@schibsted/account-sdk-browser 5.2.7 → 6.0.0-alpha.10

package/src/identity.ts

@@ -0,0 +1,1023 @@
+/* Copyright 2024 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import Cache from './cache.js';
+import { ENDPOINTS } from './config.js';
+import { cloneDeep } from './object.js';
+import * as popup from './popup.js';
+import type RESTClient from './rest-client.js';
+import { buildClientSdrn, createAccountRestClient } from './rest-clients.js';
+import SDKError from './sdk-error.js';
+import {
+    isConnectedSessionResponse,
+    isConnectedSessionWithUserIdResponse,
+    isRedirectSessionPayload,
+    isSessionFailureResponse,
+    isSessionSuccessResponse,
+    normalizeSessionResponse,
+} from './session-response.js';
+import * as spidTalk from './spid-talk.js';
+import type { AccountEventName } from './types/account.js';
+import type { LogFunction } from './types/common.js';
+import type {
+    IdentityBeforeRedirectCallback,
+    IdentityOptions,
+    VarnishCookieOptions,
+} from './types/identity.js';
+import {
+    hasOpenSimplifiedLoginWidget,
+    type LoginOptions,
+    type OpenSimplifiedLoginWidget,
+    type SimplifiedLoginData,
+    type SimplifiedLoginWidgetInitialParams,
+    type SimplifiedLoginWidgetLoginOptions,
+    type SimplifiedLoginWidgetOptions,
+} from './types/login.js';
+import type {
+    ConnectedSessionResponse,
+    NormalizedSessionPayload,
+    SessionObjectResponse,
+    SessionResponse,
+} from './types/session.js';
+import { urlMapper } from './url.js';
+import { assert, isNonEmptyString, isObject, isStr, isStrIn, isUrl } from './validate.js';
+import version from './version.js';
+
+declare global {
+    interface Window {
+        openSimplifiedLoginWidget?: OpenSimplifiedLoginWidget;
+    }
+}
+
+const HAS_SESSION_CACHE_KEY = 'hasSession-cache';
+const SESSION_CALL_BLOCKED_CACHE_KEY = 'sessionCallBlocked-cache';
+const SESSION_CALL_BLOCKED_TTL = 1000 * 60 * 5;
+
+const TAB_ID_KEY = 'tab-id-cache';
+const TAB_ID = Math.floor(Math.random() * 100000);
+const TAB_ID_TTL = 1000 * 60 * 60 * 24 * 30;
+
+const globalWindow = () => window;
+
+/**
+ * Provides Identity functionalty to a web page
+ */
+export class Identity {
+    // Event bus
+    private readonly eventTarget = new EventTarget();
+
+    // Configuration
+    private readonly window: Window;
+    private readonly clientId: string;
+    private readonly redirectUri: string;
+    private readonly env: string;
+    private readonly log?: LogFunction;
+    private readonly callbackBeforeRedirect: IdentityBeforeRedirectCallback;
+
+    // Caches
+    private readonly sessionStorageCache: Cache;
+    private readonly localStorageCache: Cache;
+    private enableSessionCaching: boolean;
+
+    // REST clients
+    private readonly spid: RESTClient;
+    private readonly oauthService: RESTClient;
+    private readonly bffService: RESTClient;
+    private readonly sessionService: RESTClient;
+    private readonly globalSessionService: RESTClient;
+    private readonly usedSessionServiceGetSessionEndpoint: 'v2/session' | 'session';
+
+    // Session state
+    /**
+     * @internal Starts as `{}` before the first `hasSession()` call, then stores the latest
+     * object response from hasSession().
+     */
+    private session: SessionObjectResponse;
+    private hasSessionInProgress?: false | Promise<SessionResponse>;
+
+    // Popup & Varnish cookie state
+    private popup?: Window | null;
+    private setVarnishCookie?: boolean;
+    private varnishExpiresIn?: number;
+    private varnishCookieDomain?: string;
+
+    /**
+     * @param options
+     * @param options.clientId - Example: "1234567890abcdef12345678"
+     * @param options.sessionDomain - Example: "https://id.site.com"
+     * @param options.redirectUri - Example: "https://site.com"
+     * @param options.env - Schibsted account environment: `PRE` (default), `PRO`, `PRO_NO`, `PRO_FI` or `PRO_DK`
+     * @param options.log - A function that receives debug log information. If not set,
+     * no logging will be done
+     * @param options.window - window object
+     * @param options.callbackBeforeRedirect - callback triggered before session refresh redirect happen
+     * @throws {SDKError} - If any of options are invalid
+     */
+    constructor({
+        clientId,
+        redirectUri,
+        sessionDomain,
+        env = 'PRE',
+        log,
+        window = globalWindow(),
+        callbackBeforeRedirect = () => {},
+    }: IdentityOptions) {
+        assert(isNonEmptyString(clientId), 'clientId parameter is required');
+        assert(isObject(window), 'The reference to window is missing');
+        assert(!redirectUri || isUrl(redirectUri), 'redirectUri parameter is invalid');
+        assert(
+            isNonEmptyString(sessionDomain) && isUrl(sessionDomain),
+            'sessionDomain parameter is not a valid URL',
+        );
+        assert(isStr(env), `env parameter is invalid: ${env}`);
+
+        spidTalk.emulate(window);
+        this.window = window;
+        this.clientId = clientId;
+        this.redirectUri = redirectUri;
+        this.env = env;
+        this.log = log;
+        this.callbackBeforeRedirect = callbackBeforeRedirect;
+
+        this.sessionStorageCache = new Cache(() => this.window && this.window.sessionStorage);
+        this.localStorageCache = new Cache(() => this.window && this.window.localStorage);
+        // Internal hack: set to false to always refresh from hassession
+        this.enableSessionCaching = true;
+
+        this.session = {};
+
+        const accountClientParams = { client_id: this.clientId, redirect_uri: this.redirectUri };
+        const clientSdrn = buildClientSdrn(this.env, this.clientId);
+
+        this.spid = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SPiD),
+            log: this.log,
+            defaultParams: accountClientParams,
+        });
+        this.oauthService = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SPiD),
+            log: this.log,
+            defaultParams: accountClientParams,
+        });
+        this.bffService = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.BFF),
+            log: this.log,
+            defaultParams: accountClientParams,
+        });
+        this.sessionService = createAccountRestClient({
+            serverUrl: sessionDomain,
+            log: this.log,
+            defaultParams: {
+                client_sdrn: clientSdrn,
+                redirect_uri: this.redirectUri,
+                sdk_version: version,
+            },
+        });
+        this.globalSessionService = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SESSION_SERVICE),
+            log: this.log,
+            defaultParams: { client_sdrn: clientSdrn, sdk_version: version },
+        });
+        this.usedSessionServiceGetSessionEndpoint =
+            this.sessionService.url.pathname && this.sessionService.url.pathname.length <= 1
+                ? 'v2/session'
+                : 'session';
+
+        this._unblockSessionCall();
+    }
+
+    addEventListener(type: AccountEventName, listener: EventListener): void {
+        this.eventTarget.addEventListener(type, listener);
+    }
+
+    removeEventListener(type: AccountEventName, listener: EventListener): void {
+        this.eventTarget.removeEventListener(type, listener);
+    }
+
+    /**
+     * Read tabId from session storage
+     * @private
+     */
+    _getTabId(): number | undefined {
+        if (this.enableSessionCaching) {
+            const tabId = this.sessionStorageCache.get(TAB_ID_KEY);
+            if (typeof tabId !== 'number') {
+                this.sessionStorageCache.set(TAB_ID_KEY, TAB_ID, TAB_ID_TTL);
+                return TAB_ID;
+            }
+
+            return tabId;
+        }
+    }
+
+    /**
+     * Checks if getting session is blocked
+     * @private
+     *
+     */
+    _isSessionCallBlocked(): boolean {
+        return Boolean(this.localStorageCache.get(SESSION_CALL_BLOCKED_CACHE_KEY));
+    }
+
+    /**
+     * Block calls to get session
+     * @private
+     *
+     */
+    _blockSessionCall(): void {
+        const SESSION_CALL_BLOCKED = true;
+
+        this.localStorageCache.set(
+            SESSION_CALL_BLOCKED_CACHE_KEY,
+            SESSION_CALL_BLOCKED,
+            SESSION_CALL_BLOCKED_TTL,
+        );
+    }
+
+    /**
+     * Unblocks calls to get session
+     * @private
+     *
+     */
+    _unblockSessionCall(): void {
+        this.localStorageCache.delete(SESSION_CALL_BLOCKED_CACHE_KEY);
+    }
+
+    /**
+     * Close this.popup if it exists and is open
+     * @private
+     */
+    _closePopup(): void {
+        if (this.popup) {
+            if (!this.popup.closed) {
+                this.popup.close();
+            }
+            this.popup = null;
+        }
+    }
+
+    /**
+     * Set the Varnish cookie (`SP_ID`) when hasSession() is called. Note that most browsers require
+     * that you are on a "real domain" for this to work — so, **not** `localhost`
+     * @param options
+     * @param options.expiresIn Override this to set number of seconds before the varnish
+     * cookie expires. The default is to use the same time that hasSession responses are cached for
+     * @param options.domain Override cookie domain. E.g. «vg.no» instead of «www.vg.no»
+     */
+    enableVarnishCookie(options: VarnishCookieOptions): void {
+        if (typeof options !== 'object') {
+            throw new SDKError('VarnishCookieOptions must be an object');
+        }
+
+        const { expiresIn = 0, domain } = options;
+
+        assert(Number.isInteger(expiresIn), `'expiresIn' must be an integer`);
+        assert(expiresIn >= 0, `'expiresIn' cannot be negative`);
+        this.setVarnishCookie = true;
+        this.varnishExpiresIn = expiresIn;
+        this.varnishCookieDomain = domain;
+    }
+
+    /**
+     * Set the Varnish cookie if configured
+     * @private
+     * @param sessionData
+     */
+    _maybeSetVarnishCookie(sessionData: object): void {
+        if (!this.setVarnishCookie || !isSessionSuccessResponse(sessionData)) {
+            return;
+        }
+        const date = new Date();
+        const validExpires =
+            this.varnishExpiresIn ||
+            (typeof sessionData.expiresIn === 'number' && sessionData.expiresIn > 0);
+        if (validExpires) {
+            const expires = this.varnishExpiresIn || sessionData.expiresIn || 0;
+            date.setTime(date.getTime() + expires * 1000);
+        } else {
+            date.setTime(0);
+        }
+
+        // If the domain is missing or of the wrong type, we'll use document.domain
+        const domain =
+            this.varnishCookieDomain ||
+            (typeof sessionData.baseDomain === 'string'
+                ? sessionData.baseDomain
+                : this.window.location.hostname) ||
+            '';
+
+        const cookie = [
+            `SP_ID=${sessionData.sp_id}`,
+            `expires=${date.toUTCString()}`,
+            `path=/`,
+            `domain=.${domain}`,
+        ].join('; ');
+        document.cookie = cookie;
+    }
+
+    /**
+     * Clear the Varnish cookie if configured
+     * @private
+     */
+    _maybeClearVarnishCookie(): void {
+        if (this.setVarnishCookie) {
+            this._clearVarnishCookie();
+        }
+    }
+
+    /**
+     * Clear the Varnish cookie
+     * @private
+     */
+    _clearVarnishCookie(): void {
+        const baseDomain =
+            this.session &&
+            isSessionSuccessResponse(this.session) &&
+            typeof this.session.baseDomain === 'string'
+                ? this.session.baseDomain
+                : this.window.location.hostname;
+
+        const domain = this.varnishCookieDomain || baseDomain || '';
+
+        document.cookie = `SP_ID=nothing; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; domain=.${domain}`;
+    }
+
+    /**
+     * @summary Queries the hassession endpoint and returns information about the status of the user
+     * @remarks When we send a request to this endpoint, cookies sent along with the request
+     * determines the status of the user.
+     * @throws {SDKError} - If the call to the hasSession service fails in any way (this will happen
+     * if, say, the user is not logged in)
+     * @fires Identity#sessionUpdated
+     */
+    hasSession(): Promise<SessionResponse> {
+        const isSessionCallBlocked = this._isSessionCallBlocked();
+
+        if (isSessionCallBlocked) {
+            const sessionData = normalizeSessionResponse(this.session);
+            return Promise.resolve(isRedirectSessionPayload(sessionData) ? {} : sessionData);
+        }
+
+        if (this.hasSessionInProgress) {
+            return this.hasSessionInProgress;
+        }
+
+        let sessionChanged = false;
+        const _postProcess = (sessionData: SessionObjectResponse): SessionObjectResponse => {
+            if (isSessionFailureResponse(sessionData)) {
+                const errorObject = isObject(sessionData.error)
+                    ? sessionData.error
+                    : { description: String(sessionData.error) };
+                throw new SDKError('HasSession failed', errorObject);
+            }
+            this._maybeSetVarnishCookie(sessionData);
+            const currentSessionId = isSessionSuccessResponse(this.session) && this.session.id;
+            const incomingSessionId = isSessionSuccessResponse(sessionData) && sessionData.id;
+            sessionChanged = currentSessionId !== incomingSessionId;
+            this.session = sessionData;
+            return sessionData;
+        };
+
+        const _getCachedSession = (): NormalizedSessionPayload | null => {
+            const cachedSession = this.sessionStorageCache.get(HAS_SESSION_CACHE_KEY);
+            return cachedSession ? normalizeSessionResponse(cachedSession) : null;
+        };
+
+        const _getSession = async (): Promise<SessionResponse> => {
+            if (this.enableSessionCaching) {
+                // Try to resolve from cache (it has a TTL)
+                const cachedSession = _getCachedSession();
+                if (cachedSession) {
+                    if (isRedirectSessionPayload(cachedSession)) {
+                        return {};
+                    }
+                    return _postProcess(cachedSession);
+                }
+            }
+            let sessionData: NormalizedSessionPayload | null = null;
+            try {
+                sessionData = await this.sessionService.get(
+                    this.usedSessionServiceGetSessionEndpoint,
+                    { tabId: this._getTabId() },
+                    normalizeSessionResponse,
+                );
+            } catch (err: unknown) {
+                const cacheableError = isObject(err) ? err : undefined;
+                if (cacheableError?.code === 400 && this.enableSessionCaching) {
+                    const errorExpiresIn =
+                        typeof cacheableError.expiresIn === 'number'
+                            ? cacheableError.expiresIn
+                            : 300;
+                    const expiresIn = 1000 * errorExpiresIn;
+                    this.sessionStorageCache.set(HAS_SESSION_CACHE_KEY, { error: err }, expiresIn);
+                } else if (
+                    cacheableError &&
+                    typeof cacheableError.code === 'number' &&
+                    cacheableError.code >= 500 &&
+                    cacheableError.code < 600 &&
+                    this.enableSessionCaching
+                ) {
+                    // Temporary fix: 30 seconds cache to limit number of calls when service is unavailable
+                    this.sessionStorageCache.set(HAS_SESSION_CACHE_KEY, { error: err }, 30 * 1000);
+                }
+                throw err;
+            }
+
+            if (sessionData) {
+                // for expiring session and safari browser do full page redirect to gain new session
+                if (isRedirectSessionPayload(sessionData)) {
+                    this._blockSessionCall();
+
+                    await this.callbackBeforeRedirect();
+
+                    const redirectUrl = this.sessionService.makeUrl(sessionData.redirectURL, {
+                        tabId: this._getTabId(),
+                    });
+                    return redirectUrl;
+                }
+
+                if (this.enableSessionCaching) {
+                    const expiresIn =
+                        1000 *
+                        (isSessionSuccessResponse(sessionData)
+                            ? sessionData.expiresIn || 300
+                            : 300);
+                    this.sessionStorageCache.set(HAS_SESSION_CACHE_KEY, sessionData, expiresIn);
+                }
+            }
+
+            return _postProcess(sessionData ?? {});
+        };
+        this.hasSessionInProgress = _getSession().then(
+            (sessionData) => {
+                if (sessionChanged && typeof sessionData !== 'string') {
+                    this.eventTarget.dispatchEvent(
+                        new CustomEvent('sessionUpdated', { detail: sessionData }),
+                    );
+                }
+                this.hasSessionInProgress = false;
+                if (typeof sessionData === 'string') {
+                    this.window.location.href = sessionData;
+                }
+                return sessionData;
+            },
+            (err) => {
+                this.hasSessionInProgress = false;
+                throw new SDKError('HasSession failed', err);
+            },
+        );
+
+        return this.hasSessionInProgress;
+    }
+
+    /**
+     * @summary Allows the client app to check if the user is logged in to Schibsted account
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     */
+    async isLoggedIn(): Promise<boolean> {
+        try {
+            const data = await this.hasSession();
+            return isSessionSuccessResponse(data);
+        } catch (_) {
+            return false;
+        }
+    }
+
+    /**
+     * Enables or disables caching for subsequent session lookups.
+     *
+     * Changing this setting does not remove an existing cached session. Use
+     * {@link Identity#clearCachedUserSession} to clear the cache explicitly.
+     */
+    setSessionCachingEnabled(enabled: boolean): void {
+        this.enableSessionCaching = enabled;
+    }
+
+    /**
+     * Removes the cached user session.
+     */
+    clearCachedUserSession(): void {
+        this.sessionStorageCache.delete(HAS_SESSION_CACHE_KEY);
+    }
+
+    /**
+     * @summary Allows the caller to check if the current user is connected to the client_id in
+     * Schibsted account. Being connected means that the user has agreed for their account to be
+     * used by your web app and have accepted the required terms
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @summary Check if the user is connected to the client_id
+     */
+    async isConnected(): Promise<boolean> {
+        try {
+            return isConnectedSessionResponse(await this.hasSession());
+        } catch (_) {
+            return false;
+        }
+    }
+
+    /**
+     * @summary Returns information about the user
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the user isn't connected to the merchant
+     * @throws {SDKError} If we couldn't get the user
+     */
+    async getUser(): Promise<ConnectedSessionResponse> {
+        const user = await this.hasSession();
+        if (!isConnectedSessionResponse(user)) {
+            throw new SDKError('The user is not connected to this merchant');
+        }
+        return cloneDeep(user);
+    }
+    /**
+     * @summary
+     * In Schibsted account, there are multiple ways of identifying a user; the `userId` or `uuid`.
+     * There are reasons for them all to exist. The `userId` is a numeric identifier, but
+     * since Schibsted account is deployed separately in Norway and Sweden, there are a lot of
+     * duplicates. The `userId` was introduced early, so many sites still need to use them for
+     * legacy reasons. The `uuid` is universally unique, and so — if we could disregard a lot of
+     * Schibsted components depending on the numeric `userId` — it would be a good identifier to use
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the user isn't connected to the merchant
+     * @return The `userId` field (not to be confused with the `uuid`)
+     */
+    async getUserId(): Promise<number> {
+        const user = await this.hasSession();
+        if (isConnectedSessionWithUserIdResponse(user)) {
+            return user.userId;
+        }
+        throw new SDKError('The user is not connected to this merchant');
+    }
+
+    /**
+     * @function
+     * @summary
+     * Retrieves the external identifier (`externalId`) for the authenticated user.
+     *
+     * In Schibsted Account there are multiple ways of identifying users, however for integrations with
+     * third-parties it's recommended to use `externalId` as it does not disclose
+     * any critical data whilst allowing for user identification.
+     *
+     * `externalId` is merchant-scoped using a pairwise identifier (`pairId`),
+     * meaning the same user's ID will differ between merchants.
+     * Additionally, this identifier is bound to the external party provided as argument.
+     *
+     * @param externalParty
+     * @param optionalSuffix
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the `pairId` is missing in user session.
+     * @throws {SDKError} If the `externalParty` is not defined
+     * @return The merchant- and 3rd-party-specific `externalId`
+     */
+    async getExternalId(externalParty: string, optionalSuffix: string = ''): Promise<string> {
+        const user = await this.hasSession();
+        const pairId = isSessionSuccessResponse(user) ? user.pairId : undefined;
+
+        if (!pairId) throw new SDKError('pairId missing in user session!');
+
+        if (!externalParty || externalParty.length === 0) {
+            throw new SDKError('externalParty cannot be empty');
+        }
+        const _toHexDigest = (hashBuffer: ArrayBuffer) => {
+            // convert buffer to byte array
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            // convert bytes to hex string
+            return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+        };
+
+        const _getSha256Digest = (data: BufferSource) => {
+            return crypto.subtle.digest('SHA-256', data);
+        };
+
+        const _hashMessage = async (message: string) => {
+            const msgUint8 = new TextEncoder().encode(message);
+            return _getSha256Digest(msgUint8).then((it) => _toHexDigest(it));
+        };
+
+        const _constructMessage = (
+            pairId: string,
+            externalParty: string,
+            optionalSuffix: string,
+        ) => {
+            return optionalSuffix
+                ? `${pairId}:${externalParty}:${optionalSuffix}`
+                : `${pairId}:${externalParty}`;
+        };
+
+        return _hashMessage(_constructMessage(pairId, externalParty, optionalSuffix));
+    }
+
+    /**
+     * @summary Enables brands to programmatically get the current the SDRN based on the user's session.
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the SDRN is missing in user session object.
+     */
+    async getUserSDRN(): Promise<string> {
+        const user = await this.hasSession();
+        if (isSessionSuccessResponse(user) && user.sdrn) {
+            return user.sdrn;
+        }
+        throw new SDKError('Failed to get SDRN from user session');
+    }
+
+    /**
+     * @summary In Schibsted account, there are two ways of identifying a user; the `userId` and the
+     * `uuid`. There are reasons for them both existing. The `userId` is a numeric identifier, but
+     * since Schibsted account is deployed separately in Norway and Sweden, there are a lot of
+     * duplicates. The `userId` was introduced early, so many sites still need to use them for
+     * legacy reasons. The `uuid` is universally unique, and so — if we could disregard a lot of
+     * Schibsted components depending on the numeric `userId` — it would be a good identifier to use
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the user isn't connected to the merchant
+     * @return The `uuid` field (not to be confused with the `userId`)
+     */
+    async getUserUuid(): Promise<string> {
+        const user = await this.hasSession();
+        if (isSessionSuccessResponse(user) && user.uuid && user.result) {
+            return user.uuid;
+        }
+        throw new SDKError('The user is not connected to this merchant');
+    }
+
+    /**
+     * @summary Get basic information about any user currently logged-in to their Schibsted account
+     * in this browser. Can be used to provide context in a continue-as prompt.
+     * @remarks This function relies on the global Schibsted account user session cookie, which
+     * is a third-party cookie and hence might be blocked by the browser (for example due to ITP in
+     * Safari). So there's no guarantee any data is returned, even though a user is logged-in in
+     * the current browser.
+     */
+    async getUserContextData(): Promise<SimplifiedLoginData | null> {
+        try {
+            return await this.globalSessionService.get('user-context', undefined, (value) =>
+                isObject(value) && isStr(value.identifier)
+                    ? {
+                          identifier: value.identifier,
+                          display_text: isStr(value.display_text) ? value.display_text : '',
+                          client_name: isStr(value.client_name) ? value.client_name : '',
+                          provider_id: isStr(value.provider_id) ? value.provider_id : undefined,
+                      }
+                    : null,
+            );
+        } catch (_) {
+            return null;
+        }
+    }
+
+    /**
+     * If a popup is desired, this function needs to be called in response to a user event (like
+     * click or tap) in order to work correctly. Otherwise the popup will be blocked by the
+     * browser's popup blockers and has to be explicitly authorized to be shown.
+     * @summary Perform a login, either using a full-page redirect or a popup
+     * @see https://tools.ietf.org/html/rfc6749#section-4.1.1
+     *
+     * @param options
+     * @param options.state
+     * @param options.acrValues
+     * @param options.scope
+     * @param options.redirectUri
+     * @param options.preferPopup
+     * @param options.loginHint
+     * @param options.tag
+     * @param options.teaser
+     * @param options.maxAge
+     * @param options.locale
+     * @param options.oneStepLogin
+     * @param options.prompt
+     * @param options.xDomainId
+     * @param options.xEnvironmentId
+     * @param options.originCampaign
+     * @fires Identity#loginRequested
+     * @return - Reference to popup window if created (or `null` otherwise)
+     */
+    login({
+        state,
+        acrValues,
+        scope = 'openid',
+        redirectUri = this.redirectUri,
+        preferPopup = false,
+        loginHint = '',
+        tag = '',
+        teaser = '',
+        maxAge = '',
+        locale,
+        oneStepLogin = false,
+        prompt = 'select_account',
+        xDomainId = '',
+        xEnvironmentId = '',
+        originCampaign = '',
+    }: LoginOptions): Window | null {
+        this._closePopup();
+        this.sessionStorageCache.delete(HAS_SESSION_CACHE_KEY);
+        const url = this.loginUrl({
+            state,
+            acrValues,
+            scope,
+            redirectUri,
+            loginHint,
+            tag,
+            teaser,
+            maxAge,
+            locale,
+            oneStepLogin,
+            prompt,
+            xDomainId,
+            xEnvironmentId,
+            originCampaign,
+        });
+
+        if (preferPopup) {
+            this.popup = popup.open(this.window, url, 'Schibsted account', {
+                width: 360,
+                height: 570,
+            });
+
+            if (this.popup) {
+                this.eventTarget.dispatchEvent(
+                    new CustomEvent('loginRequested', {
+                        detail: { url, method: 'popup' },
+                    }),
+                );
+
+                return this.popup;
+            }
+        }
+
+        this.eventTarget.dispatchEvent(
+            new CustomEvent('loginRequested', {
+                detail: { url, method: 'default' },
+            }),
+        );
+        this.window.location.href = url;
+
+        return null;
+    }
+
+    /**
+     * @summary Retrieve the sp_id (Varnish ID)
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @return - The sp_id string or null (if the server didn't return it)
+     */
+    async getSpId(): Promise<string | null> {
+        try {
+            const user = await this.hasSession();
+            if (isSessionSuccessResponse(user)) {
+                return user.sp_id || null;
+            }
+            const spId = isObject(user) && 'sp_id' in user ? user.sp_id : undefined;
+            return isStr(spId) ? spId : null;
+        } catch (_) {
+            return null;
+        }
+    }
+
+    /**
+     * @summary Logs the user out from the Identity platform
+     * @param redirectUri - Where to redirect the browser after logging out of Schibsted account
+     * @fires Identity#logoutRequested
+     */
+    logout(redirectUri: string = this.redirectUri): void {
+        this.sessionStorageCache.delete(HAS_SESSION_CACHE_KEY);
+        this._maybeClearVarnishCookie();
+        const url = this.logoutUrl(redirectUri);
+        this.eventTarget.dispatchEvent(
+            new CustomEvent('logoutRequested', {
+                detail: { url },
+            }),
+        );
+        this.window.location.href = url;
+    }
+
+    /**
+     * Generates the link to the new login page that'll be used in the popup or redirect flow
+     * @param options
+     * @param options.state
+     * @param options.acrValues
+     * @param options.scope
+     * @param options.redirectUri
+     * @param options.loginHint
+     * @param options.tag
+     * @param options.teaser
+     * @param options.maxAge
+     * @param options.locale
+     * @param options.oneStepLogin
+     * @param options.prompt
+     * @param options.xDomainId
+     * @param options.xEnvironmentId
+     * @param options.originCampaign
+     * @return - The url
+     */
+    loginUrl({
+        state,
+        acrValues = '',
+        scope = 'openid',
+        redirectUri = this.redirectUri,
+        loginHint = '',
+        tag = '',
+        teaser = '',
+        maxAge = '',
+        locale,
+        oneStepLogin = false,
+        prompt = 'select_account',
+        xDomainId = '',
+        xEnvironmentId = '',
+        originCampaign = '',
+    }: LoginOptions): string {
+        const isValidAcrValue = (acrValue: string) =>
+            isStrIn(
+                acrValue,
+                ['password', 'otp', 'sms', 'eid-dk', 'eid-no', 'eid-se', 'eid-fi', 'eid'],
+                true,
+            );
+        assert(
+            !acrValues ||
+                isStrIn(acrValues, ['', 'otp-email'], true) ||
+                acrValues.split(' ').every(isValidAcrValue),
+            `The acrValues parameter is not acceptable: ${acrValues}`,
+        );
+        assert(
+            isUrl(redirectUri),
+            `loginUrl(): redirectUri must be a valid url but is ${redirectUri}`,
+        );
+        assert(
+            isNonEmptyString(state),
+            `the state parameter should be a non empty string but it is ${state}`,
+        );
+
+        return this.oauthService.makeUrl('oauth/authorize', {
+            response_type: 'code',
+            redirect_uri: redirectUri,
+            scope,
+            state,
+            acr_values: acrValues,
+            login_hint: loginHint,
+            tag,
+            teaser,
+            max_age: maxAge,
+            locale,
+            one_step_login: oneStepLogin || '',
+            prompt: acrValues ? '' : prompt,
+            x_domain_id: xDomainId,
+            x_env_id: xEnvironmentId,
+            utm_campaign: originCampaign,
+        });
+    }
+
+    /**
+     * The url for logging the user out
+     * @param redirectUri
+     * @return url
+     */
+    logoutUrl(redirectUri: string = this.redirectUri): string {
+        assert(isUrl(redirectUri), `logoutUrl(): redirectUri is invalid`);
+        const params = { redirect_uri: redirectUri };
+        return this.sessionService.makeUrl('logout', params);
+    }
+
+    /**
+     * The account summary page url
+     * @param redirectUri
+     */
+    accountUrl(redirectUri: string = this.redirectUri): string {
+        return this.spid.makeUrl('profile-pages', {
+            response_type: 'code',
+            redirect_uri: redirectUri,
+        });
+    }
+
+    /**
+     * Function responsible for loading and displaying simplified login widget. How often
+     * widget will be display is up to you. Preferred way would be to show it once per user,
+     * and store that info in localStorage. Widget will be display only if user is logged in to SSO.
+     *
+     * @param loginParams - the same as `options` param for login function. Login will be called on user
+     * continue action. `state` might be string or async function.
+     * @param options - additional configuration of Simplified Login Widget
+     * @fires Identity#simplifiedLoginOpened
+     * @fires Identity#simplifiedLoginCancelled
+     * @throws {SDKError} - If user context data is missing or the widget script cannot be loaded
+     * @return - will resolve to true if widget will be displayed
+     */
+    async showSimplifiedLoginWidget(
+        loginParams: SimplifiedLoginWidgetLoginOptions,
+        options?: SimplifiedLoginWidgetOptions,
+    ): Promise<boolean> {
+        // getUserContextData doesn't throw exception
+        const userData = await this.getUserContextData();
+
+        const queryParams: Record<string, string> = { client_id: this.clientId };
+        if (options && options.encoding) {
+            queryParams.encoding = options.encoding;
+        }
+        const widgetUrl = this.bffService.makeUrl('simplified-login-widget', queryParams, false);
+
+        const prepareLoginParams = async (
+            loginParams: SimplifiedLoginWidgetLoginOptions,
+        ): Promise<LoginOptions> => {
+            const state =
+                typeof loginParams.state === 'function'
+                    ? await loginParams.state()
+                    : loginParams.state;
+
+            return {
+                ...loginParams,
+                state,
+            };
+        };
+
+        return new Promise<boolean>((resolve, reject) => {
+            if (!userData?.display_text || !userData.identifier) {
+                reject(new SDKError('Missing user data'));
+                return;
+            }
+
+            const initialParams: SimplifiedLoginWidgetInitialParams = {
+                displayText: userData.display_text,
+                env: this.env,
+                clientName: userData.client_name || '',
+                clientId: this.clientId,
+                providerId: userData.provider_id,
+                windowWidth: () => window.innerWidth,
+                windowOnResize: (f: () => void) => {
+                    window.onresize = f;
+                },
+            };
+
+            if (options && options.locale) {
+                initialParams.locale = options.locale;
+            }
+
+            const loginHandler = async () => {
+                this.login(
+                    Object.assign(await prepareLoginParams(loginParams), {
+                        loginHint: userData.identifier,
+                    }) as LoginOptions,
+                );
+            };
+
+            const loginNotYouHandler = async () => {
+                this.login(
+                    Object.assign(await prepareLoginParams(loginParams), {
+                        loginHint: userData.identifier,
+                        prompt: 'login',
+                    }) as LoginOptions,
+                );
+            };
+
+            const initHandler = () => {
+                /**
+                 * Emitted when the simplified login widget is displayed on the screen
+                 * @event Identity#simplifiedLoginOpened
+                 */
+                this.eventTarget.dispatchEvent(new Event('simplifiedLoginOpened'));
+            };
+
+            const cancelLoginHandler = () => {
+                this.eventTarget.dispatchEvent(new Event('simplifiedLoginCancelled'));
+            };
+
+            if (hasOpenSimplifiedLoginWidget(window)) {
+                window.openSimplifiedLoginWidget(
+                    initialParams,
+                    loginHandler,
+                    loginNotYouHandler,
+                    initHandler,
+                    cancelLoginHandler,
+                );
+                return resolve(true);
+            }
+
+            const simplifiedLoginWidget = document.createElement('script');
+            simplifiedLoginWidget.type = 'text/javascript';
+            simplifiedLoginWidget.src = widgetUrl;
+            simplifiedLoginWidget.onload = () => {
+                if (!hasOpenSimplifiedLoginWidget(window)) {
+                    reject(new SDKError('Error when loading simplified login widget content'));
+                    return;
+                }
+                window.openSimplifiedLoginWidget(
+                    initialParams,
+                    loginHandler,
+                    loginNotYouHandler,
+                    initHandler,
+                    cancelLoginHandler,
+                );
+                resolve(true);
+            };
+            simplifiedLoginWidget.onerror = () => {
+                reject(new SDKError('Error when loading simplified login widget content'));
+            };
+            document.getElementsByTagName('body')[0].appendChild(simplifiedLoginWidget);
+        });
+    }
+}
+
+export default Identity;