@snokam/auth 3.7.14 → 3.7.15

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.7.15](https://github.com/snokam/components/compare/@snokam/auth@3.7.14...@snokam/auth@3.7.15) (2026-10-14)
+
+### Bug Fixes
+
+- **auth:** verify a password once when TOTP enrolment is pending, and say when sign-in is slow ([#2893](https://github.com/snokam/components/issues/2893)) ([d3e5c79](https://github.com/snokam/components/commit/d3e5c79c4c22db49389cddd07e1331dc6d25c381))
+
 ## [3.7.14](https://github.com/snokam/components/compare/@snokam/auth@3.7.13...@snokam/auth@3.7.14) (2026-10-14)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.7.14",
+  "version": "3.7.15",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,12 +26,12 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/identity": "1.1.0",
     "@snokam/platform-client": "3.8.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/ui": "4.0.3",
+    "@snokam/sanity-page-content": "4.11.1",
+    "@snokam/identity": "1.1.0",
     "@snokam/tenant": "2.1.17",
-    "@snokam/sanity-page-content": "4.11.1"
+    "@snokam/ui": "4.0.3"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/options/providers.ts

@@ -3,7 +3,11 @@ import AzureADProvider from "next-auth/providers/azure-ad";
 import CredentialsProvider from "next-auth/providers/credentials";
 import { getDefaultAuthParams } from "../options/params";
 import { openHandoff } from "../handoff/ticket";
-import { passwordLogin, redeemBootstrapToken } from "../password/api";
+import {
+  enrolmentRequiredError,
+  passwordLogin,
+  redeemBootstrapToken,
+} from "../password/api";
 import { requestClientIp, requestHost } from "./request";
 import { Auth } from "../types";
 
@@ -100,6 +104,8 @@ function password() {
         },
         requestClientIp(req)
       );
+      if (outcome.enrolment)
+        throw new Error(enrolmentRequiredError(outcome.enrolment));
       if (!outcome.login)
         throw new Error(outcome.error ?? "invalid_credentials");
 

package/src/password/api.ts

@@ -1,3 +1,5 @@
+export { enrolmentFromError, enrolmentRequiredError } from "./enrolment";
+
 export interface PasswordLoginResult {
   userId: string;
   businessId: string;

package/src/password/enrolment.test.ts

@@ -0,0 +1,24 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { enrolmentFromError, enrolmentRequiredError } from "./enrolment.ts";
+
+const enrolment = {
+  email: "owner@businessx.no",
+  enrolmentToken: "token+/=",
+  otpauthUri: "otpauth://totp/Sn%C3%B8sky:owner?secret=ABC&issuer=Sn%C3%B8sky",
+};
+
+describe("totp enrolment carried by the sign-in error", () => {
+  it("survives the round trip through the sign-in error url", () => {
+    const url = new URL("https://login.test.snosky.no/auth/login");
+    url.searchParams.set("error", enrolmentRequiredError(enrolment));
+    const error = new URL(url.toString()).searchParams.get("error");
+    assert.deepEqual(enrolmentFromError(error), enrolment);
+  });
+
+  it("ignores every other sign-in error", () => {
+    assert.equal(enrolmentFromError("invalid_credentials"), null);
+    assert.equal(enrolmentFromError("totp_enrollment_required"), null);
+    assert.equal(enrolmentFromError(undefined), null);
+  });
+});

package/src/password/enrolment.ts

@@ -0,0 +1,15 @@
+import type { PasswordEnrolment } from "./api";
+
+const ENROLMENT_REQUIRED = "totp_enrollment_required";
+const PREFIX = `${ENROLMENT_REQUIRED}:`;
+
+export function enrolmentRequiredError(enrolment: PasswordEnrolment): string {
+  return `${PREFIX}${JSON.stringify(enrolment)}`;
+}
+
+export function enrolmentFromError(
+  error: string | undefined | null
+): PasswordEnrolment | null {
+  if (!error?.startsWith(PREFIX)) return null;
+  return JSON.parse(error.slice(PREFIX.length)) as PasswordEnrolment;
+}