@snokam/auth 5.3.0 → 5.3.2

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.3.2](https://github.com/snokam/components/compare/@snokam/auth@5.3.1...@snokam/auth@5.3.2) (2026-10-14)
+
+### Bug Fixes
+
+- **auth:** allow-list and chain every Vis som session host on exit ([#2951](https://github.com/snokam/components/issues/2951)) ([ee10692](https://github.com/snokam/components/commit/ee1069225349380b3a7d7087ed6007a3a4fff28e))
+
+## [5.3.1](https://github.com/snokam/components/compare/@snokam/auth@5.3.0...@snokam/auth@5.3.1) (2026-10-14)
+
+### Bug Fixes
+
+- Vis som follow-ups to [#2944](https://github.com/snokam/components/issues/2944) (policy split, banner once, exit everywhere) ([#2950](https://github.com/snokam/components/issues/2950)) ([a5a6037](https://github.com/snokam/components/commit/a5a60377afdbdf9abfd5074f7cbbdd604e4a8def)), closes [#2948](https://github.com/snokam/components/issues/2948)
+
 # [5.3.0](https://github.com/snokam/components/compare/@snokam/auth@5.2.2...@snokam/auth@5.3.0) (2026-10-14)
 
 ### Features

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.3.0",
+  "version": "5.3.2",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -27,10 +27,10 @@
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "5.3.0",
+    "@snokam/platform-client": "5.3.1",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "6.5.1",
-    "@snokam/tenant": "4.3.0",
+    "@snokam/sanity-page-content": "6.5.2",
+    "@snokam/tenant": "4.3.1",
     "@snokam/ui": "6.1.0"
   },
   "peerDependencies": {

package/src/app-router/components/Login.tsx

@@ -1,12 +1,12 @@
 "use client";
 
 import { useEffect, useState, useRef } from "react";
-import { useRouter, useSearchParams } from "next/navigation";
+import { useSearchParams } from "next/navigation";
 import { useAuth } from "../../hooks";
 import { signIn } from "next-auth/react";
 import { PageLoader } from "@snokam/ui";
 import { useOptionalConfig } from "@snokam/tenant";
-import { safeCallbackTarget } from "../../session";
+import { callbackDestination, safeCallbackTarget } from "../../session";
 import Error from "../../components/Error";
 import Consent from "../../components/Consent";
 import LoggedOut from "../../components/LoggedOut";
@@ -18,7 +18,6 @@ export const Login = () => {
   const [errorKind, setErrorKind] = useState<string | null>(null);
   const [loggedOut, setLoggedOut] = useState(false);
   const hasSignedIn = useRef(false);
-  const router = useRouter();
   const searchParams = useSearchParams();
   const config = useOptionalConfig();
   const central = config?.NEXT_PUBLIC_CENTRAL_AUTH_URL;
@@ -76,21 +75,15 @@ export const Login = () => {
     }
 
     if (isAuthenticated) {
-      router.replace(callbackUrl || "/");
+      window.location.replace(
+        callbackDestination(callbackUrl, window.location.origin)
+      );
     } else if (!loggedOut) {
       hasSignedIn.current = true;
       startSignIn();
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [
-    inProgress,
-    isAuthenticated,
-    callbackUrl,
-    router,
-    isError,
-    central,
-    loggedOut,
-  ]);
+  }, [inProgress, isAuthenticated, callbackUrl, isError, central, loggedOut]);
 
   if (loggedOut && !isAuthenticated && !isError) {
     return (

package/src/impersonation/claims.test.ts

@@ -1,29 +1,22 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import { claimedRoles, tokenClaims } from "./claims.ts";
+import { tokenClaims } from "./claims.ts";
 
 function token(payload: object): string {
   const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
   return `header.${encoded}.signature`;
 }
 
-describe("roles carried by a view-as token", () => {
-  it("reads the actor and a single role", () => {
+describe("claims of a view-as token", () => {
+  it("reads the actor and the business", () => {
     const claims = tokenClaims(
-      token({
-        act: "morten.jansrud@test.snokam.no",
-        roles: "platform-operator",
-      })
+      token({ act: "morten.jansrud@test.snokam.no", biz: "biz-1" })
     );
     assert.equal(claims.act, "morten.jansrud@test.snokam.no");
-    assert.deepEqual(claimedRoles(claims), ["platform-operator"]);
+    assert.equal(claims.biz, "biz-1");
   });
 
-  it("reads several roles and none", () => {
-    assert.deepEqual(claimedRoles(tokenClaims(token({ roles: ["a", "b"] }))), [
-      "a",
-      "b",
-    ]);
-    assert.deepEqual(claimedRoles(tokenClaims(token({}))), []);
+  it("reads nothing from a malformed token", () => {
+    assert.deepEqual(tokenClaims("not-a-token"), {});
   });
 });

package/src/impersonation/claims.ts

@@ -3,12 +3,6 @@ export interface TokenClaims {
   email?: string;
   act?: string;
   imp?: string;
-  roles?: string | string[];
-}
-
-export function claimedRoles(claims: TokenClaims): string[] {
-  if (!claims.roles) return [];
-  return Array.isArray(claims.roles) ? claims.roles : [claims.roles];
 }
 
 export function tokenClaims(accessToken: string): TokenClaims {

package/src/impersonation/context.tsx

@@ -14,6 +14,7 @@ import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
 import { useOptionalConfig } from "@snokam/tenant";
 import { isAllowedRedirect, platformBaseDomain } from "./redirects";
+import { exitDestination } from "./exit";
 
 export interface StartImpersonationInput {
   targetEmail: string;
@@ -121,12 +122,19 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
       }).catch(() => undefined);
       clearAuthTokenCache();
       const returnTo = active?.returnTo;
+      const destination =
+        returnTo && isSafeReturnTo(returnTo, apiBaseUrl)
+          ? returnTo
+          : window.location.href;
       setActive(null);
-      if (returnTo && isSafeReturnTo(returnTo, apiBaseUrl)) {
-        window.location.assign(returnTo);
-      } else {
-        window.location.reload();
-      }
+      window.location.assign(
+        exitDestination(
+          active?.origins,
+          window.location.origin,
+          destination,
+          (origin) => isSafeReturnTo(origin, apiBaseUrl)
+        )
+      );
     } finally {
       setExiting(false);
     }

package/src/impersonation/cookies.ts

@@ -1,5 +1,5 @@
 import { resolveCookieDomain } from "../session";
-import { claimedRoles, tokenClaims } from "./claims";
+import { tokenClaims } from "./claims";
 
 export const IMP_SESSION_COOKIE = "imp_session";
 export const IMP_ACTIVE_COOKIE = "imp_active";
@@ -19,7 +19,7 @@ export interface ImpersonationActive {
   expiresOn: number;
   returnTo?: string;
   actorEmail?: string;
-  roles?: string[];
+  origins?: string[];
 }
 
 interface MintedToken {
@@ -31,6 +31,7 @@ interface MintedToken {
   targetImage?: string | null;
   finance: boolean;
   returnTo?: string;
+  origins?: string[];
 }
 
 function parseCookieHeader(header: string | null): Record<string, string> {
@@ -103,7 +104,6 @@ export function buildImpersonationCookies(
   const claims = tokenClaims(minted.accessToken);
   const active: ImpersonationActive = {
     actorEmail: claims.act,
-    roles: claimedRoles(claims),
     targetEmail: minted.targetEmail,
     targetName: minted.targetName,
     targetImage: minted.targetImage,
@@ -111,6 +111,7 @@ export function buildImpersonationCookies(
     tokenId: minted.tokenId,
     expiresOn: minted.expiresOn,
     returnTo: minted.returnTo,
+    origins: minted.origins,
   };
   return [
     serialize(IMP_SESSION_COOKIE, JSON.stringify(session), {

package/src/impersonation/exit.test.ts

@@ -0,0 +1,106 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { exitDestination, withOrigin } from "./exit.ts";
+import { isAllowedRedirect } from "./redirects.ts";
+
+const platform = "https://www.test.snosky.no";
+const tenant = "https://snokam.test.snosky.no";
+const other = "https://andre.test.snosky.no";
+const minside = `${tenant}/minside`;
+
+function allowedFrom(origin: string) {
+  return (target: string) =>
+    isAllowedRedirect(target, { origin, platformDomain: "snosky.no" });
+}
+
+function leave(origins: string[] | undefined, from: string, to: string) {
+  return exitDestination(origins, from, to, allowedFrom(from));
+}
+
+function hops(url: string): string[] {
+  const chain = [];
+  let next: string | null = url;
+  while (next) {
+    const parsed: URL = new URL(next);
+    chain.push(parsed.origin);
+    next = parsed.searchParams.get("returnTo");
+  }
+  return chain;
+}
+
+describe("leaving Vis som", () => {
+  it("clears the other host before landing when the session spans two hosts", () => {
+    const url = new URL(leave([platform, tenant], tenant, minside));
+    assert.equal(url.origin, platform);
+    assert.equal(url.pathname, "/api/impersonation/clear");
+    assert.equal(url.searchParams.get("returnTo"), minside);
+  });
+
+  it("clears the tenant host when leaving from the platform host", () => {
+    const url = new URL(
+      leave([platform, tenant], platform, `${platform}/manage`)
+    );
+    assert.equal(url.origin, tenant);
+    assert.equal(url.searchParams.get("returnTo"), `${platform}/manage`);
+  });
+
+  it("goes straight to the destination when only this host holds the session", () => {
+    assert.equal(leave([tenant], tenant, minside), minside);
+    assert.equal(leave(undefined, tenant, minside), minside);
+  });
+
+  it("chains through every other host that adopted the session", () => {
+    assert.deepEqual(hops(leave([platform, tenant, other], tenant, minside)), [
+      platform,
+      other,
+      tenant,
+    ]);
+  });
+
+  it("visits each host once even when it is listed twice", () => {
+    assert.deepEqual(
+      hops(leave([platform, platform, `${platform}/`], tenant, minside)),
+      [platform, tenant]
+    );
+  });
+});
+
+describe("a tampered session-host list", () => {
+  const foreign = [
+    "https://evil.example",
+    "https://snosky.no.evil.example",
+    "http://plain.test.snosky.no",
+    "javascript:alert(1)",
+    "not a url",
+  ];
+
+  it("never redirects to a host outside the allow-list", () => {
+    const url = leave([...foreign, tenant], tenant, minside);
+    assert.equal(url, minside);
+  });
+
+  it("keeps the allowed hosts and drops the foreign ones", () => {
+    assert.deepEqual(
+      hops(leave([platform, ...foreign, other], tenant, minside)),
+      [platform, other, tenant]
+    );
+  });
+});
+
+describe("recording the hosts a session lives on", () => {
+  it("appends a host that adopts the session", () => {
+    assert.deepEqual(withOrigin([platform, tenant], other), [
+      platform,
+      tenant,
+      other,
+    ]);
+  });
+
+  it("leaves the list alone when the host is already on it", () => {
+    assert.deepEqual(withOrigin([platform, tenant], tenant), [
+      platform,
+      tenant,
+    ]);
+    assert.deepEqual(withOrigin(undefined, tenant), [tenant]);
+  });
+});

package/src/impersonation/exit.ts

@@ -0,0 +1,36 @@
+export const CLEAR_PATH = "/api/impersonation/clear";
+
+export function withOrigin(
+  origins: string[] | undefined,
+  origin: string
+): string[] {
+  const known = origins ?? [];
+  return known.includes(origin) ? known : [...known, origin];
+}
+
+function otherSessionHosts(
+  origins: string[] | undefined,
+  currentOrigin: string,
+  isAllowed: (origin: string) => boolean
+): string[] {
+  const hosts = (origins ?? [])
+    .filter(isAllowed)
+    .map((origin) => new URL(origin, currentOrigin).origin);
+  return [...new Set(hosts)].filter((host) => host !== currentOrigin);
+}
+
+export function exitDestination(
+  origins: string[] | undefined,
+  currentOrigin: string,
+  destination: string,
+  isAllowed: (origin: string) => boolean
+): string {
+  return otherSessionHosts(origins, currentOrigin, isAllowed).reduceRight(
+    (next, host) => {
+      const clear = new URL(CLEAR_PATH, host);
+      clear.searchParams.set("returnTo", next);
+      return clear.toString();
+    },
+    destination
+  );
+}

package/src/impersonation/handlers.ts

@@ -14,6 +14,7 @@ import {
   requestHost,
 } from "./request";
 import { isAllowedRedirect, platformBaseDomain } from "./redirects";
+import { withOrigin } from "./exit";
 
 interface StartBody {
   targetEmail?: string;
@@ -108,18 +109,23 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
       tokenId: result.tokenId,
       expiresOn: result.expiresOn,
     };
+    const here = requestOrigin(request);
+    const target =
+      body.redirectTo && handsOffToTarget(request, body.redirectTo)
+        ? new URL(body.redirectTo)
+        : null;
+    const origins = target ? [here, target.origin] : [here];
     const cookies = buildImpersonationCookies(
-      { ...result, returnTo: body.returnTo },
+      { ...result, returnTo: body.returnTo, origins },
       requestHost(request)
     );
 
-    if (!body.redirectTo || !handsOffToTarget(request, body.redirectTo)) {
+    if (!target) {
       return withCookies(Response.json(summary), cookies);
     }
 
-    const target = new URL(body.redirectTo);
     const ticket = sealImpersonationTicket(
-      { ...result, business: target.host, returnTo: body.returnTo },
+      { ...result, business: target.host, returnTo: body.returnTo, origins },
       authConfig.nextAuthSecret
     );
     const adopt = new URL("/api/impersonation/adopt", target.origin);
@@ -164,7 +170,24 @@ export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
     );
     return withCookies(
       new Response(null, { status: 302, headers: { Location: dest } }),
-      buildImpersonationCookies(claims, host)
+      buildImpersonationCookies(
+        { ...claims, origins: withOrigin(claims.origins, origin) },
+        host
+      )
+    );
+  };
+}
+
+export function createImpersonationClearHandler() {
+  return async function GET(request: Request) {
+    const origin = requestOrigin(request);
+    const dest = resolveLanding(
+      new URL(request.url).searchParams.get("returnTo") || "/",
+      origin
+    );
+    return withCookies(
+      new Response(null, { status: 302, headers: { Location: dest } }),
+      clearImpersonationCookies(requestHost(request))
     );
   };
 }

package/src/impersonation/picker.ts

@@ -42,7 +42,13 @@ export function createPickerBusinessesHandler(authConfig: Auth.Config) {
       platformCall(caller.client.listImpersonationBusinesses()),
       platformCall(caller.client.getMeApps()),
     ]);
-    if ("error" in businesses) return businesses.error;
+    if ("error" in businesses) {
+      if (businesses.error.status !== 403) return businesses.error;
+      return Response.json(
+        { returnBusiness: await returnBusiness(request) },
+        { status: 403 }
+      );
+    }
     if ("error" in apps) return apps.error;
     if (businesses.value.length === 0) {
       return new Response("Not found", { status: 404 });

package/src/impersonation/routes.ts

@@ -3,6 +3,7 @@ import {
   createImpersonationStartHandler,
   createImpersonationEndHandler,
   createImpersonationAdoptHandler,
+  createImpersonationClearHandler,
 } from "./handlers";
 import { createImpersonationRenewHandler } from "./renew";
 import {
@@ -16,6 +17,7 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
   const start = createImpersonationStartHandler(authConfig);
   const end = createImpersonationEndHandler(authConfig);
   const adopt = createImpersonationAdoptHandler(authConfig);
+  const clear = createImpersonationClearHandler();
   const renew = createImpersonationRenewHandler(authConfig);
   const businesses = createPickerBusinessesHandler(authConfig);
   const people = createPickerPeopleHandler(authConfig);
@@ -24,6 +26,7 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
     async GET(request: Request, ctx: OpContext) {
       const { op } = await ctx.params;
       if (op === "adopt") return adopt(request);
+      if (op === "clear") return clear(request);
       if (op === "businesses") return businesses(request);
       if (op === "people") return people(request);
       return new Response("Not found", { status: 404 });

package/src/impersonation/ticket.ts

@@ -9,6 +9,7 @@ export interface ImpersonationTicket {
   finance: boolean;
   business: string;
   returnTo?: string;
+  origins?: string[];
 }
 
 const TTL_SECONDS = 120;

package/src/session/callback-url.test.ts

@@ -0,0 +1,22 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { callbackDestination } from "./callback-url.ts";
+
+describe("where an already signed-in login page sends you", () => {
+  const origin = "https://snokam.test.snosky.no";
+
+  it("keeps the basePath the callbackUrl already carries, once", () => {
+    assert.equal(
+      callbackDestination("/minside", origin),
+      "https://snokam.test.snosky.no/minside"
+    );
+    assert.equal(
+      callbackDestination("/minside/okonomi?x=1", origin),
+      "https://snokam.test.snosky.no/minside/okonomi?x=1"
+    );
+  });
+
+  it("falls back to the host root", () => {
+    assert.equal(callbackDestination(null, origin), `${origin}/`);
+  });
+});

package/src/session/callback-url.ts

@@ -15,3 +15,11 @@ export function safeCallbackTarget(
   }
   return AUTH_FLOW.test(target) ? "/" : target;
 }
+
+// A callbackUrl already carries the app's basePath; the Next router would add it again.
+export function callbackDestination(
+  callbackUrl: string | null,
+  origin: string
+): string {
+  return new URL(callbackUrl || "/", origin).toString();
+}

package/src/session/index.ts

@@ -1,3 +1,3 @@
 export { resolveCookieDomain, getSessionCookieSettings } from "./cookies";
 export { getAuthUrl, requestOrigin } from "./url";
-export { safeCallbackTarget } from "./callback-url";
+export { callbackDestination, safeCallbackTarget } from "./callback-url";