@snokam/auth 6.0.5 → 6.0.6

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [6.0.6](https://github.com/snokam/components/compare/@snokam/auth@6.0.5...@snokam/auth@6.0.6) (2026-11-05)
+
+### Bug Fixes
+
+- **web:** post go-live fixes for texts, sessions, place search and pickers ([#3218](https://github.com/snokam/components/issues/3218)) ([0fbf0bb](https://github.com/snokam/components/commit/0fbf0bbec53b6cf946684c76fef318aa5cea7403))
+
 ## [6.0.5](https://github.com/snokam/components/compare/@snokam/auth@6.0.4...@snokam/auth@6.0.5) (2026-11-05)
 
 **Note:** Version bump only for package @snokam/auth

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@snokam/auth",
   "description": "Snøkam auth components",
-  "version": "6.0.5",
+  "version": "6.0.6",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "files": [

package/src/app-router/components/Provider/index.tsx

@@ -8,6 +8,7 @@ import { SessionProvider } from "next-auth/react";
 import { useAuth } from "../../../hooks";
 import { EmployeeThemeSync } from "../../../theme/employee-theme-sync";
 import { ServerSessionContext } from "../../../session/useSession";
+import { ConfirmedSessionProvider } from "../../../session/confirmed";
 
 export const Provider = memo((props: Auth.Provider.Props) => {
   const { session, children } = props;
@@ -15,10 +16,12 @@ export const Provider = memo((props: Auth.Provider.Props) => {
   return (
     <ServerSessionContext.Provider value={session ?? null}>
       <SessionProvider session={session ?? undefined}>
-        <EmployeeThemeSync />
-        <Suspense fallback={<>{children}</>}>
-          <ProviderInner {...props}>{children}</ProviderInner>
-        </Suspense>
+        <ConfirmedSessionProvider>
+          <EmployeeThemeSync />
+          <Suspense fallback={<>{children}</>}>
+            <ProviderInner {...props}>{children}</ProviderInner>
+          </Suspense>
+        </ConfirmedSessionProvider>
       </SessionProvider>
     </ServerSessionContext.Provider>
   );

package/src/hooks.ts

@@ -5,8 +5,17 @@ import { useImpersonation } from "./impersonation/context";
 import { useOwnIdentity } from "./identity/own";
 import { useSession } from "./session/useSession";
 import { isReusable, type CachedToken } from "./token/reuse";
-
-class ConsentRequiredError extends Error {}
+import {
+  confirmSessionState,
+  fetchSessionFromServer,
+  withRetries,
+} from "./session/confirm";
+import {
+  ConsentRequiredError,
+  failureOf,
+  SignedOutError,
+  TransientTokenError,
+} from "./token/failure";
 
 type TokenKind = "session" | "own";
 
@@ -31,25 +40,27 @@ export function clearAuthTokenCache(): void {
   inFlightTokens.own = null;
 }
 
-async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
-  const res = await fetch("/api/auth/token", {
-    method: "POST",
-    body: JSON.stringify(kind === "own" ? { own: true } : {}),
-    credentials: "include",
-    headers: {
-      "Content-Type": "application/json",
-    },
-  });
-
-  if (res.status === 403) {
-    const body = await res.json().catch(() => null);
-    if (body?.error === "consent_required") {
-      throw new ConsentRequiredError();
-    }
+async function requestToken(kind: TokenKind): Promise<Response> {
+  try {
+    return await fetch("/api/auth/token", {
+      method: "POST",
+      body: JSON.stringify(kind === "own" ? { own: true } : {}),
+      credentials: "include",
+      headers: {
+        "Content-Type": "application/json",
+      },
+    });
+  } catch {
+    throw new TransientTokenError("Token request did not reach the server");
   }
+}
+
+async function fetchToken(kind: TokenKind, impKey: string): Promise<string> {
+  const res = await requestToken(kind);
 
   if (!res.ok) {
-    throw new Error("Token fetch failed");
+    const body = await res.json().catch(() => null);
+    throw failureOf(res.status, body);
   }
 
   const token = await res.json();
@@ -78,7 +89,10 @@ async function getFreshToken(kind: TokenKind): Promise<string> {
     return inFlight.promise;
   }
 
-  const promise = fetchToken(kind, impKey);
+  const promise = withRetries(
+    () => fetchToken(kind, impKey),
+    (error) => error instanceof TransientTokenError
+  );
   inFlightTokens[kind] = { impKey, promise };
   promise
     .catch(() => undefined)
@@ -93,11 +107,20 @@ export function fetchOwnToken(): Promise<string> {
   return tokenOrLogin("own");
 }
 
+async function signInAgainIfSignedOut(error: SignedOutError): Promise<void> {
+  const state = await confirmSessionState(fetchSessionFromServer);
+  if (state !== "signed-out") throw error;
+  const here = `${window.location.pathname}${window.location.search}`;
+  window.location.href = `/auth/login?callbackUrl=${encodeURIComponent(here)}`;
+}
+
 function tokenOrLogin(kind: TokenKind): Promise<string> {
   return getFreshToken(kind).catch((error) => {
     console.error(error);
+    if (error instanceof TransientTokenError) throw error;
     const onAuthPage = window.location.pathname.startsWith("/auth/");
     if (onAuthPage) return;
+    if (error instanceof SignedOutError) return signInAgainIfSignedOut(error);
     const reason = error instanceof ConsentRequiredError ? "consent" : "true";
     window.location.href = `/auth/login?error=${reason}`;
   }) as Promise<string>;

package/src/session/confirm.test.ts

@@ -0,0 +1,100 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  confirmSessionState,
+  readSessionState,
+  withRetries,
+} from "./confirm.ts";
+
+const noWait = async () => {};
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status });
+
+const replies = (...answers: (Response | Error)[]) => {
+  let calls = 0;
+  const fetchSession = async () => {
+    const answer = answers[Math.min(calls, answers.length - 1)];
+    calls += 1;
+    if (answer instanceof Error) throw answer;
+    return answer;
+  };
+  return { fetchSession, calls: () => calls };
+};
+
+test("a session with a user is signed in", async () => {
+  const { fetchSession } = replies(json({ user: { email: "a@b.no" } }));
+  assert.equal(await readSessionState(fetchSession), "signed-in");
+});
+
+test("an empty session is a confirmed sign-out", async () => {
+  const { fetchSession } = replies(json({}));
+  assert.equal(await readSessionState(fetchSession), "signed-out");
+});
+
+test("a failed request says nothing about the session", async () => {
+  assert.equal(
+    await readSessionState(replies(new TypeError("offline")).fetchSession),
+    "unknown"
+  );
+  assert.equal(
+    await readSessionState(replies(json({}, 502)).fetchSession),
+    "unknown"
+  );
+});
+
+test("hiccups are retried until the server answers", async () => {
+  const session = replies(
+    new TypeError("offline"),
+    json({}, 503),
+    json({ user: { email: "a@b.no" } })
+  );
+  const state = await confirmSessionState(
+    session.fetchSession,
+    [1, 1, 1],
+    noWait
+  );
+  assert.equal(state, "signed-in");
+  assert.equal(session.calls(), 3);
+});
+
+test("a server that never answers leaves the session unknown, not signed out", async () => {
+  const session = replies(new TypeError("offline"));
+  const state = await confirmSessionState(session.fetchSession, [1, 1], noWait);
+  assert.equal(state, "unknown");
+  assert.equal(session.calls(), 3);
+});
+
+test("retries wait longer each time and stop at the first success", async () => {
+  const waits: number[] = [];
+  let attempts = 0;
+  const value = await withRetries(
+    async () => {
+      attempts += 1;
+      if (attempts < 3) throw new Error("hiccup");
+      return "token";
+    },
+    () => true,
+    [100, 200, 400],
+    async (ms) => {
+      waits.push(ms);
+    }
+  );
+  assert.equal(value, "token");
+  assert.deepEqual(waits, [100, 200]);
+});
+
+test("errors that are not transient are not retried", async () => {
+  let attempts = 0;
+  await assert.rejects(
+    withRetries(
+      async () => {
+        attempts += 1;
+        throw new Error("signed out");
+      },
+      () => false,
+      [1, 1],
+      noWait
+    )
+  );
+  assert.equal(attempts, 1);
+});

package/src/session/confirm.ts

@@ -0,0 +1,63 @@
+export type SessionState = "signed-in" | "signed-out" | "unknown";
+
+export const RETRY_DELAYS_MS = [500, 1500, 4000, 10000];
+
+export type Wait = (ms: number) => Promise<void>;
+
+const sleep: Wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export async function withRetries<T>(
+  attempt: () => Promise<T>,
+  isTransient: (error: unknown) => boolean,
+  delays: number[] = RETRY_DELAYS_MS,
+  wait: Wait = sleep
+): Promise<T> {
+  for (const delay of delays) {
+    try {
+      return await attempt();
+    } catch (error) {
+      if (!isTransient(error)) throw error;
+      await wait(delay);
+    }
+  }
+  return attempt();
+}
+
+export async function readSessionState(
+  fetchSession: () => Promise<Response>
+): Promise<SessionState> {
+  try {
+    const response = await fetchSession();
+    if (!response.ok) return "unknown";
+    const session = (await response.json()) as { user?: unknown } | null;
+    return session?.user ? "signed-in" : "signed-out";
+  } catch {
+    return "unknown";
+  }
+}
+
+class UnknownSession extends Error {}
+
+export async function confirmSessionState(
+  fetchSession: () => Promise<Response>,
+  delays: number[] = RETRY_DELAYS_MS,
+  wait: Wait = sleep
+): Promise<SessionState> {
+  try {
+    return await withRetries(
+      async () => {
+        const state = await readSessionState(fetchSession);
+        if (state === "unknown") throw new UnknownSession();
+        return state;
+      },
+      (error) => error instanceof UnknownSession,
+      delays,
+      wait
+    );
+  } catch {
+    return "unknown";
+  }
+}
+
+export const fetchSessionFromServer = () =>
+  fetch("/api/auth/session", { credentials: "include", cache: "no-store" });

package/src/session/confirmed.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import { createContext, ReactNode, useEffect, useMemo, useState } from "react";
+import {
+  useSession as useLiveSession,
+  type SessionContextValue,
+} from "next-auth/react";
+import type { Session } from "next-auth";
+import { confirmSessionState, fetchSessionFromServer } from "./confirm";
+import { holdSession } from "./hold";
+
+export const ConfirmedSessionContext =
+  createContext<SessionContextValue | null>(null);
+
+export function ConfirmedSessionProvider({
+  children,
+}: {
+  children: ReactNode;
+}) {
+  const live = useLiveSession();
+  const [lastSignedIn, setLastSignedIn] = useState<Session | null>(null);
+  const [confirmedSignedOut, setConfirmedSignedOut] = useState(false);
+  const { status, data, update } = live;
+
+  useEffect(() => {
+    if (status !== "authenticated" || !data) return;
+    setLastSignedIn(data);
+    setConfirmedSignedOut(false);
+  }, [status, data]);
+
+  useEffect(() => {
+    if (status !== "unauthenticated" || !lastSignedIn || confirmedSignedOut)
+      return;
+    let cancelled = false;
+    confirmSessionState(fetchSessionFromServer).then((state) => {
+      if (!cancelled && state === "signed-out") setConfirmedSignedOut(true);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [status, lastSignedIn, confirmedSignedOut]);
+
+  const value = useMemo(() => {
+    const held = holdSession(
+      { data, status },
+      lastSignedIn,
+      confirmedSignedOut
+    );
+    if (held.status === status || !held.data) return live;
+    return { update, data: held.data, status: "authenticated" as const };
+  }, [live, data, status, update, lastSignedIn, confirmedSignedOut]);
+
+  return (
+    <ConfirmedSessionContext.Provider value={value}>
+      {children}
+    </ConfirmedSessionContext.Provider>
+  );
+}

package/src/session/hold.test.ts

@@ -0,0 +1,27 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import type { Session } from "next-auth";
+import { holdSession } from "./hold.ts";
+
+const session = { user: { email: "a@b.no" }, expires: "2099-01-01" } as Session;
+const signedOut = { data: null, status: "unauthenticated" as const };
+
+test("a live session passes through", () => {
+  const live = { data: session, status: "authenticated" as const };
+  assert.equal(holdSession(live, session, false), live);
+});
+
+test("a dropped session is held while the sign-out is unconfirmed", () => {
+  assert.deepEqual(holdSession(signedOut, session, false), {
+    data: session,
+    status: "authenticated",
+  });
+});
+
+test("a confirmed sign-out is passed on", () => {
+  assert.equal(holdSession(signedOut, session, true), signedOut);
+});
+
+test("a visitor who never signed in stays signed out", () => {
+  assert.equal(holdSession(signedOut, null, false), signedOut);
+});

package/src/session/hold.ts

@@ -0,0 +1,18 @@
+import type { Session } from "next-auth";
+
+export type LiveStatus = "authenticated" | "unauthenticated" | "loading";
+
+export interface HeldSession {
+  data: Session | null;
+  status: LiveStatus;
+}
+
+export function holdSession(
+  live: HeldSession,
+  lastSignedIn: Session | null,
+  confirmedSignedOut: boolean
+): HeldSession {
+  if (live.status !== "unauthenticated") return live;
+  if (!lastSignedIn || confirmedSignedOut) return live;
+  return { data: lastSignedIn, status: "authenticated" };
+}

package/src/session/useSession.ts

@@ -7,11 +7,14 @@ import {
 } from "next-auth/react";
 import type { Session } from "next-auth";
 import { useIsHydrating } from "../hydration/useIsHydrating";
+import { ConfirmedSessionContext } from "./confirmed";
 
 export const ServerSessionContext = createContext<Session | null>(null);
 
 export const useSession = (): SessionContextValue => {
-  const liveSession = useLiveSession();
+  const ownLiveSession = useLiveSession();
+  const confirmedSession = useContext(ConfirmedSessionContext);
+  const liveSession = confirmedSession ?? ownLiveSession;
   const serverSession = useContext(ServerSessionContext);
   const hydrating = useIsHydrating();
 

package/src/token/failure.test.ts

@@ -0,0 +1,33 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  ConsentRequiredError,
+  failureOf,
+  SignedOutError,
+  TransientTokenError,
+} from "./failure.ts";
+
+test("server and gateway hiccups are transient", () => {
+  for (const status of [500, 502, 503, 504, 408, 429])
+    assert.ok(
+      failureOf(status, null) instanceof TransientTokenError,
+      `${status}`
+    );
+});
+
+test("401 means signed out", () => {
+  assert.ok(failureOf(401, null) instanceof SignedOutError);
+});
+
+test("a consent request is not a hiccup", () => {
+  assert.ok(
+    failureOf(403, { error: "consent_required" }) instanceof
+      ConsentRequiredError
+  );
+});
+
+test("other refusals are neither transient nor a sign-out", () => {
+  const error = failureOf(403, null);
+  assert.ok(!(error instanceof TransientTokenError));
+  assert.ok(!(error instanceof SignedOutError));
+});

package/src/token/failure.ts

@@ -0,0 +1,17 @@
+export class ConsentRequiredError extends Error {}
+
+export class SignedOutError extends Error {}
+
+export class TransientTokenError extends Error {}
+
+const TRANSIENT_STATUSES = new Set([408, 425, 429]);
+
+export function failureOf(status: number, body: unknown): Error {
+  const error = (body as { error?: unknown } | null)?.error;
+  if (status === 403 && error === "consent_required")
+    return new ConsentRequiredError();
+  if (status === 401) return new SignedOutError("Not signed in");
+  if (status >= 500 || TRANSIENT_STATUSES.has(status))
+    return new TransientTokenError(`Token request failed with ${status}`);
+  return new Error(`Token request failed with ${status}`);
+}