@snokam/auth 6.0.4 → 6.0.6

package/src/scopes/state.ts

@@ -0,0 +1,44 @@
+export interface ScopesState {
+  scopes: string[];
+  isImpersonating: boolean;
+  isAuthoritative: boolean;
+  isLoading: boolean;
+}
+
+export interface ScopesInput {
+  impersonating: boolean;
+  tokenScopes: string[] | null;
+  normalScopes?: string[] | null;
+  ready?: boolean;
+}
+
+export function scopesState({
+  impersonating,
+  tokenScopes,
+  normalScopes,
+  ready,
+}: ScopesInput): ScopesState {
+  if (impersonating) {
+    return {
+      scopes: tokenScopes ?? [],
+      isImpersonating: true,
+      isAuthoritative: tokenScopes !== null,
+      isLoading: tokenScopes === null,
+    };
+  }
+  return {
+    scopes: normalScopes ?? [],
+    isImpersonating: false,
+    isAuthoritative: ready ?? normalScopes != null,
+    isLoading: ready === false,
+  };
+}
+
+export function serverRenderedScopes(ready?: boolean): ScopesState {
+  return scopesState({
+    impersonating: false,
+    tokenScopes: null,
+    normalScopes: null,
+    ready: ready === undefined ? undefined : false,
+  });
+}

package/src/session/confirm.test.ts

@@ -0,0 +1,100 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  confirmSessionState,
+  readSessionState,
+  withRetries,
+} from "./confirm.ts";
+
+const noWait = async () => {};
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status });
+
+const replies = (...answers: (Response | Error)[]) => {
+  let calls = 0;
+  const fetchSession = async () => {
+    const answer = answers[Math.min(calls, answers.length - 1)];
+    calls += 1;
+    if (answer instanceof Error) throw answer;
+    return answer;
+  };
+  return { fetchSession, calls: () => calls };
+};
+
+test("a session with a user is signed in", async () => {
+  const { fetchSession } = replies(json({ user: { email: "a@b.no" } }));
+  assert.equal(await readSessionState(fetchSession), "signed-in");
+});
+
+test("an empty session is a confirmed sign-out", async () => {
+  const { fetchSession } = replies(json({}));
+  assert.equal(await readSessionState(fetchSession), "signed-out");
+});
+
+test("a failed request says nothing about the session", async () => {
+  assert.equal(
+    await readSessionState(replies(new TypeError("offline")).fetchSession),
+    "unknown"
+  );
+  assert.equal(
+    await readSessionState(replies(json({}, 502)).fetchSession),
+    "unknown"
+  );
+});
+
+test("hiccups are retried until the server answers", async () => {
+  const session = replies(
+    new TypeError("offline"),
+    json({}, 503),
+    json({ user: { email: "a@b.no" } })
+  );
+  const state = await confirmSessionState(
+    session.fetchSession,
+    [1, 1, 1],
+    noWait
+  );
+  assert.equal(state, "signed-in");
+  assert.equal(session.calls(), 3);
+});
+
+test("a server that never answers leaves the session unknown, not signed out", async () => {
+  const session = replies(new TypeError("offline"));
+  const state = await confirmSessionState(session.fetchSession, [1, 1], noWait);
+  assert.equal(state, "unknown");
+  assert.equal(session.calls(), 3);
+});
+
+test("retries wait longer each time and stop at the first success", async () => {
+  const waits: number[] = [];
+  let attempts = 0;
+  const value = await withRetries(
+    async () => {
+      attempts += 1;
+      if (attempts < 3) throw new Error("hiccup");
+      return "token";
+    },
+    () => true,
+    [100, 200, 400],
+    async (ms) => {
+      waits.push(ms);
+    }
+  );
+  assert.equal(value, "token");
+  assert.deepEqual(waits, [100, 200]);
+});
+
+test("errors that are not transient are not retried", async () => {
+  let attempts = 0;
+  await assert.rejects(
+    withRetries(
+      async () => {
+        attempts += 1;
+        throw new Error("signed out");
+      },
+      () => false,
+      [1, 1],
+      noWait
+    )
+  );
+  assert.equal(attempts, 1);
+});

package/src/session/confirm.ts

@@ -0,0 +1,63 @@
+export type SessionState = "signed-in" | "signed-out" | "unknown";
+
+export const RETRY_DELAYS_MS = [500, 1500, 4000, 10000];
+
+export type Wait = (ms: number) => Promise<void>;
+
+const sleep: Wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export async function withRetries<T>(
+  attempt: () => Promise<T>,
+  isTransient: (error: unknown) => boolean,
+  delays: number[] = RETRY_DELAYS_MS,
+  wait: Wait = sleep
+): Promise<T> {
+  for (const delay of delays) {
+    try {
+      return await attempt();
+    } catch (error) {
+      if (!isTransient(error)) throw error;
+      await wait(delay);
+    }
+  }
+  return attempt();
+}
+
+export async function readSessionState(
+  fetchSession: () => Promise<Response>
+): Promise<SessionState> {
+  try {
+    const response = await fetchSession();
+    if (!response.ok) return "unknown";
+    const session = (await response.json()) as { user?: unknown } | null;
+    return session?.user ? "signed-in" : "signed-out";
+  } catch {
+    return "unknown";
+  }
+}
+
+class UnknownSession extends Error {}
+
+export async function confirmSessionState(
+  fetchSession: () => Promise<Response>,
+  delays: number[] = RETRY_DELAYS_MS,
+  wait: Wait = sleep
+): Promise<SessionState> {
+  try {
+    return await withRetries(
+      async () => {
+        const state = await readSessionState(fetchSession);
+        if (state === "unknown") throw new UnknownSession();
+        return state;
+      },
+      (error) => error instanceof UnknownSession,
+      delays,
+      wait
+    );
+  } catch {
+    return "unknown";
+  }
+}
+
+export const fetchSessionFromServer = () =>
+  fetch("/api/auth/session", { credentials: "include", cache: "no-store" });

package/src/session/confirmed.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import { createContext, ReactNode, useEffect, useMemo, useState } from "react";
+import {
+  useSession as useLiveSession,
+  type SessionContextValue,
+} from "next-auth/react";
+import type { Session } from "next-auth";
+import { confirmSessionState, fetchSessionFromServer } from "./confirm";
+import { holdSession } from "./hold";
+
+export const ConfirmedSessionContext =
+  createContext<SessionContextValue | null>(null);
+
+export function ConfirmedSessionProvider({
+  children,
+}: {
+  children: ReactNode;
+}) {
+  const live = useLiveSession();
+  const [lastSignedIn, setLastSignedIn] = useState<Session | null>(null);
+  const [confirmedSignedOut, setConfirmedSignedOut] = useState(false);
+  const { status, data, update } = live;
+
+  useEffect(() => {
+    if (status !== "authenticated" || !data) return;
+    setLastSignedIn(data);
+    setConfirmedSignedOut(false);
+  }, [status, data]);
+
+  useEffect(() => {
+    if (status !== "unauthenticated" || !lastSignedIn || confirmedSignedOut)
+      return;
+    let cancelled = false;
+    confirmSessionState(fetchSessionFromServer).then((state) => {
+      if (!cancelled && state === "signed-out") setConfirmedSignedOut(true);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [status, lastSignedIn, confirmedSignedOut]);
+
+  const value = useMemo(() => {
+    const held = holdSession(
+      { data, status },
+      lastSignedIn,
+      confirmedSignedOut
+    );
+    if (held.status === status || !held.data) return live;
+    return { update, data: held.data, status: "authenticated" as const };
+  }, [live, data, status, update, lastSignedIn, confirmedSignedOut]);
+
+  return (
+    <ConfirmedSessionContext.Provider value={value}>
+      {children}
+    </ConfirmedSessionContext.Provider>
+  );
+}

package/src/session/cookies.test.ts

@@ -0,0 +1,27 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { cookieScope, resolveCookieDomain } from "./cookies.ts";
+
+test("local hosts keep host-only cookies", () => {
+  assert.equal(resolveCookieDomain("localhost:3020"), undefined);
+  assert.equal(resolveCookieDomain("minside.localhost:3020"), undefined);
+  assert.equal(resolveCookieDomain("127.0.0.1:3020"), undefined);
+});
+
+test("a business zone shares one scope across its hosts", () => {
+  process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = "test.snosky.no";
+  assert.equal(cookieScope("salg.beta.test.snokam.no"), ".beta.test.snokam.no");
+  assert.equal(
+    cookieScope("minside.beta.test.snokam.no:443"),
+    ".beta.test.snokam.no"
+  );
+});
+
+test("platform-zone hosts are their own scope", () => {
+  process.env.NEXT_PUBLIC_PLATFORM_DOMAIN = "test.snosky.no";
+  assert.equal(
+    cookieScope("snokam.beta.test.snosky.no"),
+    "snokam.beta.test.snosky.no"
+  );
+  assert.equal(cookieScope("localhost:3020"), "localhost");
+});

package/src/session/cookies.ts

@@ -2,7 +2,12 @@ export function resolveCookieDomain(
   host: string | undefined
 ): string | undefined {
   const bareHost = (host ?? "").split(":")[0].toLowerCase();
-  if (!bareHost || bareHost === "localhost" || /^[\d.]+$/.test(bareHost)) {
+  if (
+    !bareHost ||
+    bareHost === "localhost" ||
+    bareHost.endsWith(".localhost") ||
+    /^[\d.]+$/.test(bareHost)
+  ) {
     return undefined;
   }
 
@@ -29,6 +34,10 @@ export function resolveCookieDomain(
   return firstDot > 0 ? `.${bareHost.slice(firstDot + 1)}` : undefined;
 }
 
+export function cookieScope(host: string): string {
+  return resolveCookieDomain(host) ?? host.split(":")[0].toLowerCase();
+}
+
 export function getSessionCookieSettings(nextAuthUrl: string) {
   const cookieDomain = process.env.COOKIE_DOMAIN;
   const cookieTag = process.env.COOKIE_TAG;

package/src/session/hold.test.ts

@@ -0,0 +1,27 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import type { Session } from "next-auth";
+import { holdSession } from "./hold.ts";
+
+const session = { user: { email: "a@b.no" }, expires: "2099-01-01" } as Session;
+const signedOut = { data: null, status: "unauthenticated" as const };
+
+test("a live session passes through", () => {
+  const live = { data: session, status: "authenticated" as const };
+  assert.equal(holdSession(live, session, false), live);
+});
+
+test("a dropped session is held while the sign-out is unconfirmed", () => {
+  assert.deepEqual(holdSession(signedOut, session, false), {
+    data: session,
+    status: "authenticated",
+  });
+});
+
+test("a confirmed sign-out is passed on", () => {
+  assert.equal(holdSession(signedOut, session, true), signedOut);
+});
+
+test("a visitor who never signed in stays signed out", () => {
+  assert.equal(holdSession(signedOut, null, false), signedOut);
+});

package/src/session/hold.ts

@@ -0,0 +1,18 @@
+import type { Session } from "next-auth";
+
+export type LiveStatus = "authenticated" | "unauthenticated" | "loading";
+
+export interface HeldSession {
+  data: Session | null;
+  status: LiveStatus;
+}
+
+export function holdSession(
+  live: HeldSession,
+  lastSignedIn: Session | null,
+  confirmedSignedOut: boolean
+): HeldSession {
+  if (live.status !== "unauthenticated") return live;
+  if (!lastSignedIn || confirmedSignedOut) return live;
+  return { data: lastSignedIn, status: "authenticated" };
+}

package/src/session/index.ts

@@ -1,3 +1,7 @@
-export { resolveCookieDomain, getSessionCookieSettings } from "./cookies";
+export {
+  cookieScope,
+  resolveCookieDomain,
+  getSessionCookieSettings,
+} from "./cookies";
 export { getAuthUrl, requestOrigin } from "./url";
 export { callbackDestination, safeCallbackTarget } from "./callback-url";

package/src/session/useSession.ts

@@ -1,25 +1,20 @@
 "use client";
 
-import { createContext, useContext, useSyncExternalStore } from "react";
+import { createContext, useContext } from "react";
 import {
   useSession as useLiveSession,
   type SessionContextValue,
 } from "next-auth/react";
 import type { Session } from "next-auth";
+import { useIsHydrating } from "../hydration/useIsHydrating";
+import { ConfirmedSessionContext } from "./confirmed";
 
 export const ServerSessionContext = createContext<Session | null>(null);
 
-const subscribeToNothing = () => () => {};
-
-const useIsHydrating = () =>
-  useSyncExternalStore(
-    subscribeToNothing,
-    () => false,
-    () => true
-  );
-
 export const useSession = (): SessionContextValue => {
-  const liveSession = useLiveSession();
+  const ownLiveSession = useLiveSession();
+  const confirmedSession = useContext(ConfirmedSessionContext);
+  const liveSession = confirmedSession ?? ownLiveSession;
   const serverSession = useContext(ServerSessionContext);
   const hydrating = useIsHydrating();
 

package/src/sso/exchange.test.ts

@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { exchangeSsoToken } from "./exchange.ts";
+
+const realFetch = globalThis.fetch;
+const realWarn = console.warn;
+const inAnHour = () => Math.floor(Date.now() / 1000) + 3600;
+
+function answering(body: unknown): { calls: number } {
+  const counter = { calls: 0 };
+  globalThis.fetch = (async () => {
+    counter.calls += 1;
+    return new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }) as typeof fetch;
+  return counter;
+}
+
+describe("exchangeSsoToken", () => {
+  beforeEach(() => {
+    process.env.NEXT_PUBLIC_PLATFORM_API_BASE_URL =
+      "https://snokam.test.snosky.no/api/platform";
+    console.warn = () => {};
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    console.warn = realWarn;
+  });
+
+  it("returns the platform token with its expiry and reuses it", async () => {
+    const expiresOn = inAnHour();
+    const counter = answering({ accessToken: "platform", expiresOn });
+
+    const first = await exchangeSsoToken("entra-reused");
+    const second = await exchangeSsoToken("entra-reused");
+
+    assert.deepEqual(first, { accessToken: "platform", expiresOn });
+    assert.deepEqual(second, first);
+    assert.equal(counter.calls, 1);
+  });
+
+  it("refuses an answer without an expiry instead of caching it", async () => {
+    const counter = answering({ accessToken: "platform", expiresOn: null });
+
+    assert.equal(await exchangeSsoToken("entra-no-expiry"), null);
+    assert.equal(await exchangeSsoToken("entra-no-expiry"), null);
+    assert.equal(counter.calls, 2);
+  });
+
+  it("refuses an answer without a token", async () => {
+    answering({ accessToken: null, expiresOn: inAnHour() });
+
+    assert.equal(await exchangeSsoToken("entra-no-token"), null);
+  });
+});

package/src/sso/exchange.ts

@@ -3,12 +3,17 @@ import {
   Configuration,
   PlatformClient,
   type TokenExchangeResult,
-} from "@snokam/platform-client";
+} from "@snokam/api-client/platform";
 
 const EXPIRY_SKEW_SECONDS = 60;
 const MAX_ENTRIES = 500;
 
-const cache = new Map<string, TokenExchangeResult>();
+export interface ExchangedToken {
+  accessToken: string;
+  expiresOn: number;
+}
+
+const cache = new Map<string, ExchangedToken>();
 
 function platformBase(): string | null {
   return (
@@ -20,11 +25,18 @@ function keyFor(providerToken: string): string {
   return createHash("sha256").update(providerToken).digest("base64url");
 }
 
-function isUsable(token: TokenExchangeResult, nowSeconds: number): boolean {
+function isUsable(token: ExchangedToken, nowSeconds: number): boolean {
   return token.expiresOn - EXPIRY_SKEW_SECONDS > nowSeconds;
 }
 
-function remember(key: string, token: TokenExchangeResult): void {
+function complete(result: TokenExchangeResult): ExchangedToken | null {
+  const { accessToken, expiresOn } = result;
+  return accessToken && typeof expiresOn === "number"
+    ? { accessToken, expiresOn }
+    : null;
+}
+
+function remember(key: string, token: ExchangedToken): void {
   const now = Math.floor(Date.now() / 1000);
   for (const [existing, value] of cache)
     if (!isUsable(value, now)) cache.delete(existing);
@@ -40,7 +52,7 @@ function remember(key: string, token: TokenExchangeResult): void {
 
 export async function exchangeSsoToken(
   providerToken: string
-): Promise<TokenExchangeResult | null> {
+): Promise<ExchangedToken | null> {
   const basePath = platformBase();
   if (!basePath || !providerToken) return null;
 
@@ -51,10 +63,12 @@ export async function exchangeSsoToken(
 
   const client = new PlatformClient(new Configuration({ basePath }));
   try {
-    const result = await client.ssoTokenExchange({
-      ssoExchangeRequest: { token: providerToken },
-    });
-    if (!result.accessToken) return null;
+    const result = complete(
+      await client.ssoTokenExchange({
+        ssoExchangeRequest: { token: providerToken },
+      })
+    );
+    if (!result) return null;
     remember(key, result);
     return result;
   } catch (e) {

package/src/theme/employee-theme-sync.tsx

@@ -1,8 +1,8 @@
 "use client";
 
 import { useEffect, useMemo, useRef } from "react";
-import { Configuration, EmployeesClient } from "@snokam/employees-client";
-import { useOptionalConfig } from "@snokam/tenant";
+import { Configuration, EmployeesClient } from "@snokam/api-client/employees";
+import { apiBaseUrl, useOptionalConfig } from "@snokam/tenant";
 import { useClientQuery } from "@snokam/react-query";
 import { useAdminTheme } from "@snokam/ui/theme/admin";
 import type { ColorSchemeMode } from "@snokam/ui/theme/admin";
@@ -21,7 +21,7 @@ export function EmployeeThemeSync() {
   const config = useOptionalConfig();
   const seeded = useRef(false);
 
-  const basePath = config?.NEXT_PUBLIC_EMPLOYEES_API_BASE_URL;
+  const basePath = config ? apiBaseUrl(config) : undefined;
   const client = useMemo(
     () =>
       new EmployeesClient(

package/src/token/failure.test.ts

@@ -0,0 +1,33 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  ConsentRequiredError,
+  failureOf,
+  SignedOutError,
+  TransientTokenError,
+} from "./failure.ts";
+
+test("server and gateway hiccups are transient", () => {
+  for (const status of [500, 502, 503, 504, 408, 429])
+    assert.ok(
+      failureOf(status, null) instanceof TransientTokenError,
+      `${status}`
+    );
+});
+
+test("401 means signed out", () => {
+  assert.ok(failureOf(401, null) instanceof SignedOutError);
+});
+
+test("a consent request is not a hiccup", () => {
+  assert.ok(
+    failureOf(403, { error: "consent_required" }) instanceof
+      ConsentRequiredError
+  );
+});
+
+test("other refusals are neither transient nor a sign-out", () => {
+  const error = failureOf(403, null);
+  assert.ok(!(error instanceof TransientTokenError));
+  assert.ok(!(error instanceof SignedOutError));
+});

package/src/token/failure.ts

@@ -0,0 +1,17 @@
+export class ConsentRequiredError extends Error {}
+
+export class SignedOutError extends Error {}
+
+export class TransientTokenError extends Error {}
+
+const TRANSIENT_STATUSES = new Set([408, 425, 429]);
+
+export function failureOf(status: number, body: unknown): Error {
+  const error = (body as { error?: unknown } | null)?.error;
+  if (status === 403 && error === "consent_required")
+    return new ConsentRequiredError();
+  if (status === 401) return new SignedOutError("Not signed in");
+  if (status >= 500 || TRANSIENT_STATUSES.has(status))
+    return new TransientTokenError(`Token request failed with ${status}`);
+  return new Error(`Token request failed with ${status}`);
+}

package/src/token/reuse.test.ts

@@ -0,0 +1,28 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { isReusable, type CachedToken } from "./reuse.ts";
+
+const token = (expiresOn: number, fetchedAt: number): CachedToken => ({
+  bearer: "Bearer x",
+  expiresOn,
+  fetchedAt,
+  impKey: "imp-1",
+});
+
+describe("cached access token reuse", () => {
+  it("reuses a token until a minute before it expires", () => {
+    assert.equal(isReusable(token(1_000, 0), "imp-1", 939), true);
+    assert.equal(isReusable(token(1_000, 0), "imp-1", 940), false);
+  });
+
+  it("reuses a token handed out close to expiry instead of fetching it again on every call", () => {
+    assert.equal(isReusable(token(1_000, 970), "imp-1", 980), true);
+    assert.equal(isReusable(token(1_000, 970), "imp-1", 990), false);
+  });
+
+  it("never reuses an expired token or one for another view-as session", () => {
+    assert.equal(isReusable(token(1_000, 995), "imp-1", 1_000), false);
+    assert.equal(isReusable(token(1_000, 0), "imp-2", 10), false);
+    assert.equal(isReusable(null, "imp-1", 10), false);
+  });
+});

package/src/token/reuse.ts

@@ -0,0 +1,22 @@
+const REFRESH_MARGIN_SECONDS = 60;
+const MIN_REUSE_SECONDS = 15;
+
+export interface CachedToken {
+  bearer: string;
+  expiresOn: number;
+  fetchedAt: number;
+  impKey: string;
+}
+
+export function isReusable(
+  cached: CachedToken | null,
+  impKey: string,
+  nowSeconds: number
+): cached is CachedToken {
+  if (!cached || cached.impKey !== impKey) return false;
+  if (nowSeconds >= cached.expiresOn) return false;
+  return (
+    nowSeconds < cached.expiresOn - REFRESH_MARGIN_SECONDS ||
+    nowSeconds < cached.fetchedAt + MIN_REUSE_SECONDS
+  );
+}