@snokam/auth 5.2.2 → 5.3.1

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.3.1](https://github.com/snokam/components/compare/@snokam/auth@5.3.0...@snokam/auth@5.3.1) (2026-10-14)
+
+### Bug Fixes
+
+- Vis som follow-ups to [#2944](https://github.com/snokam/components/issues/2944) (policy split, banner once, exit everywhere) ([#2950](https://github.com/snokam/components/issues/2950)) ([a5a6037](https://github.com/snokam/components/commit/a5a60377afdbdf9abfd5074f7cbbdd604e4a8def)), closes [#2948](https://github.com/snokam/components/issues/2948)
+
+# [5.3.0](https://github.com/snokam/components/compare/@snokam/auth@5.2.2...@snokam/auth@5.3.0) (2026-10-14)
+
+### Features
+
+- Vis som in test is prod plus operator persona starts (platform setting) ([#2944](https://github.com/snokam/components/issues/2944)) ([40084cc](https://github.com/snokam/components/commit/40084ccec44e34308e8007fb7ff0f270a5078bfc)), closes [#2917](https://github.com/snokam/components/issues/2917) [#2894](https://github.com/snokam/components/issues/2894) [#2913](https://github.com/snokam/components/issues/2913)
+
 ## [5.2.2](https://github.com/snokam/components/compare/@snokam/auth@5.2.0...@snokam/auth@5.2.2) (2026-10-14)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.2.2",
+  "version": "5.3.1",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,11 +26,11 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "5.2.0",
+    "@snokam/platform-client": "5.3.1",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "6.5.0",
-    "@snokam/tenant": "4.2.0",
+    "@snokam/sanity-page-content": "6.5.2",
+    "@snokam/tenant": "4.3.1",
+    "@snokam/identity": "1.1.0",
     "@snokam/ui": "6.1.0"
   },
   "peerDependencies": {

package/src/app-router/components/Login.tsx

@@ -1,12 +1,12 @@
 "use client";
 
 import { useEffect, useState, useRef } from "react";
-import { useRouter, useSearchParams } from "next/navigation";
+import { useSearchParams } from "next/navigation";
 import { useAuth } from "../../hooks";
 import { signIn } from "next-auth/react";
 import { PageLoader } from "@snokam/ui";
 import { useOptionalConfig } from "@snokam/tenant";
-import { safeCallbackTarget } from "../../session";
+import { callbackDestination, safeCallbackTarget } from "../../session";
 import Error from "../../components/Error";
 import Consent from "../../components/Consent";
 import LoggedOut from "../../components/LoggedOut";
@@ -18,7 +18,6 @@ export const Login = () => {
   const [errorKind, setErrorKind] = useState<string | null>(null);
   const [loggedOut, setLoggedOut] = useState(false);
   const hasSignedIn = useRef(false);
-  const router = useRouter();
   const searchParams = useSearchParams();
   const config = useOptionalConfig();
   const central = config?.NEXT_PUBLIC_CENTRAL_AUTH_URL;
@@ -76,21 +75,15 @@ export const Login = () => {
     }
 
     if (isAuthenticated) {
-      router.replace(callbackUrl || "/");
+      window.location.replace(
+        callbackDestination(callbackUrl, window.location.origin)
+      );
     } else if (!loggedOut) {
       hasSignedIn.current = true;
       startSignIn();
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [
-    inProgress,
-    isAuthenticated,
-    callbackUrl,
-    router,
-    isError,
-    central,
-    loggedOut,
-  ]);
+  }, [inProgress, isAuthenticated, callbackUrl, isError, central, loggedOut]);
 
   if (loggedOut && !isAuthenticated && !isError) {
     return (

package/src/app-sign-in/handlers.ts

@@ -6,13 +6,6 @@ import {
   requestOrigin,
 } from "../session";
 import { resolveAccessToken } from "../route-handler/token";
-import { readImpersonationSession } from "../impersonation/cookies";
-import { tokenClaims } from "../impersonation/claims";
-import {
-  chooseToken,
-  impersonationPickerUrl,
-  PERSONA_REQUIRED,
-} from "../impersonation/required";
 import type { Auth } from "../types";
 import {
   type AuthorizationParams,
@@ -58,23 +51,7 @@ interface Signer {
   accessToken: string;
 }
 
-type SignerResult = Signer | typeof PERSONA_REQUIRED | null;
-
-function sameEmail(a: string | undefined, b: string): boolean {
-  return !!a && a.toLowerCase() === b.toLowerCase();
-}
-
-function personaSigner(request: Request, operator: string): Signer | null {
-  const session = readImpersonationSession(request);
-  if (!session || session.expiresOn * 1000 <= Date.now()) return null;
-
-  const claims = tokenClaims(session.accessToken);
-  if (!claims.email || !sameEmail(claims.act, operator)) return null;
-
-  return { email: claims.email, accessToken: session.accessToken };
-}
-
-async function ownSigner(
+async function signerFor(
   authConfig: Auth.Config,
   request: Request,
   email: string
@@ -83,25 +60,6 @@ async function ownSigner(
   return "error" in access ? null : { email, accessToken: access.accessToken };
 }
 
-async function signerFor(
-  authConfig: Auth.Config,
-  request: Request,
-  email: string
-): Promise<SignerResult> {
-  const persona = personaSigner(request, email);
-  if (persona) return persona;
-
-  const own = await ownSigner(authConfig, request, email);
-  return chooseToken(null, own, own ? tokenClaims(own.accessToken) : {});
-}
-
-function pickerRedirect(request: Request): Response {
-  const url = new URL(request.url);
-  const origin = requestOrigin(request);
-  const resume = `${origin}${url.pathname}${url.search}`;
-  return Response.redirect(impersonationPickerUrl(origin, resume), 302);
-}
-
 function loginRedirect(request: Request, resource: string, prompt?: string) {
   const url = new URL(request.url);
   const resume = new URLSearchParams(url.searchParams);
@@ -166,7 +124,6 @@ export function createAppSignInAuthorizeHandler(authConfig: Auth.Config) {
     if (!signedIn) return loginRedirect(request, params.resource);
 
     const signer = await signerFor(authConfig, request, signedIn);
-    if (signer === PERSONA_REQUIRED) return pickerRedirect(request);
     if (!signer) return loginRedirect(request, params.resource);
 
     const preview = await previewAuthorization(params, signer.accessToken);
@@ -219,11 +176,7 @@ export function createAppSignInApproveHandler(authConfig: Auth.Config) {
     if (!signedIn) return invalidRequest();
 
     const signer = await signerFor(authConfig, request, signedIn);
-    if (
-      !signer ||
-      signer === PERSONA_REQUIRED ||
-      signer.email !== consent.email
-    ) {
+    if (!signer || signer.email !== consent.email) {
       return invalidRequest();
     }
 

package/src/components/Error/index.tsx

@@ -2,11 +2,10 @@
 
 import { ReactNode } from "react";
 import Styled from "./styled";
-import { Alert, Avatar } from "@snokam/ui";
+import { Avatar } from "@snokam/ui";
 import { SystemPage } from "@snokam/ui/system-page";
 import { ThemeScope } from "@snokam/ui/theme";
 import { useAuth } from "../../hooks";
-import { useTenantEntitlements } from "@snokam/tenant";
 
 export interface ErrorPageProps {
   message?: ReactNode;
@@ -23,8 +22,6 @@ export const Error = ({
 }: ErrorPageProps) => {
   const { session, signOut } = useAuth();
 
-  const tenant = useTenantEntitlements();
-
   return (
     <SystemPage>
       <ThemeScope theme="light" as={Styled.Wrapper}>
@@ -49,12 +46,6 @@ export const Error = ({
             <br />({session.user.email})
           </Styled.User>
         )}
-        {tenant?.personaMode && (
-          <Alert severity="warning">
-            Du er i test! Husk at det kun er mulig å logge inn <br />
-            med en av våre testbrukere som du finner i 1Password.
-          </Alert>
-        )}
         {action}
         {!hideRetryButton && (
           <Styled.RetryButton

package/src/hooks.ts

@@ -3,27 +3,9 @@ import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useSession } from "./session/useSession";
-import {
-  IMPERSONATION_REQUIRED_ERROR,
-  impersonationPickerUrl,
-  isSignInPage,
-} from "./impersonation/required";
 
 class ConsentRequiredError extends Error {}
 
-class ImpersonationRequiredError extends Error {
-  constructor(readonly platformUrl: string | undefined) {
-    super(IMPERSONATION_REQUIRED_ERROR);
-  }
-}
-
-function sendToPicker(error: ImpersonationRequiredError): void {
-  if (!error.platformUrl || isSignInPage(window.location.pathname)) return;
-  window.location.assign(
-    impersonationPickerUrl(error.platformUrl, window.location.href)
-  );
-}
-
 const REFRESH_MARGIN_SECONDS = 60;
 
 interface CachedToken {
@@ -75,9 +57,6 @@ async function fetchToken(impKey: string): Promise<string> {
     if (body?.error === "consent_required") {
       throw new ConsentRequiredError();
     }
-    if (body?.error === IMPERSONATION_REQUIRED_ERROR) {
-      throw new ImpersonationRequiredError(body.platformUrl);
-    }
   }
 
   if (!res.ok) {
@@ -144,10 +123,6 @@ export function useAuth() {
       session,
       getToken: () =>
         getFreshToken().catch((error) => {
-          if (error instanceof ImpersonationRequiredError) {
-            sendToPicker(error);
-            throw error;
-          }
           console.error(error);
           const onAuthPage = window.location.pathname.startsWith("/auth/");
           if (onAuthPage) return;

package/src/impersonation/claims.test.ts

@@ -1,29 +1,22 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import { claimedRoles, tokenClaims } from "./claims.ts";
+import { tokenClaims } from "./claims.ts";
 
 function token(payload: object): string {
   const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
   return `header.${encoded}.signature`;
 }
 
-describe("roles carried by a view-as token", () => {
-  it("reads the actor and a single role", () => {
+describe("claims of a view-as token", () => {
+  it("reads the actor and the business", () => {
     const claims = tokenClaims(
-      token({
-        act: "morten.jansrud@test.snokam.no",
-        roles: "platform-operator",
-      })
+      token({ act: "morten.jansrud@test.snokam.no", biz: "biz-1" })
     );
     assert.equal(claims.act, "morten.jansrud@test.snokam.no");
-    assert.deepEqual(claimedRoles(claims), ["platform-operator"]);
+    assert.equal(claims.biz, "biz-1");
   });
 
-  it("reads several roles and none", () => {
-    assert.deepEqual(claimedRoles(tokenClaims(token({ roles: ["a", "b"] }))), [
-      "a",
-      "b",
-    ]);
-    assert.deepEqual(claimedRoles(tokenClaims(token({}))), []);
+  it("reads nothing from a malformed token", () => {
+    assert.deepEqual(tokenClaims("not-a-token"), {});
   });
 });

package/src/impersonation/claims.ts

@@ -3,13 +3,6 @@ export interface TokenClaims {
   email?: string;
   act?: string;
   imp?: string;
-  prs?: string;
-  roles?: string | string[];
-}
-
-export function claimedRoles(claims: TokenClaims): string[] {
-  if (!claims.roles) return [];
-  return Array.isArray(claims.roles) ? claims.roles : [claims.roles];
 }
 
 export function tokenClaims(accessToken: string): TokenClaims {

package/src/impersonation/context.tsx

@@ -14,6 +14,7 @@ import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
 import { useOptionalConfig } from "@snokam/tenant";
 import { isAllowedRedirect, platformBaseDomain } from "./redirects";
+import { exitDestination } from "./exit";
 
 export interface StartImpersonationInput {
   targetEmail: string;
@@ -121,12 +122,14 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
       }).catch(() => undefined);
       clearAuthTokenCache();
       const returnTo = active?.returnTo;
+      const destination =
+        returnTo && isSafeReturnTo(returnTo, apiBaseUrl)
+          ? returnTo
+          : window.location.href;
       setActive(null);
-      if (returnTo && isSafeReturnTo(returnTo, apiBaseUrl)) {
-        window.location.assign(returnTo);
-      } else {
-        window.location.reload();
-      }
+      window.location.assign(
+        exitDestination(active?.origins, window.location.origin, destination)
+      );
     } finally {
       setExiting(false);
     }

package/src/impersonation/cookies.ts

@@ -1,5 +1,5 @@
 import { resolveCookieDomain } from "../session";
-import { claimedRoles, tokenClaims } from "./claims";
+import { tokenClaims } from "./claims";
 
 export const IMP_SESSION_COOKIE = "imp_session";
 export const IMP_ACTIVE_COOKIE = "imp_active";
@@ -19,7 +19,7 @@ export interface ImpersonationActive {
   expiresOn: number;
   returnTo?: string;
   actorEmail?: string;
-  roles?: string[];
+  origins?: string[];
 }
 
 interface MintedToken {
@@ -31,6 +31,7 @@ interface MintedToken {
   targetImage?: string | null;
   finance: boolean;
   returnTo?: string;
+  origins?: string[];
 }
 
 function parseCookieHeader(header: string | null): Record<string, string> {
@@ -103,7 +104,6 @@ export function buildImpersonationCookies(
   const claims = tokenClaims(minted.accessToken);
   const active: ImpersonationActive = {
     actorEmail: claims.act,
-    roles: claimedRoles(claims),
     targetEmail: minted.targetEmail,
     targetName: minted.targetName,
     targetImage: minted.targetImage,
@@ -111,6 +111,7 @@ export function buildImpersonationCookies(
     tokenId: minted.tokenId,
     expiresOn: minted.expiresOn,
     returnTo: minted.returnTo,
+    origins: minted.origins,
   };
   return [
     serialize(IMP_SESSION_COOKIE, JSON.stringify(session), {

package/src/impersonation/exit.test.ts

@@ -0,0 +1,29 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { exitDestination } from "./exit.ts";
+
+const platform = "https://www.test.snosky.no";
+const tenant = "https://snokam.test.snosky.no";
+const minside = `${tenant}/minside`;
+
+describe("leaving Vis som", () => {
+  it("clears the other host before landing when the session spans two hosts", () => {
+    const url = new URL(exitDestination([platform, tenant], tenant, minside));
+    assert.equal(url.origin, platform);
+    assert.equal(url.pathname, "/api/impersonation/clear");
+    assert.equal(url.searchParams.get("returnTo"), minside);
+  });
+
+  it("clears the tenant host when leaving from the platform host", () => {
+    const url = new URL(
+      exitDestination([platform, tenant], platform, `${platform}/manage`)
+    );
+    assert.equal(url.origin, tenant);
+    assert.equal(url.searchParams.get("returnTo"), `${platform}/manage`);
+  });
+
+  it("goes straight to the destination when only this host holds the session", () => {
+    assert.equal(exitDestination([tenant], tenant, minside), minside);
+    assert.equal(exitDestination(undefined, tenant, minside), minside);
+  });
+});

package/src/impersonation/exit.ts

@@ -0,0 +1,13 @@
+export const CLEAR_PATH = "/api/impersonation/clear";
+
+export function exitDestination(
+  origins: string[] | undefined,
+  currentOrigin: string,
+  destination: string
+): string {
+  const other = (origins ?? []).find((origin) => origin !== currentOrigin);
+  if (!other) return destination;
+  const clear = new URL(CLEAR_PATH, other);
+  clear.searchParams.set("returnTo", destination);
+  return clear.toString();
+}

package/src/impersonation/handlers.ts

@@ -108,18 +108,23 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
       tokenId: result.tokenId,
       expiresOn: result.expiresOn,
     };
+    const here = requestOrigin(request);
+    const target =
+      body.redirectTo && handsOffToTarget(request, body.redirectTo)
+        ? new URL(body.redirectTo)
+        : null;
+    const origins = target ? [here, target.origin] : [here];
     const cookies = buildImpersonationCookies(
-      { ...result, returnTo: body.returnTo },
+      { ...result, returnTo: body.returnTo, origins },
       requestHost(request)
     );
 
-    if (!body.redirectTo || !handsOffToTarget(request, body.redirectTo)) {
+    if (!target) {
       return withCookies(Response.json(summary), cookies);
     }
 
-    const target = new URL(body.redirectTo);
     const ticket = sealImpersonationTicket(
-      { ...result, business: target.host, returnTo: body.returnTo },
+      { ...result, business: target.host, returnTo: body.returnTo, origins },
       authConfig.nextAuthSecret
     );
     const adopt = new URL("/api/impersonation/adopt", target.origin);
@@ -169,6 +174,20 @@ export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
   };
 }
 
+export function createImpersonationClearHandler() {
+  return async function GET(request: Request) {
+    const origin = requestOrigin(request);
+    const dest = resolveLanding(
+      new URL(request.url).searchParams.get("returnTo") || "/",
+      origin
+    );
+    return withCookies(
+      new Response(null, { status: 302, headers: { Location: dest } }),
+      clearImpersonationCookies(requestHost(request))
+    );
+  };
+}
+
 export function createImpersonationEndHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
     const session = readImpersonationSession(request);

package/src/impersonation/picker.ts

@@ -1,6 +1,7 @@
 import { Auth } from "../types";
 import { resolveAccessToken } from "../route-handler/token";
 import { platformCall, platformClient, platformNotConfigured } from "./request";
+import { tokenClaims } from "./claims";
 import { hostOwner } from "../handoff/business";
 
 interface ReturnBusiness {
@@ -27,7 +28,9 @@ async function callerClient(authConfig: Auth.Config, request: Request) {
   const caller = await resolveAccessToken(authConfig, request);
   if ("error" in caller) return { error: caller.error };
   const client = platformClient(caller.accessToken);
-  return client ? { client } : { error: platformNotConfigured() };
+  return client
+    ? { client, accessToken: caller.accessToken }
+    : { error: platformNotConfigured() };
 }
 
 export function createPickerBusinessesHandler(authConfig: Auth.Config) {
@@ -39,7 +42,13 @@ export function createPickerBusinessesHandler(authConfig: Auth.Config) {
       platformCall(caller.client.listImpersonationBusinesses()),
       platformCall(caller.client.getMeApps()),
     ]);
-    if ("error" in businesses) return businesses.error;
+    if ("error" in businesses) {
+      if (businesses.error.status !== 403) return businesses.error;
+      return Response.json(
+        { returnBusiness: await returnBusiness(request) },
+        { status: 403 }
+      );
+    }
     if ("error" in apps) return apps.error;
     if (businesses.value.length === 0) {
       return new Response("Not found", { status: 404 });
@@ -49,6 +58,7 @@ export function createPickerBusinessesHandler(authConfig: Auth.Config) {
       businesses: businesses.value,
       apps: apps.value,
       returnBusiness: await returnBusiness(request),
+      ownBusinessId: tokenClaims(caller.accessToken).biz ?? null,
     });
   };
 }

package/src/impersonation/required.test.ts

@@ -1,59 +1,8 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import {
-  chooseToken,
-  impersonationPickerUrl,
-  isSignInPage,
-  PERSONA_REQUIRED,
-  personaRequired,
-  renewDelayMs,
-} from "./required.ts";
-
-describe("token choice for the token route and MCP sign-in", () => {
-  const persona = { email: "persona@test.snokam.no", accessToken: "imp" };
-  const snokamSso = { email: "dev@snokam.no", accessToken: "own" };
-  const customerOwner = { email: "owner@acme.no", accessToken: "own" };
-
-  it("sends a persona-mode user without a persona to the picker", () => {
-    assert.equal(chooseToken(null, snokamSso, { prs: "1" }), PERSONA_REQUIRED);
-  });
-
-  it("signs as the chosen persona once a Vis som session is active", () => {
-    assert.equal(chooseToken(persona, snokamSso, { prs: "1" }), persona);
-  });
-
-  it("signs a customer as themselves", () => {
-    assert.equal(chooseToken(null, customerOwner, {}), customerOwner);
-  });
-
-  it("has nothing to sign with when there is no session", () => {
-    assert.equal(chooseToken(null, null, {}), null);
-  });
-});
-
-describe("persona required", () => {
-  const cases = [
-    { prs: false, imp: false, act: false, required: false },
-    { prs: false, imp: true, act: true, required: false },
-    { prs: false, imp: false, act: true, required: false },
-    { prs: false, imp: true, act: false, required: false },
-    { prs: true, imp: false, act: false, required: true },
-    { prs: true, imp: true, act: true, required: false },
-    { prs: true, imp: false, act: true, required: false },
-    { prs: true, imp: true, act: false, required: false },
-  ];
-
-  for (const { prs, imp, act, required } of cases) {
-    it(`is ${required} for prs=${prs} imp=${imp} act=${act}`, () => {
-      const claims = {
-        ...(prs ? { prs: "1" } : {}),
-        ...(imp ? { imp: "true" } : {}),
-        ...(act ? { act: "dev@snokam.no" } : {}),
-      };
-      assert.equal(personaRequired(claims), required);
-    });
-  }
+import { impersonationPickerUrl, renewDelayMs } from "./required.ts";
 
+describe("Vis som picker and renewal", () => {
   it("points the picker back at the page the person asked for", () => {
     const url = new URL(
       impersonationPickerUrl(
@@ -69,14 +18,6 @@ describe("persona required", () => {
     );
   });
 
-  it("never sends a sign-in page to the picker, at the root or under a base path", () => {
-    assert.equal(isSignInPage("/auth/complete"), true);
-    assert.equal(isSignInPage("/minside/auth/login"), true);
-    assert.equal(isSignInPage("/"), false);
-    assert.equal(isSignInPage("/okonomi"), false);
-    assert.equal(isSignInPage("/authors"), false);
-  });
-
   it("renews two minutes before the token expires, and at once when already late", () => {
     assert.equal(renewDelayMs(1_000, 0), 880_000);
     assert.equal(renewDelayMs(1_000, 999_000), 0);

package/src/impersonation/required.ts

@@ -1,41 +1,7 @@
-import type { TokenClaims } from "./claims";
-
-export const IMPERSONATION_REQUIRED_ERROR = "impersonation_required";
-
 export const IMPERSONATION_PICKER_PATH = "/velg-bruker";
 
 const RENEW_MARGIN_SECONDS = 120;
 
-export const PERSONA_REQUIRED = "persona_required";
-
-export function personaRequired(ownClaims: TokenClaims): boolean {
-  return !!ownClaims.prs && !ownClaims.imp && !ownClaims.act;
-}
-
-export function chooseToken<T>(
-  viewAs: T | null,
-  own: T | null,
-  ownClaims: TokenClaims
-): T | typeof PERSONA_REQUIRED | null {
-  if (viewAs) return viewAs;
-  if (!own) return null;
-  return personaRequired(ownClaims) ? PERSONA_REQUIRED : own;
-}
-
-export function impersonationRequiredResponse(): Response {
-  return Response.json(
-    {
-      error: IMPERSONATION_REQUIRED_ERROR,
-      platformUrl: process.env.NEXT_PUBLIC_PLATFORM_BASE_URL,
-    },
-    { status: 403 }
-  );
-}
-
-export function isSignInPage(pathname: string): boolean {
-  return /(^|\/)auth\//.test(pathname);
-}
-
 export function impersonationPickerUrl(
   platformBaseUrl: string,
   returnTo: string

package/src/impersonation/routes.ts

@@ -3,6 +3,7 @@ import {
   createImpersonationStartHandler,
   createImpersonationEndHandler,
   createImpersonationAdoptHandler,
+  createImpersonationClearHandler,
 } from "./handlers";
 import { createImpersonationRenewHandler } from "./renew";
 import {
@@ -16,6 +17,7 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
   const start = createImpersonationStartHandler(authConfig);
   const end = createImpersonationEndHandler(authConfig);
   const adopt = createImpersonationAdoptHandler(authConfig);
+  const clear = createImpersonationClearHandler();
   const renew = createImpersonationRenewHandler(authConfig);
   const businesses = createPickerBusinessesHandler(authConfig);
   const people = createPickerPeopleHandler(authConfig);
@@ -24,6 +26,7 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
     async GET(request: Request, ctx: OpContext) {
       const { op } = await ctx.params;
       if (op === "adopt") return adopt(request);
+      if (op === "clear") return clear(request);
       if (op === "businesses") return businesses(request);
       if (op === "people") return people(request);
       return new Response("Not found", { status: 404 });

package/src/impersonation/ticket.ts

@@ -9,6 +9,7 @@ export interface ImpersonationTicket {
   finance: boolean;
   business: string;
   returnTo?: string;
+  origins?: string[];
 }
 
 const TTL_SECONDS = 120;

package/src/route-handler/token.ts

@@ -8,12 +8,6 @@ import { getAuthUrl, getSessionCookieSettings } from "../session";
 import { exchangePasswordToken } from "../password/api";
 import { readImpersonationSession } from "../impersonation/cookies";
 import { exchangeSsoToken } from "../sso/exchange";
-import { tokenClaims } from "../impersonation/claims";
-import {
-  chooseToken,
-  impersonationRequiredResponse,
-  PERSONA_REQUIRED,
-} from "../impersonation/required";
 
 export type TokenResult =
   { accessToken: string; expiresOn: number } | { error: Response };
@@ -120,10 +114,6 @@ export function createTokenHandler(authConfig: Auth.Config) {
     if ("error" in result) {
       return result.error;
     }
-    const chosen = chooseToken(null, result, tokenClaims(result.accessToken));
-    if (chosen === PERSONA_REQUIRED) {
-      return impersonationRequiredResponse();
-    }
-    return Response.json(chosen);
+    return Response.json(result);
   };
 }

package/src/session/callback-url.test.ts

@@ -0,0 +1,22 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { callbackDestination } from "./callback-url.ts";
+
+describe("where an already signed-in login page sends you", () => {
+  const origin = "https://snokam.test.snosky.no";
+
+  it("keeps the basePath the callbackUrl already carries, once", () => {
+    assert.equal(
+      callbackDestination("/minside", origin),
+      "https://snokam.test.snosky.no/minside"
+    );
+    assert.equal(
+      callbackDestination("/minside/okonomi?x=1", origin),
+      "https://snokam.test.snosky.no/minside/okonomi?x=1"
+    );
+  });
+
+  it("falls back to the host root", () => {
+    assert.equal(callbackDestination(null, origin), `${origin}/`);
+  });
+});

package/src/session/callback-url.ts

@@ -15,3 +15,11 @@ export function safeCallbackTarget(
   }
   return AUTH_FLOW.test(target) ? "/" : target;
 }
+
+// A callbackUrl already carries the app's basePath; the Next router would add it again.
+export function callbackDestination(
+  callbackUrl: string | null,
+  origin: string
+): string {
+  return new URL(callbackUrl || "/", origin).toString();
+}

package/src/session/index.ts

@@ -1,3 +1,3 @@
 export { resolveCookieDomain, getSessionCookieSettings } from "./cookies";
 export { getAuthUrl, requestOrigin } from "./url";
-export { safeCallbackTarget } from "./callback-url";
+export { callbackDestination, safeCallbackTarget } from "./callback-url";