@snokam/auth 3.7.1 → 3.7.3

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.7.3](https://github.com/snokam/components/compare/@snokam/auth@3.7.2...@snokam/auth@3.7.3) (2026-10-06)
+
+**Note:** Version bump only for package @snokam/auth
+
+## [3.7.2](https://github.com/snokam/components/compare/@snokam/auth@3.7.0...@snokam/auth@3.7.2) (2026-10-06)
+
+### Bug Fixes
+
+- **auth:** ending a persona returns to where it started; no picker loop from sign-in ([#2708](https://github.com/snokam/components/issues/2708)) ([e609377](https://github.com/snokam/components/commit/e6093776f8a5458b611f622f09611145b7cbc461))
+- **mcp:** return iss on the sign-in callback so Codex and Cursor accept it ([#2707](https://github.com/snokam/components/issues/2707)) ([b55887e](https://github.com/snokam/components/commit/b55887e62b9e4b84fbd4bed7fbd4b5e588b534a4))
+
 ## [3.7.1](https://github.com/snokam/components/compare/@snokam/auth@3.7.0...@snokam/auth@3.7.1) (2026-10-06)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.7.1",
+  "version": "3.7.3",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -27,11 +27,11 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "3.6.0",
+    "@snokam/platform-client": "3.6.1",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "4.4.2",
-    "@snokam/tenant": "2.1.13",
-    "@snokam/ui": "4.0.0"
+    "@snokam/tenant": "2.1.14",
+    "@snokam/ui": "4.0.0",
+    "@snokam/sanity-page-content": "4.6.0"
   },
   "peerDependencies": {
     "next": "16.3.3",

package/src/app-sign-in/consent.ts

@@ -13,6 +13,7 @@ export interface ConsentClaims extends AuthorizationParams {
   state: string;
   clientName: string;
   businessName: string;
+  issuer: string;
   email: string;
   nonce: string;
 }

package/src/app-sign-in/handlers.ts

@@ -15,6 +15,7 @@ import {
 import type { Auth } from "../types";
 import {
   type AuthorizationParams,
+  type ConsentClaims,
   CONSENT_TTL_SECONDS,
   readAppSignInConsent,
   sealConsent,
@@ -133,15 +134,15 @@ function sameOrigin(request: Request): boolean {
 
 function clientRedirect(
   request: Request,
-  redirectUri: string,
-  state: string,
+  consent: ConsentClaims,
   result: Record<string, string>
 ): Response {
-  const target = new URL(redirectUri);
+  const target = new URL(consent.redirectUri);
   for (const [key, value] of Object.entries(result)) {
     target.searchParams.set(key, value);
   }
-  if (state) target.searchParams.set("state", state);
+  if (consent.state) target.searchParams.set("state", consent.state);
+  if (consent.issuer) target.searchParams.set("iss", consent.issuer);
   return new Response(null, {
     status: 303,
     headers: {
@@ -180,6 +181,7 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
         ...params,
         clientName: preview.value.clientName ?? "",
         businessName: preview.value.businessName ?? "",
+        issuer: preview.value.issuer ?? "",
         business: new URL(params.resource).hostname,
         state: query.get("state") ?? "",
         email: signer.email,
@@ -219,16 +221,13 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
     if (!signer || signer.email !== consent.email) return invalidRequest();
 
     if (form.get("decision") !== "approve") {
-      return clientRedirect(request, consent.redirectUri, consent.state, {
-        error: ACCESS_DENIED,
-      });
+      return clientRedirect(request, consent, { error: ACCESS_DENIED });
     }
 
     const approved = await approveAuthorization(consent, signer.accessToken);
     return clientRedirect(
       request,
-      consent.redirectUri,
-      consent.state,
+      consent,
       "error" in approved
         ? { error: approved.error }
         : { code: approved.value.code ?? "" }

package/src/hooks.ts

@@ -6,6 +6,7 @@ import { useSession } from "./session/useSession";
 import {
   IMPERSONATION_REQUIRED_ERROR,
   impersonationPickerUrl,
+  isSignInPage,
 } from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
@@ -17,7 +18,7 @@ class ImpersonationRequiredError extends Error {
 }
 
 function sendToPicker(error: ImpersonationRequiredError): void {
-  if (!error.platformUrl) return;
+  if (!error.platformUrl || isSignInPage(window.location.pathname)) return;
   window.location.assign(
     impersonationPickerUrl(error.platformUrl, window.location.href)
   );

package/src/impersonation/context.tsx

@@ -12,6 +12,7 @@ import {
 import { IMP_ACTIVE_COOKIE, type ImpersonationActive } from "./cookies";
 import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
+import { useOptionalConfig } from "@snokam/tenant";
 import { isAllowedRedirect, platformBaseDomain } from "./redirects";
 
 export interface StartImpersonationInput {
@@ -38,11 +39,14 @@ const ImpersonationContext = createContext<ImpersonationContextValue | null>(
   null
 );
 
-function isSafeReturnTo(returnTo: string): boolean {
-  if (typeof window === "undefined") return false;
+function isSafeReturnTo(
+  returnTo: string,
+  apiBaseUrl: string | undefined
+): boolean {
+  if (typeof window === "undefined" || !apiBaseUrl) return false;
   return isAllowedRedirect(returnTo, {
     origin: window.location.origin,
-    platformDomain: platformBaseDomain(),
+    platformDomain: platformBaseDomain(apiBaseUrl),
   });
 }
 
@@ -64,6 +68,7 @@ function readActiveCookie(): ImpersonationActive | null {
 }
 
 export function ImpersonationProvider({ children }: { children: ReactNode }) {
+  const apiBaseUrl = useOptionalConfig()?.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
   const [active, setActive] = useState<ImpersonationActive | null>(null);
   const [starting, setStarting] = useState(false);
   const [exiting, setExiting] = useState(false);
@@ -116,7 +121,7 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
       clearAuthTokenCache();
       const returnTo = active?.returnTo;
       setActive(null);
-      if (returnTo && isSafeReturnTo(returnTo)) {
+      if (returnTo && isSafeReturnTo(returnTo, apiBaseUrl)) {
         window.location.assign(returnTo);
       } else {
         window.location.reload();
@@ -124,7 +129,7 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
     } finally {
       setExiting(false);
     }
-  }, [active]);
+  }, [active, apiBaseUrl]);
 
   const value = useMemo<ImpersonationContextValue>(
     () => ({ active, starting, exiting, start, exit }),

package/src/impersonation/handlers.ts

@@ -32,7 +32,9 @@ function registrable(host: string): string {
 function resolveLanding(returnTo: string, origin: string): string {
   const allowed = isAllowedRedirect(returnTo, {
     origin,
-    platformDomain: platformBaseDomain(),
+    platformDomain: platformBaseDomain(
+      process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL
+    ),
   });
   return allowed
     ? new URL(returnTo, origin).toString()

package/src/impersonation/redirects.ts

@@ -1,9 +1,8 @@
-export function platformBaseDomain(): string {
-  const api = process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL;
-  if (!api) {
+export function platformBaseDomain(apiBaseUrl: string | undefined): string {
+  if (!apiBaseUrl) {
     throw new Error("NEXT_PUBLIC_PLATFORM_API_BASE_URL is not configured");
   }
-  return new URL(api).hostname.split(".").slice(-2).join(".");
+  return new URL(apiBaseUrl).hostname.split(".").slice(-2).join(".");
 }
 
 interface RedirectRules {

package/src/impersonation/required.test.ts

@@ -3,6 +3,7 @@ import { describe, it } from "node:test";
 import {
   impersonationPickerUrl,
   impersonationRequired,
+  isSignInPage,
   renewDelayMs,
 } from "./required.ts";
 
@@ -32,6 +33,14 @@ describe("impersonation required", () => {
     );
   });
 
+  it("never sends a sign-in page to the picker, at the root or under a base path", () => {
+    assert.equal(isSignInPage("/auth/complete"), true);
+    assert.equal(isSignInPage("/minside/auth/login"), true);
+    assert.equal(isSignInPage("/"), false);
+    assert.equal(isSignInPage("/okonomi"), false);
+    assert.equal(isSignInPage("/authors"), false);
+  });
+
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -12,6 +12,10 @@ export function impersonationRequired(
   return environment === TEST_ENVIRONMENT;
 }
 
+export function isSignInPage(pathname: string): boolean {
+  return /(^|\/)auth\//.test(pathname);
+}
+
 export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string