@snokam/auth 3.7.14 → 3.8.0

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.8.0](https://github.com/snokam/components/compare/@snokam/auth@3.7.14...@snokam/auth@3.8.0) (2026-10-14)
+
+### Bug Fixes
+
+- **auth:** verify a password once when TOTP enrolment is pending, and say when sign-in is slow ([#2893](https://github.com/snokam/components/issues/2893)) ([d3e5c79](https://github.com/snokam/components/commit/d3e5c79c4c22db49389cddd07e1331dc6d25c381))
+
+### Features
+
+- persona mode per business, prs claim, Vis som gate, handoff sealing and CI persona (test identity P1) ([#2894](https://github.com/snokam/components/issues/2894)) ([8ab98a8](https://github.com/snokam/components/commit/8ab98a846ed6a5f962eadca6723c923a55395ce1)), closes [#2890](https://github.com/snokam/components/issues/2890)
+
+## [3.7.15](https://github.com/snokam/components/compare/@snokam/auth@3.7.14...@snokam/auth@3.7.15) (2026-10-14)
+
+### Bug Fixes
+
+- **auth:** verify a password once when TOTP enrolment is pending, and say when sign-in is slow ([#2893](https://github.com/snokam/components/issues/2893)) ([d3e5c79](https://github.com/snokam/components/commit/d3e5c79c4c22db49389cddd07e1331dc6d25c381))
+
 ## [3.7.14](https://github.com/snokam/components/compare/@snokam/auth@3.7.13...@snokam/auth@3.7.14) (2026-10-14)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "3.7.14",
+  "version": "3.8.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -27,11 +27,11 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "3.8.0",
+    "@snokam/platform-client": "3.9.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/ui": "4.0.3",
-    "@snokam/tenant": "2.1.17",
-    "@snokam/sanity-page-content": "4.11.1"
+    "@snokam/sanity-page-content": "4.12.0",
+    "@snokam/tenant": "2.1.18",
+    "@snokam/ui": "4.1.0"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/app-router/index.tsx

@@ -33,7 +33,7 @@ export {
   useImpersonation,
 } from "../impersonation/context";
 export type { ImpersonationActive } from "../impersonation/cookies";
-export { impersonationRequired } from "../impersonation/required";
+export { FOREIGN_BUSINESS_ERROR } from "../impersonation/required";
 export { isAllowedRedirect } from "../impersonation/redirects";
 export { signIn, SessionProvider } from "next-auth/react";
 export {

package/src/app-sign-in/handlers.ts

@@ -9,8 +9,9 @@ import { resolveAccessToken } from "../route-handler/token";
 import { readImpersonationSession } from "../impersonation/cookies";
 import { tokenClaims } from "../impersonation/claims";
 import {
+  chooseToken,
   impersonationPickerUrl,
-  impersonationRequired,
+  PERSONA_REQUIRED,
 } from "../impersonation/required";
 import type { Auth } from "../types";
 import {
@@ -57,6 +58,8 @@ interface Signer {
   accessToken: string;
 }
 
+type SignerResult = Signer | typeof PERSONA_REQUIRED | null;
+
 function sameEmail(a: string | undefined, b: string): boolean {
   return !!a && a.toLowerCase() === b.toLowerCase();
 }
@@ -84,11 +87,12 @@ async function signerFor(
   authConfig: Auth.Config,
   request: Request,
   email: string
-): Promise<Signer | null> {
-  if (impersonationRequired(authConfig.environment)) {
-    return personaSigner(request, email);
-  }
-  return ownSigner(authConfig, request, email);
+): Promise<SignerResult> {
+  const persona = personaSigner(request, email);
+  if (persona) return persona;
+
+  const own = await ownSigner(authConfig, request, email);
+  return chooseToken(null, own, own ? tokenClaims(own.accessToken) : {});
 }
 
 function pickerRedirect(request: Request): Response {
@@ -162,11 +166,8 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
     if (!signedIn) return loginRedirect(request, params.resource);
 
     const signer = await signerFor(authConfig, request, signedIn);
-    if (!signer) {
-      return impersonationRequired(authConfig.environment)
-        ? pickerRedirect(request)
-        : loginRedirect(request, params.resource);
-    }
+    if (signer === PERSONA_REQUIRED) return pickerRedirect(request);
+    if (!signer) return loginRedirect(request, params.resource);
 
     const preview = await previewAuthorization(params, signer.accessToken);
     if ("error" in preview) {
@@ -218,7 +219,13 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
     if (!signedIn) return invalidRequest();
 
     const signer = await signerFor(authConfig, request, signedIn);
-    if (!signer || signer.email !== consent.email) return invalidRequest();
+    if (
+      !signer ||
+      signer === PERSONA_REQUIRED ||
+      signer.email !== consent.email
+    ) {
+      return invalidRequest();
+    }
 
     if (form.get("decision") !== "approve") {
       return clientRedirect(request, consent, { error: ACCESS_DENIED });

package/src/config.ts

@@ -5,5 +5,4 @@ export const getAuthConfig = (): Auth.Config => ({
   tenantId: process.env.NEXT_PUBLIC_AZURE_AD_TENANT_ID ?? "",
   clientSecret: process.env.AZURE_AD_SECRET ?? "",
   nextAuthSecret: process.env.NEXTAUTH_SECRET ?? "",
-  environment: process.env.NEXT_PUBLIC_ENVIRONMENT,
 });

package/src/handoff/business.ts

@@ -0,0 +1,26 @@
+import { isLocalHost, resolveTenantByHostStrict } from "@snokam/tenant";
+import { getManagedBearer } from "@snokam/identity";
+import { type HostOwner, PLATFORM_HOST, UNKNOWN_HOST } from "./seal";
+
+function hostOf(url: string | undefined): string | null {
+  return url && URL.canParse(url) ? new URL(url).hostname.toLowerCase() : null;
+}
+
+function isPlatformHost(host: string): boolean {
+  return [
+    process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
+    process.env.NEXT_PUBLIC_CENTRAL_AUTH_URL,
+  ].some((url) => hostOf(url) === host);
+}
+
+export async function hostOwner(url: string): Promise<HostOwner> {
+  const host = new URL(url).hostname.toLowerCase();
+  if (isLocalHost(host) || isPlatformHost(host)) return PLATFORM_HOST;
+
+  const tenant = await resolveTenantByHostStrict({
+    host,
+    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
+    authToken: await getManagedBearer(),
+  });
+  return tenant?.businessId ? { businessId: tenant.businessId } : UNKNOWN_HOST;
+}

package/src/handoff/handlers.ts

@@ -7,7 +7,13 @@ import {
 } from "../session";
 import { sealHandoff } from "./ticket";
 import { isAllowedReturnTo } from "./return-to";
+import { hostOwner } from "./business";
+import { type HostOwner, maySealFor, PLATFORM_HOST } from "./seal";
 import { revokePasswordToken } from "../password/api";
+import { resolveAccessToken } from "../route-handler/token";
+import { tokenClaims } from "../impersonation/claims";
+import { impersonationPickerUrl } from "../impersonation/required";
+import type { Auth } from "../types";
 
 interface HandoffConfig {
   nextAuthSecret: string;
@@ -75,6 +81,41 @@ function completeRedirect(
   return Response.redirect(complete.toString(), 302);
 }
 
+async function callerBusiness(
+  authConfig: Auth.Config,
+  request: Request
+): Promise<string | undefined | Response> {
+  const caller = await resolveAccessToken(authConfig, request);
+  return "error" in caller ? caller.error : tokenClaims(caller.accessToken).biz;
+}
+
+async function handOff(
+  request: Request,
+  authConfig: Auth.Config,
+  token: HandoffToken,
+  returnTo: string
+): Promise<Response> {
+  let owner: HostOwner;
+  try {
+    owner = await hostOwner(returnTo);
+  } catch {
+    return new Response("Tenant lookup unavailable", { status: 503 });
+  }
+
+  if (owner !== PLATFORM_HOST) {
+    const business = await callerBusiness(authConfig, request);
+    if (business instanceof Response) return business;
+    if (!maySealFor(owner, business)) {
+      return Response.redirect(
+        impersonationPickerUrl(requestOrigin(request), returnTo),
+        302
+      );
+    }
+  }
+
+  return completeRedirect(token, returnTo, authConfig.nextAuthSecret);
+}
+
 function expireCookie(name: string, domain?: string, secure?: boolean): string {
   return [
     `${name}=`,
@@ -109,7 +150,7 @@ export function createHandoffLogoutHandler(config?: HandoffConfig) {
   };
 }
 
-export function createHandoffStartHandler(config: HandoffConfig) {
+export function createHandoffStartHandler(authConfig: Auth.Config) {
   return async function GET(request: Request) {
     const returnTo = await validReturnTo(request);
     if (!returnTo) {
@@ -117,9 +158,9 @@ export function createHandoffStartHandler(config: HandoffConfig) {
     }
 
     const prompt = new URL(request.url).searchParams.get("prompt");
-    const token = await centralToken(request, config.nextAuthSecret);
+    const token = await centralToken(request, authConfig.nextAuthSecret);
     if (token?.refreshToken && !prompt) {
-      return completeRedirect(token, returnTo, config.nextAuthSecret);
+      return handOff(request, authConfig, token, returnTo);
     }
 
     const origin = requestOrigin(request);
@@ -130,20 +171,20 @@ export function createHandoffStartHandler(config: HandoffConfig) {
   };
 }
 
-export function createHandoffFinishHandler(config: HandoffConfig) {
+export function createHandoffFinishHandler(authConfig: Auth.Config) {
   return async function GET(request: Request) {
     const returnTo = await validReturnTo(request);
     if (!returnTo) {
       return new Response("Invalid returnTo", { status: 400 });
     }
 
-    const token = await centralToken(request, config.nextAuthSecret);
+    const token = await centralToken(request, authConfig.nextAuthSecret);
     if (!token?.refreshToken) {
       const origin = requestOrigin(request);
       const start = `${origin}/handoff/start?returnTo=${encodeURIComponent(returnTo)}`;
       return Response.redirect(start, 302);
     }
 
-    return completeRedirect(token, returnTo, config.nextAuthSecret);
+    return handOff(request, authConfig, token, returnTo);
   };
 }

package/src/handoff/seal.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { maySealFor, PLATFORM_HOST, UNKNOWN_HOST } from "./seal.ts";
+
+describe("handoff sealing", () => {
+  it("seals for hosts of the caller's own business", () => {
+    assert.equal(maySealFor({ businessId: "biz-own" }, "biz-own"), true);
+  });
+
+  it("seals for the platform's own hosts and localhost", () => {
+    assert.equal(maySealFor(PLATFORM_HOST, "biz-own"), true);
+  });
+
+  it("refuses hosts of another business, admins included", () => {
+    assert.equal(maySealFor({ businessId: "biz-other" }, "biz-own"), false);
+  });
+
+  it("refuses business hosts when the caller has no business", () => {
+    assert.equal(maySealFor({ businessId: "biz-other" }, undefined), false);
+  });
+
+  it("refuses a host that resolves to no business", () => {
+    assert.equal(maySealFor(UNKNOWN_HOST, "biz-own"), false);
+  });
+});

package/src/handoff/seal.ts

@@ -0,0 +1,14 @@
+export const PLATFORM_HOST = "platform";
+export const UNKNOWN_HOST = "unknown";
+
+export type HostOwner =
+  typeof PLATFORM_HOST | typeof UNKNOWN_HOST | { businessId: string };
+
+export function maySealFor(
+  owner: HostOwner,
+  callerBusiness: string | undefined
+): boolean {
+  if (owner === PLATFORM_HOST) return true;
+  if (owner === UNKNOWN_HOST) return false;
+  return owner.businessId === callerBusiness;
+}

package/src/impersonation/claims.ts

@@ -2,6 +2,8 @@ export interface TokenClaims {
   biz?: string;
   email?: string;
   act?: string;
+  imp?: string;
+  prs?: string;
 }
 
 export function tokenClaims(accessToken: string): TokenClaims {

package/src/impersonation/personas.ts

@@ -3,7 +3,9 @@ import { Auth } from "../types";
 import { resolveAccessToken } from "../route-handler/token";
 import { tokenClaims } from "./claims";
 import { platformCall, platformClient, platformNotConfigured } from "./request";
-import { impersonationRequired } from "./required";
+import { FOREIGN_BUSINESS_ERROR, personaRequired } from "./required";
+import { hostOwner } from "../handoff/business";
+import { maySealFor } from "../handoff/seal";
 
 function persona(employee: ProtectedEmployee) {
   return {
@@ -22,34 +24,40 @@ function persona(employee: ProtectedEmployee) {
   };
 }
 
+async function isForeignReturn(
+  request: Request,
+  callerBusiness: string | undefined
+): Promise<boolean> {
+  const returnTo = new URL(request.url).searchParams.get("returnTo");
+  if (!returnTo || !URL.canParse(returnTo)) return false;
+  return !maySealFor(await hostOwner(returnTo), callerBusiness);
+}
+
 export function createImpersonationPersonasHandler(authConfig: Auth.Config) {
   return async function GET(request: Request) {
-    if (!impersonationRequired(authConfig.environment)) {
-      return new Response("Not found", { status: 404 });
-    }
-
     const caller = await resolveAccessToken(authConfig, request);
     if ("error" in caller) return caller.error;
 
+    const claims = tokenClaims(caller.accessToken);
+    if (await isForeignReturn(request, claims.biz)) {
+      return Response.json({ error: FOREIGN_BUSINESS_ERROR }, { status: 403 });
+    }
+    if (!personaRequired(claims)) {
+      return new Response("Not found", { status: 404 });
+    }
+
     const client = platformClient(caller.accessToken);
     if (!client) return platformNotConfigured();
 
-    const businessId = tokenClaims(caller.accessToken).biz;
-    if (!businessId) {
-      return new Response("The signed-in account has no business", {
-        status: 409,
-      });
-    }
-
-    const [employees, apps] = await Promise.all([
-      platformCall(client.listBusinessEmployees({ id: businessId })),
+    const [personas, apps] = await Promise.all([
+      platformCall(client.listTestPersonas()),
       platformCall(client.getMeApps()),
     ]);
-    if ("error" in employees) return employees.error;
+    if ("error" in personas) return personas.error;
     if ("error" in apps) return apps.error;
 
     return Response.json({
-      personas: employees.value.map(persona),
+      personas: personas.value.map(persona),
       apps: apps.value,
     });
   };

package/src/impersonation/required.test.ts

@@ -1,22 +1,58 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import {
+  chooseToken,
   impersonationPickerUrl,
-  impersonationRequired,
   isSignInPage,
+  PERSONA_REQUIRED,
+  personaRequired,
   renewDelayMs,
 } from "./required.ts";
 
-describe("impersonation required", () => {
-  it("is off in production and everywhere that is not the test environment", () => {
-    for (const environment of ["p", "test", "production", "", undefined]) {
-      assert.equal(impersonationRequired(environment), false);
-    }
+describe("token choice for the token route and MCP sign-in", () => {
+  const persona = { email: "persona@test.snokam.no", accessToken: "imp" };
+  const snokamSso = { email: "dev@snokam.no", accessToken: "own" };
+  const customerOwner = { email: "owner@acme.no", accessToken: "own" };
+
+  it("sends a persona-mode user without a persona to the picker", () => {
+    assert.equal(chooseToken(null, snokamSso, { prs: "1" }), PERSONA_REQUIRED);
+  });
+
+  it("signs as the chosen persona once a Vis som session is active", () => {
+    assert.equal(chooseToken(persona, snokamSso, { prs: "1" }), persona);
+  });
+
+  it("signs a customer as themselves", () => {
+    assert.equal(chooseToken(null, customerOwner, {}), customerOwner);
   });
 
-  it("is on in test", () => {
-    assert.equal(impersonationRequired("t"), true);
+  it("has nothing to sign with when there is no session", () => {
+    assert.equal(chooseToken(null, null, {}), null);
   });
+});
+
+describe("persona required", () => {
+  const cases = [
+    { prs: false, imp: false, act: false, required: false },
+    { prs: false, imp: true, act: true, required: false },
+    { prs: false, imp: false, act: true, required: false },
+    { prs: false, imp: true, act: false, required: false },
+    { prs: true, imp: false, act: false, required: true },
+    { prs: true, imp: true, act: true, required: false },
+    { prs: true, imp: false, act: true, required: false },
+    { prs: true, imp: true, act: false, required: false },
+  ];
+
+  for (const { prs, imp, act, required } of cases) {
+    it(`is ${required} for prs=${prs} imp=${imp} act=${act}`, () => {
+      const claims = {
+        ...(prs ? { prs: "1" } : {}),
+        ...(imp ? { imp: "true" } : {}),
+        ...(act ? { act: "dev@snokam.no" } : {}),
+      };
+      assert.equal(personaRequired(claims), required);
+    });
+  }
 
   it("points the picker back at the page the person asked for", () => {
     const url = new URL(

package/src/impersonation/required.ts

@@ -1,15 +1,37 @@
+import type { TokenClaims } from "./claims";
+
 export const IMPERSONATION_REQUIRED_ERROR = "impersonation_required";
 
-const TEST_ENVIRONMENT = "t";
+export const FOREIGN_BUSINESS_ERROR = "foreign_business";
 
 export const IMPERSONATION_PICKER_PATH = "/velg-bruker";
 
 const RENEW_MARGIN_SECONDS = 120;
 
-export function impersonationRequired(
-  environment: string | undefined
-): boolean {
-  return environment === TEST_ENVIRONMENT;
+export const PERSONA_REQUIRED = "persona_required";
+
+export function personaRequired(ownClaims: TokenClaims): boolean {
+  return !!ownClaims.prs && !ownClaims.imp && !ownClaims.act;
+}
+
+export function chooseToken<T>(
+  viewAs: T | null,
+  own: T | null,
+  ownClaims: TokenClaims
+): T | typeof PERSONA_REQUIRED | null {
+  if (viewAs) return viewAs;
+  if (!own) return null;
+  return personaRequired(ownClaims) ? PERSONA_REQUIRED : own;
+}
+
+export function impersonationRequiredResponse(): Response {
+  return Response.json(
+    {
+      error: IMPERSONATION_REQUIRED_ERROR,
+      platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
+    },
+    { status: 403 }
+  );
 }
 
 export function isSignInPage(pathname: string): boolean {

package/src/options/providers.ts

@@ -3,7 +3,11 @@ import AzureADProvider from "next-auth/providers/azure-ad";
 import CredentialsProvider from "next-auth/providers/credentials";
 import { getDefaultAuthParams } from "../options/params";
 import { openHandoff } from "../handoff/ticket";
-import { passwordLogin, redeemBootstrapToken } from "../password/api";
+import {
+  enrolmentRequiredError,
+  passwordLogin,
+  redeemBootstrapToken,
+} from "../password/api";
 import { requestClientIp, requestHost } from "./request";
 import { Auth } from "../types";
 
@@ -100,6 +104,8 @@ function password() {
         },
         requestClientIp(req)
       );
+      if (outcome.enrolment)
+        throw new Error(enrolmentRequiredError(outcome.enrolment));
       if (!outcome.login)
         throw new Error(outcome.error ?? "invalid_credentials");
 

package/src/password/api.ts

@@ -1,3 +1,5 @@
+export { enrolmentFromError, enrolmentRequiredError } from "./enrolment";
+
 export interface PasswordLoginResult {
   userId: string;
   businessId: string;

package/src/password/enrolment.test.ts

@@ -0,0 +1,24 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { enrolmentFromError, enrolmentRequiredError } from "./enrolment.ts";
+
+const enrolment = {
+  email: "owner@businessx.no",
+  enrolmentToken: "token+/=",
+  otpauthUri: "otpauth://totp/Sn%C3%B8sky:owner?secret=ABC&issuer=Sn%C3%B8sky",
+};
+
+describe("totp enrolment carried by the sign-in error", () => {
+  it("survives the round trip through the sign-in error url", () => {
+    const url = new URL("https://login.test.snosky.no/auth/login");
+    url.searchParams.set("error", enrolmentRequiredError(enrolment));
+    const error = new URL(url.toString()).searchParams.get("error");
+    assert.deepEqual(enrolmentFromError(error), enrolment);
+  });
+
+  it("ignores every other sign-in error", () => {
+    assert.equal(enrolmentFromError("invalid_credentials"), null);
+    assert.equal(enrolmentFromError("totp_enrollment_required"), null);
+    assert.equal(enrolmentFromError(undefined), null);
+  });
+});

package/src/password/enrolment.ts

@@ -0,0 +1,15 @@
+import type { PasswordEnrolment } from "./api";
+
+const ENROLMENT_REQUIRED = "totp_enrollment_required";
+const PREFIX = `${ENROLMENT_REQUIRED}:`;
+
+export function enrolmentRequiredError(enrolment: PasswordEnrolment): string {
+  return `${PREFIX}${JSON.stringify(enrolment)}`;
+}
+
+export function enrolmentFromError(
+  error: string | undefined | null
+): PasswordEnrolment | null {
+  if (!error?.startsWith(PREFIX)) return null;
+  return JSON.parse(error.slice(PREFIX.length)) as PasswordEnrolment;
+}

package/src/route-handler/token.ts

@@ -8,9 +8,11 @@ import { getAuthUrl, getSessionCookieSettings } from "../session";
 import { exchangePasswordToken } from "../password/api";
 import { readImpersonationSession } from "../impersonation/cookies";
 import { exchangeSsoToken } from "../sso/exchange";
+import { tokenClaims } from "../impersonation/claims";
 import {
-  IMPERSONATION_REQUIRED_ERROR,
-  impersonationRequired,
+  chooseToken,
+  impersonationRequiredResponse,
+  PERSONA_REQUIRED,
 } from "../impersonation/required";
 
 export type TokenResult =
@@ -114,20 +116,14 @@ export function createTokenHandler(authConfig: Auth.Config) {
       });
     }
 
-    if (impersonationRequired(authConfig.environment)) {
-      return Response.json(
-        {
-          error: IMPERSONATION_REQUIRED_ERROR,
-          platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
-        },
-        { status: 403 }
-      );
-    }
-
     const result = await resolveAccessToken(authConfig, request);
     if ("error" in result) {
       return result.error;
     }
-    return Response.json(result);
+    const chosen = chooseToken(null, result, tokenClaims(result.accessToken));
+    if (chosen === PERSONA_REQUIRED) {
+      return impersonationRequiredResponse();
+    }
+    return Response.json(chosen);
   };
 }

package/src/types.ts

@@ -8,7 +8,6 @@ export namespace Auth {
     clientSecret: string;
     nextAuthSecret: string;
     tenantId: string;
-    environment?: string;
   }
   export namespace Provider {
     export interface Props {