@snokam/auth 3.6.0 → 3.7.1

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.7.1](https://github.com/snokam/components/compare/@snokam/auth@3.7.0...@snokam/auth@3.7.1) (2026-10-06)
+
+**Note:** Version bump only for package @snokam/auth
+
+# [3.7.0](https://github.com/snokam/components/compare/@snokam/auth@3.6.0...@snokam/auth@3.7.0) (2026-10-06)
+
+### Features
+
+- **test:** every test page needs a login; pick a persona only when a page needs one ([#2705](https://github.com/snokam/components/issues/2705)) ([e086fb6](https://github.com/snokam/components/commit/e086fb63511e0f3f4f2002d0189e089c8cda6d30))
+
 # [3.6.0](https://github.com/snokam/components/compare/@snokam/auth@3.5.0...@snokam/auth@3.6.0) (2026-10-06)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.6.0",
+  "version": "3.7.1",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [

package/src/app-router/index.tsx

@@ -34,6 +34,7 @@ export {
 } from "../impersonation/context";
 export type { ImpersonationActive } from "../impersonation/cookies";
 export { impersonationRequired } from "../impersonation/required";
+export { isAllowedRedirect } from "../impersonation/redirects";
 export { signIn, SessionProvider } from "next-auth/react";
 export {
   Login,

package/src/app-sign-in/handlers.ts

@@ -79,13 +79,13 @@ async function ownSigner(
   return "error" in access ? null : { email, accessToken: access.accessToken };
 }
 
-function signerFor(
+async function signerFor(
   authConfig: Auth.Config,
   request: Request,
   email: string
 ): Promise<Signer | null> {
   if (impersonationRequired(authConfig.environment)) {
-    return Promise.resolve(personaSigner(request, email));
+    return personaSigner(request, email);
   }
   return ownSigner(authConfig, request, email);
 }

package/src/app-sign-in/platform.ts

@@ -1,36 +1,24 @@
 import { getManagedBearer } from "@snokam/identity";
 import {
-  Configuration,
   PlatformClient,
   ResponseError,
   type AuthorizationPreview,
   type IssuedAuthorizationCode,
 } from "@snokam/platform-client";
+import { platformClientFor } from "../impersonation/request";
 import type { AuthorizationParams } from "./consent";
 
 type Outcome<T> = { value: T } | { error: string };
 
 const UNAVAILABLE = "temporarily_unavailable";
 
-function apiBase(): string {
-  return (process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "").replace(
-    /\/+$/,
-    ""
-  );
-}
-
 async function asLoginSite<T>(
   call: (client: PlatformClient) => Promise<T>
 ): Promise<Outcome<T>> {
   const loginSite = await getManagedBearer();
-  if (!loginSite) return { error: UNAVAILABLE };
+  const client = loginSite ? platformClientFor(loginSite) : null;
+  if (!client) return { error: UNAVAILABLE };
 
-  const client = new PlatformClient(
-    new Configuration({
-      basePath: apiBase(),
-      accessToken: async () => loginSite,
-    })
-  );
   try {
     return { value: await call(client) };
   } catch (error) {

package/src/hooks.ts

@@ -3,11 +3,25 @@ import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useSession } from "./session/useSession";
-import { IMPERSONATION_REQUIRED_ERROR } from "./impersonation/required";
+import {
+  IMPERSONATION_REQUIRED_ERROR,
+  impersonationPickerUrl,
+} from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
 
-class ImpersonationRequiredError extends Error {}
+class ImpersonationRequiredError extends Error {
+  constructor(readonly platformUrl: string | undefined) {
+    super(IMPERSONATION_REQUIRED_ERROR);
+  }
+}
+
+function sendToPicker(error: ImpersonationRequiredError): void {
+  if (!error.platformUrl) return;
+  window.location.assign(
+    impersonationPickerUrl(error.platformUrl, window.location.href)
+  );
+}
 
 const REFRESH_MARGIN_SECONDS = 60;
 
@@ -20,11 +34,6 @@ interface CachedToken {
 let cachedToken: CachedToken | null = null;
 let inFlight: { impKey: string; promise: Promise<string> } | null = null;
 
-/**
- * Identifies which principal the next token belongs to: the active impersonation
- * tokenId, or "" for the admin's own token. Changing this (Vis som start/exit)
- * invalidates the cache so the swap in the token route is never served stale.
- */
 function readImpersonationKey(): string {
   if (typeof document === "undefined") return "";
   const match = document.cookie
@@ -66,7 +75,7 @@ async function fetchToken(impKey: string): Promise<string> {
       throw new ConsentRequiredError();
     }
     if (body?.error === IMPERSONATION_REQUIRED_ERROR) {
-      throw new ImpersonationRequiredError();
+      throw new ImpersonationRequiredError(body.platformUrl);
     }
   }
 
@@ -134,7 +143,10 @@ export function useAuth() {
       session,
       getToken: () =>
         getFreshToken().catch((error) => {
-          if (error instanceof ImpersonationRequiredError) throw error;
+          if (error instanceof ImpersonationRequiredError) {
+            sendToPicker(error);
+            throw error;
+          }
           console.error(error);
           const onAuthPage = window.location.pathname.startsWith("/auth/");
           if (onAuthPage) return;

package/src/impersonation/context.tsx

@@ -12,22 +12,25 @@ import {
 import { IMP_ACTIVE_COOKIE, type ImpersonationActive } from "./cookies";
 import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
-import { RequiredImpersonationGate } from "./RequiredImpersonationGate";
+import { isAllowedRedirect, platformBaseDomain } from "./redirects";
+
+export interface StartImpersonationInput {
+  targetEmail: string;
+  targetName?: string;
+  targetImage?: string;
+  reason: string;
+  redirectTo?: string;
+  returnTo?: string;
+  landingUrl?: string;
+}
 
 interface ImpersonationContextValue {
   active: ImpersonationActive | null;
   starting: boolean;
   exiting: boolean;
-  start: (input: {
-    targetEmail: string;
-    targetName?: string;
-    targetImage?: string;
-    reason: string;
-    redirectTo?: string;
-    returnTo?: string;
-    landingUrl?: string;
-    handOffOnly?: boolean;
-  }) => Promise<{ ok: boolean; error?: string }>;
+  start: (
+    input: StartImpersonationInput
+  ) => Promise<{ ok: boolean; error?: string }>;
   exit: () => Promise<void>;
 }
 
@@ -35,27 +38,12 @@ const ImpersonationContext = createContext<ImpersonationContextValue | null>(
   null
 );
 
-/** Registrable base domain of the platform (last two labels of the API host). */
-function platformBaseDomain(): string {
-  const api = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
-  if (!api) {
-    throw new Error("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured");
-  }
-  return new URL(api).hostname.split(".").slice(-2).join(".");
-}
-
-/** Guards the exit redirect against open-redirect: same-origin, or https on the platform base domain. */
 function isSafeReturnTo(returnTo: string): boolean {
   if (typeof window === "undefined") return false;
-  const base = platformBaseDomain();
-  try {
-    const url = new URL(returnTo, window.location.origin);
-    if (url.origin === window.location.origin) return true;
-    if (url.protocol !== "https:") return false;
-    return url.hostname === base || url.hostname.endsWith(`.${base}`);
-  } catch {
-    return false;
-  }
+  return isAllowedRedirect(returnTo, {
+    origin: window.location.origin,
+    platformDomain: platformBaseDomain(),
+  });
 }
 
 function readActiveCookie(): ImpersonationActive | null {
@@ -77,7 +65,6 @@ function readActiveCookie(): ImpersonationActive | null {
 
 export function ImpersonationProvider({ children }: { children: ReactNode }) {
   const [active, setActive] = useState<ImpersonationActive | null>(null);
-  const [cookieRead, setCookieRead] = useState(false);
   const [starting, setStarting] = useState(false);
   const [exiting, setExiting] = useState(false);
 
@@ -85,52 +72,39 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   useEffect(() => {
     rereadCookie();
-    setCookieRead(true);
   }, [rereadCookie]);
 
   useSessionRenewal(active, rereadCookie);
 
-  const start = useCallback(
-    async (input: {
-      targetEmail: string;
-      targetName?: string;
-      targetImage?: string;
-      reason: string;
-      redirectTo?: string;
-      returnTo?: string;
-      landingUrl?: string;
-      handOffOnly?: boolean;
-    }) => {
-      setStarting(true);
-      try {
-        const { redirectTo, landingUrl } = input;
-        const res = await fetch("/api/impersonation/start", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          credentials: "include",
-          body: JSON.stringify(input),
-        });
-        if (!res.ok) {
-          return {
-            ok: false,
-            error: (await res.text()) || `HTTP ${res.status}`,
-          };
-        }
-        clearAuthTokenCache();
-        const data = (await res.json().catch(() => ({}))) as {
-          adoptUrl?: string;
+  const start = useCallback(async (input: StartImpersonationInput) => {
+    setStarting(true);
+    try {
+      const { redirectTo, landingUrl } = input;
+      const res = await fetch("/api/impersonation/start", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        credentials: "include",
+        body: JSON.stringify(input),
+      });
+      if (!res.ok) {
+        return {
+          ok: false,
+          error: (await res.text()) || `HTTP ${res.status}`,
         };
-        if (data.adoptUrl) window.location.assign(data.adoptUrl);
-        else if (landingUrl) window.location.assign(landingUrl);
-        else if (redirectTo) window.location.assign(redirectTo);
-        else window.location.reload();
-        return { ok: true };
-      } finally {
-        setStarting(false);
       }
-    },
-    []
-  );
+      clearAuthTokenCache();
+      const data = (await res.json().catch(() => ({}))) as {
+        adoptUrl?: string;
+      };
+      if (data.adoptUrl) window.location.assign(data.adoptUrl);
+      else if (landingUrl) window.location.assign(landingUrl);
+      else if (redirectTo) window.location.assign(redirectTo);
+      else window.location.reload();
+      return { ok: true };
+    } finally {
+      setStarting(false);
+    }
+  }, []);
 
   const exit = useCallback(async () => {
     setExiting(true);
@@ -159,12 +133,7 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 
   return (
     <ImpersonationContext.Provider value={value}>
-      <RequiredImpersonationGate
-        sessionActive={!!active}
-        cookieRead={cookieRead}
-      >
-        {children}
-      </RequiredImpersonationGate>
+      {children}
     </ImpersonationContext.Provider>
   );
 }
@@ -172,7 +141,6 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
 export function useImpersonation(): ImpersonationContextValue {
   const context = useContext(ImpersonationContext);
   if (!context) {
-    // Safe no-op default so the shared banner can mount in apps that haven't wired the provider yet.
     return {
       active: null,
       starting: false,

package/src/impersonation/cookies.ts

@@ -1,8 +1,6 @@
 import { resolveCookieDomain } from "../session";
 
-/** HttpOnly — carries the impersonation bearer; only the token handler ever reads it. */
 export const IMP_SESSION_COOKIE = "imp_session";
-/** Readable — non-sensitive session facts that drive the banner + provider (no token). */
 export const IMP_ACTIVE_COOKIE = "imp_active";
 
 export interface ImpersonationSession {
@@ -89,7 +87,6 @@ function serialize(
   return parts.join("; ");
 }
 
-/** Set-Cookie values that open a session (server-side, on mint success). */
 export function buildImpersonationCookies(
   minted: MintedToken,
   host: string | null
@@ -123,7 +120,6 @@ export function buildImpersonationCookies(
   ];
 }
 
-/** Set-Cookie values that clear the session (exit or after posting the end record). */
 export function clearImpersonationCookies(host: string | null): string[] {
   return [
     serialize(IMP_SESSION_COOKIE, "", { host, httpOnly: true, maxAge: 0 }),

package/src/impersonation/handlers.ts

@@ -13,35 +13,35 @@ import {
   platformNotConfigured,
   requestHost,
 } from "./request";
+import { isAllowedRedirect, platformBaseDomain } from "./redirects";
+
+interface StartBody {
+  targetEmail?: string;
+  targetName?: string;
+  targetImage?: string;
+  reason?: string;
+  redirectTo?: string;
+  returnTo?: string;
+  landingUrl?: string;
+}
 
 function registrable(host: string): string {
   return host.split(":")[0].toLowerCase().split(".").slice(-2).join(".");
 }
 
-function platformBaseDomain(): string {
-  const api = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
-  if (!api) {
-    throw new Error("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured");
-  }
-  return new URL(api).hostname.split(".").slice(-2).join(".");
+function resolveLanding(returnTo: string, origin: string): string {
+  const allowed = isAllowedRedirect(returnTo, {
+    origin,
+    platformDomain: platformBaseDomain(),
+  });
+  return allowed
+    ? new URL(returnTo, origin).toString()
+    : new URL("/", origin).toString();
 }
 
-// The adopt sets the tenant-domain cookie, then hands back to a same-origin path OR the platform
-// hub (/manage on snosky.no) — anything else falls back to "/" so it can never open-redirect.
-function resolveLanding(returnTo: string, origin: string): string {
-  const base = platformBaseDomain();
-  try {
-    const url = new URL(returnTo, origin);
-    if (url.origin === origin) return url.toString();
-    if (
-      url.protocol === "https:" &&
-      (url.hostname === base || url.hostname.endsWith(`.${base}`))
-    )
-      return url.toString();
-  } catch {
-    // Fall through to the safe default.
-  }
-  return new URL("/", origin).toString();
+function withCookies(response: Response, cookies: string[]): Response {
+  for (const cookie of cookies) response.headers.append("Set-Cookie", cookie);
+  return response;
 }
 
 function cookieScope(host: string): string {
@@ -62,11 +62,6 @@ function handsOffToTarget(request: Request, target: string): boolean {
   }
 }
 
-/**
- * Starts a view-as-employee session: authenticates as the admin, calls the platform mint endpoint
- * (which enforces the platform.impersonate gate + required reason + audit server-side), and, on
- * success, sets the impersonation cookies so subsequent product calls ride the minted token.
- */
 export function createImpersonationStartHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
     const caller = await resolveAccessToken(authConfig, request);
@@ -75,16 +70,7 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
     const client = platformClient(caller.accessToken);
     if (!client) return platformNotConfigured();
 
-    let body: {
-      targetEmail?: string;
-      targetName?: string;
-      targetImage?: string;
-      reason?: string;
-      redirectTo?: string;
-      returnTo?: string;
-      landingUrl?: string;
-      handOffOnly?: boolean;
-    };
+    let body: StartBody;
     try {
       body = await request.json();
     } catch {
@@ -118,46 +104,33 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
       tokenId: result.tokenId,
       expiresOn: result.expiresOn,
     };
-
-    // Custom-domain tenant: hand the session to the tenant domain's adopt route (login's pattern).
-    if (body.redirectTo && handsOffToTarget(request, body.redirectTo)) {
-      const target = new URL(body.redirectTo);
-      const ticket = sealImpersonationTicket(
-        { ...result, business: target.host, returnTo: body.returnTo },
-        authConfig.nextAuthSecret
-      );
-      const adopt = new URL("/api/impersonation/adopt", target.origin);
-      adopt.searchParams.set("t", ticket);
-      adopt.searchParams.set(
-        "returnTo",
-        body.landingUrl ?? target.pathname + target.search
-      );
-      const crossDomain = Response.json({
-        ...summary,
-        adoptUrl: adopt.toString(),
-      });
-      if (body.handOffOnly) return crossDomain;
-      for (const cookie of buildImpersonationCookies(
-        { ...result, returnTo: body.returnTo },
-        requestHost(request)
-      )) {
-        crossDomain.headers.append("Set-Cookie", cookie);
-      }
-      return crossDomain;
-    }
-
-    const out = Response.json(summary);
-    for (const cookie of buildImpersonationCookies(
+    const cookies = buildImpersonationCookies(
       { ...result, returnTo: body.returnTo },
       requestHost(request)
-    )) {
-      out.headers.append("Set-Cookie", cookie);
+    );
+
+    if (!body.redirectTo || !handsOffToTarget(request, body.redirectTo)) {
+      return withCookies(Response.json(summary), cookies);
     }
-    return out;
+
+    const target = new URL(body.redirectTo);
+    const ticket = sealImpersonationTicket(
+      { ...result, business: target.host, returnTo: body.returnTo },
+      authConfig.nextAuthSecret
+    );
+    const adopt = new URL("/api/impersonation/adopt", target.origin);
+    adopt.searchParams.set("t", ticket);
+    adopt.searchParams.set(
+      "returnTo",
+      body.landingUrl ?? target.pathname + target.search
+    );
+    return withCookies(
+      Response.json({ ...summary, adoptUrl: adopt.toString() }),
+      cookies
+    );
   };
 }
 
-// Runs on the tenant domain: opens the sealed ticket and sets the impersonation cookie here.
 export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
   return async function GET(request: Request) {
     const url = new URL(request.url);
@@ -185,21 +158,13 @@ export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
       url.searchParams.get("returnTo") || "/",
       origin
     );
-    const out = new Response(null, {
-      status: 302,
-      headers: { Location: dest },
-    });
-    for (const cookie of buildImpersonationCookies(claims, host)) {
-      out.headers.append("Set-Cookie", cookie);
-    }
-    return out;
+    return withCookies(
+      new Response(null, { status: 302, headers: { Location: dest } }),
+      buildImpersonationCookies(claims, host)
+    );
   };
 }
 
-/**
- * Ends a session: writes the append-only session-end audit record (best effort) and clears the
- * cookies so the admin's own token is restored. Token expiry auto-ends too.
- */
 export function createImpersonationEndHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
     const session = readImpersonationSession(request);
@@ -213,10 +178,9 @@ export function createImpersonationEndHandler(authConfig: Auth.Config) {
         .catch(() => undefined);
     }
 
-    const out = Response.json({ ok: true });
-    for (const cookie of clearImpersonationCookies(requestHost(request))) {
-      out.headers.append("Set-Cookie", cookie);
-    }
-    return out;
+    return withCookies(
+      Response.json({ ok: true }),
+      clearImpersonationCookies(requestHost(request))
+    );
   };
 }

package/src/impersonation/redirects.test.ts

@@ -0,0 +1,47 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isAllowedRedirect } from "./redirects.ts";
+
+const rules = {
+  origin: "https://www.test.snosky.no",
+  platformDomain: "snosky.no",
+  extraOrigins: ["https://minside.test.snokam.no"],
+};
+
+describe("redirect allow-list", () => {
+  it("allows the same origin, relative or absolute", () => {
+    assert.equal(isAllowedRedirect("/manage", rules), true);
+    assert.equal(
+      isAllowedRedirect("https://www.test.snosky.no/x", rules),
+      true
+    );
+  });
+
+  it("allows https on the platform domain and its subdomains", () => {
+    assert.equal(isAllowedRedirect("https://snosky.no/", rules), true);
+    assert.equal(
+      isAllowedRedirect("https://snokam.test.snosky.no/minside", rules),
+      true
+    );
+  });
+
+  it("allows the extra origins it is given", () => {
+    assert.equal(
+      isAllowedRedirect("https://minside.test.snokam.no/okonomi", rules),
+      true
+    );
+  });
+
+  it("refuses everything else", () => {
+    assert.equal(isAllowedRedirect("https://evil.example/", rules), false);
+    assert.equal(
+      isAllowedRedirect("http://snokam.test.snosky.no/", rules),
+      false
+    );
+    assert.equal(
+      isAllowedRedirect("https://snosky.no.evil.example/", rules),
+      false
+    );
+    assert.equal(isAllowedRedirect("javascript:alert(1)", rules), false);
+  });
+});

package/src/impersonation/redirects.ts

@@ -0,0 +1,31 @@
+export function platformBaseDomain(): string {
+  const api = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
+  if (!api) {
+    throw new Error("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured");
+  }
+  return new URL(api).hostname.split(".").slice(-2).join(".");
+}
+
+interface RedirectRules {
+  origin: string;
+  platformDomain: string;
+  extraOrigins?: string[];
+}
+
+export function isAllowedRedirect(
+  target: string,
+  { origin, platformDomain, extraOrigins = [] }: RedirectRules
+): boolean {
+  try {
+    const url = new URL(target, origin);
+    if (url.origin === origin) return true;
+    if (url.protocol !== "https:") return false;
+    return (
+      url.hostname === platformDomain ||
+      url.hostname.endsWith(`.${platformDomain}`) ||
+      extraOrigins.includes(url.origin)
+    );
+  } catch {
+    return false;
+  }
+}

package/src/impersonation/request.ts

@@ -10,17 +10,20 @@ export function platformBase(): string | null {
   );
 }
 
-export function platformClient(accessToken: string): PlatformClient | null {
+export function platformClientFor(
+  authorization: string
+): PlatformClient | null {
   const basePath = platformBase();
   if (!basePath) return null;
   return new PlatformClient(
-    new Configuration({
-      basePath,
-      accessToken: async () => `Bearer ${accessToken}`,
-    })
+    new Configuration({ basePath, accessToken: async () => authorization })
   );
 }
 
+export function platformClient(accessToken: string): PlatformClient | null {
+  return platformClientFor(`Bearer ${accessToken}`);
+}
+
 export function platformNotConfigured(): Response {
   return new Response("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured", {
     status: 500,

package/src/impersonation/required.test.ts

@@ -3,20 +3,10 @@ import { describe, it } from "node:test";
 import {
   impersonationPickerUrl,
   impersonationRequired,
-  isExemptRoute,
   renewDelayMs,
-  sendsToPicker,
-  withholdsApp,
 } from "./required.ts";
 
-const signedInAlone = {
-  authenticated: true,
-  sessionActive: false,
-  cookieRead: true,
-  exemptRoute: false,
-};
-
-describe("impersonation required gate", () => {
+describe("impersonation required", () => {
   it("is off in production and everywhere that is not the test environment", () => {
     for (const environment of ["p", "test", "production", "", undefined]) {
       assert.equal(impersonationRequired(environment), false);
@@ -27,58 +17,21 @@ describe("impersonation required gate", () => {
     assert.equal(impersonationRequired("t"), true);
   });
 
-  it("never withholds the app or redirects when not required", () => {
-    const state = { required: false, ...signedInAlone };
-    assert.equal(withholdsApp(state), false);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("sends a signed-in person without a session to the picker when required", () => {
-    const state = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp(state), true);
-    assert.equal(sendsToPicker(state), true);
-  });
-
-  it("lets the app render once someone is being viewed as", () => {
-    const state = { required: true, ...signedInAlone, sessionActive: true };
-    assert.equal(withholdsApp(state), false);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("holds the app without redirecting until the session cookie is read", () => {
-    const state = { required: true, ...signedInAlone, cookieRead: false };
-    assert.equal(withholdsApp(state), true);
-    assert.equal(sendsToPicker(state), false);
-  });
-
-  it("leaves sign-in routes, the picker and anonymous visitors alone", () => {
-    const base = { required: true, ...signedInAlone };
-    assert.equal(withholdsApp({ ...base, exemptRoute: true }), false);
-    assert.equal(withholdsApp({ ...base, authenticated: false }), false);
-  });
-
   it("points the picker back at the page the person asked for", () => {
     const url = new URL(
       impersonationPickerUrl(
         "https://www.test.snosky.no",
-        "https://snokam.test.snosky.no/minside/okonomi?x=1"
+        "https://minside.test.snokam.no/okonomi?x=1"
       )
     );
+    assert.equal(url.origin, "https://www.test.snosky.no");
     assert.equal(url.pathname, "/velg-bruker");
     assert.equal(
       url.searchParams.get("returnTo"),
-      "https://snokam.test.snosky.no/minside/okonomi?x=1"
+      "https://minside.test.snokam.no/okonomi?x=1"
     );
   });
 
-  it("exempts sign-in routes and the picker, and nothing else", () => {
-    assert.equal(isExemptRoute("/auth/login"), true);
-    assert.equal(isExemptRoute("/velg-bruker"), true);
-    assert.equal(isExemptRoute("/manage"), false);
-    assert.equal(isExemptRoute("/"), false);
-    assert.equal(isExemptRoute(null), false);
-  });
-
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -12,35 +12,6 @@ export function impersonationRequired(
   return environment === TEST_ENVIRONMENT;
 }
 
-export interface ImpersonationGateState {
-  required: boolean;
-  authenticated: boolean;
-  sessionActive: boolean;
-  cookieRead: boolean;
-  exemptRoute: boolean;
-}
-
-function gated({
-  required,
-  authenticated,
-  exemptRoute,
-}: ImpersonationGateState) {
-  return required && authenticated && !exemptRoute;
-}
-
-export function isExemptRoute(pathname: string | null): boolean {
-  if (!pathname) return false;
-  return pathname.startsWith("/auth") || pathname === IMPERSONATION_PICKER_PATH;
-}
-
-export function withholdsApp(state: ImpersonationGateState): boolean {
-  return gated(state) && (!state.cookieRead || !state.sessionActive);
-}
-
-export function sendsToPicker(state: ImpersonationGateState): boolean {
-  return gated(state) && state.cookieRead && !state.sessionActive;
-}
-
 export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string

package/src/middleware.tsx

@@ -6,6 +6,15 @@ import { Auth } from "./types";
 import { getSessionCookieSettings, getAuthUrl } from "./session";
 import { addCorsHeaders } from "./cors";
 
+const TEST_ENVIRONMENT = "t";
+
+const LOGIN_FLOW_PATHS = [
+  "/auth/",
+  "/handoff/",
+  "/api/password/",
+  "/api/impersonation/adopt",
+];
+
 export function buildAuthMiddleware({
   matcher = [],
   callbacks = {},
@@ -13,7 +22,9 @@ export function buildAuthMiddleware({
   cors = {},
   ...rest
 }: Auth.Middleware.Props = {}): Auth.Middleware.Builder {
-  const requireLogin = process.env.IS_PR === "true";
+  const requireLogin =
+    process.env.IS_PR === "true" ||
+    process.env.ENVIRONMENT === TEST_ENVIRONMENT;
   const { name } = getSessionCookieSettings(getAuthUrl());
 
   const shouldProtectPath = (pathname: string): boolean => {
@@ -25,7 +36,7 @@ export function buildAuthMiddleware({
       return false;
     }
 
-    if (pathname.startsWith("/auth/")) {
+    if (LOGIN_FLOW_PATHS.some((path) => pathname.startsWith(path))) {
       return false;
     }
 

package/src/route-handler/token.ts

@@ -116,7 +116,10 @@ export function createTokenHandler(authConfig: Auth.Config) {
 
     if (impersonationRequired(authConfig.environment)) {
       return Response.json(
-        { error: IMPERSONATION_REQUIRED_ERROR },
+        {
+          error: IMPERSONATION_REQUIRED_ERROR,
+          platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
+        },
         { status: 403 }
       );
     }

package/src/impersonation/RequiredImpersonationGate.tsx

@@ -1,51 +0,0 @@
-"use client";
-
-import { useEffect, type ReactNode } from "react";
-import { usePathname } from "next/navigation";
-import { PageLoader } from "@snokam/ui";
-import { useOptionalConfig } from "@snokam/tenant";
-import { useSession } from "../session/useSession";
-import {
-  impersonationPickerUrl,
-  impersonationRequired,
-  isExemptRoute,
-  sendsToPicker,
-  withholdsApp,
-} from "./required";
-
-interface Props {
-  sessionActive: boolean;
-  cookieRead: boolean;
-  children: ReactNode;
-}
-
-export function RequiredImpersonationGate({
-  sessionActive,
-  cookieRead,
-  children,
-}: Props) {
-  const config = useOptionalConfig();
-  const { status, data: session } = useSession();
-  const pathname = usePathname();
-  const platformUrl = config?.NEXT_PUBLIC_PLATFORM_BASE_URL;
-
-  const state = {
-    required: impersonationRequired(config?.NEXT_PUBLIC_ENVIRONMENT),
-    authenticated:
-      status === "authenticated" || (status === "loading" && !!session),
-    sessionActive,
-    cookieRead,
-    exemptRoute: isExemptRoute(pathname),
-  };
-  const redirect = sendsToPicker(state);
-
-  useEffect(() => {
-    if (!redirect || !platformUrl) return;
-    window.location.assign(
-      impersonationPickerUrl(platformUrl, window.location.href)
-    );
-  }, [redirect, platformUrl]);
-
-  if (withholdsApp(state)) return <PageLoader />;
-  return <>{children}</>;
-}