@salesforce/commerce-sdk-react 3.1.0 → 3.1.1-preview.1

package/auth/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.default = exports.DEFAULT_SLAS_REFRESH_TOKEN_REGISTERED_TTL = exports.DEFAULT_SLAS_REFRESH_TOKEN_GUEST_TTL = void 0;
+exports.default = void 0;
 var _commerceSdkIsomorphic = require("commerce-sdk-isomorphic");
 var _jwtDecode = require("jwt-decode");
 var _storage = require("./storage");
@@ -107,18 +107,8 @@ const DATA_MAP = {
   access_token_sfra: {
     storageType: 'cookie',
     key: 'cc-at'
-  },
-  [_constant.DNT_COOKIE_NAME]: {
-    storageType: 'cookie',
-    key: _constant.DNT_COOKIE_NAME
-  },
-  dwsid: {
-    storageType: 'cookie',
-    key: _constant.DWSID_COOKIE_NAME
   }
 };
-const DEFAULT_SLAS_REFRESH_TOKEN_REGISTERED_TTL = exports.DEFAULT_SLAS_REFRESH_TOKEN_REGISTERED_TTL = 90 * 24 * 60 * 60;
-const DEFAULT_SLAS_REFRESH_TOKEN_GUEST_TTL = exports.DEFAULT_SLAS_REFRESH_TOKEN_GUEST_TTL = 30 * 24 * 60 * 60;
 
 /**
  * This class is used to handle shopper authentication.
@@ -167,10 +157,8 @@ class Auth {
     };
     this.redirectURI = config.redirectURI;
     this.fetchedToken = config.fetchedToken || '';
+    this.OCAPISessionsURL = config.OCAPISessionsURL || '';
     this.logger = config.logger;
-    this.defaultDnt = config.defaultDnt;
-    this.refreshTokenRegisteredCookieTTL = config.refreshTokenRegisteredCookieTTL;
-    this.refreshTokenGuestCookieTTL = config.refreshTokenGuestCookieTTL;
 
     /*
      * There are 2 ways to enable SLAS private client mode.
@@ -219,65 +207,6 @@ class Auth {
     storage.set(key, value, options);
     (_DATA_MAP$name$callba = (_DATA_MAP$name = DATA_MAP[name]).callback) === null || _DATA_MAP$name$callba === void 0 ? void 0 : _DATA_MAP$name$callba.call(_DATA_MAP$name, storage);
   }
-  delete(name) {
-    const {
-      key,
-      storageType
-    } = DATA_MAP[name];
-    const storage = this.stores[storageType];
-    storage.delete(key);
-  }
-  getDnt() {
-    const dntCookieVal = this.get(_constant.DNT_COOKIE_NAME);
-    // Only '1' or '0' are valid, and invalid values, lack of cookie, or value conflict with token must be an undefined DNT
-    let dntCookieStatus = undefined;
-    const accessToken = this.getAccessToken();
-    let isInSync = true;
-    if (accessToken) {
-      const {
-        dnt
-      } = this.parseSlasJWT(accessToken);
-      isInSync = dnt === dntCookieVal;
-    }
-    if (dntCookieVal !== '1' && dntCookieVal !== '0' || !isInSync) {
-      this.delete(_constant.DNT_COOKIE_NAME);
-    } else {
-      dntCookieStatus = Boolean(Number(dntCookieVal));
-    }
-    return dntCookieStatus;
-  }
-  setDnt(preference) {
-    var _this = this;
-    return _asyncToGenerator(function* () {
-      let dntCookieVal = String(Number(preference));
-      // Use defaultDNT if defined. If not, use SLAS default DNT
-      if (preference === null) {
-        dntCookieVal = _this.defaultDnt ? String(Number(_this.defaultDnt)) : '0';
-      }
-      // Set the cookie once to include dnt in the access token and then again to set the expiry time
-      _this.set(_constant.DNT_COOKIE_NAME, dntCookieVal, _objectSpread(_objectSpread({}, (0, _utils.getDefaultCookieAttributes)()), {}, {
-        secure: true
-      }));
-      const accessToken = _this.getAccessToken();
-      if (accessToken !== '') {
-        const {
-          dnt
-        } = _this.parseSlasJWT(accessToken);
-        if (dnt !== dntCookieVal) {
-          yield _this.refreshAccessToken();
-        }
-      } else {
-        yield _this.refreshAccessToken();
-      }
-      if (preference !== null) {
-        const SECONDS_IN_DAY = 86400;
-        _this.set(_constant.DNT_COOKIE_NAME, dntCookieVal, _objectSpread(_objectSpread({}, (0, _utils.getDefaultCookieAttributes)()), {}, {
-          secure: true,
-          expires: Number(_this.get('refresh_token_expires_in')) / SECONDS_IN_DAY
-        }));
-      }
-    })();
-  }
   clearStorage() {
     // Type assertion because Object.keys is silly and limited :(
     const keys = Object.keys(DATA_MAP);
@@ -323,21 +252,6 @@ class Auth {
     return validTimeSeconds <= tokenAgeSeconds;
   }
 
-  /**
-   * Gets the Do-Not-Track (DNT) preference from the `dw_dnt` cookie.
-   * If user has set their DNT preference, read the cookie, if not, use the default DNT pref. If the default DNT pref has not been set, default to false.
-   */
-  getDntPreference(dw_dnt, defaultDnt) {
-    let dntPref;
-    // Read `dw_dnt` cookie
-    const dntCookie = dw_dnt === '1' ? true : dw_dnt === '0' ? false : undefined;
-    dntPref = dntCookie;
-
-    // If the cookie is not set, read the default DNT preference.
-    if (dntCookie === undefined) dntPref = defaultDnt !== undefined ? defaultDnt : undefined;
-    return dntPref;
-  }
-
   /**
    * Returns the SLAS access token or an empty string if the access token
    * is not found in local store or if SFRA wants PWA to trigger refresh token login.
@@ -382,17 +296,6 @@ class Auth {
     }
     return accessToken;
   }
-
-  /**
-   * For Hybrid storefronts ONLY!!!
-   * This method clears out SLAS access token generated in Plugin SLAS and passed in via "cc-at" cookie.
-   *
-   * In a hybrid setup, whenever any SLAS flow executes in Plugin SLAS and an access token is generated,
-   * the access token is sent over to PWA Kit using cc-at cookie.
-   *
-   * PWA Kit will check to see if cc-at cookie exists, if it does, the access token value in localStorage is updated
-   * with value from the cc-at cookie and is then used for all SCAPI requests made from PWA Kit. The cc-at cookie is then cleared.
-   */
   clearSFRAAuthToken() {
     const {
       key,
@@ -403,52 +306,7 @@ class Auth {
   }
 
   /**
-   * For Hybrid storefronts ONLY!!!
-   * This method clears the dwsid cookie from the browser.
-   * In a hybrid setup, dwsid points to an ECOM session and is passed between PWA Kit and SFRA/SG sites via "dwsid" cookie.
-   *
-   * Whenever a registered shopper logs in on PWA Kit, we must clear the dwsid cookie if one exists. When shopper navigates
-   * to SFRA as a logged-in shopper, ECOM notices a missing DWSID, generates a new DWSID and triggers the onSession hook which uses
-   * registered shopper refresh-token and restores session and basket on SFRA.
-   */
-  clearECOMSession() {
-    const {
-      key,
-      storageType
-    } = DATA_MAP[_constant.DWSID_COOKIE_NAME];
-    const store = this.stores[storageType];
-    store.delete(key);
-  }
-
-  /**
-   * Converts a duration in seconds to a Date object.
-   * This function takes a number representing seconds and returns a Date object
-   * for the current time plus the given duration.
-   *
-   * @param {number} seconds - The number of seconds to add to the current time.
-   * @returns {Date} A Date object for the expiration time.
-   */
-  convertSecondsToDate(seconds) {
-    if (typeof seconds !== 'number') {
-      throw new Error('The refresh_token_expires_in seconds parameter must be a number.');
-    }
-    return new Date(Date.now() + seconds * 1000);
-  }
-
-  /**
-   * Retrieves our refresh token cookie ttl value
-   */
-  getRefreshTokenCookieTTLValue(overrideValue, responseValue, defaultValue) {
-    let value = overrideValue;
-    if (typeof value !== 'number' || value <= 0 || value > defaultValue) {
-      this.logWarning(_constant.SLAS_REFRESH_TOKEN_COOKIE_TTL_OVERRIDE_MSG);
-      value = responseValue || defaultValue;
-    }
-    return value;
-  }
-
-  /**
-   * This method stores the TokenResponse object retrieved from SLAS, and
+   * This method stores the TokenResponse object retrived from SLAS, and
    * store the data in storage.
    */
   handleTokenResponse(res, isGuest) {
@@ -462,77 +320,10 @@ class Auth {
     this.set('usid', res.usid);
     this.set('customer_type', isGuest ? 'guest' : 'registered');
     const refreshTokenKey = isGuest ? 'refresh_token_guest' : 'refresh_token_registered';
-    const overrideValue = isGuest ? this.refreshTokenGuestCookieTTL : this.refreshTokenRegisteredCookieTTL;
-    const responseValue = res.refresh_token_expires_in;
-    const defaultValue = isGuest ? DEFAULT_SLAS_REFRESH_TOKEN_GUEST_TTL : DEFAULT_SLAS_REFRESH_TOKEN_REGISTERED_TTL;
-    const refreshTokenTTLValue = this.getRefreshTokenCookieTTLValue(overrideValue, responseValue, defaultValue);
-    const expiresDate = this.convertSecondsToDate(refreshTokenTTLValue);
-    this.set('refresh_token_expires_in', refreshTokenTTLValue.toString());
     this.set(refreshTokenKey, res.refresh_token, {
-      expires: expiresDate
+      expires: res.refresh_token_expires_in
     });
   }
-  refreshAccessToken() {
-    var _this2 = this;
-    return _asyncToGenerator(function* () {
-      const dntPref = _this2.getDntPreference(_this2.get(_constant.DNT_COOKIE_NAME), _this2.defaultDnt);
-      const refreshTokenRegistered = _this2.get('refresh_token_registered');
-      const refreshTokenGuest = _this2.get('refresh_token_guest');
-      const refreshToken = refreshTokenRegistered || refreshTokenGuest;
-      if (refreshToken) {
-        try {
-          return yield _this2.queueRequest(() => _commerceSdkIsomorphic.helpers.refreshAccessToken(_this2.client, _objectSpread({
-            refreshToken
-          }, dntPref !== undefined && {
-            dnt: dntPref
-          }), {
-            clientSecret: _this2.clientSecret
-          }), !!refreshTokenGuest);
-        } catch (error) {
-          // If the refresh token is invalid, we need to re-login the user
-          if (error instanceof Error && 'response' in error) {
-            // commerce-sdk-isomorphic throws a `ResponseError`, but doesn't export the class.
-            // We can't use `instanceof`, so instead we just check for the `response` property
-            // and assume it is a fetch Response.
-            const json = yield error['response'].json();
-            if (json.message === 'invalid refresh_token') {
-              // clean up storage and restart the login flow
-              _this2.clearStorage();
-            }
-          }
-        }
-      }
-
-      // refresh flow for TAOB
-      const accessToken = _this2.getAccessToken();
-      if (accessToken && _this2.isTokenExpired(accessToken)) {
-        try {
-          const {
-            isGuest,
-            usid,
-            loginId,
-            isAgent
-          } = _this2.parseSlasJWT(accessToken);
-          if (isAgent) {
-            return yield _this2.queueRequest(() => _this2.refreshTrustedAgent(loginId, usid), isGuest);
-          }
-        } catch (e) {
-          /* catch invalid jwt */
-        }
-      }
-
-      // if a TAOB left a usid and it tries to
-      // use it, we will be stuck in a fail loop
-      let token;
-      try {
-        token = yield _this2.loginGuestUser();
-      } catch (e) {
-        _this2.clearStorage();
-        token = yield _this2.loginGuestUser();
-      }
-      return token;
-    })();
-  }
 
   /**
    * This method queues the requests and handles the SLAS token response.
@@ -542,20 +333,23 @@ class Auth {
    * @Internal
    */
   queueRequest(fn, isGuest) {
-    var _this3 = this;
+    var _this = this;
     return _asyncToGenerator(function* () {
-      const queue = _this3.pendingToken ?? Promise.resolve();
-      _this3.pendingToken = queue.then( /*#__PURE__*/_asyncToGenerator(function* () {
+      const queue = _this.pendingToken ?? Promise.resolve();
+      _this.pendingToken = queue.then(/*#__PURE__*/_asyncToGenerator(function* () {
         const token = yield fn();
-        _this3.handleTokenResponse(token, isGuest);
+        _this.handleTokenResponse(token, isGuest);
+        if ((0, _utils.onClient)() && _this.OCAPISessionsURL) {
+          void _this.createOCAPISession();
+        }
         // Q: Why don't we just return token? Why re-construct the same object again?
         // A: because a user could open multiple tabs and the data in memory could be out-dated
         // We must always grab the data from the storage (cookie/localstorage) directly
-        return _this3.data;
+        return _this.data;
       })).finally(() => {
-        _this3.pendingToken = undefined;
+        _this.pendingToken = undefined;
       });
-      return yield _this3.pendingToken;
+      return yield _this.pendingToken;
     })();
   }
   logWarning = msg => {
@@ -564,42 +358,6 @@ class Auth {
     }
   };
 
-  /**
-   * This method extracts the status and message from a ResponseError that is returned
-   * by commerce-sdk-isomorphic.
-   *
-   * commerce-sdk-isomorphic throws a `ResponseError`, but doesn't export the class.
-   * We can't use `instanceof`, so instead we just check for the `response` property
-   * and assume it is a `ResponseError` if a response is present
-   *
-   * Once commerce-sdk-isomorphic exports `ResponseError` we can revisit if this method is
-   * still required.
-   *
-   * @returns {status_code, responseMessage} contained within the ResponseError
-   * @throws error if the error is not a ResponseError
-   * @Internal
-   */
-  extractResponseError = (() => function () {
-    var _ref2 = _asyncToGenerator(function* (error) {
-      // the regular error.message will return only the generic status code message
-      // ie. 'Bad Request' for 400. We need to drill specifically into the ResponseError
-      // to get a more descriptive error message from SLAS
-      if ('response' in error) {
-        const json = yield error['response'].json();
-        const status_code = json.status_code;
-        const responseMessage = json.message;
-        return {
-          status_code,
-          responseMessage
-        };
-      }
-      throw error;
-    });
-    return function (_x) {
-      return _ref2.apply(this, arguments);
-    };
-  }())();
-
   /**
    * The ready function returns a promise that resolves with valid ShopperLogin
    * token response.
@@ -609,32 +367,55 @@ class Auth {
    * The flow:
    * 1. If we have valid access token - use it
    * 2. If we have valid refresh token - refresh token flow
-   * 3. If we have valid TAOB access token - refresh TAOB token flow
-   * 4. PKCE flow
+   * 3. PKCE flow
    */
   ready() {
-    var _this4 = this;
+    var _this2 = this;
     return _asyncToGenerator(function* () {
-      if (_this4.fetchedToken && _this4.fetchedToken !== '') {
+      if (_this2.fetchedToken && _this2.fetchedToken !== '') {
         const {
           isGuest,
           customerId,
           usid
-        } = _this4.parseSlasJWT(_this4.fetchedToken);
-        _this4.set('access_token', _this4.fetchedToken);
-        _this4.set('customer_id', customerId);
-        _this4.set('usid', usid);
-        _this4.set('customer_type', isGuest ? 'guest' : 'registered');
-        return _this4.data;
+        } = _this2.parseSlasJWT(_this2.fetchedToken);
+        _this2.set('access_token', _this2.fetchedToken);
+        _this2.set('customer_id', customerId);
+        _this2.set('usid', usid);
+        _this2.set('customer_type', isGuest ? 'guest' : 'registered');
+        return _this2.data;
       }
-      if (_this4.pendingToken) {
-        return yield _this4.pendingToken;
+      if (_this2.pendingToken) {
+        return yield _this2.pendingToken;
       }
-      const accessToken = _this4.getAccessToken();
-      if (accessToken && !_this4.isTokenExpired(accessToken)) {
-        return _this4.data;
+      const accessToken = _this2.getAccessToken();
+      if (accessToken && !_this2.isTokenExpired(accessToken)) {
+        return _this2.data;
       }
-      return yield _this4.refreshAccessToken();
+      const refreshTokenRegistered = _this2.get('refresh_token_registered');
+      const refreshTokenGuest = _this2.get('refresh_token_guest');
+      const refreshToken = refreshTokenRegistered || refreshTokenGuest;
+      if (refreshToken) {
+        try {
+          return yield _this2.queueRequest(() => _commerceSdkIsomorphic.helpers.refreshAccessToken(_this2.client, {
+            refreshToken
+          }, {
+            clientSecret: _this2.clientSecret
+          }), !!refreshTokenGuest);
+        } catch (error) {
+          // If the refresh token is invalid, we need to re-login the user
+          if (error instanceof Error && 'response' in error) {
+            // commerce-sdk-isomorphic throws a `ResponseError`, but doesn't export the class.
+            // We can't use `instanceof`, so instead we just check for the `response` property
+            // and assume it is a fetch Response.
+            const json = yield error['response'].json();
+            if (json.message === 'invalid refresh_token') {
+              // clean up storage and restart the login flow
+              _this2.clearStorage();
+            }
+          }
+        }
+      }
+      return _this2.loginGuestUser();
     })();
   }
 
@@ -644,9 +425,9 @@ class Auth {
    * @returns Wrapped function
    */
   whenReady(fn) {
-    var _this5 = this;
+    var _this3 = this;
     return /*#__PURE__*/_asyncToGenerator(function* (...args) {
-      yield _this5.ready();
+      yield _this3.ready();
       return yield fn(...args);
     });
   }
@@ -656,41 +437,25 @@ class Auth {
    *
    */
   loginGuestUser() {
-    var _this6 = this;
+    var _this4 = this;
     return _asyncToGenerator(function* () {
-      if (_this6.clientSecret && (0, _utils.onClient)() && _this6.clientSecret !== _constant.SLAS_SECRET_PLACEHOLDER) {
-        _this6.logWarning(_constant.SLAS_SECRET_WARNING_MSG);
+      if (_this4.clientSecret && (0, _utils.onClient)() && _this4.clientSecret !== _constant.SLAS_SECRET_PLACEHOLDER) {
+        _this4.logWarning(_constant.SLAS_SECRET_WARNING_MSG);
       }
-      const usid = _this6.get('usid');
-      const dntPref = _this6.getDntPreference(_this6.get(_constant.DNT_COOKIE_NAME), _this6.defaultDnt);
+      const usid = _this4.get('usid');
       const isGuest = true;
-      const guestPrivateArgs = [_this6.client, _objectSpread(_objectSpread({}, dntPref !== undefined && {
-        dnt: dntPref
-      }), usid && {
+      const guestPrivateArgs = [_this4.client, _objectSpread({}, usid && {
         usid
       }), {
-        clientSecret: _this6.clientSecret
+        clientSecret: _this4.clientSecret
       }];
-      const guestPublicArgs = [_this6.client, _objectSpread(_objectSpread({
-        redirectURI: _this6.redirectURI
-      }, dntPref !== undefined && {
-        dnt: dntPref
-      }), usid && {
+      const guestPublicArgs = [_this4.client, _objectSpread({
+        redirectURI: _this4.redirectURI
+      }, usid && {
         usid
       })];
-      const callback = _this6.clientSecret ? () => _commerceSdkIsomorphic.helpers.loginGuestUserPrivate(...guestPrivateArgs) : () => _commerceSdkIsomorphic.helpers.loginGuestUser(...guestPublicArgs);
-      try {
-        return yield _this6.queueRequest(callback, isGuest);
-      } catch (error) {
-        // We catch the error here to do logging but we still need to
-        // throw an error to stop the login flow from continuing.
-        const {
-          status_code,
-          responseMessage
-        } = yield _this6.extractResponseError(error);
-        _this6.logger.error(`${status_code} ${responseMessage}`);
-        throw new Error(`New guest user could not be logged in. ${status_code} ${responseMessage}`);
-      }
+      const callback = _this4.clientSecret ? () => _commerceSdkIsomorphic.helpers.loginGuestUserPrivate(...guestPrivateArgs) : () => _commerceSdkIsomorphic.helpers.loginGuestUser(...guestPublicArgs);
+      return yield _this4.queueRequest(callback, isGuest);
     })();
   }
 
@@ -699,7 +464,7 @@ class Auth {
    *
    */
   register(body) {
-    var _this7 = this;
+    var _this5 = this;
     return _asyncToGenerator(function* () {
       const {
         customer: {
@@ -714,13 +479,13 @@ class Auth {
       if (!login) {
         throw new Error('Customer registration is missing login field.');
       }
-      const res = yield _this7.shopperCustomersClient.registerCustomer({
+      const res = yield _this5.shopperCustomersClient.registerCustomer({
         headers: {
-          authorization: `Bearer ${_this7.get('access_token')}`
+          authorization: `Bearer ${_this5.get('access_token')}`
         },
         body
       });
-      yield _this7.loginRegisteredUserB2C({
+      yield _this5.loginRegisteredUserB2C({
         username: login,
         password
       });
@@ -733,135 +498,64 @@ class Auth {
    *
    */
   loginRegisteredUserB2C(credentials) {
-    var _this8 = this;
+    var _this6 = this;
     return _asyncToGenerator(function* () {
-      if (_this8.clientSecret && (0, _utils.onClient)() && _this8.clientSecret !== _constant.SLAS_SECRET_PLACEHOLDER) {
-        _this8.logWarning(_constant.SLAS_SECRET_WARNING_MSG);
+      if (_this6.clientSecret && (0, _utils.onClient)() && _this6.clientSecret !== _constant.SLAS_SECRET_PLACEHOLDER) {
+        _this6.logWarning(_constant.SLAS_SECRET_WARNING_MSG);
       }
-      const redirectURI = _this8.redirectURI;
-      const usid = _this8.get('usid');
-      const dntPref = _this8.getDntPreference(_this8.get(_constant.DNT_COOKIE_NAME), _this8.defaultDnt);
+      const redirectURI = _this6.redirectURI;
+      const usid = _this6.get('usid');
       const isGuest = false;
-      const token = yield _commerceSdkIsomorphic.helpers.loginRegisteredUserB2C(_this8.client, _objectSpread(_objectSpread({}, credentials), {}, {
-        clientSecret: _this8.clientSecret
-      }), _objectSpread(_objectSpread({
+      const token = yield _commerceSdkIsomorphic.helpers.loginRegisteredUserB2C(_this6.client, _objectSpread(_objectSpread({}, credentials), {}, {
+        clientSecret: _this6.clientSecret
+      }), _objectSpread({
         redirectURI
-      }, dntPref !== undefined && {
-        dnt: dntPref
-      }), usid && {
+      }, usid && {
         usid
       }));
-      _this8.handleTokenResponse(token, isGuest);
-      if ((0, _utils.onClient)()) {
-        void _this8.clearECOMSession();
+      _this6.handleTokenResponse(token, isGuest);
+      if ((0, _utils.onClient)() && _this6.OCAPISessionsURL) {
+        void _this6.createOCAPISession();
       }
       return token;
     })();
   }
 
   /**
-   * Trusted agent authorization
+   * A wrapper method for commerce-sdk-isomorphic helper: logout.
    *
-   * @warning This method is not supported on the server, it is a client-only method.
    */
-  authorizeTrustedAgent(credentials) {
-    var _this9 = this;
+  logout() {
+    var _this7 = this;
     return _asyncToGenerator(function* () {
-      const slasClient = _this9.client;
-      const codeVerifier = _commerceSdkIsomorphic.helpers.createCodeVerifier();
-      const codeChallenge = yield _commerceSdkIsomorphic.helpers.generateCodeChallenge(codeVerifier);
-      const organizationId = slasClient.clientConfig.parameters.organizationId;
-      const clientId = slasClient.clientConfig.parameters.clientId;
-      const siteId = slasClient.clientConfig.parameters.siteId;
-      const loginId = credentials.loginId || 'guest';
-      const isGuest = loginId === 'guest';
-      const idpOrigin = isGuest ? 'slas' : 'ecom';
-      const url = `${slasClient.clientConfig.proxy || ''}/shopper/auth/v1/organizations/${organizationId}/oauth2/trusted-agent/authorize?${[...[`client_id=${clientId}`, `channel_id=${siteId}`, `login_id=${loginId}`, `redirect_uri=${_this9.redirectURI}`, `idp_origin=${idpOrigin}`, `response_type=code`], ...(!_this9.clientSecret ? [`code_challenge=${codeChallenge}`] : [])].join('&')}`;
-      return {
-        url,
-        codeVerifier
-      };
+      // Not awaiting on purpose because there isn't much we can do if this fails.
+      void _commerceSdkIsomorphic.helpers.logout(_this7.client, {
+        accessToken: _this7.get('access_token'),
+        refreshToken: _this7.get('refresh_token_registered')
+      });
+      _this7.clearStorage();
+      return yield _this7.loginGuestUser();
     })();
   }
 
   /**
-   * Trusted agent login
+   * Make a post request to the OCAPI /session endpoint to bridge the session.
    *
-   * @warning This method is not supported on the server, it is a client-only method.
-   */
-  loginTrustedAgent(credentials) {
-    var _this10 = this;
-    return _asyncToGenerator(function* () {
-      const slasClient = _this10.client;
-      const loginId = credentials.loginId || 'guest';
-      const isGuest = loginId === 'guest';
-      const idpOrigin = isGuest ? 'slas' : 'ecom';
-      const optionsToken = {
-        headers: {
-          Authorization: `Bearer ${credentials.code}`
-        },
-        body: _objectSpread(_objectSpread(_objectSpread({
-          channel_id: slasClient.clientConfig.parameters.siteId,
-          grant_type: 'client_credentials',
-          redirect_uri: _this10.redirectURI,
-          login_id: loginId,
-          idp_origin: idpOrigin,
-          dnt: 'true'
-        }, !_this10.clientSecret && {
-          client_id: slasClient.clientConfig.parameters.clientId,
-          code_verifier: credentials.codeVerifier
-        }), credentials.state && {
-          state: credentials.state
-        }), credentials.usid && {
-          usid: credentials.usid
-        })
-      };
-
-      // using slas private client
-      if (credentials.clientSecret) {
-        optionsToken.headers._sfdc_client_auth = `Basic ${_commerceSdkIsomorphic.helpers.stringToBase64(`${slasClient.clientConfig.parameters.clientId}:${credentials.clientSecret}`)}`;
-      }
-      const token = yield slasClient.getTrustedAgentAccessToken(optionsToken);
-      _this10.handleTokenResponse(token, isGuest);
-      return token;
-    })();
-  }
-  /**
-   * Trusted agent refresh handler
+   * The HTTP response contains a set-cookie header which sets the dwsid session cookie.
+   * This cookie is used on SFRA, and it allows shoppers to navigate between SFRA and
+   * this PWA site seamlessly; this is often used to enable hybrid deployment.
    *
-   * @warning This method is not supported on the server, it is a client-only method.
-   */
-  registerTrustedAgentRefreshHandler(refreshTrustedAgentHandler) {
-    this.refreshTrustedAgentHandler = refreshTrustedAgentHandler;
-  }
-  refreshTrustedAgent(loginId, usid) {
-    var _this11 = this;
-    return _asyncToGenerator(function* () {
-      if (_this11.refreshTrustedAgentHandler) {
-        return yield _this11.refreshTrustedAgentHandler(loginId, usid, true);
-      }
-      _this11.clearStorage();
-      return yield _this11.loginGuestUser();
-    })();
-  }
-
-  /**
-   * A wrapper method for commerce-sdk-isomorphic helper: logout.
+   * (Note: this method is client side only, b/c MRT doesn't support set-cookie header right now)
    *
+   * @returns {Promise}
    */
-  logout() {
-    var _this12 = this;
-    return _asyncToGenerator(function* () {
-      if (_this12.get('customer_type') === 'registered') {
-        // Not awaiting on purpose because there isn't much we can do if this fails.
-        void _commerceSdkIsomorphic.helpers.logout(_this12.client, {
-          accessToken: _this12.get('access_token'),
-          refreshToken: _this12.get('refresh_token_registered')
-        });
+  createOCAPISession() {
+    return fetch(this.OCAPISessionsURL, {
+      method: 'POST',
+      headers: {
+        Authorization: 'Bearer ' + this.get('access_token')
       }
-      _this12.clearStorage();
-      return yield _this12.loginGuestUser();
-    })();
+    });
   }
 
   /**
@@ -869,12 +563,10 @@ class Auth {
    *
    */
   parseSlasJWT(jwt) {
-    var _isbParts, _isbParts2;
     const payload = (0, _jwtDecode.jwtDecode)(jwt);
     const {
       sub,
-      isb,
-      dnt
+      isb
     } = payload;
     if (!sub || !isb) {
       throw new Error('Unable to parse access token payload: missing sub and isb.');
@@ -885,21 +577,13 @@ class Auth {
     const isbParts = isb.split('::');
     const isGuest = isbParts[1] === 'upn:Guest';
     const customerId = isGuest ? isbParts[3].replace('gcid:', '') : isbParts[4].replace('rcid:', '');
-    const loginId = isGuest ? 'guest' : isbParts[1].replace('upn:', '');
-    const isAgent = !!(isbParts !== null && isbParts !== void 0 && (_isbParts = isbParts[isGuest ? 5 : 6]) !== null && _isbParts !== void 0 && _isbParts.startsWith('agent:'));
-    const agentId = isAgent ? isbParts === null || isbParts === void 0 ? void 0 : (_isbParts2 = isbParts[isGuest ? 5 : 6]) === null || _isbParts2 === void 0 ? void 0 : _isbParts2.replace('agent:', '') : null;
-
     // SUB format
     // cc-slas::zzrf_001::scid:c9c45bfd-0ed3-4aa2-xxxx-40f88962b836::usid:b4865233-de92-4039-xxxx-aa2dfc8c1ea5
     const usid = sub.split('::')[3].replace('usid:', '');
     return {
       isGuest,
       customerId,
-      usid,
-      dnt,
-      loginId,
-      isAgent,
-      agentId
+      usid
     };
   }
 }