@schibsted/account-sdk-browser 5.2.7 → 6.0.0-alpha.10

package/src/index.ts

@@ -0,0 +1,40 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+export { Account } from './account.js';
+export { createAccountSdk, getAccountSdk } from './account-sdk.js';
+export * from './globals.js';
+export { default as SDKError } from './sdk-error.js';
+
+/** session response type guards */
+export {
+    isConnectedSessionResponse,
+    isConnectedSessionWithUserIdResponse,
+    isSessionFailureResponse,
+    isSessionSuccessResponse,
+} from './session-response.js';
+
+/* public available types */
+export type {
+    AccountConfig,
+    AccountEventListener,
+    AccountEventName,
+} from './types/account.js';
+export type { AccountEnvironment, LogFunction } from './types/common.js';
+export type {
+    LoginOptions,
+    SimplifiedLoginData,
+    SimplifiedLoginWidgetLoginOptions,
+    SimplifiedLoginWidgetOptions,
+} from './types/login.js';
+export type { HasAccessResult } from './types/monetization.js';
+export type {
+    ConnectedSessionResponse,
+    ConnectedSessionWithUserIdResponse,
+    RedirectSessionResponse,
+    SessionFailureResponse,
+    SessionResponse,
+    SessionSuccessResponse,
+    SessionUserId,
+} from './types/session.js';

package/src/monetization.ts

@@ -0,0 +1,128 @@
+/* Copyright 2024 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import Cache from './cache.js';
+import { parseHasAccessResult } from './has-access-response.js';
+import type RESTClient from './rest-client.js';
+import { buildClientSdrn, createAccountRestClient } from './rest-clients.js';
+import SDKError from './sdk-error.js';
+import * as spidTalk from './spid-talk.js';
+import type { HasAccessResult, MonetizationOptions } from './types/monetization.js';
+import type { SessionUserId } from './types/session.js';
+import { assert, isNonEmptyString, isStr, isUrl } from './validate.js';
+import version from './version.js';
+
+const globalWindow = () => window;
+
+/**
+ * Provides features related to monetization
+ */
+export class Monetization {
+    private readonly cache: Cache;
+    private readonly sessionService?: RESTClient;
+    private readonly pendingHasAccessRequests: Record<string, Promise<HasAccessResult>>;
+
+    /**
+     * @param options - Monetization configuration
+     * @throws {SDKError} - If any of options are invalid
+     */
+    constructor({
+        clientId,
+        redirectUri,
+        env = 'PRE',
+        sessionDomain,
+        window = globalWindow(),
+    }: MonetizationOptions) {
+        spidTalk.emulate(window);
+        assert(isNonEmptyString(clientId), 'clientId parameter is required');
+        assert(isStr(env), `env parameter is invalid: ${env}`);
+        const clientSdrn = buildClientSdrn(env, clientId);
+
+        this.cache = new Cache(() => window && window.sessionStorage);
+        this.pendingHasAccessRequests = {};
+
+        if (sessionDomain) {
+            assert(isUrl(sessionDomain), 'sessionDomain parameter is not a valid URL');
+            this.sessionService = createAccountRestClient({
+                serverUrl: sessionDomain,
+                defaultParams: {
+                    client_sdrn: clientSdrn,
+                    redirect_uri: redirectUri,
+                    sdk_version: version,
+                },
+            });
+        }
+    }
+
+    /**
+     * Checks if the user has access to a set of products or features.
+     * @param productIds - which products/features to check
+     * @param userId - id of currently logged in user
+     * @throws {SDKError} - If the input is incorrect, or a network call fails in any way
+     * (this will happen if, say, the user is not logged in)
+     * @returns The data object returned from Schibsted account (or `null` if the user
+     * doesn't have access to any of the given products/features)
+     */
+    async hasAccess(productIds: string[], userId: SessionUserId): Promise<HasAccessResult | null> {
+        if (!this.sessionService) {
+            throw new SDKError(`hasAccess can only be called if 'sessionDomain' is configured`);
+        }
+        if (!userId) {
+            throw new SDKError(`'userId' must be specified`);
+        }
+        if (!Array.isArray(productIds)) {
+            throw new SDKError(`'productIds' must be an array`);
+        }
+
+        const sortedIds = [...productIds].sort();
+        const cacheKey = this.accessCacheKey(sortedIds, userId);
+        let data = this.cache.get(cacheKey) as HasAccessResult | null;
+        if (!data) {
+            if (!this.pendingHasAccessRequests[cacheKey]) {
+                this.pendingHasAccessRequests[cacheKey] = this.sessionService.get(
+                    `/hasAccess/${sortedIds.join(',')}`,
+                    undefined,
+                    parseHasAccessResult,
+                );
+            }
+            const promise = this.pendingHasAccessRequests[cacheKey];
+            try {
+                data = await promise;
+                const expiresSeconds = data.ttl;
+                this.cache.set(cacheKey, data, expiresSeconds * 1000);
+            } finally {
+                if (this.pendingHasAccessRequests[cacheKey] === promise) {
+                    delete this.pendingHasAccessRequests[cacheKey];
+                }
+            }
+        }
+
+        if (!data.entitled) {
+            return null;
+        }
+
+        return data;
+    }
+
+    /**
+     * Removes the cached access result.
+     * @param productIds - which products/features to check
+     * @param userId - id of currently logged in user
+     */
+    clearCachedAccessResult(productIds: string[], userId: SessionUserId): void {
+        this.cache.delete(this.accessCacheKey(productIds, userId));
+    }
+
+    /**
+     * Compute "has access" cache key for the given product ids and user id.
+     * @private
+     * @param productIds - which products/features to check
+     * @param userId - id of currently logged in user
+     */
+    private accessCacheKey(productIds: string[], userId: SessionUserId): string {
+        return `prd_${[...productIds].sort()}_${userId}`;
+    }
+}
+
+export default Monetization;

package/src/{object.js → object.ts}

@@ -2,41 +2,36 @@
  * See LICENSE.md in the project root.
  */
 
-'use strict';
-
 /**
  * @summary Some routines that work on javascript objects
  * @private
  */
 
-import { assert, isObject, isNonEmptyObj } from './validate.js';
-import SDKError from './SDKError.js';
+import SDKError from './sdk-error.js';
+import { assert, isNonEmptyObj, isObject } from './validate.js';
 
 /**
  * Similar to Object.assign({}, src) but only clones the keys of an object that have non-undefined
  * values.
  * Please note that the values in the rightmost parameters can overwrite the values of the earlier
  * parameters so the order of the parameters matters.
- * @memberof core
  * @example
  * cloneDefined({foo: 1, bar: 2}, {foo: 2}) // returns {foo: 2, bar: 2}
  *
- * @param {object} sources - one or more sources. Their defined properties will override the ones
+ * @param sources - one or more sources. Their defined properties will override the ones
  *        that came before it. For example if `source1.foo = 'bar'` and `source2.foo = 'baz'`, the
  *        result will include `{ foo: 'baz' }`
- * @return {object} a new object that is similar to src with all the key/values where the
- *         keys for undefined values are removed.
  */
-export function cloneDefined(...sources) {
-    const result = {};
+export function cloneDefined(...sources: object[]): Record<string, unknown> {
+    const result: Record<string, unknown> = {};
     if (!(sources && sources.length)) {
         throw new SDKError('No objects to clone');
     }
-    sources.forEach(source => {
+    sources.forEach((source) => {
         assert(isObject(source));
         if (isNonEmptyObj(source)) {
             Object.entries(source).forEach(([key, value]) => {
-                if (typeof value !== 'undefined' ) {
+                if (typeof value !== 'undefined') {
                     result[key] = isObject(value) ? cloneDeep(value) : value;
                 }
             });
@@ -47,13 +42,11 @@ export function cloneDefined(...sources) {
 
 /**
  * Deep copies an object. This is handy for immutability.
- * @memberof core
- * @param {object} obj - An object, array or null.
- * @return {object} - an exact copy of the object but deep copied
+ * @param obj - An object, array or null.
  * @throws {SDKError} - if the obj is not an accepted type or is not
  *         stringifiable by JSON for example if it has loops
  */
-export function cloneDeep(obj) {
+export function cloneDeep<T extends object | null>(obj: T): T {
     assert(typeof obj === 'object', `obj should be an object (even null) but it is ${obj}`);
     return JSON.parse(JSON.stringify(obj)) || obj;
 }

package/src/popup.ts

@@ -0,0 +1,74 @@
+/* Copyright 2024 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { cloneDefined } from './object.js';
+import { assert, isFunction, isObject, isUrl } from './validate.js';
+
+/**
+ * Serializes an object to string.
+ * @private
+ * @param obj - for example {a: 'b', c: 1}
+ */
+function serialize(obj: Record<string, unknown>): string {
+    assert(isObject(obj), `Object must be an object but it is '${obj}'`);
+    return Object.keys(obj)
+        .map((key) => `${key}=${obj[key]}`)
+        .join(',');
+}
+
+const defaultWindowFeatures = {
+    scrollbars: 'yes',
+    location: 'yes',
+    status: 'no',
+    menubar: 'no',
+    toolbar: 'no',
+    resizable: 'yes',
+};
+
+/**
+ * Opens a popup
+ * @param parentWindow - A reference to the window that will open the popup
+ * @param url - The URL that the popup will open
+ * @param windowName - A name for the window
+ * @param windowFeatures - Window features for the popup (default ones are usually ok)
+ * @private
+ */
+export function open(
+    parentWindow: Window,
+    url: string,
+    windowName = '',
+    windowFeatures: Record<string, string | number> = {},
+): Window | null {
+    assert(isObject(parentWindow), `window was supposed to be an object but it is ${parentWindow}`);
+    assert(
+        isObject(parentWindow.screen),
+        `window should be a valid Window object but it lacks a 'screen' property`,
+    );
+    assert(
+        isFunction(parentWindow.open),
+        `window should be a valid Window object but it lacks an 'open' function`,
+    );
+    assert(isUrl(url), 'Invalid URL for popup');
+
+    const { height, width } = parentWindow.screen;
+
+    const mergedFeatures = cloneDefined(defaultWindowFeatures, windowFeatures);
+    const { width: featureWidth, height: featureHeight } = mergedFeatures;
+    if (
+        typeof featureWidth === 'number' &&
+        Number.isFinite(featureWidth) &&
+        Number.isFinite(width)
+    ) {
+        mergedFeatures.left = (width - featureWidth) / 2;
+    }
+    if (
+        typeof featureHeight === 'number' &&
+        Number.isFinite(featureHeight) &&
+        Number.isFinite(height)
+    ) {
+        mergedFeatures.top = (height - featureHeight) / 2;
+    }
+    const features = serialize(mergedFeatures);
+    return parentWindow.open(url, windowName, features);
+}

package/src/resolve-browser-window.ts

@@ -0,0 +1,11 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+export const resolveBrowserWindow = (providedWindow?: Window): Window | undefined => {
+    if (providedWindow) {
+        return providedWindow;
+    }
+
+    return typeof window === 'undefined' ? undefined : window;
+};

package/src/rest-client.ts

@@ -0,0 +1,253 @@
+/* Copyright 2024 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { cloneDefined } from './object.js';
+import SDKError from './sdk-error.js';
+import type { LogFunction } from './types/common.js';
+import { urlMapper } from './url.js';
+import { assert, isFunction, isNonEmptyString, isObject, isStr } from './validate.js';
+
+/**
+ * Converts a series of parameters of various types to a string that's suitable for logging.
+ * @private
+ * @param msg - The values to format; objects are stringified to JSON
+ */
+const logString = (msg: unknown[]): string =>
+    msg.map((m) => (isObject(m) ? JSON.stringify(m, null, 2) : m)).join(' ');
+
+const logFn = (fn: LogFunction | undefined, ...msg: unknown[]): void => {
+    if (fn) {
+        fn(logString(msg));
+    }
+};
+
+/**
+ * Encode a string like URLSearchParams would do
+ * @private
+ * @param str - The input
+ */
+function encode(str: string): string {
+    const replace: Record<string, string> = {
+        '!': '%21',
+        "'": '%27',
+        '(': '%28',
+        ')': '%29',
+        '~': '%7E',
+        '%20': '+',
+        '%00': '\x00',
+    };
+    return encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, (match) => replace[match]);
+}
+type FetchFunction = (input: RequestInfo, init?: RequestInit) => Promise<Response>;
+const globalFetch = () => window.fetch && window.fetch.bind(window);
+const noFetch: FetchFunction = () => {
+    throw new SDKError('fetch is not available in this environment');
+};
+
+/**
+ * The value of a single query parameter; `undefined` entries are skipped.
+ */
+type QueryValue = string | number | boolean | undefined;
+
+/**
+ * Query parameters appended to a request URL.
+ */
+type QueryParams = Record<string, QueryValue>;
+
+/**
+ * HTTP method used for a request.
+ */
+type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };
+
+type ResponseParser<T> = (value: JsonValue) => T;
+
+type RESTRequestOptions<T = JsonValue> = {
+    method: HttpMethod;
+    pathname: string;
+    data?: QueryParams;
+    headers?: Record<string, string>;
+    useDefaultParams?: boolean;
+    fetchOptions?: RequestInit;
+    parseResponse?: ResponseParser<T>;
+};
+
+/**
+ * This class can be used for creating a wrapper around a server and all its endpoints.
+ * Its functionality is extended by {@link JSONPClient}
+ * Creates a client to a REST server. While useful stand-alone, it's also used for some other
+ * types of client that change some functionalities.
+ * @throws {SDKError} - If any of options are invalid
+ * @summary The simplest way to communicate to a REST endpoint without any
+ *          special authentication
+ * @private
+ */
+export class RESTClient {
+    url: URL;
+    defaultParams: QueryParams;
+    log?: LogFunction;
+    fetch: FetchFunction;
+
+    /**
+     * @param options
+     * @param options.serverUrl - The URL to the server eg.
+     * https://login.schibsted.com or a URL key like 'DEV' in combination with {@link envDic}.
+     * @param options.envDic - A dictionary that will be used for looking up
+     * {@link serverUrl} keys. If serverUrl is always a URL, you don't need this.
+     * @param options.fetch - The fetch function to use. It can be native
+     * or a polyfill
+     * @param options.log - A function that will be called with log messages about
+     * request and response
+     * @param options.defaultParams - Query parameters added to every request
+     */
+    constructor({
+        serverUrl = 'PRE',
+        envDic,
+        fetch = globalFetch() ?? noFetch,
+        log,
+        defaultParams = {},
+    }: {
+        serverUrl?: string;
+        envDic?: Record<string, string>;
+        fetch?: FetchFunction;
+        log?: LogFunction;
+        defaultParams?: QueryParams;
+    }) {
+        assert(isObject(defaultParams), `defaultParams should be a non-null object`);
+
+        const mappedUrl = urlMapper(serverUrl, envDic ?? {});
+        const handledServerUrl = mappedUrl.endsWith('/') ? mappedUrl : `${mappedUrl}/`;
+        this.url = new URL(handledServerUrl);
+
+        this.defaultParams = defaultParams;
+
+        if (log) {
+            assert(isFunction(log), `log must be a function but it is ${log}`);
+            this.log = log;
+        }
+
+        this.fetch = fetch;
+    }
+
+    /**
+     * Makes the actual call to the server and deals with headers, data objects and the edge cases.
+     * Please note that this method expects the response to be in JSON format. However, it'll not
+     * parse the response if its code is not in the 200 range.
+     * @param options - An obligatory options object
+     * @param options.method - The HTTP request method, e.g. 'GET' or 'POST'
+     * @param options.pathname - The path to the endpoint like 'api/2/endpoint-name'
+     * @param options.data - Query parameters added to the request URL
+     * @param options.headers - Request headers as a plain key/value map
+     * @param options.useDefaultParams - Should we add the defaultParams to the query?
+     * @param options.fetchOptions - Additional fetch options
+     * @throws {SDKError} - If the call can't be made for whatever reason.
+     */
+    // Overloads describe the two supported modes:
+    // - without a parser: return the parsed JSON response as-is;
+    // - with a parser: return the parser's typed result.
+    async go(options: RESTRequestOptions): Promise<JsonValue>;
+    async go<T>(options: RESTRequestOptions<T> & { parseResponse: ResponseParser<T> }): Promise<T>;
+
+    // TypeScript requires one implementation signature for the overloads above.
+    async go<T = JsonValue>(options: RESTRequestOptions<T>): Promise<JsonValue | T> {
+        const {
+            method,
+            headers,
+            pathname,
+            data = {},
+            useDefaultParams = true,
+            fetchOptions = { method: options.method, credentials: 'include' },
+            parseResponse,
+        } = options;
+        assert(isNonEmptyString(method), `Method must be a non empty string but it is "${method}"`);
+        assert(isNonEmptyString(pathname), `Pathname must be string but it is "${pathname}"`);
+        assert(isObject(data), `data must be a non-null object`);
+
+        fetchOptions.headers = isObject(headers) ? headers : {};
+        const fullUrl = this.makeUrl(pathname, data, useDefaultParams);
+
+        logFn(this.log, 'Request:', method.toUpperCase(), fullUrl);
+        logFn(this.log, 'Request Headers:', fetchOptions.headers);
+        logFn(this.log, 'Request Body:', fetchOptions.body);
+        try {
+            const response = await this.fetch(fullUrl, fetchOptions);
+            logFn(this.log, 'Response Code:', response.status, response.statusText);
+            if (!response.ok) {
+                // status code not in range 200-299
+                throw new SDKError(response.statusText, { code: response.status });
+            }
+            const responseObject: JsonValue = await response.json();
+            logFn(this.log, 'Response Parsed:', responseObject);
+            return parseResponse ? parseResponse(responseObject) : responseObject;
+        } catch (err: unknown) {
+            let msg = isStr(err) ? err : 'Unknown RESTClient error';
+            if (isObject(err) && isStr(err.message)) {
+                msg = err.message;
+            }
+            const errorObject = isObject(err) ? err : undefined;
+            throw new SDKError(`Failed to '${method}' '${fullUrl}': '${msg}'`, errorObject);
+        }
+    }
+
+    /**
+     * Creates a url that points to an endpoint in the server
+     * @param pathname - WHATWG pathname ie. 'api/2/endpoint-name'
+     * @param query - Query parameters to serialize into the query string
+     * @param useDefaultParams - Should we add the defaultParams to the query?
+     */
+    makeUrl(pathname = '', query: QueryParams = {}, useDefaultParams = true): string {
+        const handledPathname = pathname.startsWith('/') ? pathname.slice(1) : pathname;
+
+        const url = new URL(handledPathname, this.url);
+        url.search = RESTClient.search(query, useDefaultParams, this.defaultParams);
+        return url.href;
+    }
+
+    /**
+     * Make a GET request
+     * @param pathname - WHATWG pathname ie. 'api/2/endpoint-name'
+     * @param data - Query parameters
+     */
+    // Mirrors `go()` overloads for the common GET helper.
+    get(pathname: string, data?: QueryParams): Promise<JsonValue>;
+    get<T>(
+        pathname: string,
+        data: QueryParams | undefined,
+        parseResponse: ResponseParser<T>,
+    ): Promise<T>;
+
+    // TypeScript requires one implementation signature for the overloads above.
+    get<T>(
+        pathname: string,
+        data?: QueryParams,
+        parseResponse?: ResponseParser<T>,
+    ): Promise<JsonValue | T> {
+        if (parseResponse) {
+            return this.go({ method: 'GET', pathname, data, parseResponse });
+        }
+        return this.go({ method: 'GET', pathname, data });
+    }
+
+    /**
+     * Construct query string for WHATWG urls
+     * @private
+     * @param query - Query parameters to generate the query string from
+     * @param useDefaultParams - Use defaultParams or not
+     * @param defaultParams - Default params
+     */
+    private static search(
+        query: QueryParams,
+        useDefaultParams: boolean,
+        defaultParams: QueryParams,
+    ): string {
+        const params = useDefaultParams ? cloneDefined(defaultParams, query) : cloneDefined(query);
+        return Object.keys(params)
+            .filter((p) => params[p] !== '')
+            .map((p) => `${encode(p)}=${encode(String(params[p]))}`)
+            .join('&');
+    }
+}
+
+export default RESTClient;

package/src/rest-clients.ts

@@ -0,0 +1,30 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { NAMESPACE } from './config.js';
+import RESTClient from './rest-client.js';
+import type { LogFunction } from './types/common.js';
+import { assert, isNonEmptyString } from './validate.js';
+
+type AccountRestClientOptions = {
+    serverUrl: string;
+    log?: LogFunction;
+    defaultParams: Record<string, string | number | boolean | undefined>;
+};
+
+const isKnownNamespace = (env: string): env is keyof typeof NAMESPACE =>
+    Object.hasOwn(NAMESPACE, env);
+
+export const buildClientSdrn = (env: string, clientId: string): string => {
+    assert(isNonEmptyString(clientId), 'clientId parameter is required');
+    assert(isKnownNamespace(env), `env parameter is invalid: ${env}`);
+
+    return `sdrn:${NAMESPACE[env]}:client:${clientId}`;
+};
+
+export const createAccountRestClient = ({
+    serverUrl,
+    log,
+    defaultParams,
+}: AccountRestClientOptions): RESTClient => new RESTClient({ serverUrl, log, defaultParams });

package/src/sdk-error.ts

@@ -0,0 +1,61 @@
+/* Copyright 2024 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+/*
+ * Note: this module can't have any internal dependencies because it's used in ./validate which
+ * in turn is used as a dependency to a lot of other modules. Doing so may create a circular
+ * dependency that's hard to debug in Node.
+ */
+
+const STRINGIFY_TYPES = ['boolean', 'number', 'string'];
+
+/**
+ * Custom error class thrown by all SDK methods on failure.
+ *
+ * All rejected promises from API calls reject with an instance of this class.
+ *
+ * @group Errors
+ */
+export default class SDKError extends Error {
+    /** HTTP status code from the server error payload;
+     * declared explicitly to allow numeric comparisons without type-casting.
+     */
+    code?: number;
+    /**
+     * Properties copied from the server error object.
+     * @internal
+     */
+    [key: string]: unknown;
+
+    /**
+     * @param message - Human-readable error message
+     * @param errorObject - Optional server error payload. All enumerable properties are
+     * shallow-copied onto this instance.
+     */
+    constructor(message: string, errorObject?: Record<string, unknown>) {
+        super(message);
+        this.name = 'SDKError';
+
+        if (errorObject) {
+            try {
+                Object.assign(this, errorObject);
+            } catch {
+                // silent
+            }
+        }
+    }
+
+    /**
+     * Returns a multi-line string with the error name, message, and any other properties copied
+     * from the server error payload.
+     */
+    toString(): string {
+        const ret = `${this.name}: ${this.message}`;
+        const additionalInfo = Object.keys(this)
+            .filter((key) => key !== 'name' && STRINGIFY_TYPES.includes(typeof this[key]))
+            .map((key) => `    ${key}: ${this[key]}`)
+            .join('\n');
+        return additionalInfo ? `${ret}\n${additionalInfo}` : ret;
+    }
+}