(authConfig: Auth.Config) {
 
     if (impersonationRequired(authConfig.environment)) {
       return Response.json(
-        { error: IMPERSONATION_REQUIRED_ERROR },
+        {
+          error: IMPERSONATION_REQUIRED_ERROR,
+          platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
+        },
         { status: 403 }
       );
     }

package/src/impersonation/RequiredImpersonationGate.tsx

@@ -1,51 +0,0 @@
-"use client";
-
-import { useEffect, type ReactNode } from "react";
-import { usePathname } from "next/navigation";
-import { PageLoader } from "@snokam/ui";
-import { useOptionalConfig } from "@snokam/tenant";
-import { useSession } from "../session/useSession";
-import {
-  impersonationPickerUrl,
-  impersonationRequired,
-  isExemptRoute,
-  sendsToPicker,
-  withholdsApp,
-} from "./required";
-
-interface Props {
-  sessionActive: boolean;
-  cookieRead: boolean;
-  children: ReactNode;
-}
-
-export function RequiredImpersonationGate({
-  sessionActive,
-  cookieRead,
-  children,
-}: Props) {
-  const config = useOptionalConfig();
-  const { status, data: session } = useSession();
-  const pathname = usePathname();
-  const platformUrl = config?.NEXT_PUBLIC_PLATFORM_BASE_URL;
-
-  const state = {
-    required: impersonationRequired(config?.NEXT_PUBLIC_ENVIRONMENT),
-    authenticated:
-      status === "authenticated" || (status === "loading" && !!session),
-    sessionActive,
-    cookieRead,
-    exemptRoute: isExemptRoute(pathname),
-  };
-  const redirect = sendsToPicker(state);
-
-  useEffect(() => {
-    if (!redirect || !platformUrl) return;
-    window.location.assign(
-      impersonationPickerUrl(platformUrl, window.location.href)
-    );
-  }, [redirect, platformUrl]);
-
-  if (withholdsApp(state)) return <PageLoader />;
-  return <>{children}</>;
-}