@snokam/auth 4.0.0 → 5.0.0

package/CHANGELOG.md

@@ -3,6 +3,75 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [5.0.0](https://github.com/snokam/components/compare/@snokam/auth@3.7.14...@snokam/auth@5.0.0) (2026-10-14)
+
+### Bug Fixes
+
+- **auth:** verify a password once when TOTP enrolment is pending, and say when sign-in is slow ([#2893](https://github.com/snokam/components/issues/2893)) ([d3e5c79](https://github.com/snokam/components/commit/d3e5c79c4c22db49389cddd07e1331dc6d25c381))
+
+### Features
+
+- per-company branding (logo, dark logo, icon) ([#2907](https://github.com/snokam/components/issues/2907)) ([dc32583](https://github.com/snokam/components/commit/dc325832803c88158937f45fe5b9e1b64846a52d))
+- persona mode per business, prs claim, Vis som gate, handoff sealing and CI persona (test identity P1) ([#2894](https://github.com/snokam/components/issues/2894)) ([8ab98a8](https://github.com/snokam/components/commit/8ab98a846ed6a5f962eadca6723c923a55395ce1)), closes [#2890](https://github.com/snokam/components/issues/2890)
+- **platform:** a test persona carries the operator's own operator role ([#2913](https://github.com/snokam/components/issues/2913)) ([0d777a3](https://github.com/snokam/components/commit/0d777a39400cace619513e77ba0872ffeb56f7c2))
+
+### BREAKING CHANGES
+
+- SimpleHeaderBase and FooterBase take `logo` as a ReactNode;
+  the HeaderLogo and FooterLogo types are removed.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Nv57F4rwzYRkuUVFdd2wXA
+
+- feat(platform-web): company branding in /manage, at login and in the shell
+
+/manage/innstillinger gets a Merkevare section: the logo for light
+backgrounds, the logo for dark backgrounds and the square icon, each with a
+preview on its own background, upload (react-hook-form + zod: type and 2 MB
+checked before sending) and remove. Server error codes map to CMS copy.
+The central login shows the company's logo above "Logg inn hos …", from
+login-config. The /manage shell shows the managed business's logo linking to
+its front page; /admin and an operator without a business show the platform
+business. The public snosky.no chrome keeps the Snøsky logo from the platform
+CMS, through the same BusinessLogo.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Nv57F4rwzYRkuUVFdd2wXA
+
+- fix(my-page-web): drop leftover Snøkam favicons
+
+The unused pages-router meta component and finance-web's public/favicon.ico
+served Snøkam's icon to every company; favicons now come from the
+company's uploaded icon.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Nv57F4rwzYRkuUVFdd2wXA
+
+- fix(handbook-web): no Snøkam share image, no raw-URL fallback in branding metadata
+
+The handbook's root metadata no longer hardcodes the Snøkam icon as the
+share image, so the company's share image from makeTenantMetadata applies.
+The favicon and share helpers drop their raw-URL fallback: a transform that
+yields nothing yields no image, never an untransformed (possibly SVG) URL.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Nv57F4rwzYRkuUVFdd2wXA
+
+- fix(ui): show the light logo inverted on dark when no dark logo is uploaded
+
+Without a dark logo, a dark background shows the light logo turned white
+(brightness(0) invert(1)) instead of the wordmark. The Merkevare previews
+use static brand tokens, and upload errors are read by parsing the JSON
+body rather than stripping quotes.
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Nv57F4rwzYRkuUVFdd2wXA
+
+- chore(clients): regenerate platform-function clients for branding
+
+Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
+Claude-Session: https://claude.ai/code/session_01Nv57F4rwzYRkuUVFdd2wXA
+
 # [4.0.0](https://github.com/snokam/components/compare/@snokam/auth@3.7.14...@snokam/auth@4.0.0) (2026-10-14)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -27,11 +27,11 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "4.0.0",
+    "@snokam/platform-client": "5.0.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "5.0.0",
-    "@snokam/ui": "5.0.0",
-    "@snokam/tenant": "3.0.0"
+    "@snokam/sanity-page-content": "6.0.0",
+    "@snokam/tenant": "4.0.0",
+    "@snokam/ui": "6.0.0"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/impersonation/claims.test.ts

@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { claimedRoles, tokenClaims } from "./claims.ts";
+
+function token(payload: object): string {
+  const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `header.${encoded}.signature`;
+}
+
+describe("roles carried by a view-as token", () => {
+  it("reads the actor and a single role", () => {
+    const claims = tokenClaims(
+      token({
+        act: "morten.jansrud@test.snokam.no",
+        roles: "platform-operator",
+      })
+    );
+    assert.equal(claims.act, "morten.jansrud@test.snokam.no");
+    assert.deepEqual(claimedRoles(claims), ["platform-operator"]);
+  });
+
+  it("reads several roles and none", () => {
+    assert.deepEqual(claimedRoles(tokenClaims(token({ roles: ["a", "b"] }))), [
+      "a",
+      "b",
+    ]);
+    assert.deepEqual(claimedRoles(tokenClaims(token({}))), []);
+  });
+});

package/src/impersonation/claims.ts

@@ -4,6 +4,12 @@ export interface TokenClaims {
   act?: string;
   imp?: string;
   prs?: string;
+  roles?: string | string[];
+}
+
+export function claimedRoles(claims: TokenClaims): string[] {
+  if (!claims.roles) return [];
+  return Array.isArray(claims.roles) ? claims.roles : [claims.roles];
 }
 
 export function tokenClaims(accessToken: string): TokenClaims {

package/src/impersonation/cookies.ts

@@ -1,4 +1,5 @@
 import { resolveCookieDomain } from "../session";
+import { claimedRoles, tokenClaims } from "./claims";
 
 export const IMP_SESSION_COOKIE = "imp_session";
 export const IMP_ACTIVE_COOKIE = "imp_active";
@@ -17,6 +18,8 @@ export interface ImpersonationActive {
   tokenId: string;
   expiresOn: number;
   returnTo?: string;
+  actorEmail?: string;
+  roles?: string[];
 }
 
 interface MintedToken {
@@ -97,7 +100,10 @@ export function buildImpersonationCookies(
     expiresOn: minted.expiresOn,
     tokenId: minted.tokenId,
   };
+  const claims = tokenClaims(minted.accessToken);
   const active: ImpersonationActive = {
+    actorEmail: claims.act,
+    roles: claimedRoles(claims),
     targetEmail: minted.targetEmail,
     targetName: minted.targetName,
     targetImage: minted.targetImage,