@snokam/auth 6.0.3 → 6.0.5

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [6.0.5](https://github.com/snokam/components/compare/@snokam/auth@6.0.4...@snokam/auth@6.0.5) (2026-11-05)
+
+**Note:** Version bump only for package @snokam/auth
+
+## [6.0.4](https://github.com/snokam/components/compare/@snokam/auth@6.0.3...@snokam/auth@6.0.4) (2026-11-04)
+
+**Note:** Version bump only for package @snokam/auth
+
 ## [6.0.3](https://github.com/snokam/components/compare/@snokam/auth@6.0.2...@snokam/auth@6.0.3) (2026-11-02)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "6.0.3",
+  "version": "6.0.5",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -23,15 +23,14 @@
     "@emotion/styled": "^11.14.1",
     "@mui/icons-material": "^9.2.0",
     "@mui/material": "^9.2.0",
-    "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
+    "@snokam/api-client": "1.0.0",
     "@snokam/identity": "1.1.0",
-    "@snokam/platform-client": "5.3.2",
+    "@snokam/page-content": "6.9.5",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "6.9.3",
-    "@snokam/tenant": "4.5.0",
-    "@snokam/ui": "7.2.0"
+    "@snokam/tenant": "4.5.2",
+    "@snokam/ui": "7.2.2"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/app-router/index.tsx

@@ -12,6 +12,7 @@ export { Unauthenticated } from "../components/Unauthenticated";
 export { Authenticated } from "../components/Authenticated";
 export { useAuth } from "../hooks";
 export { useSession } from "../session/useSession";
+export { useIsHydrating } from "../hydration/useIsHydrating";
 export { retryUnlessMissing } from "../employee-query/retry";
 export { EmployeeThemeSync } from "../theme/employee-theme-sync";
 export { ScopesProvider, useScopes, useHasScope } from "../scopes";

package/src/app-router/server.ts

@@ -14,6 +14,7 @@ import {
   appUrl,
   backendUrl,
   managedBearer,
+  resolveApiBaseUrl,
 } from "@snokam/tenant/server";
 
 export { getServerToken } from "./token";
@@ -27,6 +28,10 @@ export function serverTenantToken(): Promise<string | undefined> {
   return scope ? managedBearer(scope) : Promise.resolve(undefined);
 }
 
+export function resolveServerApiBaseUrl(): Promise<string> {
+  return resolveApiBaseUrl();
+}
+
 export function resolveServerApiBase(service: string): Promise<string> {
   return service ? backendUrl(service) : Promise.resolve("");
 }

package/src/app-sign-in/platform.ts

@@ -4,7 +4,7 @@ import {
   ResponseError,
   type AuthorizationPreview,
   type IssuedAuthorizationCode,
-} from "@snokam/platform-client";
+} from "@snokam/api-client/platform";
 import { platformClientFor } from "../impersonation/request";
 import type { AuthorizationParams } from "./consent";
 

package/src/components/NotProvisioned/AccessHelp.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { usePageContent } from "@snokam/sanity-page-content";
+import { usePageContent } from "@snokam/page-content";
 import { PersonOffOutlined } from "@snokam/ui/icons";
 import { SystemPage, SystemPageAction } from "@snokam/ui/system-page";
 import { useAuth } from "../../hooks";

package/src/components/NotProvisioned/index.tsx

@@ -2,11 +2,11 @@
 
 import { useQuery } from "@snokam/react-query";
 import { PageLoader } from "@snokam/ui";
-import { loadAppContent } from "@snokam/sanity-page-content/app-router/actions";
+import { loadAppContent } from "@snokam/page-content/app-router/actions";
 import {
   AppContentProvider,
   PageContentProvider,
-} from "@snokam/sanity-page-content/app-router/providers";
+} from "@snokam/page-content/app-router/providers";
 import { AccessHelp } from "./AccessHelp";
 import { usePickerRedirect } from "./usePickerRedirect";
 

package/src/cors-origin.test.ts

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { isAllowedOrigin } from "./cors-origin.ts";
+
+const ZONE = "platform.example";
+
+describe("CORS origin trust", () => {
+  beforeEach(() => {
+    process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = ZONE;
+  });
+
+  afterEach(() => {
+    delete process.env.NEXT_PUBLIC_PLATFORM_DOMAIN;
+  });
+
+  it("trusts the configured platform zone and its subdomains", () => {
+    assert.equal(isAllowedOrigin(`https://${ZONE}`), true);
+    assert.equal(isAllowedOrigin(`https://acme.${ZONE}`), true);
+  });
+
+  it("does not trust hosts that only end with the zone name", () => {
+    assert.equal(isAllowedOrigin(`https://evil${ZONE}`), false);
+    assert.equal(isAllowedOrigin(`https://${ZONE}.evil.example`), false);
+  });
+
+  it("trusts listed extra origins and local development", () => {
+    assert.equal(
+      isAllowedOrigin("https://partner.example", ["https://partner.example"]),
+      true
+    );
+    assert.equal(isAllowedOrigin("http://localhost:3000"), true);
+  });
+
+  it("fails clearly when the platform zone is not configured", () => {
+    delete process.env.NEXT_PUBLIC_PLATFORM_DOMAIN;
+    assert.throws(
+      () => isAllowedOrigin("https://acme.elsewhere.example"),
+      /NEXT_PUBLIC_PLATFORM_DOMAIN/
+    );
+  });
+});

package/src/cors-origin.ts

@@ -0,0 +1,34 @@
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1"]);
+
+function platformZone(): string {
+  const zone = process.env.NEXT_PUBLIC_PLATFORM_DOMAIN;
+  if (!zone) {
+    throw new Error(
+      "NEXT_PUBLIC_PLATFORM_DOMAIN is not configured, so CORS cannot tell platform origins apart"
+    );
+  }
+  return zone.toLowerCase();
+}
+
+function isWithin(hostname: string, domain: string): boolean {
+  return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+
+export function isAllowedOrigin(
+  origin: string | null,
+  additionalOrigins: string[] = []
+): boolean {
+  if (!origin) return false;
+  if (additionalOrigins.includes(origin)) return true;
+
+  let hostname: string;
+  try {
+    hostname = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+
+  if (LOCAL_HOSTS.has(hostname)) return true;
+  if (isWithin(hostname, "snokam.no")) return true;
+  return isWithin(hostname, platformZone());
+}

package/src/cors.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { Auth } from "./types";
+import { isAllowedOrigin } from "./cors-origin";
 
 const DEFAULT_CORS_HEADERS = [
   "X-CSRF-Token",
@@ -15,36 +16,6 @@ const DEFAULT_CORS_HEADERS = [
   "Cookie",
 ];
 
-export function isAllowedOrigin(
-  origin: string | null,
-  additionalOrigins: string[] = []
-): boolean {
-  if (!origin) return false;
-
-  try {
-    const url = new URL(origin);
-    if (url.hostname.endsWith(".snokam.no") || url.hostname === "snokam.no") {
-      return true;
-    }
-
-    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-      return true;
-    }
-
-    if (url.hostname.endsWith(".snosky.no") || url.hostname === "snosky.no") {
-      return true;
-    }
-
-    if (additionalOrigins.includes(origin)) {
-      return true;
-    }
-
-    return false;
-  } catch {
-    return false;
-  }
-}
-
 export function addCorsHeaders(
   response: NextResponse,
   origin: string | null,

package/src/hooks.ts

@@ -1,20 +1,13 @@
 import { signIn, signOut } from "next-auth/react";
-import { useMemo } from "react";
-import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
+import { useCallback, useMemo } from "react";
+import { readActiveCookie } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useOwnIdentity } from "./identity/own";
 import { useSession } from "./session/useSession";
+import { isReusable, type CachedToken } from "./token/reuse";
 
 class ConsentRequiredError extends Error {}
 
-const REFRESH_MARGIN_SECONDS = 60;
-
-interface CachedToken {
-  bearer: string;
-  expiresOn: number;
-  impKey: string;
-}
-
 type TokenKind = "session" | "own";
 
 const cachedTokens: Record<TokenKind, CachedToken | null> = {
@@ -28,22 +21,7 @@ const inFlightTokens: Record<
 
 function readImpersonationKey(): string {
   if (typeof document === "undefined") return "";
-  const match = document.cookie
-    .split(";")
-    .map((part) => part.trim())
-    .find((part) => part.startsWith(`${IMP_ACTIVE_COOKIE}=`));
-  if (!match) return "";
-  try {
-    const value = decodeURIComponent(match.slice(IMP_ACTIVE_COOKIE.length + 1));
-    const parsed = JSON.parse(value) as {
-      tokenId?: string;
-      expiresOn?: number;
-    };
-    if (parsed.expiresOn && parsed.expiresOn * 1000 <= Date.now()) return "";
-    return parsed.tokenId ?? "";
-  } catch {
-    return "";
-  }
+  return readActiveCookie(document.cookie)?.tokenId ?? "";
 }
 
 export function clearAuthTokenCache(): void {
@@ -79,7 +57,12 @@ async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
 
   sessionStorage.removeItem("auth-consent-retried");
   const bearer = `Bearer ${accessToken}`;
-  cachedTokens[kind] = { bearer, expiresOn, impKey };
+  cachedTokens[kind] = {
+    bearer,
+    expiresOn,
+    fetchedAt: Date.now() / 1000,
+    impKey,
+  };
   return bearer;
 }
 
@@ -88,13 +71,7 @@ async function getFreshToken(kind: TokenKind): Promise<string> {
   const now = Date.now() / 1000;
   const cached = cachedTokens[kind];
 
-  if (
-    cached &&
-    cached.impKey === impKey &&
-    now < cached.expiresOn - REFRESH_MARGIN_SECONDS
-  ) {
-    return cached.bearer;
-  }
+  if (isReusable(cached, impKey, now)) return cached.bearer;
 
   const inFlight = inFlightTokens[kind];
   if (inFlight && inFlight.impKey === impKey) {
@@ -146,13 +123,18 @@ export function useAuth() {
     };
   }, [rawSession, active]);
 
+  const getToken = useCallback(
+    () => tokenOrLogin(own ? "own" : "session"),
+    [own]
+  );
+
   const value = useMemo(
     () => ({
       update,
       signIn,
       signOut,
       session,
-      getToken: () => tokenOrLogin(own ? "own" : "session"),
+      getToken,
       inProgress: status === "loading",
       isAuthenticated:
         status === "authenticated" ||
@@ -160,7 +142,7 @@ export function useAuth() {
         (status === "loading" && !!session),
     }),
 
-    [update, status, session, active, own]
+    [update, status, session, active, getToken]
   );
 
   return value;

package/src/hydration/useIsHydrating.ts

@@ -0,0 +1,12 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+const subscribeToNothing = () => () => {};
+
+export const useIsHydrating = () =>
+  useSyncExternalStore(
+    subscribeToNothing,
+    () => false,
+    () => true
+  );

package/src/impersonation/carried.test.ts

@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { carriedTo } from "./carried.ts";
+import { PLATFORM_HOST, UNKNOWN_HOST } from "../handoff/seal.ts";
+
+const now = Date.UTC(2026, 10, 3, 12, 0, 0);
+const expiresOn = now / 1000 + 600;
+
+function tokenFor(biz: string) {
+  const payload = Buffer.from(JSON.stringify({ biz })).toString("base64url");
+  return `header.${payload}.signature`;
+}
+
+const session = { accessToken: tokenFor("snokam"), expiresOn, tokenId: "t1" };
+const active = {
+  targetEmail: "bjorn@test.snokam.no",
+  finance: false,
+  tokenId: "t1",
+  expiresOn,
+  origins: ["https://salg.beta.test.snokam.no"],
+};
+const snokam = { businessId: "snokam" };
+
+describe("carrying an impersonation to another host", () => {
+  it("carries it to a host owned by the impersonated business", () => {
+    assert.deepEqual(carriedTo({ session, active }, snokam, now), {
+      session,
+      active,
+    });
+  });
+
+  it("carries it to a platform host", () => {
+    assert.ok(carriedTo({ session, active }, PLATFORM_HOST, now));
+  });
+
+  it("refuses a host owned by another business", () => {
+    assert.equal(
+      carriedTo({ session, active }, { businessId: "other" }, now),
+      null
+    );
+  });
+
+  it("refuses a host nobody owns", () => {
+    assert.equal(carriedTo({ session, active }, UNKNOWN_HOST, now), null);
+  });
+
+  it("refuses when nothing is being impersonated", () => {
+    assert.equal(carriedTo({}, snokam, now), null);
+    assert.equal(carriedTo({ session }, snokam, now), null);
+  });
+
+  it("refuses an expired impersonation", () => {
+    assert.equal(carriedTo({ session, active }, snokam, now + 601_000), null);
+  });
+
+  it("refuses when the session and the visible state disagree", () => {
+    assert.equal(
+      carriedTo({ session, active: { ...active, tokenId: "t2" } }, snokam, now),
+      null
+    );
+  });
+});

package/src/impersonation/carried.ts

@@ -0,0 +1,21 @@
+import { type HostOwner, maySealFor } from "../handoff/seal.ts";
+import { tokenClaims } from "./claims.ts";
+import type { ImpersonationActive, ImpersonationSession } from "./cookies";
+
+export interface Carried {
+  session: ImpersonationSession;
+  active: ImpersonationActive;
+}
+
+export function carriedTo(
+  carried: Partial<Carried>,
+  owner: HostOwner,
+  now: number = Date.now()
+): Carried | null {
+  const { session, active } = carried;
+  if (!session?.accessToken || !active) return null;
+  if (session.tokenId !== active.tokenId) return null;
+  if (session.expiresOn * 1000 <= now) return null;
+  const business = tokenClaims(session.accessToken).biz;
+  return maySealFor(owner, business) ? { session, active } : null;
+}

package/src/impersonation/carry.ts

@@ -0,0 +1,82 @@
+import { Auth } from "../types";
+import { isAllowedReturnTo } from "../handoff/return-to";
+import { hostOwner } from "../handoff/business";
+import type { HostOwner } from "../handoff/seal";
+import {
+  buildImpersonationCookies,
+  readImpersonationActive,
+  readImpersonationSession,
+} from "./cookies";
+import { carriedTo } from "./carried";
+import { withOrigin } from "./exit";
+import { handsOffToTarget } from "./handlers";
+import { requestHost } from "./request";
+import { sealImpersonationTicket } from "./ticket";
+
+const ADOPT_PATH = "/api/impersonation/adopt";
+
+async function allowedTarget(target: unknown): Promise<URL | null> {
+  if (typeof target !== "string" || !URL.canParse(target)) return null;
+  const allowed = await isAllowedReturnTo(target, {
+    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
+    platformBaseDomain: process.env.NEXT_PUBLIC_PLATFORM_DOMAIN ?? "",
+    allowLocalhost: process.env.AUTH_ALLOW_LOCALHOST === "true",
+  });
+  return allowed ? new URL(target) : null;
+}
+
+async function ownerOf(target: URL): Promise<HostOwner | null> {
+  try {
+    return await hostOwner(target.toString());
+  } catch {
+    return null;
+  }
+}
+
+function adoptUrl(target: URL, ticket: string): string {
+  const adopt = new URL(ADOPT_PATH, target.origin);
+  adopt.searchParams.set("t", ticket);
+  adopt.searchParams.set("returnTo", target.pathname + target.search);
+  return adopt.toString();
+}
+
+export function createImpersonationCarryHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    const body = (await request.json().catch(() => null)) as {
+      redirectTo?: unknown;
+    } | null;
+    const target = await allowedTarget(body?.redirectTo);
+    if (!target) return new Response("Invalid redirectTo", { status: 400 });
+    if (!handsOffToTarget(request, target.toString())) {
+      return new Response("Shares cookies with this host", { status: 409 });
+    }
+
+    const owner = await ownerOf(target);
+    if (!owner)
+      return new Response("Tenant lookup unavailable", { status: 503 });
+
+    const carried = carriedTo(
+      {
+        session: readImpersonationSession(request) ?? undefined,
+        active: readImpersonationActive(request) ?? undefined,
+      },
+      owner
+    );
+    if (!carried) return new Response("Nothing to carry", { status: 409 });
+
+    const { session, active } = carried;
+    const origins = withOrigin(active.origins, target.origin);
+    const ticket = sealImpersonationTicket(
+      { ...session, ...active, business: target.host, origins },
+      authConfig.nextAuthSecret
+    );
+    const response = Response.json({ adoptUrl: adoptUrl(target, ticket) });
+    for (const cookie of buildImpersonationCookies(
+      { ...session, ...active, origins },
+      requestHost(request)
+    )) {
+      response.headers.append("Set-Cookie", cookie);
+    }
+    return response;
+  };
+}

package/src/impersonation/context.tsx

@@ -9,11 +9,7 @@ import {
   useState,
   type ReactNode,
 } from "react";
-import {
-  IMP_ACTIVE_COOKIE,
-  parseActiveCookie,
-  type ImpersonationActive,
-} from "./cookies";
+import { readActiveCookie, type ImpersonationActive } from "./cookies";
 import { clearAuthTokenCache } from "../hooks";
 import { useSessionRenewal } from "./renewal";
 import { useOptionalConfig } from "@snokam/tenant";
@@ -56,20 +52,16 @@ function isSafeReturnTo(
   });
 }
 
-function readActiveCookie(): ImpersonationActive | null {
+function readDocumentActiveCookie(): ImpersonationActive | null {
   if (typeof document === "undefined") return null;
-  const match = document.cookie
-    .split(";")
-    .map((part) => part.trim())
-    .find((part) => part.startsWith(`${IMP_ACTIVE_COOKIE}=`));
-  if (!match) return null;
-  try {
-    return parseActiveCookie(
-      decodeURIComponent(match.slice(IMP_ACTIVE_COOKIE.length + 1))
-    );
-  } catch {
-    return null;
-  }
+  return readActiveCookie(document.cookie);
+}
+
+function keepIfUnchanged(
+  current: ImpersonationActive | null,
+  next: ImpersonationActive | null
+): ImpersonationActive | null {
+  return JSON.stringify(current) === JSON.stringify(next) ? current : next;
 }
 
 export function ImpersonationProvider({
@@ -86,7 +78,13 @@ export function ImpersonationProvider({
   const [starting, setStarting] = useState(false);
   const [exiting, setExiting] = useState(false);
 
-  const rereadCookie = useCallback(() => setActive(readActiveCookie()), []);
+  const rereadCookie = useCallback(
+    () =>
+      setActive((current) =>
+        keepIfUnchanged(current, readDocumentActiveCookie())
+      ),
+    []
+  );
 
   useEffect(() => {
     rereadCookie();

package/src/impersonation/cookies.ts

@@ -1,9 +1,20 @@
 import { resolveCookieDomain } from "../session";
 import { tokenClaims } from "./claims";
+import {
+  IMP_ACTIVE_COOKIE,
+  IMP_PASS_COOKIE,
+  IMP_SESSION_COOKIE,
+  parseCookieHeader,
+} from "./jar";
 
-export const IMP_SESSION_COOKIE = "imp_session";
-export const IMP_ACTIVE_COOKIE = "imp_active";
-export const IMP_PASS_COOKIE = "imp_pass";
+export {
+  IMP_ACTIVE_COOKIE,
+  IMP_PASS_COOKIE,
+  IMP_SESSION_COOKIE,
+  parseActiveCookie,
+  parseCookieHeader,
+  readActiveCookie,
+} from "./jar";
 
 export interface ImpersonationSession {
   accessToken: string;
@@ -23,19 +34,6 @@ export interface ImpersonationActive {
   origins?: string[];
 }
 
-export function parseActiveCookie(
-  json: string | undefined
-): ImpersonationActive | null {
-  if (!json) return null;
-  try {
-    const parsed = JSON.parse(json) as ImpersonationActive;
-    if (parsed.expiresOn * 1000 <= Date.now()) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-
 interface MintedToken {
   accessToken: string;
   expiresOn: number;
@@ -48,20 +46,6 @@ interface MintedToken {
   origins?: string[];
 }
 
-export function parseCookieHeader(
-  header: string | null
-): Record<string, string> {
-  const jar: Record<string, string> = {};
-  if (!header) return jar;
-  for (const part of header.split(";")) {
-    const index = part.indexOf("=");
-    if (index < 0) continue;
-    const name = part.slice(0, index).trim();
-    if (name) jar[name] = decodeURIComponent(part.slice(index + 1).trim());
-  }
-  return jar;
-}
-
 function readCookieJson<T>(request: Request, name: string): T | null {
   const raw = parseCookieHeader(request.headers.get("cookie"))[name];
   if (!raw) return null;

package/src/impersonation/handlers.ts

@@ -7,7 +7,7 @@ import {
 } from "./cookies";
 import { sealImpersonationTicket, openImpersonationTicket } from "./ticket";
 import { impersonationPassCookie } from "./pass-cookie";
-import { requestOrigin, resolveCookieDomain } from "../session";
+import { cookieScope, requestOrigin } from "../session";
 import {
   platformCall,
   platformClient,
@@ -49,11 +49,7 @@ function withCookies(response: Response, cookies: string[]): Response {
   return response;
 }
 
-function cookieScope(host: string): string {
-  return resolveCookieDomain(host) ?? host.split(":")[0].toLowerCase();
-}
-
-function handsOffToTarget(request: Request, target: string): boolean {
+export function handsOffToTarget(request: Request, target: string): boolean {
   const here = requestHost(request);
   if (!here) return false;
   try {