@snokam/auth 5.5.4 → 5.5.5

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [5.5.5](https://github.com/snokam/components/compare/@snokam/auth@5.5.4...@snokam/auth@5.5.5) (2026-10-28)
+
+### Bug Fixes
+
+- **platform-web:** platform sections run as yourself, also while viewing as a persona ([#3046](https://github.com/snokam/components/issues/3046)) ([3ef73be](https://github.com/snokam/components/commit/3ef73be782f088cb4fe2174ab754d172aecb1bb1))
+
 ## [5.5.4](https://github.com/snokam/components/compare/@snokam/auth@5.5.3...@snokam/auth@5.5.4) (2026-10-28)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "5.5.4",
+  "version": "5.5.5",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -26,12 +26,12 @@
     "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
+    "@snokam/identity": "1.1.0",
     "@snokam/platform-client": "5.3.2",
     "@snokam/react-query": "1.1.0",
     "@snokam/sanity-page-content": "6.8.1",
     "@snokam/tenant": "4.4.1",
-    "@snokam/ui": "6.4.1",
-    "@snokam/identity": "1.1.0"
+    "@snokam/ui": "6.4.1"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/app-router/index.tsx

@@ -21,7 +21,8 @@ export {
   PLATFORM_ADMIN,
   PLATFORM_OPERATOR,
 } from "../roles/context";
-export type { RolesState } from "../roles/context";
+export type { RolesState, PlatformRolesOptions } from "../roles/context";
+export { OwnIdentity } from "../identity/own";
 export type { ScopesState } from "../scopes";
 export {
   scopeGranted,

package/src/hooks.ts

@@ -2,6 +2,7 @@ import { signIn, signOut } from "next-auth/react";
 import { useMemo } from "react";
 import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
+import { useOwnIdentity } from "./identity/own";
 import { useSession } from "./session/useSession";
 
 class ConsentRequiredError extends Error {}
@@ -14,8 +15,16 @@ interface CachedToken {
   impKey: string;
 }
 
-let cachedToken: CachedToken | null = null;
-let inFlight: { impKey: string; promise: Promise<string> } | null = null;
+type TokenKind = "session" | "own";
+
+const cachedTokens: Record<TokenKind, CachedToken | null> = {
+  session: null,
+  own: null,
+};
+const inFlightTokens: Record<
+  TokenKind,
+  { impKey: string; promise: Promise<string> } | null
+> = { session: null, own: null };
 
 function readImpersonationKey(): string {
   if (typeof document === "undefined") return "";
@@ -38,14 +47,16 @@ function readImpersonationKey(): string {
 }
 
 export function clearAuthTokenCache(): void {
-  cachedToken = null;
-  inFlight = null;
+  cachedTokens.session = null;
+  cachedTokens.own = null;
+  inFlightTokens.session = null;
+  inFlightTokens.own = null;
 }
 
-async function fetchToken(impKey: string): Promise<string> {
+async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
   const res = await fetch("/api/auth/token", {
     method: "POST",
-    body: JSON.stringify({}),
+    body: JSON.stringify(kind === "own" ? { own: true } : {}),
     credentials: "include",
     headers: {
       "Content-Type": "application/json",
@@ -68,39 +79,57 @@ async function fetchToken(impKey: string): Promise<string> {
 
   sessionStorage.removeItem("auth-consent-retried");
   const bearer = `Bearer ${accessToken}`;
-  cachedToken = { bearer, expiresOn, impKey };
+  cachedTokens[kind] = { bearer, expiresOn, impKey };
   return bearer;
 }
 
-async function getFreshToken(): Promise<string> {
-  const impKey = readImpersonationKey();
+async function getFreshToken(kind: TokenKind): Promise<string> {
+  const impKey = kind === "own" ? "" : readImpersonationKey();
   const now = Date.now() / 1000;
+  const cached = cachedTokens[kind];
 
   if (
-    cachedToken &&
-    cachedToken.impKey === impKey &&
-    now < cachedToken.expiresOn - REFRESH_MARGIN_SECONDS
+    cached &&
+    cached.impKey === impKey &&
+    now < cached.expiresOn - REFRESH_MARGIN_SECONDS
   ) {
-    return cachedToken.bearer;
+    return cached.bearer;
   }
 
+  const inFlight = inFlightTokens[kind];
   if (inFlight && inFlight.impKey === impKey) {
     return inFlight.promise;
   }
 
-  const promise = fetchToken(impKey);
-  inFlight = { impKey, promise };
+  const promise = fetchToken(kind, impKey);
+  inFlightTokens[kind] = { impKey, promise };
   promise
     .catch(() => undefined)
     .finally(() => {
-      if (inFlight?.promise === promise) inFlight = null;
+      if (inFlightTokens[kind]?.promise === promise)
+        inFlightTokens[kind] = null;
     });
   return promise;
 }
 
+export function fetchOwnToken(): Promise<string> {
+  return tokenOrLogin("own");
+}
+
+function tokenOrLogin(kind: TokenKind): Promise<string> {
+  return getFreshToken(kind).catch((error) => {
+    console.error(error);
+    const onAuthPage = window.location.pathname.startsWith("/auth/");
+    if (onAuthPage) return;
+    const reason = error instanceof ConsentRequiredError ? "consent" : "true";
+    window.location.href = `/auth/login?error=${reason}`;
+  }) as Promise<string>;
+}
+
 export function useAuth() {
   const { data: rawSession, status, update } = useSession();
   const { active } = useImpersonation();
+  const own = useOwnIdentity();
 
   const session = useMemo(() => {
     if (!active) return rawSession;
@@ -123,15 +152,7 @@ export function useAuth() {
       signIn,
       signOut,
       session,
-      getToken: () =>
-        getFreshToken().catch((error) => {
-          console.error(error);
-          const onAuthPage = window.location.pathname.startsWith("/auth/");
-          if (onAuthPage) return;
-          const reason =
-            error instanceof ConsentRequiredError ? "consent" : "true";
-          window.location.href = `/auth/login?error=${reason}`;
-        }) as Promise<string>,
+      getToken: () => tokenOrLogin(own ? "own" : "session"),
       inProgress: status === "loading",
       isAuthenticated:
         status === "authenticated" ||
@@ -139,7 +160,7 @@ export function useAuth() {
         (status === "loading" && !!session),
     }),
 
-    [update, status, session, active]
+    [update, status, session, active, own]
   );
 
   return value;

package/src/identity/own.tsx

@@ -0,0 +1,17 @@
+"use client";
+
+import { createContext, useContext, type ReactNode } from "react";
+
+const OwnIdentityContext = createContext(false);
+
+export function OwnIdentity({ children }: { children: ReactNode }) {
+  return (
+    <OwnIdentityContext.Provider value={true}>
+      {children}
+    </OwnIdentityContext.Provider>
+  );
+}
+
+export function useOwnIdentity(): boolean {
+  return useContext(OwnIdentityContext);
+}

package/src/roles/context.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useMemo, useState } from "react";
-import { useAuth } from "../hooks";
+import { fetchOwnToken, useAuth } from "../hooks";
 import { decodeJwtClaims } from "../token/claims";
 
 export const PLATFORM_OPERATOR = "platform-operator";
@@ -20,8 +20,13 @@ function decodeTokenRoles(bearer: string): string[] {
   return [];
 }
 
-export function usePlatformRoles(): RolesState {
+export interface PlatformRolesOptions {
+  own?: boolean;
+}
+
+export function usePlatformRoles(options?: PlatformRolesOptions): RolesState {
   const { getToken, isAuthenticated } = useAuth();
+  const fetchToken = options?.own ? fetchOwnToken : getToken;
   const [roles, setRoles] = useState<string[] | null>(null);
 
   useEffect(() => {
@@ -30,7 +35,7 @@ export function usePlatformRoles(): RolesState {
       return;
     }
     let cancelled = false;
-    getToken()
+    fetchToken()
       .then((bearer) => {
         if (!cancelled) setRoles(decodeTokenRoles(bearer));
       })
@@ -40,7 +45,7 @@ export function usePlatformRoles(): RolesState {
     return () => {
       cancelled = true;
     };
-  }, [isAuthenticated, getToken]);
+  }, [isAuthenticated, fetchToken]);
 
   return useMemo(
     () => ({ roles: roles ?? [], isLoading: roles === null }),
@@ -48,7 +53,10 @@ export function usePlatformRoles(): RolesState {
   );
 }
 
-export function useHasPlatformRole(role: string): boolean {
-  const { roles } = usePlatformRoles();
+export function useHasPlatformRole(
+  role: string,
+  options?: PlatformRolesOptions
+): boolean {
+  const { roles } = usePlatformRoles(options);
   return useMemo(() => roles.includes(role), [roles, role]);
 }

package/src/route-handler/token.ts

@@ -95,9 +95,18 @@ export async function resolveAccessToken(
   }
 }
 
+async function wantsOwnToken(request: Request): Promise<boolean> {
+  const body = (await request.json().catch(() => null)) as {
+    own?: unknown;
+  } | null;
+  return body?.own === true;
+}
+
 export function createTokenHandler(authConfig: Auth.Config) {
   return async function POST(request: Request) {
-    const impersonation = readImpersonationSession(request);
+    const impersonation = (await wantsOwnToken(request))
+      ? null
+      : readImpersonationSession(request);
     if (impersonation && impersonation.expiresOn * 1000 > Date.now()) {
       return Response.json({
         accessToken: impersonation.accessToken,