@snokam/auth 3.6.0 → 3.7.0

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.7.0](https://github.com/snokam/components/compare/@snokam/auth@3.6.0...@snokam/auth@3.7.0) (2026-10-06)
+
+### Features
+
+- **test:** every test page needs a login; pick a persona only when a page needs one ([#2705](https://github.com/snokam/components/issues/2705)) ([e086fb6](https://github.com/snokam/components/commit/e086fb63511e0f3f4f2002d0189e089c8cda6d30))
+
 # [3.6.0](https://github.com/snokam/components/compare/@snokam/auth@3.5.0...@snokam/auth@3.6.0) (2026-10-06)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [

package/src/hooks.ts

@@ -3,11 +3,25 @@ import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useSession } from "./session/useSession";
-import { IMPERSONATION_REQUIRED_ERROR } from "./impersonation/required";
+import {
+  IMPERSONATION_REQUIRED_ERROR,
+  impersonationPickerUrl,
+} from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
 
-class ImpersonationRequiredError extends Error {}
+class ImpersonationRequiredError extends Error {
+  constructor(readonly platformUrl: string | undefined) {
+    super(IMPERSONATION_REQUIRED_ERROR);
+  }
+}
+
+function sendToPicker(error: ImpersonationRequiredError): void {
+  if (!error.platformUrl) return;
+  window.location.assign(
+    impersonationPickerUrl(error.platformUrl, window.location.href)
+  );
+}
 
 const REFRESH_MARGIN_SECONDS = 60;
 
@@ -20,11 +34,6 @@ interface CachedToken {
 let cachedToken: CachedToken | null = null;
 let inFlight: { impKey: string; promise: Promise<string> } | null = null;
 
-/**
- * Identifies which principal the next token belongs to: the active impersonation
- * tokenId, or "" for the admin's own token. Changing this (Vis som start/exit)
- * invalidates the cache so the swap in the token route is never served stale.
- */
 function readImpersonationKey(): string {
   if (typeof document === "undefined") return "";
   const match = document.cookie
@@ -66,7 +75,7 @@ async function fetchToken(impKey: string): Promise<string> {
       throw new ConsentRequiredError();
     }
     if (body?.error === IMPERSONATION_REQUIRED_ERROR) {
-      throw new ImpersonationRequiredError();
+      throw new ImpersonationRequiredError(body.platformUrl);
     }
   }
 
@@ -134,7 +143,10 @@ export function useAuth() {
       session,
       getToken: () =>
         getFreshToken().catch((error) => {
-          if (error instanceof ImpersonationRequiredError) throw error;
+          if (error instanceof ImpersonationRequiredError) {
+            sendToPicker(error);
+            throw error;
+          }
           console.error(error);
           const onAuthPage = window.location.pathname.startsWith("/auth/");
           if (onAuthPage) return;

package/src/impersonation/context.tsx

@@ -12,7 +12,6 @@ import {
 import { IMP_ACTIVE_COOKIE, type ImpersonationActive } from "./cookies";
 import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
-import { RequiredImpersonationGate } from "./RequiredImpersonationGate";
 
 interface ImpersonationContextValue {
   active: ImpersonationActive | null;
@@ -77,7 +76,6 @@ function readActiveCookie(): ImpersonationActive | null {
 
 export function ImpersonationProvider({ children }: { children: ReactNode }) {
   const [active, setActive] = useState<ImpersonationActive | null>(null);
-  const [cookieRead, setCookieRead] = useState(false);
   const [starting, setStarting] = useState(false);
   const [exiting, setExiting] = useState(false);
 
@@ -85,7 +83,6 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   useEffect(() => {
     rereadCookie();
-    setCookieRead(true);
   }, [rereadCookie]);
 
   useSessionRenewal(active, rereadCookie);
@@ -159,12 +156,7 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   return (
     <ImpersonationContext.Provider value={value}>
-      <RequiredImpersonationGate
-        sessionActive={!!active}
-        cookieRead={cookieRead}
-      >
-        {children}
-      </RequiredImpersonationGate>
+      {children}
     </ImpersonationContext.Provider>
   );
 }

package/src/impersonation/required.test.ts

@@ -3,20 +3,10 @@ import { describe, it } from "node:test";
 import {
   impersonationPickerUrl,
   impersonationRequired,
-  isExemptRoute,
   renewDelayMs,
-  sendsToPicker,
-  withholdsApp,
 } from "./required.ts";
 
-const signedInAlone = {
-  authenticated: true,
-  sessionActive: false,
-  cookieRead: true,
-  exemptRoute: false,
-};
-
-describe("impersonation required gate", () => {
+describe("impersonation required", () => {
   it("is off in production and everywhere that is not the test environment", () => {
     for (const environment of ["p", "test", "production", "", undefined]) {
       assert.equal(impersonationRequired(environment), false);
@@ -27,58 +17,21 @@ describe("impersonation required gate", () => {
     assert.equal(impersonationRequired("t"), true);
   });
 
-  it("never withholds the app or redirects when not required", () => {
-    const state = { required: false, ...signedInAlone };
-    assert.equal(withholdsApp(state), false);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("sends a signed-in person without a session to the picker when required", () => {
-    const state = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp(state), true);
-    assert.equal(sendsToPicker(state), true);
-  });
-
-  it("lets the app render once someone is being viewed as", () => {
-    const state = { required: true, ...signedInAlone, sessionActive: true };
-    assert.equal(withholdsApp(state), false);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("holds the app without redirecting until the session cookie is read", () => {
-    const state = { required: true, ...signedInAlone, cookieRead: false };
-    assert.equal(withholdsApp(state), true);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("leaves sign-in routes, the picker and anonymous visitors alone", () => {
-    const base = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp({ ...base, exemptRoute: true }), false);
-    assert.equal(withholdsApp({ ...base, authenticated: false }), false);
-  });
-
   it("points the picker back at the page the person asked for", () => {
     const url = new URL(
       impersonationPickerUrl(
         "https://www.test.snosky.no",
-        "https://snokam.test.snosky.no/minside/okonomi?x=1"
+        "https://minside.test.snokam.no/okonomi?x=1"
       )
     );
+    assert.equal(url.origin, "https://www.test.snosky.no");
     assert.equal(url.pathname, "/velg-bruker");
     assert.equal(
       url.searchParams.get("returnTo"),
-      "https://snokam.test.snosky.no/minside/okonomi?x=1"
+      "https://minside.test.snokam.no/okonomi?x=1"
     );
   });
 
-  it("exempts sign-in routes and the picker, and nothing else", () => {
-    assert.equal(isExemptRoute("/auth/login"), true);
-    assert.equal(isExemptRoute("/velg-bruker"), true);
-    assert.equal(isExemptRoute("/manage"), false);
-    assert.equal(isExemptRoute("/"), false);
-    assert.equal(isExemptRoute(null), false);
-  });
-
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -12,35 +12,6 @@ export function impersonationRequired(
   return environment === TEST_ENVIRONMENT;
 }
 
-export interface ImpersonationGateState {
-  required: boolean;
-  authenticated: boolean;
-  sessionActive: boolean;
-  cookieRead: boolean;
-  exemptRoute: boolean;
-}
-
-function gated({
-  required,
-  authenticated,
-  exemptRoute,
-}: ImpersonationGateState) {
-  return required && authenticated && !exemptRoute;
-}
-
-export function isExemptRoute(pathname: string | null): boolean {
-  if (!pathname) return false;
-  return pathname.startsWith("/auth") || pathname === IMPERSONATION_PICKER_PATH;
-}
-
-export function withholdsApp(state: ImpersonationGateState): boolean {
-  return gated(state) && (!state.cookieRead || !state.sessionActive);
-}
-
-export function sendsToPicker(state: ImpersonationGateState): boolean {
-  return gated(state) && state.cookieRead && !state.sessionActive;
-}
-
 export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string

package/src/middleware.tsx

@@ -6,6 +6,15 @@ import { Auth } from "./types";
 import { getSessionCookieSettings, getAuthUrl } from "./session";
 import { addCorsHeaders } from "./cors";
 
+const TEST_ENVIRONMENT = "t";
+
+const LOGIN_FLOW_PATHS = [
+  "/auth/",
+  "/handoff/",
+  "/api/password/",
+  "/api/impersonation/adopt",
+];
+
 export function buildAuthMiddleware({
   matcher = [],
   callbacks = {},
@@ -13,7 +22,9 @@ export function buildAuthMiddleware({
   cors = {},
   ...rest
 }: Auth.Middleware.Props = {}): Auth.Middleware.Builder {
-  const requireLogin = process.env.IS_PR === "true";
+  const requireLogin =
+    process.env.IS_PR === "true" ||
+    process.env.ENVIRONMENT === TEST_ENVIRONMENT;
   const { name } = getSessionCookieSettings(getAuthUrl());
 
   const shouldProtectPath = (pathname: string): boolean => {
@@ -25,7 +36,7 @@ export function buildAuthMiddleware({
       return false;
     }
 
-    if (pathname.startsWith("/auth/")) {
+    if (LOGIN_FLOW_PATHS.some((path) => pathname.startsWith(path))) {
       return false;
     }
 

package/src/route-handler/token.ts

@@ -116,7 +116,10 @@ export function createTokenHandler(authConfig: Auth.Config) {
 
     if (impersonationRequired(authConfig.environment)) {
       return Response.json(
-        { error: IMPERSONATION_REQUIRED_ERROR },
+        {
+          error: IMPERSONATION_REQUIRED_ERROR,
+          platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
+        },
         { status: 403 }
       );
     }

package/src/impersonation/RequiredImpersonationGate.tsx

@@ -1,51 +0,0 @@
-"use client";
-
-import { useEffect, type ReactNode } from "react";
-import { usePathname } from "next/navigation";
-import { PageLoader } from "@snokam/ui";
-import { useOptionalConfig } from "@snokam/tenant";
-import { useSession } from "../session/useSession";
-import {
-  impersonationPickerUrl,
-  impersonationRequired,
-  isExemptRoute,
-  sendsToPicker,
-  withholdsApp,
-} from "./required";
-
-interface Props {
-  sessionActive: boolean;
-  cookieRead: boolean;
-  children: ReactNode;
-}
-
-export function RequiredImpersonationGate({
-  sessionActive,
-  cookieRead,
-  children,
-}: Props) {
-  const config = useOptionalConfig();
-  const { status, data: session } = useSession();
-  const pathname = usePathname();
-  const platformUrl = config?.NEXT_PUBLIC_PLATFORM_BASE_URL;
-
-  const state = {
-    required: impersonationRequired(config?.NEXT_PUBLIC_ENVIRONMENT),
-    authenticated:
-      status === "authenticated" || (status === "loading" && !!session),
-    sessionActive,
-    cookieRead,
-    exemptRoute: isExemptRoute(pathname),
-  };
-  const redirect = sendsToPicker(state);
-
-  useEffect(() => {
-    if (!redirect || !platformUrl) return;
-    window.location.assign(
-      impersonationPickerUrl(platformUrl, window.location.href)
-    );
-  }, [redirect, platformUrl]);
-
-  if (withholdsApp(state)) return <PageLoader />;
-  return <>{children}</>;
-}