@snokam/auth 6.0.4 → 6.0.5

package/src/impersonation/jar.test.ts

@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { parseCookieHeader, readActiveCookie } from "./jar.ts";
+
+const active = (tokenId: string, expiresOn: number) =>
+  `imp_active=${encodeURIComponent(
+    JSON.stringify({
+      tokenId,
+      expiresOn,
+      targetEmail: "ola@test",
+      finance: false,
+    })
+  )}`;
+
+describe("reading the view-as cookie in the browser", () => {
+  const future = Math.floor(Date.now() / 1000) + 600;
+
+  it("picks the same imp_active as the server when two cookie scopes both send one", () => {
+    const cookie = `${active("other-scope", future - 100)}; ${active("own", future)}`;
+
+    assert.equal(readActiveCookie(cookie)?.tokenId, "own");
+    assert.equal(
+      JSON.parse(parseCookieHeader(cookie).imp_active).tokenId,
+      "own"
+    );
+  });
+
+  it("ignores an expired or unreadable cookie", () => {
+    assert.equal(readActiveCookie(active("old", 1)), null);
+    assert.equal(readActiveCookie("imp_active=%E0%A4%A"), null);
+    assert.equal(readActiveCookie(""), null);
+  });
+});

package/src/impersonation/jar.ts

@@ -0,0 +1,44 @@
+import type { ImpersonationActive } from "./cookies";
+
+export const IMP_SESSION_COOKIE = "imp_session";
+export const IMP_ACTIVE_COOKIE = "imp_active";
+export const IMP_PASS_COOKIE = "imp_pass";
+
+export function parseCookieHeader(
+  header: string | null
+): Record<string, string> {
+  const jar: Record<string, string> = {};
+  if (!header) return jar;
+  for (const part of header.split(";")) {
+    const index = part.indexOf("=");
+    if (index < 0) continue;
+    const name = part.slice(0, index).trim();
+    if (name) jar[name] = decodeURIComponent(part.slice(index + 1).trim());
+  }
+  return jar;
+}
+
+export function parseActiveCookie(
+  json: string | undefined
+): ImpersonationActive | null {
+  if (!json) return null;
+  try {
+    const parsed = JSON.parse(json) as ImpersonationActive;
+    if (parsed.expiresOn * 1000 <= Date.now()) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export function readActiveCookie(
+  cookieString: string
+): ImpersonationActive | null {
+  try {
+    return parseActiveCookie(
+      parseCookieHeader(cookieString)[IMP_ACTIVE_COOKIE]
+    );
+  } catch {
+    return null;
+  }
+}

package/src/impersonation/pass-cookie.ts

@@ -1,5 +1,6 @@
 import { IMP_PASS_COOKIE, parseCookieHeader, serialize } from "./cookies";
 import { isValidPass, sealPass } from "./pass";
+import { cookieScope } from "../session";
 
 export function impersonationPassCookie(
   session: { tokenId: string; expiresOn: number },
@@ -7,7 +8,12 @@ export function impersonationPassCookie(
   secret: string
 ): string {
   const maxAge = Math.max(0, Math.floor(session.expiresOn - Date.now() / 1000));
-  const pass = sealPass(host ?? "", session.tokenId, maxAge, secret);
+  const pass = sealPass(
+    host ? cookieScope(host) : "",
+    session.tokenId,
+    maxAge,
+    secret
+  );
   return serialize(IMP_PASS_COOKIE, pass, { host, httpOnly: true, maxAge });
 }
 
@@ -20,5 +26,5 @@ export function hasImpersonationPass(
   ];
   const host =
     request.headers.get("x-forwarded-host") ?? request.headers.get("host");
-  return isValidPass(pass, host, secret);
+  return isValidPass(pass, host && cookieScope(host), secret);
 }

package/src/impersonation/pass.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { isValidPass, sealPass } from "./pass.ts";
+import { cookieScope } from "../session/cookies.ts";
 
 const SECRET = "test-secret";
 const HOST = "businessx.test.snosky.no";
@@ -40,4 +41,22 @@ describe("the Vis som pass", () => {
     assert.equal(isValidPass(pass, null, SECRET), false);
     assert.equal(isValidPass(pass, HOST, ""), false);
   });
+
+  it("is accepted on every host that shares its cookie scope", () => {
+    process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = "test.snosky.no";
+    const pass = sealPass(
+      cookieScope("salg.beta.test.snokam.no"),
+      "tok",
+      HOUR,
+      SECRET
+    );
+    assert.equal(
+      isValidPass(pass, cookieScope("minside.beta.test.snokam.no"), SECRET),
+      true
+    );
+    assert.equal(
+      isValidPass(pass, cookieScope("snokam.beta.test.snosky.no"), SECRET),
+      false
+    );
+  });
 });

package/src/impersonation/renewal.ts

@@ -1,9 +1,9 @@
 "use client";
 
-import { useEffect } from "react";
+import { useEffect, useRef } from "react";
 import { clearAuthTokenCache } from "../hooks";
 import type { ImpersonationActive } from "./cookies";
-import { renewDelayMs } from "./required";
+import { scheduleRenewal, type RenewalAttempt } from "./schedule";
 
 async function renewSession(): Promise<boolean> {
   const res = await fetch("/api/impersonation/renew", {
@@ -17,26 +17,19 @@ export function useSessionRenewal(
   active: ImpersonationActive | null,
   rereadCookie: () => void
 ) {
-  useEffect(() => {
-    if (!active) return;
+  const attempts = useRef<RenewalAttempt | null>(null);
+  const tokenId = active?.tokenId;
+  const expiresOn = active?.expiresOn;
 
-    const renewal = setTimeout(
-      async () => {
-        if (!(await renewSession())) return;
+  useEffect(() => {
+    if (!tokenId || !expiresOn) return;
+    return scheduleRenewal({ tokenId, expiresOn }, attempts, {
+      renew: renewSession,
+      renewed: () => {
         clearAuthTokenCache();
         rereadCookie();
       },
-      renewDelayMs(active.expiresOn, Date.now())
-    );
-
-    const expiry = setTimeout(
-      rereadCookie,
-      Math.max(0, active.expiresOn * 1000 - Date.now())
-    );
-
-    return () => {
-      clearTimeout(renewal);
-      clearTimeout(expiry);
-    };
-  }, [active, rereadCookie]);
+      expired: rereadCookie,
+    });
+  }, [tokenId, expiresOn, rereadCookie]);
 }

package/src/impersonation/request.ts

@@ -2,7 +2,7 @@ import {
   Configuration,
   PlatformClient,
   ResponseError,
-} from "@snokam/platform-client";
+} from "@snokam/api-client/platform";
 
 export function platformBase(): string | null {
   return (

package/src/impersonation/routes.ts

@@ -6,6 +6,7 @@ import {
   createImpersonationClearHandler,
 } from "./handlers";
 import { createImpersonationRenewHandler } from "./renew";
+import { createImpersonationCarryHandler } from "./carry";
 import {
   createPickerBusinessesHandler,
   createPickerPeopleHandler,
@@ -19,6 +20,7 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
   const adopt = createImpersonationAdoptHandler(authConfig);
   const clear = createImpersonationClearHandler();
   const renew = createImpersonationRenewHandler(authConfig);
+  const carry = createImpersonationCarryHandler(authConfig);
   const businesses = createPickerBusinessesHandler(authConfig);
   const people = createPickerPeopleHandler(authConfig);
 
@@ -36,6 +38,7 @@ export function createImpersonationRouteHandlers(authConfig: Auth.Config) {
       if (op === "start") return start(request);
       if (op === "end") return end(request);
       if (op === "renew") return renew(request);
+      if (op === "carry") return carry(request);
       return new Response("Not found", { status: 404 });
     },
   };

package/src/impersonation/schedule.test.ts

@@ -0,0 +1,95 @@
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, describe, it, mock } from "node:test";
+import {
+  scheduleRenewal,
+  type RenewalAttempt,
+  type RenewalTarget,
+} from "./schedule.ts";
+
+const START_MS = 1_800_000_000_000;
+const LIFETIME_SECONDS = 15 * 60;
+
+function flush(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+async function advance(totalMs: number, stepMs = 100): Promise<void> {
+  for (let elapsed = 0; elapsed < totalMs; elapsed += stepMs) {
+    mock.timers.tick(stepMs);
+    await flush();
+  }
+}
+
+function provider(renewedExpiresOn: (nowMs: number) => number | null) {
+  let cookie: RenewalTarget = {
+    tokenId: "imp-1",
+    expiresOn: START_MS / 1000 + LIFETIME_SECONDS,
+  };
+  const attempts: { current: RenewalAttempt | null } = { current: null };
+  const calls = { renew: 0, expired: 0 };
+  let cancel = () => {};
+
+  const mount = () => {
+    cancel();
+    cancel = scheduleRenewal({ ...cookie }, attempts, {
+      renew: async () => {
+        calls.renew += 1;
+        const next = renewedExpiresOn(Date.now());
+        if (next !== null) cookie = { ...cookie, expiresOn: next };
+        return true;
+      },
+      renewed: mount,
+      expired: () => {
+        calls.expired += 1;
+      },
+    });
+  };
+
+  mount();
+  return { calls, unmount: () => cancel() };
+}
+
+describe("impersonation renewal scheduling", () => {
+  beforeEach(() => {
+    mock.timers.enable({ apis: ["setTimeout", "Date"], now: START_MS });
+  });
+
+  afterEach(() => {
+    mock.timers.reset();
+  });
+
+  it("does not renew again when the renewed cookie never reaches this tab", async () => {
+    const { calls, unmount } = provider(() => null);
+
+    await advance(LIFETIME_SECONDS * 1000 - 110_000);
+    unmount();
+
+    assert.equal(calls.renew, 1);
+  });
+
+  it("renews once per token lifetime when the cookie is updated", async () => {
+    const { calls, unmount } = provider(
+      (nowMs) => nowMs / 1000 + LIFETIME_SECONDS
+    );
+
+    await advance(40 * 60 * 1000, 1000);
+    unmount();
+
+    assert.equal(calls.renew, 3);
+    assert.equal(calls.expired, 0);
+  });
+
+  it("paces renewals when a renewed token already looks stale to this clock", async () => {
+    const { calls, unmount } = provider((nowMs) => nowMs / 1000 + 60);
+
+    await advance(LIFETIME_SECONDS * 1000 - 120_000);
+    const before = calls.renew;
+    await advance(60_000);
+    unmount();
+
+    assert.ok(
+      calls.renew - before <= 3,
+      `renewed ${calls.renew - before} times in a minute`
+    );
+  });
+});

package/src/impersonation/schedule.ts

@@ -0,0 +1,56 @@
+import { renewDelayMs } from "./required.ts";
+
+const MIN_RENEW_INTERVAL_MS = 30_000;
+
+export interface RenewalTarget {
+  tokenId: string;
+  expiresOn: number;
+}
+
+export interface RenewalAttempt extends RenewalTarget {
+  atMs: number;
+}
+
+export interface RenewalHandlers {
+  renew: () => Promise<boolean>;
+  renewed: () => void;
+  expired: () => void;
+}
+
+export function nextRenewalDelayMs(
+  target: RenewalTarget,
+  lastAttempt: RenewalAttempt | null,
+  nowMs: number
+): number | null {
+  const due = renewDelayMs(target.expiresOn, nowMs);
+  if (!lastAttempt || lastAttempt.tokenId !== target.tokenId) return due;
+  if (lastAttempt.expiresOn >= target.expiresOn) return null;
+  return Math.max(due, lastAttempt.atMs + MIN_RENEW_INTERVAL_MS - nowMs);
+}
+
+export function scheduleRenewal(
+  target: RenewalTarget,
+  attempts: { current: RenewalAttempt | null },
+  handlers: RenewalHandlers,
+  nowMs: number = Date.now()
+): () => void {
+  const delay = nextRenewalDelayMs(target, attempts.current, nowMs);
+  const renewal =
+    delay === null
+      ? null
+      : setTimeout(async () => {
+          attempts.current = { ...target, atMs: Date.now() };
+          if (!(await handlers.renew())) return;
+          handlers.renewed();
+        }, delay);
+
+  const expiry = setTimeout(
+    handlers.expired,
+    Math.max(0, target.expiresOn * 1000 - nowMs)
+  );
+
+  return () => {
+    if (renewal) clearTimeout(renewal);
+    clearTimeout(expiry);
+  };
+}

package/src/options/employee-profile.ts

@@ -1,6 +1,6 @@
 import { ConfidentialClientApplication } from "@azure/msal-node";
-import { Configuration, EmployeesClient } from "@snokam/employees-client";
-import { backendUrl } from "@snokam/tenant/server";
+import { Configuration, EmployeesClient } from "@snokam/api-client/employees";
+import { resolveApiBaseUrl } from "@snokam/tenant/server";
 import { getSanityImageUrl } from "@snokam/ui/media/sanity";
 import { exchangePasswordToken } from "../password/api";
 import { exchangeSsoToken } from "../sso/exchange";
@@ -13,10 +13,7 @@ async function resolveEmployeesBackend(
     ? `api://${config.clientId}/user_impersonation`
     : "";
   return {
-    base: await backendUrl("employees", {
-      app: "employees",
-      entraTenantIdFallback: config.tenantId,
-    }),
+    base: await resolveApiBaseUrl({ entraTenantIdFallback: config.tenantId }),
     scope,
   };
 }

package/src/password/api.ts

@@ -1,4 +1,4 @@
-import type { BusinessBranding } from "@snokam/platform-client";
+import type { BusinessBranding } from "@snokam/api-client/platform";
 export { enrolmentFromError, enrolmentRequiredError } from "./enrolment";
 
 export interface PasswordLoginResult {

package/src/scopes/context.tsx

@@ -12,15 +12,17 @@ import { useAuth } from "../hooks";
 import { IMP_ACTIVE_COOKIE } from "../impersonation/cookies";
 import { scopeGranted, type ScopeAccess } from "./matcher";
 import { decodeJwtClaims } from "../token/claims";
+import { useIsHydrating } from "../hydration/useIsHydrating";
+import { scopesState, serverRenderedScopes, type ScopesState } from "./state";
 
-export interface ScopesState {
-  scopes: string[];
-  isImpersonating: boolean;
-  isAuthoritative: boolean;
-  isLoading: boolean;
+export type { ScopesState } from "./state";
+
+interface ScopesContextValue {
+  live: ScopesState;
+  serverRendered: ScopesState;
 }
 
-const ScopesContext = createContext<ScopesState | null>(null);
+const ScopesContext = createContext<ScopesContextValue | null>(null);
 
 function isImpersonationActive(): boolean {
   if (typeof document === "undefined") return false;
@@ -81,23 +83,13 @@ export function ScopesProvider({
     };
   }, [impersonating, isAuthenticated, getToken]);
 
-  const value = useMemo<ScopesState>(() => {
-    if (impersonating) {
-      return {
-        scopes: tokenScopes ?? [],
-        isImpersonating: true,
-        isAuthoritative: tokenScopes !== null,
-        isLoading: tokenScopes === null,
-      };
-    }
-    const authoritative = ready ?? normalScopes != null;
-    return {
-      scopes: normalScopes ?? [],
-      isImpersonating: false,
-      isAuthoritative: authoritative,
-      isLoading: ready === false,
-    };
-  }, [impersonating, tokenScopes, normalScopes, ready]);
+  const value = useMemo<ScopesContextValue>(
+    () => ({
+      live: scopesState({ impersonating, tokenScopes, normalScopes, ready }),
+      serverRendered: serverRenderedScopes(ready),
+    }),
+    [impersonating, tokenScopes, normalScopes, ready]
+  );
 
   return (
     <ScopesContext.Provider value={value}>{children}</ScopesContext.Provider>
@@ -105,14 +97,10 @@ export function ScopesProvider({
 }
 
 export function useScopes(): ScopesState {
-  return (
-    useContext(ScopesContext) ?? {
-      scopes: [],
-      isImpersonating: false,
-      isAuthoritative: false,
-      isLoading: false,
-    }
-  );
+  const value = useContext(ScopesContext);
+  const hydrating = useIsHydrating();
+  if (!value) return serverRenderedScopes();
+  return hydrating ? value.serverRendered : value.live;
 }
 
 export function useHasScope(

package/src/scopes/state.test.ts

@@ -0,0 +1,51 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { scopesState, serverRenderedScopes } from "./state.ts";
+
+test("scopes that wait for the employee render as loading on the server", () => {
+  assert.deepEqual(serverRenderedScopes(true), {
+    scopes: [],
+    isImpersonating: false,
+    isAuthoritative: false,
+    isLoading: true,
+  });
+  assert.deepEqual(serverRenderedScopes(false), serverRenderedScopes(true));
+});
+
+test("scopes without a ready signal render as not authoritative and not loading on the server", () => {
+  assert.deepEqual(serverRenderedScopes(undefined), {
+    scopes: [],
+    isImpersonating: false,
+    isAuthoritative: false,
+    isLoading: false,
+  });
+});
+
+test("the server never renders the impersonated or the employee's scopes", () => {
+  const live = scopesState({
+    impersonating: true,
+    tokenScopes: ["sales:read"],
+    normalScopes: ["employees:write"],
+    ready: true,
+  });
+
+  assert.deepEqual(live.scopes, ["sales:read"]);
+  assert.notDeepEqual(serverRenderedScopes(true), live);
+});
+
+test("employee scopes are authoritative once they are ready", () => {
+  assert.deepEqual(
+    scopesState({
+      impersonating: false,
+      tokenScopes: null,
+      normalScopes: ["sales:read"],
+      ready: true,
+    }),
+    {
+      scopes: ["sales:read"],
+      isImpersonating: false,
+      isAuthoritative: true,
+      isLoading: false,
+    }
+  );
+});

package/src/scopes/state.ts

@@ -0,0 +1,44 @@
+export interface ScopesState {
+  scopes: string[];
+  isImpersonating: boolean;
+  isAuthoritative: boolean;
+  isLoading: boolean;
+}
+
+export interface ScopesInput {
+  impersonating: boolean;
+  tokenScopes: string[] | null;
+  normalScopes?: string[] | null;
+  ready?: boolean;
+}
+
+export function scopesState({
+  impersonating,
+  tokenScopes,
+  normalScopes,
+  ready,
+}: ScopesInput): ScopesState {
+  if (impersonating) {
+    return {
+      scopes: tokenScopes ?? [],
+      isImpersonating: true,
+      isAuthoritative: tokenScopes !== null,
+      isLoading: tokenScopes === null,
+    };
+  }
+  return {
+    scopes: normalScopes ?? [],
+    isImpersonating: false,
+    isAuthoritative: ready ?? normalScopes != null,
+    isLoading: ready === false,
+  };
+}
+
+export function serverRenderedScopes(ready?: boolean): ScopesState {
+  return scopesState({
+    impersonating: false,
+    tokenScopes: null,
+    normalScopes: null,
+    ready: ready === undefined ? undefined : false,
+  });
+}

package/src/session/cookies.test.ts

@@ -0,0 +1,27 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { cookieScope, resolveCookieDomain } from "./cookies.ts";
+
+test("local hosts keep host-only cookies", () => {
+  assert.equal(resolveCookieDomain("localhost:3020"), undefined);
+  assert.equal(resolveCookieDomain("minside.localhost:3020"), undefined);
+  assert.equal(resolveCookieDomain("127.0.0.1:3020"), undefined);
+});
+
+test("a business zone shares one scope across its hosts", () => {
+  process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = "test.snosky.no";
+  assert.equal(cookieScope("salg.beta.test.snokam.no"), ".beta.test.snokam.no");
+  assert.equal(
+    cookieScope("minside.beta.test.snokam.no:443"),
+    ".beta.test.snokam.no"
+  );
+});
+
+test("platform-zone hosts are their own scope", () => {
+  process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = "test.snosky.no";
+  assert.equal(
+    cookieScope("snokam.beta.test.snosky.no"),
+    "snokam.beta.test.snosky.no"
+  );
+  assert.equal(cookieScope("localhost:3020"), "localhost");
+});

package/src/session/cookies.ts

@@ -2,7 +2,12 @@ export function resolveCookieDomain(
   host: string | undefined
 ): string | undefined {
   const bareHost = (host ?? "").split(":")[0].toLowerCase();
-  if (!bareHost || bareHost === "localhost" || /^[\d.]+$/.test(bareHost)) {
+  if (
+    !bareHost ||
+    bareHost === "localhost" ||
+    bareHost.endsWith(".localhost") ||
+    /^[\d.]+$/.test(bareHost)
+  ) {
     return undefined;
   }
 
@@ -29,6 +34,10 @@ export function resolveCookieDomain(
   return firstDot > 0 ? `.${bareHost.slice(firstDot + 1)}` : undefined;
 }
 
+export function cookieScope(host: string): string {
+  return resolveCookieDomain(host) ?? host.split(":")[0].toLowerCase();
+}
+
 export function getSessionCookieSettings(nextAuthUrl: string) {
   const cookieDomain = process.env.COOKIE_DOMAIN;
   const cookieTag = process.env.COOKIE_TAG;

package/src/session/index.ts

@@ -1,3 +1,7 @@
-export { resolveCookieDomain, getSessionCookieSettings } from "./cookies";
+export {
+  cookieScope,
+  resolveCookieDomain,
+  getSessionCookieSettings,
+} from "./cookies";
 export { getAuthUrl, requestOrigin } from "./url";
 export { callbackDestination, safeCallbackTarget } from "./callback-url";

package/src/session/useSession.ts

@@ -1,23 +1,15 @@
 "use client";
 
-import { createContext, useContext, useSyncExternalStore } from "react";
+import { createContext, useContext } from "react";
 import {
   useSession as useLiveSession,
   type SessionContextValue,
 } from "next-auth/react";
 import type { Session } from "next-auth";
+import { useIsHydrating } from "../hydration/useIsHydrating";
 
 export const ServerSessionContext = createContext<Session | null>(null);
 
-const subscribeToNothing = () => () => {};
-
-const useIsHydrating = () =>
-  useSyncExternalStore(
-    subscribeToNothing,
-    () => false,
-    () => true
-  );
-
 export const useSession = (): SessionContextValue => {
   const liveSession = useLiveSession();
   const serverSession = useContext(ServerSessionContext);