@schibsted/account-sdk-browser 5.2.7 → 6.0.0-alpha.10

package/src/account.ts

@@ -0,0 +1,332 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import Identity from './identity.js';
+import Monetization from './monetization.js';
+import { resolveBrowserWindow } from './resolve-browser-window.js';
+import SDKError from './sdk-error.js';
+import type { AccountConfig, AccountEventListener, AccountEventName } from './types/account.js';
+import type {
+    LoginOptions,
+    SimplifiedLoginData,
+    SimplifiedLoginWidgetLoginOptions,
+    SimplifiedLoginWidgetOptions,
+} from './types/login.js';
+import type { HasAccessResult } from './types/monetization.js';
+import type { ConnectedSessionResponse, SessionResponse, SessionUserId } from './types/session.js';
+
+/**
+ * Unified client-side interface for a configured Schibsted Account integration.
+ *
+ * Create an instance with `createAccountSdk()` unless you explicitly need to construct it
+ * yourself. The instance coordinates identity, login, session, and access-check features for one
+ * configured client.
+ *
+ * @group Core API
+ */
+export class Account {
+    #identity: Identity;
+    #monetization: Monetization;
+    #defaultProductIds?: string[];
+
+    constructor(config: AccountConfig) {
+        const browserWindow = resolveBrowserWindow(config.window);
+
+        if (!browserWindow) {
+            throw new SDKError('Schibsted Account SDK is not available in this browser context');
+        }
+
+        if (browserWindow.schAccount) {
+            throw new SDKError('Schibsted Account SDK has already been initialized');
+        }
+
+        const { log, callbackBeforeRedirect, defaultProductIds, varnish } = config;
+        const sharedConfig = {
+            clientId: config.clientId,
+            redirectUri: config.redirectUri,
+            sessionDomain: config.sessionDomain,
+            env: config.env,
+            window: browserWindow,
+        };
+
+        this.#identity = new Identity({
+            ...sharedConfig,
+            log,
+            callbackBeforeRedirect,
+        });
+
+        if (defaultProductIds !== undefined && !Array.isArray(defaultProductIds)) {
+            throw new SDKError('Account defaultProductIds config must be an array');
+        }
+        this.#defaultProductIds = defaultProductIds;
+
+        if (varnish) {
+            if (typeof varnish !== 'object' || Array.isArray(varnish)) {
+                throw new SDKError('Account varnish config must be an object');
+            }
+            this.#identity.enableVarnishCookie(varnish);
+        }
+
+        this.#monetization = new Monetization(sharedConfig);
+
+        browserWindow.schAccount = this;
+        browserWindow.dispatchEvent(
+            new CustomEvent('schAccount:ready', { detail: { instance: this } }),
+        );
+    }
+
+    /**
+     * Queries Session Service and returns the current browser session state.
+     *
+     * This call may trigger a full-page session refresh redirect. Configure
+     * `callbackBeforeRedirect` if your app needs to persist state before that navigation.
+     *
+     * @throws {SDKError} If the Session Service call fails.
+     */
+    hasSession(): Promise<SessionResponse> {
+        return this.#identity.hasSession();
+    }
+
+    /**
+     * Checks whether the browser currently has a Schibsted Account session.
+     *
+     * Returns `false` instead of throwing when the session lookup fails.
+     */
+    isLoggedIn(): Promise<boolean> {
+        return this.#identity.isLoggedIn();
+    }
+
+    /**
+     * Checks whether the current user is connected to the configured client.
+     *
+     * A user can be logged in to Schibsted Account without being connected to your client, for
+     * example before accepting required terms.
+     */
+    isConnected(): Promise<boolean> {
+        return this.#identity.isConnected();
+    }
+
+    /**
+     * Returns the connected user session data.
+     *
+     * @throws {SDKError} If the user is not connected to the configured client.
+     */
+    getUser(): Promise<ConnectedSessionResponse> {
+        return this.#identity.getUser();
+    }
+
+    /**
+     * Returns the realm-specific Schibsted Account user id as a number.
+     *
+     * Use `getUserUuid()` when you need the globally unique user id.
+     *
+     * @throws {SDKError} If the user is not connected to the configured client.
+     */
+    getUserId(): Promise<number> {
+        return this.#identity.getUserId();
+    }
+
+    /**
+     * Returns an external identifier for the authenticated user, scoped to the configured client
+     * and external party.
+     *
+     * @param externalParty - External party for which the identifier is generated.
+     * @param optionalSuffix - Optional suffix included when generating the identifier.
+     * @throws {SDKError} If the session lookup fails, the session does not contain a `pairId`, or
+     * `externalParty` is empty.
+     * @deprecated Retained for compatibility with existing integrations. Avoid new usage.
+     */
+    getExternalId(externalParty: string, optionalSuffix: string = ''): Promise<string> {
+        return this.#identity.getExternalId(externalParty, optionalSuffix);
+    }
+
+    /**
+     * Returns the globally unique user id from the current session.
+     *
+     * @throws {SDKError} If the user is not connected to the configured client.
+     */
+    getUserUuid(): Promise<string> {
+        return this.#identity.getUserUuid();
+    }
+
+    /**
+     * Returns the user SDRN from the current session.
+     *
+     * @throws {SDKError} If the SDRN is missing from the session response.
+     */
+    getUserSDRN(): Promise<string> {
+        return this.#identity.getUserSDRN();
+    }
+
+    /**
+     * Returns minimal user context for simplified login prompts.
+     *
+     * Returns `null` if the global account session cannot be read.
+     */
+    getUserContextData(): Promise<SimplifiedLoginData | null> {
+        return this.#identity.getUserContextData();
+    }
+
+    /**
+     * Returns the Varnish `sp_id` value from the current session when present.
+     */
+    getSpId(): Promise<string | null> {
+        return this.#identity.getSpId();
+    }
+
+    /**
+     * Starts the login flow with either a full-page redirect or a popup.
+     *
+     * Call this from a user gesture when `preferPopup` is enabled, otherwise browser popup blockers
+     * may block the popup and the SDK will fall back to redirect navigation.
+     *
+     * @param options - Login URL parameters.
+     * @returns A popup window reference when a popup is opened; otherwise `null`.
+     */
+    login(options: LoginOptions): Window | null {
+        return this.#identity.login(options);
+    }
+
+    /**
+     * Logs the user out from the brand Session Service session and redirects the browser.
+     *
+     * @param redirectUri - Where Session Service should redirect the browser after logout.
+     */
+    logout(redirectUri?: string): void {
+        this.#identity.logout(redirectUri);
+    }
+
+    /**
+     * Builds the login URL without navigating the browser.
+     *
+     * @param options - Login URL parameters.
+     */
+    loginUrl(options: LoginOptions): string {
+        return this.#identity.loginUrl(options);
+    }
+
+    /**
+     * Builds the logout URL without navigating the browser.
+     *
+     * @param redirectUri - Where Session Service should redirect the browser after logout.
+     */
+    logoutUrl(redirectUri?: string): string {
+        return this.#identity.logoutUrl(redirectUri);
+    }
+
+    /**
+     * Builds the Schibsted Account profile page URL.
+     *
+     * @param redirectUri - Where the account page should redirect the browser afterwards.
+     */
+    accountUrl(redirectUri?: string): string {
+        return this.#identity.accountUrl(redirectUri);
+    }
+
+    /**
+     * Loads and displays the simplified login widget when user context is available.
+     *
+     * Your application decides how often to call this method. The `state` field in `loginParams`
+     * may be a string or a function that resolves to a string.
+     * Widget open and cancel events can be observed with `on()`.
+     *
+     * @returns `true` when the widget was displayed.
+     * @throws {SDKError} If user context data is missing or the widget script cannot be loaded.
+     */
+    showSimplifiedLoginWidget(
+        loginParams: SimplifiedLoginWidgetLoginOptions,
+        options?: SimplifiedLoginWidgetOptions,
+    ): Promise<boolean> {
+        return this.#identity.showSimplifiedLoginWidget(loginParams, options);
+    }
+
+    /**
+     * Enables or disables caching for subsequent session lookups.
+     *
+     * Changing this setting does not remove an existing cached session.
+     */
+    setSessionCachingEnabled(enabled: boolean): void {
+        this.#identity.setSessionCachingEnabled(enabled);
+    }
+
+    /**
+     * Removes the cached Session Service user session response.
+     */
+    clearCachedUserSession(): void {
+        this.#identity.clearCachedUserSession();
+    }
+
+    /**
+     * Checks whether the current user has access to any of the requested products or features.
+     *
+     * When `productIds` is omitted, the ids configured as `defaultProductIds` are used.
+     * Results are cached according to the TTL returned by Session Service.
+     *
+     * @param productIds - Product or feature ids to check instead of the configured defaults.
+     * @returns Access data, or `null` when the user is not entitled.
+     * @throws {SDKError} If product ids are not provided or configured, `sessionDomain` is missing,
+     * the current user cannot be resolved, input is invalid, or the request fails.
+     */
+    async hasAccess(productIds = this.#defaultProductIds): Promise<HasAccessResult | null> {
+        if (!productIds) {
+            throw new SDKError(
+                'hasAccess requires productIds or defaultProductIds in the Account config',
+            );
+        }
+        if (productIds.length === 0) {
+            return null;
+        }
+
+        const userId = await this.#identity.getUserId();
+        return this.#monetization.hasAccess(productIds, userId);
+    }
+
+    /**
+     * Removes a cached access-check result.
+     *
+     * @param productIds - Product or feature ids used for the cached lookup.
+     * @param userId - User id used for the cached lookup.
+     */
+    clearCachedAccessResult(productIds: string[], userId: SessionUserId): void {
+        this.#monetization.clearCachedAccessResult(productIds, userId);
+    }
+
+    /**
+     * Subscribes to Account events.
+     *
+     * Supported event names are defined by {@link AccountEventName}.
+     *
+     * @param event - Event name.
+     * @param listener - Listener that receives an `Event` or `CustomEvent`.
+     */
+    on<EventName extends AccountEventName>(
+        event: EventName,
+        listener: AccountEventListener<EventName>,
+    ): this;
+    on(event: AccountEventName, listener: EventListener): this {
+        this.#identity.addEventListener(event, listener);
+
+        return this;
+    }
+
+    /**
+     * Unsubscribes from Account events.
+     *
+     * Supported event names are defined by {@link AccountEventName}.
+     *
+     * @param event - Event name.
+     * @param listener - Listener to remove.
+     */
+    off<EventName extends AccountEventName>(
+        event: EventName,
+        listener: AccountEventListener<EventName>,
+    ): this;
+    off(event: AccountEventName, listener: EventListener): this {
+        this.#identity.removeEventListener(event, listener);
+
+        return this;
+    }
+}
+
+export default Account;

package/src/{cache.js → cache.ts}

@@ -2,45 +2,47 @@
  * See LICENSE.md in the project root.
  */
 
-'use strict';
-
-import SDKError from './SDKError.js';
+import SDKError from './sdk-error.js';
 
 /**
  * Check whether we are able to use web storage
- * @param {Storage} storeProvider - A function to return a WebStorage instance (either
+ * @param storeProvider - A function to return a WebStorage instance (either
  * `sessionStorage` or `localStorage` from a `Window` object)
  * @private
- * @returns {boolean}
  */
-function webStorageWorks(storeProvider) {
+function webStorageWorks(storeProvider: (() => Storage) | undefined): boolean {
     if (!storeProvider) {
         return false;
     }
     try {
         const store = storeProvider();
-        const randomKey = 'x-x-x-x'.replace(/x/g, () => Math.random());
+        const randomKey = 'x-x-x-x'.replace(/x/g, () => String(Math.random()));
         const testValue = 'TEST-VALUE';
         store.setItem(randomKey, testValue);
         const val = store.getItem(randomKey);
         store.removeItem(randomKey);
-        return (val === testValue);
-    } catch (e) {
+        return val === testValue;
+    } catch {
         return false;
     }
 }
 
 /**
- * Will be used if web storage is available
+ * Cache implementation used when web storage is available. Wraps a `Storage` instance.
  * @private
  */
 class WebStorageCache {
+    store: Storage;
+    get: (key: string) => string | null;
+    set: (key: string, value: string) => void;
+    delete: (key: string) => void;
+
     /**
      * Create web storage cache object
-     * @param {Storage} store - A reference to either `sessionStorage` or `localStorage` from a
+     * @param store - A reference to either `sessionStorage` or `localStorage` from a
      * `Window` object
      */
-    constructor(store) {
+    constructor(store: Storage) {
         this.store = store;
         this.get = (key) => this.store.getItem(key);
         this.set = (key, value) => this.store.setItem(key, value);
@@ -49,35 +51,49 @@ class WebStorageCache {
 }
 
 /**
- * Will be used if session storage is not available
+ * Cache implementation used when web storage is not available. Stores entries in an in-memory object.
  * @private
  */
 class LiteralCache {
+    store: Record<string, string>;
+    get: (key: string) => string | undefined;
+    set: (key: string, value: string) => void;
+    delete: (key: string) => void;
+
     /**
      * Create JS object literal cache object
      */
     constructor() {
         this.store = {};
         this.get = (key) => this.store[key];
-        this.set = (key, value) => this.store[key] = value;
-        this.delete = (key) => delete this.store[key];
+        this.set = (key, value) => {
+            this.store[key] = value;
+        };
+        this.delete = (key) => {
+            delete this.store[key];
+        };
     }
 }
 
-const maxExpiresIn = Math.pow(2, 31) - 1;
+type CacheEntry = { expiresOn: number; value: unknown };
+
+const maxExpiresIn = 2 ** 31 - 1;
 
 /**
  * Cache class that attempts WebStorage (session/local storage), and falls back to JS object literal
  * @private
  */
 export default class Cache {
+    cache: WebStorageCache | LiteralCache;
+    type: string;
+
     /**
-     * @param {Storage} [storeProvider] - A function to return a WebStorage instance (either
+     * @param storeProvider - A function to return a WebStorage instance (either
      * `sessionStorage` or `localStorage` from a `Window` object)
      * @throws {SDKError} - If sessionStorage or localStorage are not accessible
      */
-    constructor(storeProvider) {
-        if (webStorageWorks(storeProvider)) {
+    constructor(storeProvider?: () => Storage) {
+        if (storeProvider && webStorageWorks(storeProvider)) {
             this.cache = new WebStorageCache(storeProvider());
             this.type = 'WebStorage';
         } else {
@@ -88,46 +104,46 @@ export default class Cache {
 
     /**
      * Get a value from cache (checks that the object has not expired)
-     * @param {string} key
+     * @param key
      * @private
-     * @returns {*} - The value if it exists, otherwise null
      */
-    get(key) {
+    get(key: string): unknown {
         /**
          * JSON.parse safe wrapper
-         * @param {string} raw
-         * @returns {*} parsed value or null if failed to parse
+         * @param raw
          */
-        function getObj(raw) {
+        function getObj(raw: string | null | undefined): CacheEntry | null {
+            if (raw == null) {
+                return null;
+            }
             try {
                 return JSON.parse(raw);
-            } catch (e) {
+            } catch {
                 return null;
             }
         }
 
         try {
             const raw = this.cache.get(key);
-            let obj = getObj(raw);
+            const obj = getObj(raw);
             if (obj && Number.isInteger(obj.expiresOn) && obj.expiresOn > Date.now()) {
                 return obj.value;
             }
             this.delete(key);
             return null;
         } catch (e) {
-            throw new SDKError(e);
+            throw new SDKError(String(e));
         }
     }
 
     /**
      * Set a cache entry
-     * @param {string} key
-     * @param {*} value
-     * @param {Number} expiresIn - Value in milliseconds until the entry expires
+     * @param key
+     * @param value
+     * @param expiresIn - Value in milliseconds until the entry expires
      * @private
-     * @returns {void}
      */
-    set(key, value, expiresIn = 0) {
+    set(key: string, value: unknown, expiresIn = 0): void {
         if (expiresIn <= 0) {
             return;
         }
@@ -138,21 +154,20 @@ export default class Cache {
             this.cache.set(key, JSON.stringify({ expiresOn, value }));
             setTimeout(() => this.delete(key), expiresIn);
         } catch (e) {
-            throw new SDKError(e);
+            throw new SDKError(String(e));
         }
     }
 
     /**
      * Delete a cache entry
-     * @param {string} key
+     * @param key
      * @private
-     * @returns {void}
      */
-    delete(key) {
+    delete(key: string): void {
         try {
             this.cache.delete(key);
         } catch (e) {
-            throw new SDKError(e);
+            throw new SDKError(String(e));
         }
     }
 }

package/src/{config.js → config.ts}

@@ -2,8 +2,6 @@
  * See LICENSE.md in the project root.
  */
 
-'use strict';
-
 /*
  * This file declares configs that are essentially part of how the SDK works and interacts with our
  * backend servers.
@@ -18,34 +16,11 @@
  */
 
 /**
- * Core configuration used by the SDK
- * @type {Object}
- * @memberof core
- * @prop {object} ENDPOINTS - URL to some of the services that users of this SDK may interact with
- * @prop {object} ENDPOINTS.SPiD - SPiD endpoints
- * @prop {string} ENDPOINTS.SPiD.LOCAL - Local endpoint (for Identity team)
- * @prop {string} ENDPOINTS.SPiD.DEV - Dev environment (for Identity team)
- * @prop {string} ENDPOINTS.SPiD.PRE - Staging environment
- * @prop {string} ENDPOINTS.SPiD.PRO - Production environment Sweden
- * @prop {string} ENDPOINTS.SPiD.PRO_NO - Production environment Norway
- * @prop {string} ENDPOINTS.SPiD.PRO_FI - Production environment Finland
- * @prop {string} ENDPOINTS.SPiD.PRO_DK - Production environment Denmark
- * @prop {object} ENDPOINTS.BFF - Endpoints used with new GDPR-compliant web flows
- * @prop {string} ENDPOINTS.BFF.LOCAL - Local endpoint (for Identity team)
- * @prop {string} ENDPOINTS.BFF.DEV - Dev environment (for Identity team)
- * @prop {string} ENDPOINTS.BFF.PRE - Staging environment
- * @prop {string} ENDPOINTS.BFF.PRO - Production environment Sweden
- * @prop {string} ENDPOINTS.BFF.PRO_NO - Production environment Norway
- * @prop {string} ENDPOINTS.BFF.PRO_FI - Production environment Finland
- * @prop {string} ENDPOINTS.BFF.PRO_DK - Production environment Denmark
- * @prop {object} ENDPOINTS.SESSION_SERVICE - Endpoints to check global user session data
- * @prop {string} ENDPOINTS.SESSION_SERVICE.LOCAL - Local endpoint (for Identity team)
- * @prop {string} ENDPOINTS.SESSION_SERVICE.DEV - Dev environment (for Identity team)
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRE - Staging environment
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO - Production environment Sweden
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO_NO - Production environment Norway
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO_FI - Production environment Finland
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO_DK - Production environment Denmark
+ * Core configuration used by the SDK.
+ * - `ENDPOINTS.SPiD` — SPiD endpoints per environment
+ * - `ENDPOINTS.BFF` — Endpoints used with new GDPR-compliant web flows
+ * - `ENDPOINTS.SESSION_SERVICE` — Endpoints to check global user session data
+ *
  */
 const config = {
     ENDPOINTS: {
@@ -85,8 +60,8 @@ const config = {
         PRO_NO: 'spid.no',
         PRO_FI: 'schibsted.fi',
         PRO_DK: 'schibsted.dk',
-    }
-};
+    },
+} as const;
 
 export default config;
 export const ENDPOINTS = config.ENDPOINTS;

package/src/globals.ts

@@ -0,0 +1,8 @@
+import type { Account } from './account.js';
+
+declare global {
+    interface Window {
+        schAccount?: Account;
+        SPiD?: { Talk?: { response?: (callbackName: string, data: unknown) => unknown } };
+    }
+}

package/src/has-access-response.ts

@@ -0,0 +1,35 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import SDKError from './sdk-error.js';
+import type { HasAccessResult } from './types/monetization.js';
+import { isObject, isStr } from './validate.js';
+
+export function parseHasAccessResult(value: unknown): HasAccessResult {
+    if (!isObject(value)) {
+        throw new SDKError('Invalid hasAccess response');
+    }
+
+    const { entitled, ttl, allowedFeatures, userId, uuid, sig } = value;
+
+    if (
+        typeof entitled !== 'boolean' ||
+        typeof ttl !== 'number' ||
+        !Array.isArray(allowedFeatures) ||
+        typeof userId !== 'number' ||
+        !isStr(uuid) ||
+        !isStr(sig)
+    ) {
+        throw new SDKError('Invalid hasAccess response');
+    }
+
+    return {
+        entitled,
+        ttl,
+        allowedFeatures: allowedFeatures.filter(isStr),
+        userId,
+        uuid,
+        sig,
+    };
+}