@snokam/auth 6.0.3 → 6.0.5

package/src/sso/exchange.test.ts

@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { exchangeSsoToken } from "./exchange.ts";
+
+const realFetch = globalThis.fetch;
+const realWarn = console.warn;
+const inAnHour = () => Math.floor(Date.now() / 1000) + 3600;
+
+function answering(body: unknown): { calls: number } {
+  const counter = { calls: 0 };
+  globalThis.fetch = (async () => {
+    counter.calls += 1;
+    return new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }) as typeof fetch;
+  return counter;
+}
+
+describe("exchangeSsoToken", () => {
+  beforeEach(() => {
+    process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL =
+      "https://snokam.test.snosky.no/api/platform";
+    console.warn = () => {};
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    console.warn = realWarn;
+  });
+
+  it("returns the platform token with its expiry and reuses it", async () => {
+    const expiresOn = inAnHour();
+    const counter = answering({ accessToken: "platform", expiresOn });
+
+    const first = await exchangeSsoToken("entra-reused");
+    const second = await exchangeSsoToken("entra-reused");
+
+    assert.deepEqual(first, { accessToken: "platform", expiresOn });
+    assert.deepEqual(second, first);
+    assert.equal(counter.calls, 1);
+  });
+
+  it("refuses an answer without an expiry instead of caching it", async () => {
+    const counter = answering({ accessToken: "platform", expiresOn: null });
+
+    assert.equal(await exchangeSsoToken("entra-no-expiry"), null);
+    assert.equal(await exchangeSsoToken("entra-no-expiry"), null);
+    assert.equal(counter.calls, 2);
+  });
+
+  it("refuses an answer without a token", async () => {
+    answering({ accessToken: null, expiresOn: inAnHour() });
+
+    assert.equal(await exchangeSsoToken("entra-no-token"), null);
+  });
+});

package/src/sso/exchange.ts

@@ -3,12 +3,17 @@ import {
   Configuration,
   PlatformClient,
   type TokenExchangeResult,
-} from "@snokam/platform-client";
+} from "@snokam/api-client/platform";
 
 const EXPIRY_SKEW_SECONDS = 60;
 const MAX_ENTRIES = 500;
 
-const cache = new Map<string, TokenExchangeResult>();
+export interface ExchangedToken {
+  accessToken: string;
+  expiresOn: number;
+}
+
+const cache = new Map<string, ExchangedToken>();
 
 function platformBase(): string | null {
   return (
@@ -20,11 +25,18 @@ function keyFor(providerToken: string): string {
   return createHash("sha256").update(providerToken).digest("base64url");
 }
 
-function isUsable(token: TokenExchangeResult, nowSeconds: number): boolean {
+function isUsable(token: ExchangedToken, nowSeconds: number): boolean {
   return token.expiresOn - EXPIRY_SKEW_SECONDS > nowSeconds;
 }
 
-function remember(key: string, token: TokenExchangeResult): void {
+function complete(result: TokenExchangeResult): ExchangedToken | null {
+  const { accessToken, expiresOn } = result;
+  return accessToken && typeof expiresOn === "number"
+    ? { accessToken, expiresOn }
+    : null;
+}
+
+function remember(key: string, token: ExchangedToken): void {
   const now = Math.floor(Date.now() / 1000);
   for (const [existing, value] of cache)
     if (!isUsable(value, now)) cache.delete(existing);
@@ -40,7 +52,7 @@ function remember(key: string, token: TokenExchangeResult): void {
 
 export async function exchangeSsoToken(
   providerToken: string
-): Promise<TokenExchangeResult | null> {
+): Promise<ExchangedToken | null> {
   const basePath = platformBase();
   if (!basePath || !providerToken) return null;
 
@@ -51,10 +63,12 @@ export async function exchangeSsoToken(
 
   const client = new PlatformClient(new Configuration({ basePath }));
   try {
-    const result = await client.ssoTokenExchange({
-      ssoExchangeRequest: { token: providerToken },
-    });
-    if (!result.accessToken) return null;
+    const result = complete(
+      await client.ssoTokenExchange({
+        ssoExchangeRequest: { token: providerToken },
+      })
+    );
+    if (!result) return null;
     remember(key, result);
     return result;
   } catch (e) {

package/src/theme/employee-theme-sync.tsx

@@ -1,8 +1,8 @@
 "use client";
 
 import { useEffect, useMemo, useRef } from "react";
-import { Configuration, EmployeesClient } from "@snokam/employees-client";
-import { useOptionalConfig } from "@snokam/tenant";
+import { Configuration, EmployeesClient } from "@snokam/api-client/employees";
+import { apiBaseUrl, useOptionalConfig } from "@snokam/tenant";
 import { useClientQuery } from "@snokam/react-query";
 import { useAdminTheme } from "@snokam/ui/theme/admin";
 import type { ColorSchemeMode } from "@snokam/ui/theme/admin";
@@ -21,7 +21,7 @@ export function EmployeeThemeSync() {
   const config = useOptionalConfig();
   const seeded = useRef(false);
 
-  const basePath = config?.NEXT_PUBLIC_EMPLOYEES_API_BASE_URL;
+  const basePath = config ? apiBaseUrl(config) : undefined;
   const client = useMemo(
     () =>
       new EmployeesClient(

package/src/token/reuse.test.ts

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isReusable, type CachedToken } from "./reuse.ts";
+
+const token = (expiresOn: number, fetchedAt: number): CachedToken => ({
+  bearer: "Bearer x",
+  expiresOn,
+  fetchedAt,
+  impKey: "imp-1",
+});
+
+describe("cached access token reuse", () => {
+  it("reuses a token until a minute before it expires", () => {
+    assert.equal(isReusable(token(1_000, 0), "imp-1", 939), true);
+    assert.equal(isReusable(token(1_000, 0), "imp-1", 940), false);
+  });
+
+  it("reuses a token handed out close to expiry instead of fetching it again on every call", () => {
+    assert.equal(isReusable(token(1_000, 970), "imp-1", 980), true);
+    assert.equal(isReusable(token(1_000, 970), "imp-1", 990), false);
+  });
+
+  it("never reuses an expired token or one for another view-as session", () => {
+    assert.equal(isReusable(token(1_000, 995), "imp-1", 1_000), false);
+    assert.equal(isReusable(token(1_000, 0), "imp-2", 10), false);
+    assert.equal(isReusable(null, "imp-1", 10), false);
+  });
+});

package/src/token/reuse.ts

@@ -0,0 +1,22 @@
+const REFRESH_MARGIN_SECONDS = 60;
+const MIN_REUSE_SECONDS = 15;
+
+export interface CachedToken {
+  bearer: string;
+  expiresOn: number;
+  fetchedAt: number;
+  impKey: string;
+}
+
+export function isReusable(
+  cached: CachedToken | null,
+  impKey: string,
+  nowSeconds: number
+): cached is CachedToken {
+  if (!cached || cached.impKey !== impKey) return false;
+  if (nowSeconds >= cached.expiresOn) return false;
+  return (
+    nowSeconds < cached.expiresOn - REFRESH_MARGIN_SECONDS ||
+    nowSeconds < cached.fetchedAt + MIN_REUSE_SECONDS
+  );
+}