@snokam/auth 5.3.4 → 5.4.1

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.4.1](https://github.com/snokam/components/compare/@snokam/auth@5.4.0...@snokam/auth@5.4.1) (2026-10-15)
+
+### Bug Fixes
+
+- **auth:** no cross-origin access to tokens or Vis som; only the actor ends a session ([#2959](https://github.com/snokam/components/issues/2959)) ([d1eda77](https://github.com/snokam/components/commit/d1eda773459365cf6bd46bbc0de179d57763ad75))
+
+# [5.4.0](https://github.com/snokam/components/compare/@snokam/auth@5.3.4...@snokam/auth@5.4.0) (2026-10-15)
+
+### Features
+
+- Vis som is a platform admin's everywhere; the admin sync stays prod-only ([#2958](https://github.com/snokam/components/issues/2958)) ([a2f9824](https://github.com/snokam/components/commit/a2f982455d1c19c2028e181ed109fe1f3485de90))
+
 ## [5.3.4](https://github.com/snokam/components/compare/@snokam/auth@5.3.3...@snokam/auth@5.3.4) (2026-10-15)
 
 ### Bug Fixes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.3.4",
+  "version": "5.4.1",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -28,10 +28,10 @@
     "path-to-regexp": "^8.4.2",
     "@snokam/platform-client": "5.3.1",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "6.5.2",
     "@snokam/tenant": "4.3.1",
-    "@snokam/identity": "1.1.0",
-    "@snokam/ui": "6.1.0"
+    "@snokam/sanity-page-content": "6.5.2",
+    "@snokam/ui": "6.1.0",
+    "@snokam/identity": "1.1.0"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/components/NotProvisioned/usePickerRedirect.ts

@@ -6,8 +6,6 @@ import { impersonationPickerUrl } from "../../impersonation/required";
 
 const PICKER_BUSINESSES_PATH = "/api/impersonation/businesses";
 
-// The picker's businesses route answers 200 only with persona mode on and an operator's own
-// token, so a signed-in operator who is no employee here goes to pick a test user instead.
 export function usePickerRedirect(): boolean {
   const platformBaseUrl = useOptionalConfig()?.NEXT_PUBLIC_PLATFORM_BASE_URL;
   const [checking, setChecking] = useState(Boolean(platformBaseUrl));

package/src/cors-paths.test.ts

@@ -0,0 +1,25 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { allowsCrossOrigin } from "./cors-paths.ts";
+
+describe("cross-origin access", () => {
+  it("is never granted to the routes that hand out tokens or Vis som sessions", () => {
+    for (const path of [
+      "/api/auth/token",
+      "/api/auth/session",
+      "/api/impersonation/start",
+      "/api/impersonation/adopt",
+      "/api/impersonation/businesses",
+      "/api/password/login",
+      "/handoff/start",
+    ]) {
+      assert.equal(allowsCrossOrigin(path), false, path);
+    }
+  });
+
+  it("is still granted to the app's other API routes", () => {
+    assert.equal(allowsCrossOrigin("/api/menu"), true);
+    assert.equal(allowsCrossOrigin("/api/events/random"), true);
+    assert.equal(allowsCrossOrigin("/api/authors"), true);
+  });
+});

package/src/cors-paths.ts

@@ -0,0 +1,10 @@
+const SAME_ORIGIN_ONLY = [
+  "/api/auth/",
+  "/api/impersonation/",
+  "/api/password/",
+  "/handoff/",
+];
+
+export function allowsCrossOrigin(pathname: string): boolean {
+  return !SAME_ORIGIN_ONLY.some((prefix) => pathname.startsWith(prefix));
+}

package/src/middleware.tsx

@@ -5,6 +5,7 @@ import { NextResponse, NextFetchEvent } from "next/server";
 import { Auth } from "./types";
 import { getSessionCookieSettings, getAuthUrl } from "./session";
 import { addCorsHeaders } from "./cors";
+import { allowsCrossOrigin } from "./cors-paths";
 import { hasImpersonationPass } from "./impersonation/pass-cookie";
 
 const TEST_ENVIRONMENT = "t";
@@ -143,7 +144,10 @@ export function buildAuthMiddleware({
   ) => {
     const origin = request.headers.get("origin");
     const isApiRoute = request.nextUrl.pathname.startsWith("/api/");
-    const applyCors = corsEnabled && (isApiRoute || corsAllRoutes);
+    const applyCors =
+      corsEnabled &&
+      (isApiRoute || corsAllRoutes) &&
+      allowsCrossOrigin(request.nextUrl.pathname);
 
     if (applyCors && request.method === "OPTIONS") {
       const response = new NextResponse(null, { status: 204 });