@schibsted/account-sdk-browser 5.2.7 → 5.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schibsted/account-sdk-browser",
-  "version": "5.2.7",
+  "version": "5.3.0",
   "description": "Schibsted account SDK for browsers",
   "main": "index.js",
   "type": "module",
@@ -8,8 +8,11 @@
     "build": "./build.sh",
     "clean": "rimraf .cache coverage dist docs",
     "docs": "rimraf docs && jsdoc -c ./jsdoc.conf.json --verbose",
+    "docs:build": "npm run docs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "prepare": "npm run vendor",
+    "vendor": "node scripts/vendor.js",
     "test": "jest",
     "cover": "jest --coverage"
   },
@@ -21,9 +24,11 @@
   "devDependencies": {
     "@babel/core": "^7.11.4",
     "@babel/preset-env": "^7.23.2",
+    "@schibsted/consent-url-utils": "^2.0.1",
     "babel-loader": "^8.1.0",
     "core-js": "^3.6.5",
     "docdash": "git+https://github.com/torarvid/docdash.git#v0.5.0",
+    "esbuild": "^0.28.2",
     "eslint": "^6.8.0",
     "eslint-plugin-import": "^2.20.2",
     "jest": "^26.4.2",
@@ -62,5 +67,8 @@
       ]
     ]
   },
-  "typings": "index.d.ts"
+  "typings": "index.d.ts",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
+  }
 }

package/src/consents.js

@@ -0,0 +1,87 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+'use strict';
+
+import { getAndSerializeConsentsSync } from './vendor/consent-url-utils.js';
+
+const LINK_ACTIVATION_EVENTS = ['click', 'auxclick'];
+
+/**
+ * Reads consents from the Schibsted Sourcepoint integration, the default consent reader.
+ * Pages without the integration have no consents to forward, so they are skipped before
+ * `getAndSerializeConsentsSync` would warn about the missing consent manager on every login URL.
+ * @private
+ * @return {URLSearchParams|null}
+ */
+export function readSourcepointConsents() {
+    if (!window._tcf_ && !window._scc_) {
+        return null;
+    }
+    return getAndSerializeConsentsSync();
+}
+
+/**
+ * Sets the given parameters on a URL, replacing previous values of the same parameters.
+ * @private
+ * @param {string} href
+ * @param {URLSearchParams} consentParams
+ * @return {string} - The URL with the parameters replaced
+ */
+export function replaceConsentParams(href, consentParams) {
+    const url = new URL(href);
+    // Two passes on purpose: the reader may return repeated keys (e.g. `purpose=a&purpose=b`).
+    // A single `set()` pass would keep only the last value, and a single `append()` pass would keep
+    // stale values of the link. So first drop every stale value, then append all fresh ones.
+    consentParams.forEach((_, key) => {
+        url.searchParams.delete(key);
+    });
+    consentParams.forEach((value, key) => {
+        url.searchParams.append(key, value);
+    });
+    return url.href;
+}
+
+/**
+ * Finds the link that was activated by a click, including links inside open shadow roots.
+ * @private
+ * @param {Event} event
+ * @return {HTMLAnchorElement|undefined}
+ */
+function findActivatedLink(event) {
+    const path = typeof event.composedPath === 'function' ? event.composedPath() : [event.target];
+    return path.find(node => node && node.tagName === 'A' && typeof node.href === 'string');
+}
+
+/**
+ * Refreshes consents of already rendered login links right before the browser follows them.
+ * Links are often generated before the user answers the consent dialog, so their consents are stale.
+ * The listener runs in the capture phase, before page handlers read the link.
+ * @private
+ * @param {object} document
+ * @param {object} options
+ * @param {function(string): boolean} options.isLoginUrl - Tells whether a URL is a login URL to refresh
+ * @param {function(): URLSearchParams} options.getConsentParams - Current consent parameters
+ * @return {void}
+ */
+export function refreshLoginLinksOnActivation(document, { isLoginUrl, getConsentParams }) {
+    const refreshLink = (event) => {
+        const link = findActivatedLink(event);
+        if (!link || !isLoginUrl(link.href)) {
+            return;
+        }
+
+        const consentParams = getConsentParams();
+        // Unknown consents never overwrite the ones the link was created with.
+        if (consentParams.toString() === '') {
+            return;
+        }
+
+        link.href = replaceConsentParams(link.href, consentParams);
+    };
+
+    LINK_ACTIVATION_EVENTS.forEach((type) => {
+        document.addEventListener(type, refreshLink, true);
+    });
+}

package/src/identity.d.ts

@@ -1,4 +1,6 @@
 import type { TinyEmitter } from 'tiny-emitter';
+/** Synchronously returns the current consents as query parameters; must not wait for the user's decision. */
+export type ConsentReader = () => URLSearchParams | null;
 
 /**
  * Provides Identity functionality to a web page
@@ -14,9 +16,13 @@ export class Identity extends TinyEmitter {
      * no logging will be done
      * @param {object} [options.window] - window object
      * @param {function} [options.callbackBeforeRedirect] - callback triggered before session refresh redirect happen
+     * @param {ConsentReader} [options.getConsents] - reads consents forwarded in login URLs.
+     * Defaults to the Schibsted Sourcepoint integration
+     * @param {boolean} [options.refreshLoginLinks=true] - refresh consents of rendered login links when
+     * they are clicked
      * @throws {SDKError} - If any of options are invalid
      */
-    constructor({ clientId, redirectUri, sessionDomain, env, log, window, callbackBeforeRedirect }: {
+    constructor({ clientId, redirectUri, sessionDomain, env, log, window, callbackBeforeRedirect, getConsents, refreshLoginLinks }: {
         clientId: string;
         sessionDomain: string;
         redirectUri: string;
@@ -24,6 +30,8 @@ export class Identity extends TinyEmitter {
         log?: Function;
         window?: any;
         callbackBeforeRedirect?: Function;
+        getConsents?: ConsentReader;
+        refreshLoginLinks?: boolean;
     });
     _sessionInitiatedSent: boolean;
     window: any;
@@ -34,6 +42,7 @@ export class Identity extends TinyEmitter {
     env: string;
     log: Function;
     callbackBeforeRedirect: Function;
+    private _getConsents;
     _sessionDomain: string;
     _enableSessionCaching: boolean;
     _session: {};

package/src/identity.js

@@ -4,9 +4,10 @@
 
 'use strict';
 
-import { assert, isStr, isNonEmptyString, isObject, isUrl, isStrIn } from './validate.js';
+import { assert, isStr, isNonEmptyString, isObject, isUrl, isStrIn, isFunction } from './validate.js';
 import { cloneDeep } from './object.js';
 import { urlMapper } from './url.js';
+import { readSourcepointConsents, refreshLoginLinksOnActivation, replaceConsentParams } from './consents.js';
 import { ENDPOINTS, NAMESPACE } from './config.js';
 import EventEmitter from 'tiny-emitter';
 import Cache from './cache.js';
@@ -92,6 +93,15 @@ import { registerGlobal } from './global-registry.js';
  * @property {string} [originCampaign] - Campaign identifier for tracking in Pulse
  */
 
+/**
+ * Synchronously returns the current consents, serialized as query parameters, when a login URL is
+ * created. Empty params or `null` mean that consent information is unavailable. It must not wait for
+ * the user's decision.
+ *
+ * @callback ConsentReader
+ * @return {URLSearchParams|null}
+ */
+
 /**
  * @typedef {object} HasSessionSuccessResponse
  * @property {boolean} result - Is the user connected to the merchant? (it means that the merchant
@@ -175,6 +185,10 @@ export class Identity extends EventEmitter {
      * no logging will be done
      * @param {object} [options.window] - window object
      * @param {function} [options.callbackBeforeRedirect] - callback triggered before session refresh redirect happen
+     * @param {ConsentReader} [options.getConsents] - reads consents forwarded in login URLs.
+     * Defaults to the Schibsted Sourcepoint integration
+     * @param {boolean} [options.refreshLoginLinks=true] - refresh consents of rendered login links when
+     * they are clicked
      * @throws {SDKError} - If any of options are invalid
      */
     constructor({
@@ -184,13 +198,17 @@ export class Identity extends EventEmitter {
         env = 'PRE',
         log,
         window = globalWindow(),
-        callbackBeforeRedirect = ()=>{}
+        callbackBeforeRedirect = ()=>{},
+        getConsents = readSourcepointConsents,
+        refreshLoginLinks = true
     }) {
         super();
         assert(isNonEmptyString(clientId), 'clientId parameter is required');
         assert(isObject(window), 'The reference to window is missing');
         assert(!redirectUri || isUrl(redirectUri), 'redirectUri parameter is invalid');
         assert(sessionDomain && isUrl(sessionDomain), 'sessionDomain parameter is not a valid URL');
+        assert(isFunction(getConsents),
+            'getConsents parameter must be a function');
 
         spidTalk.emulate(window);
         this._sessionInitiatedSent = false;
@@ -202,6 +220,7 @@ export class Identity extends EventEmitter {
         this.env = env;
         this.log = log;
         this.callbackBeforeRedirect = callbackBeforeRedirect;
+        this._getConsents = getConsents;
         this._sessionDomain = sessionDomain;
 
         // Internal hack: set to false to always refresh from hassession
@@ -220,6 +239,13 @@ export class Identity extends EventEmitter {
 
         this._unblockSessionCall();
 
+        if (refreshLoginLinks && window.document && isFunction(window.document.addEventListener)) {
+            refreshLoginLinksOnActivation(window.document, {
+                isLoginUrl: href => this._isLoginUrl(href),
+                getConsentParams: () => this._getConsentParams()
+            });
+        }
+
         registerGlobal(window, 'Identity', this);
 
     }
@@ -1003,7 +1029,7 @@ export class Identity extends EventEmitter {
         assert(isNonEmptyString(state),
             `the state parameter should be a non empty string but it is ${state}`);
 
-        return this._oauthService.makeUrl('oauth/authorize', {
+        return replaceConsentParams(this._oauthService.makeUrl('oauth/authorize', {
             response_type: 'code',
             redirect_uri: redirectUri,
             scope,
@@ -1019,7 +1045,43 @@ export class Identity extends EventEmitter {
             x_domain_id: xDomainId,
             x_env_id: xEnvironmentId,
             utm_campaign: originCampaign
-        });
+        }), this._getConsentParams());
+    }
+
+    /**
+     * Reads the current consent parameters. A failing consent reader must not prevent a login,
+     * so the failure is logged and the login continues without consents.
+     * @private
+     * @return {URLSearchParams} - Consent query parameters; empty when unavailable
+     */
+    _getConsentParams() {
+        try {
+            const consentParams = this._getConsents() || new URLSearchParams();
+            assert(consentParams instanceof URLSearchParams,
+                `getConsents must return URLSearchParams but it returned ${consentParams}`);
+            return consentParams;
+        } catch (error) {
+            const log = this.log || console.warn;
+            log('Schibsted account SDK: could not read consents, logging in without them', error);
+            return new URLSearchParams();
+        }
+    }
+
+    /**
+     * Tells whether a URL is a login URL generated by this instance
+     * @private
+     * @param {string} href
+     * @return {boolean}
+     */
+    _isLoginUrl(href) {
+        if (!isUrl(href)) {
+            return false;
+        }
+        const url = new URL(href);
+        const authorizeUrl = new URL(this._oauthService.makeUrl('oauth/authorize', {}, false));
+        return url.origin === authorizeUrl.origin
+            && url.pathname === authorizeUrl.pathname
+            && url.searchParams.get('client_id') === this.clientId;
     }
 
     /**

package/src/vendor/consent-url-utils.js

@@ -0,0 +1,50 @@
+// Generated by scripts/vendor.js. Do not edit.
+
+// node_modules/@schibsted/consent-url-utils/lib/esm/consent-manager.js
+function getConsentsSync(_window = window) {
+  const manager = _window._tcf_ || _window._scc_;
+  if (!manager) {
+    console.warn("Consent-query-utils: getConsentsSync called but no consent manager found on window");
+    return null;
+  }
+  const advertising = manager.getPermissionSync("CMP:advertising");
+  const analytics = manager.getPermissionSync("CMP:analytics");
+  const marketing = manager.getPermissionSync("CMP:marketing");
+  const personalisation = manager.getPermissionSync("CMP:personalisation");
+  const consents = { advertising, analytics, marketing, personalisation };
+  return consents;
+}
+
+// node_modules/@schibsted/consent-url-utils/lib/esm/serializeConsents.js
+var REJECTED_SENTINEL = "rejected";
+var CONSENT_VERSION = "v1";
+function hasConsentInformation(consents) {
+  return Object.values(consents).some((purpose) => purpose !== null);
+}
+function serializeConsents(consents) {
+  const consentsSearchParams = new URLSearchParams();
+  if (!consents || !hasConsentInformation(consents)) {
+    return consentsSearchParams;
+  }
+  const granted = [];
+  for (const [category, purpose] of Object.entries(consents)) {
+    if (purpose === "1") {
+      granted.push(category);
+    }
+  }
+  if (granted.length === 0) {
+    granted.push(REJECTED_SENTINEL);
+  }
+  const uniqueSorted = [...new Set(granted)].sort();
+  consentsSearchParams.set("consents", uniqueSorted.join(","));
+  consentsSearchParams.set("consent_version", CONSENT_VERSION);
+  return consentsSearchParams;
+}
+function getAndSerializeConsentsSync() {
+  var _a;
+  const consents = (_a = getConsentsSync()) != null ? _a : null;
+  return serializeConsents(consents);
+}
+export {
+  getAndSerializeConsentsSync
+};

package/src/version.js

@@ -1,5 +1,5 @@
 // Version is bumped automatically by release-please. See release-please-config.json.
 
 'use strict'
-const version = '5.2.7'; // x-release-please-version
+const version = '5.3.0'; // x-release-please-version
 export default version;