@snokam/auth 5.2.1 → 5.3.0

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [5.3.0](https://github.com/snokam/components/compare/@snokam/auth@5.2.2...@snokam/auth@5.3.0) (2026-10-14)
+
+### Features
+
+- Vis som in test is prod plus operator persona starts (platform setting) ([#2944](https://github.com/snokam/components/issues/2944)) ([40084cc](https://github.com/snokam/components/commit/40084ccec44e34308e8007fb7ff0f270a5078bfc)), closes [#2917](https://github.com/snokam/components/issues/2917) [#2894](https://github.com/snokam/components/issues/2894) [#2913](https://github.com/snokam/components/issues/2913)
+
+## [5.2.2](https://github.com/snokam/components/compare/@snokam/auth@5.2.0...@snokam/auth@5.2.2) (2026-10-14)
+
+### Bug Fixes
+
+- **platform-web:** show persona photos in the Vis som picker ([#2939](https://github.com/snokam/components/issues/2939)) ([125a20b](https://github.com/snokam/components/commit/125a20bdee81b673ace57d27541507bbbe6f6fbd))
+
 ## [5.2.1](https://github.com/snokam/components/compare/@snokam/auth@5.2.0...@snokam/auth@5.2.1) (2026-10-14)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.2.1",
+  "version": "5.3.0",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -27,11 +27,11 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
+    "@snokam/platform-client": "5.3.0",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "6.4.0",
-    "@snokam/tenant": "4.2.0",
-    "@snokam/ui": "6.0.3",
-    "@snokam/platform-client": "5.2.0"
+    "@snokam/sanity-page-content": "6.5.1",
+    "@snokam/tenant": "4.3.0",
+    "@snokam/ui": "6.1.0"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/app-sign-in/handlers.ts

@@ -6,13 +6,6 @@ import {
   requestOrigin,
 } from "../session";
 import { resolveAccessToken } from "../route-handler/token";
-import { readImpersonationSession } from "../impersonation/cookies";
-import { tokenClaims } from "../impersonation/claims";
-import {
-  chooseToken,
-  impersonationPickerUrl,
-  PERSONA_REQUIRED,
-} from "../impersonation/required";
 import type { Auth } from "../types";
 import {
   type AuthorizationParams,
@@ -58,23 +51,7 @@ interface Signer {
   accessToken: string;
 }
 
-type SignerResult = Signer | typeof PERSONA_REQUIRED | null;
-
-function sameEmail(a: string | undefined, b: string): boolean {
-  return !!a && a.toLowerCase() === b.toLowerCase();
-}
-
-function personaSigner(request: Request, operator: string): Signer | null {
-  const session = readImpersonationSession(request);
-  if (!session || session.expiresOn * 1000 <= Date.now()) return null;
-
-  const claims = tokenClaims(session.accessToken);
-  if (!claims.email || !sameEmail(claims.act, operator)) return null;
-
-  return { email: claims.email, accessToken: session.accessToken };
-}
-
-async function ownSigner(
+async function signerFor(
   authConfig: Auth.Config,
   request: Request,
   email: string
@@ -83,25 +60,6 @@ async function ownSigner(
   return "error" in access ? null : { email, accessToken: access.accessToken };
 }
 
-async function signerFor(
-  authConfig: Auth.Config,
-  request: Request,
-  email: string
-): Promise<SignerResult> {
-  const persona = personaSigner(request, email);
-  if (persona) return persona;
-
-  const own = await ownSigner(authConfig, request, email);
-  return chooseToken(null, own, own ? tokenClaims(own.accessToken) : {});
-}
-
-function pickerRedirect(request: Request): Response {
-  const url = new URL(request.url);
-  const origin = requestOrigin(request);
-  const resume = `${origin}${url.pathname}${url.search}`;
-  return Response.redirect(impersonationPickerUrl(origin, resume), 302);
-}
-
 function loginRedirect(request: Request, resource: string, prompt?: string) {
   const url = new URL(request.url);
   const resume = new URLSearchParams(url.searchParams);
@@ -166,7 +124,6 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
     if (!signedIn) return loginRedirect(request, params.resource);
 
     const signer = await signerFor(authConfig, request, signedIn);
-    if (signer === PERSONA_REQUIRED) return pickerRedirect(request);
     if (!signer) return loginRedirect(request, params.resource);
 
     const preview = await previewAuthorization(params, signer.accessToken);
@@ -219,11 +176,7 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
     if (!signedIn) return invalidRequest();
 
     const signer = await signerFor(authConfig, request, signedIn);
-    if (
-      !signer ||
-      signer === PERSONA_REQUIRED ||
-      signer.email !== consent.email
-    ) {
+    if (!signer || signer.email !== consent.email) {
       return invalidRequest();
     }
 

package/src/components/Error/index.tsx

@@ -2,11 +2,10 @@
 
 import { ReactNode } from "react";
 import Styled from "./styled";
-import { Alert, Avatar } from "@snokam/ui";
+import { Avatar } from "@snokam/ui";
 import { SystemPage } from "@snokam/ui/system-page";
 import { ThemeScope } from "@snokam/ui/theme";
 import { useAuth } from "../../hooks";
-import { useTenantEntitlements } from "@snokam/tenant";
 
 export interface ErrorPageProps {
   message?: ReactNode;
@@ -23,8 +22,6 @@ export const Error = ({
 }: ErrorPageProps) => {
   const { session, signOut } = useAuth();
 
-  const tenant = useTenantEntitlements();
-
   return (
     <SystemPage>
       <ThemeScope theme="light" as={Styled.Wrapper}>
@@ -49,12 +46,6 @@ export const Error = ({
             <br />({session.user.email})
           </Styled.User>
         )}
-        {tenant?.personaMode && (
-          <Alert severity="warning">
-            Du er i test! Husk at det kun er mulig å logge inn <br />
-            med en av våre testbrukere som du finner i 1Password.
-          </Alert>
-        )}
         {action}
         {!hideRetryButton && (
           <Styled.RetryButton

package/src/hooks.ts

@@ -3,27 +3,9 @@ import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useSession } from "./session/useSession";
-import {
-  IMPERSONATION_REQUIRED_ERROR,
-  impersonationPickerUrl,
-  isSignInPage,
-} from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
 
-class ImpersonationRequiredError extends Error {
-  constructor(readonly platformUrl: string | undefined) {
-    super(IMPERSONATION_REQUIRED_ERROR);
-  }
-}
-
-function sendToPicker(error: ImpersonationRequiredError): void {
-  if (!error.platformUrl || isSignInPage(window.location.pathname)) return;
-  window.location.assign(
-    impersonationPickerUrl(error.platformUrl, window.location.href)
-  );
-}
-
 const REFRESH_MARGIN_SECONDS = 60;
 
 interface CachedToken {
@@ -75,9 +57,6 @@ async function fetchToken(impKey: string): Promise<string> {
     if (body?.error === "consent_required") {
       throw new ConsentRequiredError();
     }
-    if (body?.error === IMPERSONATION_REQUIRED_ERROR) {
-      throw new ImpersonationRequiredError(body.platformUrl);
-    }
   }
 
   if (!res.ok) {
@@ -144,10 +123,6 @@ export function useAuth() {
       session,
       getToken: () =>
         getFreshToken().catch((error) => {
-          if (error instanceof ImpersonationRequiredError) {
-            sendToPicker(error);
-            throw error;
-          }
           console.error(error);
           const onAuthPage = window.location.pathname.startsWith("/auth/");
           if (onAuthPage) return;

package/src/impersonation/claims.ts

@@ -3,7 +3,6 @@ export interface TokenClaims {
   email?: string;
   act?: string;
   imp?: string;
-  prs?: string;
   roles?: string | string[];
 }
 

package/src/impersonation/picker.ts

@@ -1,6 +1,7 @@
 import { Auth } from "../types";
 import { resolveAccessToken } from "../route-handler/token";
 import { platformCall, platformClient, platformNotConfigured } from "./request";
+import { tokenClaims } from "./claims";
 import { hostOwner } from "../handoff/business";
 
 interface ReturnBusiness {
@@ -27,7 +28,9 @@ async function callerClient(authConfig: Auth.Config, request: Request) {
   const caller = await resolveAccessToken(authConfig, request);
   if ("error" in caller) return { error: caller.error };
   const client = platformClient(caller.accessToken);
-  return client ? { client } : { error: platformNotConfigured() };
+  return client
+    ? { client, accessToken: caller.accessToken }
+    : { error: platformNotConfigured() };
 }
 
 export function createPickerBusinessesHandler(authConfig: Auth.Config) {
@@ -49,6 +52,7 @@ export function createPickerBusinessesHandler(authConfig: Auth.Config) {
       businesses: businesses.value,
       apps: apps.value,
       returnBusiness: await returnBusiness(request),
+      ownBusinessId: tokenClaims(caller.accessToken).biz ?? null,
     });
   };
 }

package/src/impersonation/required.test.ts

@@ -1,59 +1,8 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import {
-  chooseToken,
-  impersonationPickerUrl,
-  isSignInPage,
-  PERSONA_REQUIRED,
-  personaRequired,
-  renewDelayMs,
-} from "./required.ts";
-
-describe("token choice for the token route and MCP sign-in", () => {
-  const persona = { email: "persona@test.snokam.no", accessToken: "imp" };
-  const snokamSso = { email: "dev@snokam.no", accessToken: "own" };
-  const customerOwner = { email: "owner@acme.no", accessToken: "own" };
-
-  it("sends a persona-mode user without a persona to the picker", () => {
-    assert.equal(chooseToken(null, snokamSso, { prs: "1" }), PERSONA_REQUIRED);
-  });
-
-  it("signs as the chosen persona once a Vis som session is active", () => {
-    assert.equal(chooseToken(persona, snokamSso, { prs: "1" }), persona);
-  });
-
-  it("signs a customer as themselves", () => {
-    assert.equal(chooseToken(null, customerOwner, {}), customerOwner);
-  });
-
-  it("has nothing to sign with when there is no session", () => {
-    assert.equal(chooseToken(null, null, {}), null);
-  });
-});
-
-describe("persona required", () => {
-  const cases = [
-    { prs: false, imp: false, act: false, required: false },
-    { prs: false, imp: true, act: true, required: false },
-    { prs: false, imp: false, act: true, required: false },
-    { prs: false, imp: true, act: false, required: false },
-    { prs: true, imp: false, act: false, required: true },
-    { prs: true, imp: true, act: true, required: false },
-    { prs: true, imp: false, act: true, required: false },
-    { prs: true, imp: true, act: false, required: false },
-  ];
-
-  for (const { prs, imp, act, required } of cases) {
-    it(`is ${required} for prs=${prs} imp=${imp} act=${act}`, () => {
-      const claims = {
-        ...(prs ? { prs: "1" } : {}),
-        ...(imp ? { imp: "true" } : {}),
-        ...(act ? { act: "dev@snokam.no" } : {}),
-      };
-      assert.equal(personaRequired(claims), required);
-    });
-  }
+import { impersonationPickerUrl, renewDelayMs } from "./required.ts";
 
+describe("Vis som picker and renewal", () => {
   it("points the picker back at the page the person asked for", () => {
     const url = new URL(
       impersonationPickerUrl(
@@ -69,14 +18,6 @@ describe("persona required", () => {
     );
   });
 
-  it("never sends a sign-in page to the picker, at the root or under a base path", () => {
-    assert.equal(isSignInPage("/auth/complete"), true);
-    assert.equal(isSignInPage("/minside/auth/login"), true);
-    assert.equal(isSignInPage("/"), false);
-    assert.equal(isSignInPage("/okonomi"), false);
-    assert.equal(isSignInPage("/authors"), false);
-  });
-
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -1,41 +1,7 @@
-import type { TokenClaims } from "./claims";
-
-export const IMPERSONATION_REQUIRED_ERROR = "impersonation_required";
-
 export const IMPERSONATION_PICKER_PATH = "/velg-bruker";
 
 const RENEW_MARGIN_SECONDS = 120;
 
-export const PERSONA_REQUIRED = "persona_required";
-
-export function personaRequired(ownClaims: TokenClaims): boolean {
-  return !!ownClaims.prs && !ownClaims.imp && !ownClaims.act;
-}
-
-export function chooseToken<T>(
-  viewAs: T | null,
-  own: T | null,
-  ownClaims: TokenClaims
-): T | typeof PERSONA_REQUIRED | null {
-  if (viewAs) return viewAs;
-  if (!own) return null;
-  return personaRequired(ownClaims) ? PERSONA_REQUIRED : own;
-}
-
-export function impersonationRequiredResponse(): Response {
-  return Response.json(
-    {
-      error: IMPERSONATION_REQUIRED_ERROR,
-      platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
-    },
-    { status: 403 }
-  );
-}
-
-export function isSignInPage(pathname: string): boolean {
-  return /(^|\/)auth\//.test(pathname);
-}
-
 export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string

package/src/route-handler/token.ts

@@ -8,12 +8,6 @@ import { getAuthUrl, getSessionCookieSettings } from "../session";
 import { exchangePasswordToken } from "../password/api";
 import { readImpersonationSession } from "../impersonation/cookies";
 import { exchangeSsoToken } from "../sso/exchange";
-import { tokenClaims } from "../impersonation/claims";
-import {
-  chooseToken,
-  impersonationRequiredResponse,
-  PERSONA_REQUIRED,
-} from "../impersonation/required";
 
 export type TokenResult =
   { accessToken: string; expiresOn: number } | { error: Response };
@@ -120,10 +114,6 @@ export function createTokenHandler(authConfig: Auth.Config) {
     if ("error" in result) {
       return result.error;
     }
-    const chosen = chooseToken(null, result, tokenClaims(result.accessToken));
-    if (chosen === PERSONA_REQUIRED) {
-      return impersonationRequiredResponse();
-    }
-    return Response.json(chosen);
+    return Response.json(result);
   };
 }