@snokam/auth 5.0.2 → 5.2.0

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [5.2.0](https://github.com/snokam/components/compare/@snokam/auth@5.0.0...@snokam/auth@5.2.0) (2026-10-14)
+
+### Features
+
+- company-first Vis som picker (test identity P3) ([#2917](https://github.com/snokam/components/issues/2917)) ([6098d44](https://github.com/snokam/components/commit/6098d446d91f630a360633615e6c4c0e81c9985f))
+
+# [5.1.0](https://github.com/snokam/components/compare/@snokam/auth@5.0.0...@snokam/auth@5.1.0) (2026-10-14)
+
+### Features
+
+- company-first Vis som picker (test identity P3) ([#2917](https://github.com/snokam/components/issues/2917)) ([6098d44](https://github.com/snokam/components/commit/6098d446d91f630a360633615e6c4c0e81c9985f))
+
 ## [5.0.2](https://github.com/snokam/components/compare/@snokam/auth@5.0.0...@snokam/auth@5.0.2) (2026-10-14)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.0.2",
+  "version": "5.2.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,12 +26,12 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/sanity-page-content": "6.2.0",
-    "@snokam/tenant": "4.0.0",
-    "@snokam/ui": "6.0.1",
-    "@snokam/platform-client": "5.0.0",
     "@snokam/identity": "1.1.0",
-    "@snokam/react-query": "1.1.0"
+    "@snokam/platform-client": "5.2.0",
+    "@snokam/react-query": "1.1.0",
+    "@snokam/sanity-page-content": "6.4.0",
+    "@snokam/tenant": "4.2.0",
+    "@snokam/ui": "6.0.3"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/app-router/index.tsx

@@ -33,7 +33,6 @@ export {
   useImpersonation,
 } from "../impersonation/context";
 export type { ImpersonationActive } from "../impersonation/cookies";
-export { FOREIGN_BUSINESS_ERROR } from "../impersonation/required";
 export { isAllowedRedirect } from "../impersonation/redirects";
 export { signIn, SessionProvider } from "next-auth/react";
 export {

package/src/components/Error/index.tsx

@@ -6,7 +6,7 @@ import { Alert, Avatar } from "@snokam/ui";
 import { SystemPage } from "@snokam/ui/system-page";
 import { ThemeScope } from "@snokam/ui/theme";
 import { useAuth } from "../../hooks";
-import { useOptionalConfig } from "@snokam/tenant";
+import { useTenantEntitlements } from "@snokam/tenant";
 
 export interface ErrorPageProps {
   message?: ReactNode;
@@ -23,8 +23,7 @@ export const Error = ({
 }: ErrorPageProps) => {
   const { session, signOut } = useAuth();
 
-  const config = useOptionalConfig();
-  const isProd = config?.NEXT_PUBLIC_ENVIRONMENT === "p";
+  const tenant = useTenantEntitlements();
 
   return (
     <SystemPage>
@@ -50,7 +49,7 @@ export const Error = ({
             <br />({session.user.email})
           </Styled.User>
         )}
-        {!isProd && (
+        {tenant?.personaMode && (
           <Alert severity="warning">
             Du er i test! Husk at det kun er mulig å logge inn <br />
             med en av våre testbrukere som du finner i 1Password.

package/src/handoff/business.ts

@@ -22,5 +22,10 @@ export async function hostOwner(url: string): Promise<HostOwner> {
     platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
     authToken: await getManagedBearer(),
   });
-  return tenant?.businessId ? { businessId: tenant.businessId } : UNKNOWN_HOST;
+  return tenant?.businessId
+    ? {
+        businessId: tenant.businessId,
+        displayName: tenant.displayName ?? undefined,
+      }
+    : UNKNOWN_HOST;
 }

package/src/handoff/seal.ts

@@ -2,7 +2,9 @@ export const PLATFORM_HOST = "platform";
 export const UNKNOWN_HOST = "unknown";
 
 export type HostOwner =
-  typeof PLATFORM_HOST | typeof UNKNOWN_HOST | { businessId: string };
+  | typeof PLATFORM_HOST
+  | typeof UNKNOWN_HOST
+  | { businessId: string; displayName?: string };
 
 export function maySealFor(
   owner: HostOwner,

package/src/impersonation/context.tsx

@@ -20,6 +20,7 @@ export interface StartImpersonationInput {
   targetName?: string;
   targetImage?: string;
   reason: string;
+  businessId?: string;
   redirectTo?: string;
   returnTo?: string;
   landingUrl?: string;

package/src/impersonation/handlers.ts

@@ -20,6 +20,7 @@ interface StartBody {
   targetName?: string;
   targetImage?: string;
   reason?: string;
+  businessId?: string;
   redirectTo?: string;
   returnTo?: string;
   landingUrl?: string;
@@ -85,6 +86,7 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
           targetEmail: body.targetEmail,
           targetName: body.targetName,
           reason: body.reason,
+          businessId: body.businessId,
         },
       })
     );

package/src/impersonation/picker.ts

@@ -0,0 +1,92 @@
+import type { ProtectedEmployee } from "@snokam/platform-client";
+import { Auth } from "../types";
+import { resolveAccessToken } from "../route-handler/token";
+import { platformCall, platformClient, platformNotConfigured } from "./request";
+import { hostOwner } from "../handoff/business";
+
+function persona(employee: ProtectedEmployee) {
+  return {
+    name: employee.name,
+    email: employee.email,
+    position: employee.position,
+    about: employee.about,
+    active: employee.active,
+    isBot: employee.isBot,
+    image: { asset: { url: employee.image?.asset?.url } },
+    scopeGrants: employee.scopeGrants,
+    groups: (employee.groups ?? []).map((group) => ({
+      name: group.name,
+      scopeGrants: group.scopeGrants,
+    })),
+  };
+}
+
+interface ReturnBusiness {
+  id: string;
+  displayName: string | null;
+}
+
+async function returnBusiness(
+  request: Request
+): Promise<ReturnBusiness | null> {
+  const returnTo = new URL(request.url).searchParams.get("returnTo");
+  if (!returnTo || !URL.canParse(returnTo)) return null;
+  try {
+    const owner = await hostOwner(returnTo);
+    return typeof owner === "object"
+      ? { id: owner.businessId, displayName: owner.displayName ?? null }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+async function callerClient(authConfig: Auth.Config, request: Request) {
+  const caller = await resolveAccessToken(authConfig, request);
+  if ("error" in caller) return { error: caller.error };
+  const client = platformClient(caller.accessToken);
+  return client ? { client } : { error: platformNotConfigured() };
+}
+
+export function createPickerBusinessesHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    const caller = await callerClient(authConfig, request);
+    if ("error" in caller) return caller.error;
+
+    const [businesses, apps] = await Promise.all([
+      platformCall(caller.client.listImpersonationBusinesses()),
+      platformCall(caller.client.getMeApps()),
+    ]);
+    if ("error" in businesses) return businesses.error;
+    if ("error" in apps) return apps.error;
+    if (businesses.value.length === 0) {
+      return new Response("Not found", { status: 404 });
+    }
+
+    return Response.json({
+      businesses: businesses.value,
+      apps: apps.value,
+      returnBusiness: await returnBusiness(request),
+    });
+  };
+}
+
+export function createPickerPeopleHandler(authConfig: Auth.Config) {
+  return async function GET(request: Request) {
+    const businessId = new URL(request.url).searchParams.get("businessId");
+    if (!businessId) return new Response("Missing businessId", { status: 400 });
+
+    const caller = await callerClient(authConfig, request);
+    if ("error" in caller) return caller.error;
+
+    const people = await platformCall(
+      caller.client.listImpersonationPeople({ businessId })
+    );
+    if ("error" in people) return people.error;
+
+    return Response.json({
+      kind: people.value.kind,
+      people: (people.value.people ?? []).map(persona),
+    });
+  };
+}

package/src/impersonation/required.ts

@@ -2,8 +2,6 @@ import type { TokenClaims } from "./claims";
 
 export const IMPERSONATION_REQUIRED_ERROR = "impersonation_required";
 
-export const FOREIGN_BUSINESS_ERROR = "foreign_business";
-
 export const IMPERSONATION_PICKER_PATH = "/velg-bruker";
 
 const RENEW_MARGIN_SECONDS = 120;

package/src/impersonation/routes.ts

@@ -5,7 +5,10 @@ import {
   createImpersonationAdoptHandler,
 } from "./handlers";
 import { createImpersonationRenewHandler } from "./renew";
-import { createImpersonationPersonasHandler } from "./personas";
+import {
+  createPickerBusinessesHandler,
+  createPickerPeopleHandler,
+} from "./picker";
 
 type OpContext = { params: Promise<{ op: string }> };
 
@@ -14,13 +17,15 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
   const end = createImpersonationEndHandler(authConfig);
   const adopt = createImpersonationAdoptHandler(authConfig);
   const renew = createImpersonationRenewHandler(authConfig);
-  const personas = createImpersonationPersonasHandler(authConfig);
+  const businesses = createPickerBusinessesHandler(authConfig);
+  const people = createPickerPeopleHandler(authConfig);
 
   return {
     async GET(request: Request, ctx: OpContext) {
       const { op } = await ctx.params;
       if (op === "adopt") return adopt(request);
-      if (op === "personas") return personas(request);
+      if (op === "businesses") return businesses(request);
+      if (op === "people") return people(request);
       return new Response("Not found", { status: 404 });
     },
     async POST(request: Request, ctx: OpContext) {

package/src/impersonation/personas.ts

@@ -1,64 +0,0 @@
-import type { ProtectedEmployee } from "@snokam/platform-client";
-import { Auth } from "../types";
-import { resolveAccessToken } from "../route-handler/token";
-import { tokenClaims } from "./claims";
-import { platformCall, platformClient, platformNotConfigured } from "./request";
-import { FOREIGN_BUSINESS_ERROR, personaRequired } from "./required";
-import { hostOwner } from "../handoff/business";
-import { maySealFor } from "../handoff/seal";
-
-function persona(employee: ProtectedEmployee) {
-  return {
-    name: employee.name,
-    email: employee.email,
-    position: employee.position,
-    about: employee.about,
-    active: employee.active,
-    isBot: employee.isBot,
-    image: { asset: { url: employee.image?.asset?.url } },
-    scopeGrants: employee.scopeGrants,
-    groups: (employee.groups ?? []).map((group) => ({
-      name: group.name,
-      scopeGrants: group.scopeGrants,
-    })),
-  };
-}
-
-async function isForeignReturn(
-  request: Request,
-  callerBusiness: string | undefined
-): Promise<boolean> {
-  const returnTo = new URL(request.url).searchParams.get("returnTo");
-  if (!returnTo || !URL.canParse(returnTo)) return false;
-  return !maySealFor(await hostOwner(returnTo), callerBusiness);
-}
-
-export function createImpersonationPersonasHandler(authConfig: Auth.Config) {
-  return async function GET(request: Request) {
-    const caller = await resolveAccessToken(authConfig, request);
-    if ("error" in caller) return caller.error;
-
-    const claims = tokenClaims(caller.accessToken);
-    if (await isForeignReturn(request, claims.biz)) {
-      return Response.json({ error: FOREIGN_BUSINESS_ERROR }, { status: 403 });
-    }
-    if (!personaRequired(claims)) {
-      return new Response("Not found", { status: 404 });
-    }
-
-    const client = platformClient(caller.accessToken);
-    if (!client) return platformNotConfigured();
-
-    const [personas, apps] = await Promise.all([
-      platformCall(client.listTestPersonas()),
-      platformCall(client.getMeApps()),
-    ]);
-    if ("error" in personas) return personas.error;
-    if ("error" in apps) return apps.error;
-
-    return Response.json({
-      personas: personas.value.map(persona),
-      apps: apps.value,
-    });
-  };
-}