@snokam/auth 5.3.1 → 5.3.3

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.3.3](https://github.com/snokam/components/compare/@snokam/auth@5.3.2...@snokam/auth@5.3.3) (2026-10-14)
+
+### Bug Fixes
+
+- send test operators from "no access" to the Vis som picker, land on Min side ([#2953](https://github.com/snokam/components/issues/2953)) ([dcce011](https://github.com/snokam/components/commit/dcce011160cd4b0d5661c41ce372ee15b905ebf9)), closes [#2949](https://github.com/snokam/components/issues/2949)
+
+## [5.3.2](https://github.com/snokam/components/compare/@snokam/auth@5.3.1...@snokam/auth@5.3.2) (2026-10-14)
+
+### Bug Fixes
+
+- **auth:** allow-list and chain every Vis som session host on exit ([#2951](https://github.com/snokam/components/issues/2951)) ([ee10692](https://github.com/snokam/components/commit/ee1069225349380b3a7d7087ed6007a3a4fff28e))
+
 ## [5.3.1](https://github.com/snokam/components/compare/@snokam/auth@5.3.0...@snokam/auth@5.3.1) (2026-10-14)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.3.1",
+  "version": "5.3.3",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,11 +26,11 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
+    "@snokam/identity": "1.1.0",
     "@snokam/platform-client": "5.3.1",
     "@snokam/react-query": "1.1.0",
     "@snokam/sanity-page-content": "6.5.2",
     "@snokam/tenant": "4.3.1",
-    "@snokam/identity": "1.1.0",
     "@snokam/ui": "6.1.0"
   },
   "peerDependencies": {

package/src/components/NotProvisioned/index.tsx

@@ -8,6 +8,7 @@ import {
   PageContentProvider,
 } from "@snokam/sanity-page-content/app-router/providers";
 import { AccessHelp } from "./AccessHelp";
+import { usePickerRedirect } from "./usePickerRedirect";
 
 const ACCESS_GATE_PAGE_KEY = "access-gate";
 
@@ -20,8 +21,9 @@ export const NotProvisioned = ({ appKey }: Props) => {
     queryKey: ["access-gate-content", appKey],
     queryFn: () => loadAppContent(appKey),
   });
+  const checkingPicker = usePickerRedirect();
 
-  if (isPending) {
+  if (isPending || checkingPicker) {
     return <PageLoader />;
   }
 

package/src/components/NotProvisioned/usePickerRedirect.ts

@@ -0,0 +1,41 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useOptionalConfig } from "@snokam/tenant";
+import { impersonationPickerUrl } from "../../impersonation/required";
+
+const PICKER_BUSINESSES_PATH = "/api/impersonation/businesses";
+
+// The picker's businesses route answers 200 only with persona mode on and an operator's own
+// token, so a signed-in operator who is no employee here goes to pick a test user instead.
+export function usePickerRedirect(): boolean {
+  const platformBaseUrl = useOptionalConfig()?.NEXT_PUBLIC_PLATFORM_BASE_URL;
+  const [checking, setChecking] = useState(Boolean(platformBaseUrl));
+
+  useEffect(() => {
+    if (!platformBaseUrl) return;
+    let cancelled = false;
+    const basePath = process.env.NEXT_PUBLIC_BASE_PATH ?? "";
+
+    fetch(`${basePath}${PICKER_BUSINESSES_PATH}`, { credentials: "include" })
+      .then((response) => {
+        if (cancelled) return;
+        if (!response.ok) {
+          setChecking(false);
+          return;
+        }
+        window.location.replace(
+          impersonationPickerUrl(platformBaseUrl, window.location.href)
+        );
+      })
+      .catch(() => {
+        if (!cancelled) setChecking(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [platformBaseUrl]);
+
+  return checking;
+}

package/src/impersonation/context.tsx

@@ -128,7 +128,12 @@ export function ImpersonationProvider({ children }: { children: ReactNode }) {
           : window.location.href;
       setActive(null);
       window.location.assign(
-        exitDestination(active?.origins, window.location.origin, destination)
+        exitDestination(
+          active?.origins,
+          window.location.origin,
+          destination,
+          (origin) => isSafeReturnTo(origin, apiBaseUrl)
+        )
       );
     } finally {
       setExiting(false);

package/src/impersonation/exit.test.ts

@@ -1,14 +1,36 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
-import { exitDestination } from "./exit.ts";
+import { exitDestination, withOrigin } from "./exit.ts";
+import { isAllowedRedirect } from "./redirects.ts";
 
 const platform = "https://www.test.snosky.no";
 const tenant = "https://snokam.test.snosky.no";
+const other = "https://andre.test.snosky.no";
 const minside = `${tenant}/minside`;
 
+function allowedFrom(origin: string) {
+  return (target: string) =>
+    isAllowedRedirect(target, { origin, platformDomain: "snosky.no" });
+}
+
+function leave(origins: string[] | undefined, from: string, to: string) {
+  return exitDestination(origins, from, to, allowedFrom(from));
+}
+
+function hops(url: string): string[] {
+  const chain = [];
+  let next: string | null = url;
+  while (next) {
+    const parsed: URL = new URL(next);
+    chain.push(parsed.origin);
+    next = parsed.searchParams.get("returnTo");
+  }
+  return chain;
+}
+
 describe("leaving Vis som", () => {
   it("clears the other host before landing when the session spans two hosts", () => {
-    const url = new URL(exitDestination([platform, tenant], tenant, minside));
+    const url = new URL(leave([platform, tenant], tenant, minside));
     assert.equal(url.origin, platform);
     assert.equal(url.pathname, "/api/impersonation/clear");
     assert.equal(url.searchParams.get("returnTo"), minside);
@@ -16,14 +38,69 @@ describe("leaving Vis som", () => {
 
   it("clears the tenant host when leaving from the platform host", () => {
     const url = new URL(
-      exitDestination([platform, tenant], platform, `${platform}/manage`)
+      leave([platform, tenant], platform, `${platform}/manage`)
     );
     assert.equal(url.origin, tenant);
     assert.equal(url.searchParams.get("returnTo"), `${platform}/manage`);
   });
 
   it("goes straight to the destination when only this host holds the session", () => {
-    assert.equal(exitDestination([tenant], tenant, minside), minside);
-    assert.equal(exitDestination(undefined, tenant, minside), minside);
+    assert.equal(leave([tenant], tenant, minside), minside);
+    assert.equal(leave(undefined, tenant, minside), minside);
+  });
+
+  it("chains through every other host that adopted the session", () => {
+    assert.deepEqual(hops(leave([platform, tenant, other], tenant, minside)), [
+      platform,
+      other,
+      tenant,
+    ]);
+  });
+
+  it("visits each host once even when it is listed twice", () => {
+    assert.deepEqual(
+      hops(leave([platform, platform, `${platform}/`], tenant, minside)),
+      [platform, tenant]
+    );
+  });
+});
+
+describe("a tampered session-host list", () => {
+  const foreign = [
+    "https://evil.example",
+    "https://snosky.no.evil.example",
+    "http://plain.test.snosky.no",
+    "javascript:alert(1)",
+    "not a url",
+  ];
+
+  it("never redirects to a host outside the allow-list", () => {
+    const url = leave([...foreign, tenant], tenant, minside);
+    assert.equal(url, minside);
+  });
+
+  it("keeps the allowed hosts and drops the foreign ones", () => {
+    assert.deepEqual(
+      hops(leave([platform, ...foreign, other], tenant, minside)),
+      [platform, other, tenant]
+    );
+  });
+});
+
+describe("recording the hosts a session lives on", () => {
+  it("appends a host that adopts the session", () => {
+    assert.deepEqual(withOrigin([platform, tenant], other), [
+      platform,
+      tenant,
+      other,
+    ]);
+  });
+
+  it("leaves the list alone when the host is already on it", () => {
+    assert.deepEqual(withOrigin([platform, tenant], tenant), [
+      platform,
+      tenant,
+    ]);
+    assert.deepEqual(withOrigin(undefined, tenant), [tenant]);
   });
 });

package/src/impersonation/exit.ts

@@ -1,13 +1,36 @@
 export const CLEAR_PATH = "/api/impersonation/clear";
 
+export function withOrigin(
+  origins: string[] | undefined,
+  origin: string
+): string[] {
+  const known = origins ?? [];
+  return known.includes(origin) ? known : [...known, origin];
+}
+
+function otherSessionHosts(
+  origins: string[] | undefined,
+  currentOrigin: string,
+  isAllowed: (origin: string) => boolean
+): string[] {
+  const hosts = (origins ?? [])
+    .filter(isAllowed)
+    .map((origin) => new URL(origin, currentOrigin).origin);
+  return [...new Set(hosts)].filter((host) => host !== currentOrigin);
+}
+
 export function exitDestination(
   origins: string[] | undefined,
   currentOrigin: string,
-  destination: string
+  destination: string,
+  isAllowed: (origin: string) => boolean
 ): string {
-  const other = (origins ?? []).find((origin) => origin !== currentOrigin);
-  if (!other) return destination;
-  const clear = new URL(CLEAR_PATH, other);
-  clear.searchParams.set("returnTo", destination);
-  return clear.toString();
+  return otherSessionHosts(origins, currentOrigin, isAllowed).reduceRight(
+    (next, host) => {
+      const clear = new URL(CLEAR_PATH, host);
+      clear.searchParams.set("returnTo", next);
+      return clear.toString();
+    },
+    destination
+  );
 }

package/src/impersonation/handlers.ts

@@ -14,6 +14,7 @@ import {
   requestHost,
 } from "./request";
 import { isAllowedRedirect, platformBaseDomain } from "./redirects";
+import { withOrigin } from "./exit";
 
 interface StartBody {
   targetEmail?: string;
@@ -169,7 +170,10 @@ export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
     );
     return withCookies(
       new Response(null, { status: 302, headers: { Location: dest } }),
-      buildImpersonationCookies(claims, host)
+      buildImpersonationCookies(
+        { ...claims, origins: withOrigin(claims.origins, origin) },
+        host
+      )
     );
   };
 }