@snokam/auth 5.3.2 → 5.3.4

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.3.4](https://github.com/snokam/components/compare/@snokam/auth@5.3.3...@snokam/auth@5.3.4) (2026-10-15)
+
+### Bug Fixes
+
+- **auth:** a Vis som session in another business no longer loops back to the picker ([#2957](https://github.com/snokam/components/issues/2957)) ([ae37b4b](https://github.com/snokam/components/commit/ae37b4b7bfc515f357a5faee3ff565e5032d81a7)), closes [#2894](https://github.com/snokam/components/issues/2894)
+
+## [5.3.3](https://github.com/snokam/components/compare/@snokam/auth@5.3.2...@snokam/auth@5.3.3) (2026-10-14)
+
+### Bug Fixes
+
+- send test operators from "no access" to the Vis som picker, land on Min side ([#2953](https://github.com/snokam/components/issues/2953)) ([dcce011](https://github.com/snokam/components/commit/dcce011160cd4b0d5661c41ce372ee15b905ebf9)), closes [#2949](https://github.com/snokam/components/issues/2949)
+
 ## [5.3.2](https://github.com/snokam/components/compare/@snokam/auth@5.3.1...@snokam/auth@5.3.2) (2026-10-14)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.3.2",
+  "version": "5.3.4",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,11 +26,11 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/identity": "1.1.0",
     "@snokam/platform-client": "5.3.1",
     "@snokam/react-query": "1.1.0",
     "@snokam/sanity-page-content": "6.5.2",
     "@snokam/tenant": "4.3.1",
+    "@snokam/identity": "1.1.0",
     "@snokam/ui": "6.1.0"
   },
   "peerDependencies": {

package/src/components/NotProvisioned/index.tsx

@@ -8,6 +8,7 @@ import {
   PageContentProvider,
 } from "@snokam/sanity-page-content/app-router/providers";
 import { AccessHelp } from "./AccessHelp";
+import { usePickerRedirect } from "./usePickerRedirect";
 
 const ACCESS_GATE_PAGE_KEY = "access-gate";
 
@@ -20,8 +21,9 @@ export const NotProvisioned = ({ appKey }: Props) => {
     queryKey: ["access-gate-content", appKey],
     queryFn: () => loadAppContent(appKey),
   });
+  const checkingPicker = usePickerRedirect();
 
-  if (isPending) {
+  if (isPending || checkingPicker) {
     return <PageLoader />;
   }
 

package/src/components/NotProvisioned/usePickerRedirect.ts

@@ -0,0 +1,41 @@
+"use client";
+
+import { useEffect, useState } from "react";
+import { useOptionalConfig } from "@snokam/tenant";
+import { impersonationPickerUrl } from "../../impersonation/required";
+
+const PICKER_BUSINESSES_PATH = "/api/impersonation/businesses";
+
+// The picker's businesses route answers 200 only with persona mode on and an operator's own
+// token, so a signed-in operator who is no employee here goes to pick a test user instead.
+export function usePickerRedirect(): boolean {
+  const platformBaseUrl = useOptionalConfig()?.NEXT_PUBLIC_PLATFORM_BASE_URL;
+  const [checking, setChecking] = useState(Boolean(platformBaseUrl));
+
+  useEffect(() => {
+    if (!platformBaseUrl) return;
+    let cancelled = false;
+    const basePath = process.env.NEXT_PUBLIC_BASE_PATH ?? "";
+
+    fetch(`${basePath}${PICKER_BUSINESSES_PATH}`, { credentials: "include" })
+      .then((response) => {
+        if (cancelled) return;
+        if (!response.ok) {
+          setChecking(false);
+          return;
+        }
+        window.location.replace(
+          impersonationPickerUrl(platformBaseUrl, window.location.href)
+        );
+      })
+      .catch(() => {
+        if (!cancelled) setChecking(false);
+      });
+
+    return () => {
+      cancelled = true;
+    };
+  }, [platformBaseUrl]);
+
+  return checking;
+}

package/src/hooks.ts

@@ -102,12 +102,15 @@ export function useAuth() {
   const { data: rawSession, status, update } = useSession();
   const { active } = useImpersonation();
 
+  // A host of another business holds only the Vis som session, never the actor's own sign-in.
   const session = useMemo(() => {
-    if (!active || !rawSession?.user) return rawSession;
+    if (!active) return rawSession;
     return {
       ...rawSession,
+      expires:
+        rawSession?.expires ?? new Date(active.expiresOn * 1000).toISOString(),
       user: {
-        ...rawSession.user,
+        ...rawSession?.user,
         name: active.targetName || active.targetEmail,
         email: active.targetEmail,
         image: active.targetImage ?? null,
@@ -132,10 +135,12 @@ export function useAuth() {
         }) as Promise<string>,
       inProgress: status === "loading",
       isAuthenticated:
-        status === "authenticated" || (status === "loading" && !!session),
+        status === "authenticated" ||
+        !!active ||
+        (status === "loading" && !!session),
     }),
 
-    [update, status, session]
+    [update, status, session, active]
   );
 
   return value;

package/src/impersonation/cookies.ts

@@ -3,6 +3,7 @@ import { tokenClaims } from "./claims";
 
 export const IMP_SESSION_COOKIE = "imp_session";
 export const IMP_ACTIVE_COOKIE = "imp_active";
+export const IMP_PASS_COOKIE = "imp_pass";
 
 export interface ImpersonationSession {
   accessToken: string;
@@ -34,7 +35,9 @@ interface MintedToken {
   origins?: string[];
 }
 
-function parseCookieHeader(header: string | null): Record<string, string> {
+export function parseCookieHeader(
+  header: string | null
+): Record<string, string> {
   const jar: Record<string, string> = {};
   if (!header) return jar;
   for (const part of header.split(";")) {
@@ -68,7 +71,7 @@ export function readImpersonationActive(
   return readCookieJson<ImpersonationActive>(request, IMP_ACTIVE_COOKIE);
 }
 
-function serialize(
+export function serialize(
   name: string,
   value: string,
   {
@@ -131,5 +134,6 @@ export function clearImpersonationCookies(host: string | null): string[] {
   return [
     serialize(IMP_SESSION_COOKIE, "", { host, httpOnly: true, maxAge: 0 }),
     serialize(IMP_ACTIVE_COOKIE, "", { host, httpOnly: false, maxAge: 0 }),
+    serialize(IMP_PASS_COOKIE, "", { host, httpOnly: true, maxAge: 0 }),
   ];
 }

package/src/impersonation/handlers.ts

@@ -6,6 +6,7 @@ import {
   readImpersonationSession,
 } from "./cookies";
 import { sealImpersonationTicket, openImpersonationTicket } from "./ticket";
+import { impersonationPassCookie } from "./pass-cookie";
 import { requestOrigin, resolveCookieDomain } from "../session";
 import {
   platformCall,
@@ -115,10 +116,17 @@ export function createImpersonationStartHandler(authConfig: Auth.Config) {
         ? new URL(body.redirectTo)
         : null;
     const origins = target ? [here, target.origin] : [here];
-    const cookies = buildImpersonationCookies(
-      { ...result, returnTo: body.returnTo, origins },
-      requestHost(request)
-    );
+    const cookies = [
+      ...buildImpersonationCookies(
+        { ...result, returnTo: body.returnTo, origins },
+        requestHost(request)
+      ),
+      impersonationPassCookie(
+        result,
+        requestHost(request),
+        authConfig.nextAuthSecret
+      ),
+    ];
 
     if (!target) {
       return withCookies(Response.json(summary), cookies);
@@ -170,10 +178,13 @@ export function createImpersonationAdoptHandler(authConfig: Auth.Config) {
     );
     return withCookies(
       new Response(null, { status: 302, headers: { Location: dest } }),
-      buildImpersonationCookies(
-        { ...claims, origins: withOrigin(claims.origins, origin) },
-        host
-      )
+      [
+        ...buildImpersonationCookies(
+          { ...claims, origins: withOrigin(claims.origins, origin) },
+          host
+        ),
+        impersonationPassCookie(claims, host, authConfig.nextAuthSecret),
+      ]
     );
   };
 }

package/src/impersonation/pass-cookie.ts

@@ -0,0 +1,24 @@
+import { IMP_PASS_COOKIE, parseCookieHeader, serialize } from "./cookies";
+import { isValidPass, sealPass } from "./pass";
+
+export function impersonationPassCookie(
+  session: { tokenId: string; expiresOn: number },
+  host: string | null,
+  secret: string
+): string {
+  const maxAge = Math.max(0, Math.floor(session.expiresOn - Date.now() / 1000));
+  const pass = sealPass(host ?? "", session.tokenId, maxAge, secret);
+  return serialize(IMP_PASS_COOKIE, pass, { host, httpOnly: true, maxAge });
+}
+
+export function hasImpersonationPass(
+  request: Request,
+  secret: string
+): boolean {
+  const pass = parseCookieHeader(request.headers.get("cookie"))[
+    IMP_PASS_COOKIE
+  ];
+  const host =
+    request.headers.get("x-forwarded-host") ?? request.headers.get("host");
+  return isValidPass(pass, host, secret);
+}

package/src/impersonation/pass.test.ts

@@ -0,0 +1,43 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isValidPass, sealPass } from "./pass.ts";
+
+const SECRET = "test-secret";
+const HOST = "businessx.test.snosky.no";
+const HOUR = 3600;
+
+describe("the Vis som pass", () => {
+  it("lets the host it was sealed for through", () => {
+    assert.equal(
+      isValidPass(sealPass(HOST, "tok", HOUR, SECRET), HOST, SECRET),
+      true
+    );
+  });
+
+  it("is refused on another host", () => {
+    const pass = sealPass(HOST, "tok", HOUR, SECRET);
+    assert.equal(isValidPass(pass, "acme.test.snosky.no", SECRET), false);
+  });
+
+  it("is refused when sealed with another secret, or forged", () => {
+    assert.equal(
+      isValidPass(sealPass(HOST, "tok", HOUR, "other"), HOST, SECRET),
+      false
+    );
+    assert.equal(isValidPass("a.b.c", HOST, SECRET), false);
+  });
+
+  it("is refused once it has expired", () => {
+    assert.equal(
+      isValidPass(sealPass(HOST, "tok", -10, SECRET), HOST, SECRET),
+      false
+    );
+  });
+
+  it("is refused without a pass, a host or a secret", () => {
+    const pass = sealPass(HOST, "tok", HOUR, SECRET);
+    assert.equal(isValidPass(undefined, HOST, SECRET), false);
+    assert.equal(isValidPass(pass, null, SECRET), false);
+    assert.equal(isValidPass(pass, HOST, ""), false);
+  });
+});

package/src/impersonation/pass.ts

@@ -0,0 +1,23 @@
+import { open, seal } from "../ticket/seal.ts";
+
+const PURPOSE = "impersonation-pass";
+
+// A host of another business never gets the actor's own sign-in, so this sealed, host-bound pass
+// is what tells the auth middleware that the host holds a Vis som session.
+export function sealPass(
+  host: string,
+  tokenId: string,
+  ttlSeconds: number,
+  secret: string
+): string {
+  return seal({ business: host, tokenId }, secret, ttlSeconds, PURPOSE);
+}
+
+export function isValidPass(
+  pass: string | undefined,
+  host: string | null,
+  secret: string
+): boolean {
+  if (!pass || !host || !secret) return false;
+  return open(pass, secret, PURPOSE, { expectedBusiness: host }) !== null;
+}

package/src/impersonation/renew.ts

@@ -5,6 +5,7 @@ import {
   readImpersonationActive,
   readImpersonationSession,
 } from "./cookies";
+import { impersonationPassCookie } from "./pass-cookie";
 import {
   platformCall,
   platformClient,
@@ -40,15 +41,22 @@ export function createImpersonationRenewHandler(authConfig: Auth.Config) {
       tokenId: session.tokenId,
       expiresOn: renewed.expiresOn,
     });
-    const cookies = buildImpersonationCookies(
-      {
-        ...active,
-        accessToken: renewed.accessToken,
-        expiresOn: renewed.expiresOn,
-        finance: renewed.finance ?? false,
-      },
-      requestHost(request)
-    );
+    const cookies = [
+      ...buildImpersonationCookies(
+        {
+          ...active,
+          accessToken: renewed.accessToken,
+          expiresOn: renewed.expiresOn,
+          finance: renewed.finance ?? false,
+        },
+        requestHost(request)
+      ),
+      impersonationPassCookie(
+        { tokenId: session.tokenId, expiresOn: renewed.expiresOn },
+        requestHost(request),
+        authConfig.nextAuthSecret
+      ),
+    ];
     for (const cookie of cookies) out.headers.append("Set-Cookie", cookie);
     return out;
   };

package/src/middleware.tsx

@@ -5,6 +5,7 @@ import { NextResponse, NextFetchEvent } from "next/server";
 import { Auth } from "./types";
 import { getSessionCookieSettings, getAuthUrl } from "./session";
 import { addCorsHeaders } from "./cors";
+import { hasImpersonationPass } from "./impersonation/pass-cookie";
 
 const TEST_ENVIRONMENT = "t";
 
@@ -117,7 +118,9 @@ export function buildAuthMiddleware({
       secret,
     });
 
-    const isAuthorized = (await authorized({ req, token })) ?? !!token;
+    const isAuthorized =
+      ((await authorized({ req, token })) ?? !!token) ||
+      hasImpersonationPass(req, secret);
     if (isAuthorized) {
       req.nextauth = { token };
       return;