@snokam/auth 6.0.4 → 6.0.6

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [6.0.6](https://github.com/snokam/components/compare/@snokam/auth@6.0.5...@snokam/auth@6.0.6) (2026-11-05)
+
+### Bug Fixes
+
+- **web:** post go-live fixes for texts, sessions, place search and pickers ([#3218](https://github.com/snokam/components/issues/3218)) ([0fbf0bb](https://github.com/snokam/components/commit/0fbf0bbec53b6cf946684c76fef318aa5cea7403))
+
+## [6.0.5](https://github.com/snokam/components/compare/@snokam/auth@6.0.4...@snokam/auth@6.0.5) (2026-11-05)
+
+**Note:** Version bump only for package @snokam/auth
+
 ## [6.0.4](https://github.com/snokam/components/compare/@snokam/auth@6.0.3...@snokam/auth@6.0.4) (2026-11-04)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "6.0.4",
+  "version": "6.0.6",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [
@@ -23,15 +23,14 @@
     "@emotion/styled": "^11.14.1",
     "@mui/icons-material": "^9.2.0",
     "@mui/material": "^9.2.0",
-    "@snokam/employees-client": "^1.3.0",
     "next-auth": "4.24.15",
     "path-to-regexp": "^8.4.2",
-    "@snokam/platform-client": "5.4.0",
+    "@snokam/api-client": "1.0.0",
+    "@snokam/identity": "1.1.0",
+    "@snokam/page-content": "6.9.5",
     "@snokam/react-query": "1.1.0",
-    "@snokam/sanity-page-content": "6.9.4",
-    "@snokam/tenant": "4.5.1",
-    "@snokam/ui": "7.2.1",
-    "@snokam/identity": "1.1.0"
+    "@snokam/tenant": "4.5.2",
+    "@snokam/ui": "7.2.2"
   },
   "peerDependencies": {
     "next": "16.3.8",

package/src/app-router/components/Provider/index.tsx

@@ -8,6 +8,7 @@ import { SessionProvider } from "next-auth/react";
 import { useAuth } from "../../../hooks";
 import { EmployeeThemeSync } from "../../../theme/employee-theme-sync";
 import { ServerSessionContext } from "../../../session/useSession";
+import { ConfirmedSessionProvider } from "../../../session/confirmed";
 
 export const Provider = memo((props: Auth.Provider.Props) => {
   const { session, children } = props;
@@ -15,10 +16,12 @@ export const Provider = memo((props: Auth.Provider.Props) => {
   return (
     <ServerSessionContext.Provider value={session ?? null}>
       <SessionProvider session={session ?? undefined}>
-        <EmployeeThemeSync />
-        <Suspense fallback={<>{children}</>}>
-          <ProviderInner {...props}>{children}</ProviderInner>
-        </Suspense>
+        <ConfirmedSessionProvider>
+          <EmployeeThemeSync />
+          <Suspense fallback={<>{children}</>}>
+            <ProviderInner {...props}>{children}</ProviderInner>
+          </Suspense>
+        </ConfirmedSessionProvider>
       </SessionProvider>
     </ServerSessionContext.Provider>
   );

package/src/app-router/index.tsx

@@ -12,6 +12,7 @@ export { Unauthenticated } from "../components/Unauthenticated";
 export { Authenticated } from "../components/Authenticated";
 export { useAuth } from "../hooks";
 export { useSession } from "../session/useSession";
+export { useIsHydrating } from "../hydration/useIsHydrating";
 export { retryUnlessMissing } from "../employee-query/retry";
 export { EmployeeThemeSync } from "../theme/employee-theme-sync";
 export { ScopesProvider, useScopes, useHasScope } from "../scopes";

package/src/app-router/server.ts

@@ -14,6 +14,7 @@ import {
   appUrl,
   backendUrl,
   managedBearer,
+  resolveApiBaseUrl,
 } from "@snokam/tenant/server";
 
 export { getServerToken } from "./token";
@@ -27,6 +28,10 @@ export function serverTenantToken(): Promise<string | undefined> {
   return scope ? managedBearer(scope) : Promise.resolve(undefined);
 }
 
+export function resolveServerApiBaseUrl(): Promise<string> {
+  return resolveApiBaseUrl();
+}
+
 export function resolveServerApiBase(service: string): Promise<string> {
   return service ? backendUrl(service) : Promise.resolve("");
 }

package/src/app-sign-in/platform.ts

@@ -4,7 +4,7 @@ import {
   ResponseError,
   type AuthorizationPreview,
   type IssuedAuthorizationCode,
-} from "@snokam/platform-client";
+} from "@snokam/api-client/platform";
 import { platformClientFor } from "../impersonation/request";
 import type { AuthorizationParams } from "./consent";
 

package/src/components/NotProvisioned/AccessHelp.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { usePageContent } from "@snokam/sanity-page-content";
+import { usePageContent } from "@snokam/page-content";
 import { PersonOffOutlined } from "@snokam/ui/icons";
 import { SystemPage, SystemPageAction } from "@snokam/ui/system-page";
 import { useAuth } from "../../hooks";

package/src/components/NotProvisioned/index.tsx

@@ -2,11 +2,11 @@
 
 import { useQuery } from "@snokam/react-query";
 import { PageLoader } from "@snokam/ui";
-import { loadAppContent } from "@snokam/sanity-page-content/app-router/actions";
+import { loadAppContent } from "@snokam/page-content/app-router/actions";
 import {
   AppContentProvider,
   PageContentProvider,
-} from "@snokam/sanity-page-content/app-router/providers";
+} from "@snokam/page-content/app-router/providers";
 import { AccessHelp } from "./AccessHelp";
 import { usePickerRedirect } from "./usePickerRedirect";
 

package/src/cors-origin.test.ts

@@ -0,0 +1,41 @@
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { isAllowedOrigin } from "./cors-origin.ts";
+
+const ZONE = "platform.example";
+
+describe("CORS origin trust", () => {
+  beforeEach(() => {
+    process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = ZONE;
+  });
+
+  afterEach(() => {
+    delete process.env.NEXT_PUBLIC_PLATFORM_DOMAIN;
+  });
+
+  it("trusts the configured platform zone and its subdomains", () => {
+    assert.equal(isAllowedOrigin(`https://${ZONE}`), true);
+    assert.equal(isAllowedOrigin(`https://acme.${ZONE}`), true);
+  });
+
+  it("does not trust hosts that only end with the zone name", () => {
+    assert.equal(isAllowedOrigin(`https://evil${ZONE}`), false);
+    assert.equal(isAllowedOrigin(`https://${ZONE}.evil.example`), false);
+  });
+
+  it("trusts listed extra origins and local development", () => {
+    assert.equal(
+      isAllowedOrigin("https://partner.example", ["https://partner.example"]),
+      true
+    );
+    assert.equal(isAllowedOrigin("http://localhost:3000"), true);
+  });
+
+  it("fails clearly when the platform zone is not configured", () => {
+    delete process.env.NEXT_PUBLIC_PLATFORM_DOMAIN;
+    assert.throws(
+      () => isAllowedOrigin("https://acme.elsewhere.example"),
+      /NEXT_PUBLIC_PLATFORM_DOMAIN/
+    );
+  });
+});

package/src/cors-origin.ts

@@ -0,0 +1,34 @@
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1"]);
+
+function platformZone(): string {
+  const zone = process.env.NEXT_PUBLIC_PLATFORM_DOMAIN;
+  if (!zone) {
+    throw new Error(
+      "NEXT_PUBLIC_PLATFORM_DOMAIN is not configured, so CORS cannot tell platform origins apart"
+    );
+  }
+  return zone.toLowerCase();
+}
+
+function isWithin(hostname: string, domain: string): boolean {
+  return hostname === domain || hostname.endsWith(`.${domain}`);
+}
+
+export function isAllowedOrigin(
+  origin: string | null,
+  additionalOrigins: string[] = []
+): boolean {
+  if (!origin) return false;
+  if (additionalOrigins.includes(origin)) return true;
+
+  let hostname: string;
+  try {
+    hostname = new URL(origin).hostname;
+  } catch {
+    return false;
+  }
+
+  if (LOCAL_HOSTS.has(hostname)) return true;
+  if (isWithin(hostname, "snokam.no")) return true;
+  return isWithin(hostname, platformZone());
+}

package/src/cors.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { Auth } from "./types";
+import { isAllowedOrigin } from "./cors-origin";
 
 const DEFAULT_CORS_HEADERS = [
   "X-CSRF-Token",
@@ -15,36 +16,6 @@ const DEFAULT_CORS_HEADERS = [
   "Cookie",
 ];
 
-export function isAllowedOrigin(
-  origin: string | null,
-  additionalOrigins: string[] = []
-): boolean {
-  if (!origin) return false;
-
-  try {
-    const url = new URL(origin);
-    if (url.hostname.endsWith(".snokam.no") || url.hostname === "snokam.no") {
-      return true;
-    }
-
-    if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-      return true;
-    }
-
-    if (url.hostname.endsWith(".snosky.no") || url.hostname === "snosky.no") {
-      return true;
-    }
-
-    if (additionalOrigins.includes(origin)) {
-      return true;
-    }
-
-    return false;
-  } catch {
-    return false;
-  }
-}
-
 export function addCorsHeaders(
   response: NextResponse,
   origin: string | null,

package/src/hooks.ts

@@ -1,19 +1,21 @@
 import { signIn, signOut } from "next-auth/react";
-import { useMemo } from "react";
-import { IMP_ACTIVE_COOKIE } from "./impersonation/cookies";
+import { useCallback, useMemo } from "react";
+import { readActiveCookie } from "./impersonation/cookies";
 import { useImpersonation } from "./impersonation/context";
 import { useOwnIdentity } from "./identity/own";
 import { useSession } from "./session/useSession";
-
-class ConsentRequiredError extends Error {}
-
-const REFRESH_MARGIN_SECONDS = 60;
-
-interface CachedToken {
-  bearer: string;
-  expiresOn: number;
-  impKey: string;
-}
+import { isReusable, type CachedToken } from "./token/reuse";
+import {
+  confirmSessionState,
+  fetchSessionFromServer,
+  withRetries,
+} from "./session/confirm";
+import {
+  ConsentRequiredError,
+  failureOf,
+  SignedOutError,
+  TransientTokenError,
+} from "./token/failure";
 
 type TokenKind = "session" | "own";
 
@@ -28,22 +30,7 @@ const inFlightTokens: Record<
 
 function readImpersonationKey(): string {
   if (typeof document === "undefined") return "";
-  const match = document.cookie
-    .split(";")
-    .map((part) => part.trim())
-    .find((part) => part.startsWith(`${IMP_ACTIVE_COOKIE}=`));
-  if (!match) return "";
-  try {
-    const value = decodeURIComponent(match.slice(IMP_ACTIVE_COOKIE.length + 1));
-    const parsed = JSON.parse(value) as {
-      tokenId?: string;
-      expiresOn?: number;
-    };
-    if (parsed.expiresOn && parsed.expiresOn * 1000 <= Date.now()) return "";
-    return parsed.tokenId ?? "";
-  } catch {
-    return "";
-  }
+  return readActiveCookie(document.cookie)?.tokenId ?? "";
 }
 
 export function clearAuthTokenCache(): void {
@@ -53,25 +40,27 @@ export function clearAuthTokenCache(): void {
   inFlightTokens.own = null;
 }
 
-async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
-  const res = await fetch("/api/auth/token", {
-    method: "POST",
-    body: JSON.stringify(kind === "own" ? { own: true } : {}),
-    credentials: "include",
-    headers: {
-      "Content-Type": "application/json",
-    },
-  });
-
-  if (res.status === 403) {
-    const body = await res.json().catch(() => null);
-    if (body?.error === "consent_required") {
-      throw new ConsentRequiredError();
-    }
+async function requestToken(kind: TokenKind): Promise<Response> {
+  try {
+    return await fetch("/api/auth/token", {
+      method: "POST",
+      body: JSON.stringify(kind === "own" ? { own: true } : {}),
+      credentials: "include",
+      headers: {
+        "Content-Type": "application/json",
+      },
+    });
+  } catch {
+    throw new TransientTokenError("Token request did not reach the server");
   }
+}
+
+async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
+  const res = await requestToken(kind);
 
   if (!res.ok) {
-    throw new Error("Token fetch failed");
+    const body = await res.json().catch(() => null);
+    throw failureOf(res.status, body);
   }
 
   const token = await res.json();
@@ -79,7 +68,12 @@ async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
 
   sessionStorage.removeItem("auth-consent-retried");
   const bearer = `Bearer ${accessToken}`;
-  cachedTokens[kind] = { bearer, expiresOn, impKey };
+  cachedTokens[kind] = {
+    bearer,
+    expiresOn,
+    fetchedAt: Date.now() / 1000,
+    impKey,
+  };
   return bearer;
 }
 
@@ -88,20 +82,17 @@ async function getFreshToken(kind: TokenKind): Promise<string> {
   const now = Date.now() / 1000;
   const cached = cachedTokens[kind];
 
-  if (
-    cached &&
-    cached.impKey === impKey &&
-    now < cached.expiresOn - REFRESH_MARGIN_SECONDS
-  ) {
-    return cached.bearer;
-  }
+  if (isReusable(cached, impKey, now)) return cached.bearer;
 
   const inFlight = inFlightTokens[kind];
   if (inFlight && inFlight.impKey === impKey) {
     return inFlight.promise;
   }
 
-  const promise = fetchToken(kind, impKey);
+  const promise = withRetries(
+    () => fetchToken(kind, impKey),
+    (error) => error instanceof TransientTokenError
+  );
   inFlightTokens[kind] = { impKey, promise };
   promise
     .catch(() => undefined)
@@ -116,11 +107,20 @@ export function fetchOwnToken(): Promise<string> {
   return tokenOrLogin("own");
 }
 
+async function signInAgainIfSignedOut(error: SignedOutError): Promise<void> {
+  const state = await confirmSessionState(fetchSessionFromServer);
+  if (state !== "signed-out") throw error;
+  const here = `${window.location.pathname}${window.location.search}`;
+  window.location.href = `/auth/login?callbackUrl=${encodeURIComponent(here)}`;
+}
+
 function tokenOrLogin(kind: TokenKind): Promise<string> {
   return getFreshToken(kind).catch((error) => {
     console.error(error);
+    if (error instanceof TransientTokenError) throw error;
     const onAuthPage = window.location.pathname.startsWith("/auth/");
     if (onAuthPage) return;
+    if (error instanceof SignedOutError) return signInAgainIfSignedOut(error);
     const reason = error instanceof ConsentRequiredError ? "consent" : "true";
     window.location.href = `/auth/login?error=${reason}`;
   }) as Promise<string>;
@@ -146,13 +146,18 @@ export function useAuth() {
     };
   }, [rawSession, active]);
 
+  const getToken = useCallback(
+    () => tokenOrLogin(own ? "own" : "session"),
+    [own]
+  );
+
   const value = useMemo(
     () => ({
       update,
       signIn,
       signOut,
       session,
-      getToken: () => tokenOrLogin(own ? "own" : "session"),
+      getToken,
       inProgress: status === "loading",
       isAuthenticated:
         status === "authenticated" ||
@@ -160,7 +165,7 @@ export function useAuth() {
         (status === "loading" && !!session),
     }),
 
-    [update, status, session, active, own]
+    [update, status, session, active, getToken]
   );
 
   return value;

package/src/hydration/useIsHydrating.ts

@@ -0,0 +1,12 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+const subscribeToNothing = () => () => {};
+
+export const useIsHydrating = () =>
+  useSyncExternalStore(
+    subscribeToNothing,
+    () => false,
+    () => true
+  );

package/src/impersonation/carried.test.ts

@@ -0,0 +1,62 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { carriedTo } from "./carried.ts";
+import { PLATFORM_HOST, UNKNOWN_HOST } from "../handoff/seal.ts";
+
+const now = Date.UTC(2026, 10, 3, 12, 0, 0);
+const expiresOn = now / 1000 + 600;
+
+function tokenFor(biz: string) {
+  const payload = Buffer.from(JSON.stringify({ biz })).toString("base64url");
+  return `header.${payload}.signature`;
+}
+
+const session = { accessToken: tokenFor("snokam"), expiresOn, tokenId: "t1" };
+const active = {
+  targetEmail: "bjorn@test.snokam.no",
+  finance: false,
+  tokenId: "t1",
+  expiresOn,
+  origins: ["https://salg.beta.test.snokam.no"],
+};
+const snokam = { businessId: "snokam" };
+
+describe("carrying an impersonation to another host", () => {
+  it("carries it to a host owned by the impersonated business", () => {
+    assert.deepEqual(carriedTo({ session, active }, snokam, now), {
+      session,
+      active,
+    });
+  });
+
+  it("carries it to a platform host", () => {
+    assert.ok(carriedTo({ session, active }, PLATFORM_HOST, now));
+  });
+
+  it("refuses a host owned by another business", () => {
+    assert.equal(
+      carriedTo({ session, active }, { businessId: "other" }, now),
+      null
+    );
+  });
+
+  it("refuses a host nobody owns", () => {
+    assert.equal(carriedTo({ session, active }, UNKNOWN_HOST, now), null);
+  });
+
+  it("refuses when nothing is being impersonated", () => {
+    assert.equal(carriedTo({}, snokam, now), null);
+    assert.equal(carriedTo({ session }, snokam, now), null);
+  });
+
+  it("refuses an expired impersonation", () => {
+    assert.equal(carriedTo({ session, active }, snokam, now + 601_000), null);
+  });
+
+  it("refuses when the session and the visible state disagree", () => {
+    assert.equal(
+      carriedTo({ session, active: { ...active, tokenId: "t2" } }, snokam, now),
+      null
+    );
+  });
+});

package/src/impersonation/carried.ts

@@ -0,0 +1,21 @@
+import { type HostOwner, maySealFor } from "../handoff/seal.ts";
+import { tokenClaims } from "./claims.ts";
+import type { ImpersonationActive, ImpersonationSession } from "./cookies";
+
+export interface Carried {
+  session: ImpersonationSession;
+  active: ImpersonationActive;
+}
+
+export function carriedTo(
+  carried: Partial<Carried>,
+  owner: HostOwner,
+  now: number = Date.now()
+): Carried | null {
+  const { session, active } = carried;
+  if (!session?.accessToken || !active) return null;
+  if (session.tokenId !== active.tokenId) return null;
+  if (session.expiresOn * 1000 <= now) return null;
+  const business = tokenClaims(session.accessToken).biz;
+  return maySealFor(owner, business) ? { session, active } : null;
+}

package/src/impersonation/carry.ts

@@ -0,0 +1,82 @@
+import { Auth } from "../types";
+import { isAllowedReturnTo } from "../handoff/return-to";
+import { hostOwner } from "../handoff/business";
+import type { HostOwner } from "../handoff/seal";
+import {
+  buildImpersonationCookies,
+  readImpersonationActive,
+  readImpersonationSession,
+} from "./cookies";
+import { carriedTo } from "./carried";
+import { withOrigin } from "./exit";
+import { handsOffToTarget } from "./handlers";
+import { requestHost } from "./request";
+import { sealImpersonationTicket } from "./ticket";
+
+const ADOPT_PATH = "/api/impersonation/adopt";
+
+async function allowedTarget(target: unknown): Promise<URL | null> {
+  if (typeof target !== "string" || !URL.canParse(target)) return null;
+  const allowed = await isAllowedReturnTo(target, {
+    platformApiBase: process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL ?? "",
+    platformBaseDomain: process.env.NEXT_PUBLIC_PLATFORM_DOMAIN ?? "",
+    allowLocalhost: process.env.AUTH_ALLOW_LOCALHOST === "true",
+  });
+  return allowed ? new URL(target) : null;
+}
+
+async function ownerOf(target: URL): Promise<HostOwner | null> {
+  try {
+    return await hostOwner(target.toString());
+  } catch {
+    return null;
+  }
+}
+
+function adoptUrl(target: URL, ticket: string): string {
+  const adopt = new URL(ADOPT_PATH, target.origin);
+  adopt.searchParams.set("t", ticket);
+  adopt.searchParams.set("returnTo", target.pathname + target.search);
+  return adopt.toString();
+}
+
+export function createImpersonationCarryHandler(authConfig: Auth.Config) {
+  return async function POST(request: Request) {
+    const body = (await request.json().catch(() => null)) as {
+      redirectTo?: unknown;
+    } | null;
+    const target = await allowedTarget(body?.redirectTo);
+    if (!target) return new Response("Invalid redirectTo", { status: 400 });
+    if (!handsOffToTarget(request, target.toString())) {
+      return new Response("Shares cookies with this host", { status: 409 });
+    }
+
+    const owner = await ownerOf(target);
+    if (!owner)
+      return new Response("Tenant lookup unavailable", { status: 503 });
+
+    const carried = carriedTo(
+      {
+        session: readImpersonationSession(request) ?? undefined,
+        active: readImpersonationActive(request) ?? undefined,
+      },
+      owner
+    );
+    if (!carried) return new Response("Nothing to carry", { status: 409 });
+
+    const { session, active } = carried;
+    const origins = withOrigin(active.origins, target.origin);
+    const ticket = sealImpersonationTicket(
+      { ...session, ...active, business: target.host, origins },
+      authConfig.nextAuthSecret
+    );
+    const response = Response.json({ adoptUrl: adoptUrl(target, ticket) });
+    for (const cookie of buildImpersonationCookies(
+      { ...session, ...active, origins },
+      requestHost(request)
+    )) {
+      response.headers.append("Set-Cookie", cookie);
+    }
+    return response;
+  };
+}