@schibsted/account-sdk-browser 6.0.0-alpha.1 → 6.0.0-alpha.3

package/src/account.ts

@@ -0,0 +1,149 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { registerAndDispatchInGlobal } from './global-registry.js';
+import Identity from './identity.js';
+import Monetization from './monetization.js';
+import { resolveBrowserWindow } from './resolve-browser-window.js';
+import SDKError from './sdk-error.js';
+import type { AccountConfig, AccountEventHandler, AccountEventName } from './types/account.js';
+import type {
+    LoginOptions,
+    SimplifiedLoginData,
+    SimplifiedLoginWidgetLoginOptions,
+    SimplifiedLoginWidgetOptions,
+} from './types/login.js';
+import type { HasAccessResult } from './types/monetization.js';
+import type { ConnectedSessionResponse, SessionResponse, SessionUserId } from './types/session.js';
+
+/**
+ * Unified client-side interface for a configured Schibsted Account integration.
+ */
+export class Account {
+    #identity: Identity;
+    #monetization: Monetization;
+
+    constructor(config: AccountConfig) {
+        const browserWindow = resolveBrowserWindow(config.window);
+
+        if (!browserWindow) {
+            throw new SDKError('Schibsted Account SDK is not available in this browser context');
+        }
+
+        if (browserWindow.schAccount) {
+            throw new SDKError('Schibsted Account SDK has already been initialized');
+        }
+
+        const { log, callbackBeforeRedirect, varnish } = config;
+        const sharedConfig = {
+            clientId: config.clientId,
+            redirectUri: config.redirectUri,
+            sessionDomain: config.sessionDomain,
+            env: config.env,
+            window: browserWindow,
+        };
+
+        this.#identity = new Identity({
+            ...sharedConfig,
+            log,
+            callbackBeforeRedirect,
+        });
+
+        if (varnish) {
+            if (typeof varnish !== 'object' || Array.isArray(varnish)) {
+                throw new SDKError('Account varnish config must be an object');
+            }
+            this.#identity.enableVarnishCookie(varnish);
+        }
+
+        this.#monetization = new Monetization(sharedConfig);
+
+        registerAndDispatchInGlobal(browserWindow, 'schAccount', this);
+    }
+
+    hasSession(): Promise<SessionResponse> {
+        return this.#identity.hasSession();
+    }
+
+    isLoggedIn(): Promise<boolean> {
+        return this.#identity.isLoggedIn();
+    }
+
+    isConnected(): Promise<boolean> {
+        return this.#identity.isConnected();
+    }
+
+    getUser(): Promise<ConnectedSessionResponse> {
+        return this.#identity.getUser();
+    }
+
+    getUserId(): Promise<string> {
+        return this.#identity.getUserId();
+    }
+
+    getUserSDRN(): Promise<string> {
+        return this.#identity.getUserSDRN();
+    }
+
+    getUserContextData(): Promise<SimplifiedLoginData | null> {
+        return this.#identity.getUserContextData();
+    }
+
+    getSpId(): Promise<string | null> {
+        return this.#identity.getSpId();
+    }
+
+    login(options: LoginOptions): Window | null {
+        return this.#identity.login(options);
+    }
+
+    logout(redirectUri?: string): void {
+        this.#identity.logout(redirectUri);
+    }
+
+    loginUrl(options: LoginOptions): string {
+        return this.#identity.loginUrl(options);
+    }
+
+    showSimplifiedLoginWidget(
+        loginParams: SimplifiedLoginWidgetLoginOptions,
+        options?: SimplifiedLoginWidgetOptions,
+    ): Promise<boolean> {
+        return this.#identity.showSimplifiedLoginWidget(loginParams, options);
+    }
+
+    clearCachedUserSession(): void {
+        this.#identity.clearCachedUserSession();
+    }
+
+    hasAccess(productIds: string[], userId: SessionUserId): Promise<HasAccessResult | null> {
+        return this.#monetization.hasAccess(productIds, userId);
+    }
+
+    clearCachedAccessResult(productIds: string[], userId: SessionUserId): void {
+        this.#monetization.clearCachedAccessResult(productIds, userId);
+    }
+
+    on(event: AccountEventName, callback: AccountEventHandler, ctx?: unknown): this {
+        if (event === 'hasAccess') {
+            this.#monetization.on(event, callback, ctx);
+        } else {
+            this.#identity.on(event, callback, ctx);
+        }
+
+        return this;
+    }
+
+    off(event: AccountEventName, callback?: AccountEventHandler): this {
+        if (event === 'hasAccess') {
+            this.#monetization.off(event, callback);
+        } else {
+            this.#identity.off(event, callback);
+        }
+
+        return this;
+    }
+}
+
+export default Account;

package/src/{cache.js → cache.ts}

@@ -2,45 +2,47 @@
  * See LICENSE.md in the project root.
  */
 
-'use strict';
-
-import SDKError from './SDKError.js';
+import SDKError from './sdk-error.js';
 
 /**
  * Check whether we are able to use web storage
- * @param {Storage} storeProvider - A function to return a WebStorage instance (either
+ * @param storeProvider - A function to return a WebStorage instance (either
  * `sessionStorage` or `localStorage` from a `Window` object)
  * @private
- * @returns {boolean}
  */
-function webStorageWorks(storeProvider) {
+function webStorageWorks(storeProvider: (() => Storage) | undefined): boolean {
     if (!storeProvider) {
         return false;
     }
     try {
         const store = storeProvider();
-        const randomKey = 'x-x-x-x'.replace(/x/g, () => Math.random());
+        const randomKey = 'x-x-x-x'.replace(/x/g, () => String(Math.random()));
         const testValue = 'TEST-VALUE';
         store.setItem(randomKey, testValue);
         const val = store.getItem(randomKey);
         store.removeItem(randomKey);
-        return (val === testValue);
-    } catch (e) {
+        return val === testValue;
+    } catch {
         return false;
     }
 }
 
 /**
- * Will be used if web storage is available
+ * Cache implementation used when web storage is available. Wraps a `Storage` instance.
  * @private
  */
 class WebStorageCache {
+    store: Storage;
+    get: (key: string) => string | null;
+    set: (key: string, value: string) => void;
+    delete: (key: string) => void;
+
     /**
      * Create web storage cache object
-     * @param {Storage} store - A reference to either `sessionStorage` or `localStorage` from a
+     * @param store - A reference to either `sessionStorage` or `localStorage` from a
      * `Window` object
      */
-    constructor(store) {
+    constructor(store: Storage) {
         this.store = store;
         this.get = (key) => this.store.getItem(key);
         this.set = (key, value) => this.store.setItem(key, value);
@@ -49,35 +51,49 @@ class WebStorageCache {
 }
 
 /**
- * Will be used if session storage is not available
+ * Cache implementation used when web storage is not available. Stores entries in an in-memory object.
  * @private
  */
 class LiteralCache {
+    store: Record<string, string>;
+    get: (key: string) => string | undefined;
+    set: (key: string, value: string) => void;
+    delete: (key: string) => void;
+
     /**
      * Create JS object literal cache object
      */
     constructor() {
         this.store = {};
         this.get = (key) => this.store[key];
-        this.set = (key, value) => this.store[key] = value;
-        this.delete = (key) => delete this.store[key];
+        this.set = (key, value) => {
+            this.store[key] = value;
+        };
+        this.delete = (key) => {
+            delete this.store[key];
+        };
     }
 }
 
-const maxExpiresIn = Math.pow(2, 31) - 1;
+type CacheEntry = { expiresOn: number; value: unknown };
+
+const maxExpiresIn = 2 ** 31 - 1;
 
 /**
  * Cache class that attempts WebStorage (session/local storage), and falls back to JS object literal
  * @private
  */
 export default class Cache {
+    cache: WebStorageCache | LiteralCache;
+    type: string;
+
     /**
-     * @param {Storage} [storeProvider] - A function to return a WebStorage instance (either
+     * @param storeProvider - A function to return a WebStorage instance (either
      * `sessionStorage` or `localStorage` from a `Window` object)
      * @throws {SDKError} - If sessionStorage or localStorage are not accessible
      */
-    constructor(storeProvider) {
-        if (webStorageWorks(storeProvider)) {
+    constructor(storeProvider?: () => Storage) {
+        if (storeProvider && webStorageWorks(storeProvider)) {
             this.cache = new WebStorageCache(storeProvider());
             this.type = 'WebStorage';
         } else {
@@ -88,46 +104,46 @@ export default class Cache {
 
     /**
      * Get a value from cache (checks that the object has not expired)
-     * @param {string} key
+     * @param key
      * @private
-     * @returns {*} - The value if it exists, otherwise null
      */
-    get(key) {
+    get(key: string): unknown {
         /**
          * JSON.parse safe wrapper
-         * @param {string} raw
-         * @returns {*} parsed value or null if failed to parse
+         * @param raw
          */
-        function getObj(raw) {
+        function getObj(raw: string | null | undefined): CacheEntry | null {
+            if (raw == null) {
+                return null;
+            }
             try {
                 return JSON.parse(raw);
-            } catch (e) {
+            } catch {
                 return null;
             }
         }
 
         try {
             const raw = this.cache.get(key);
-            let obj = getObj(raw);
+            const obj = getObj(raw);
             if (obj && Number.isInteger(obj.expiresOn) && obj.expiresOn > Date.now()) {
                 return obj.value;
             }
             this.delete(key);
             return null;
         } catch (e) {
-            throw new SDKError(e);
+            throw new SDKError(String(e));
         }
     }
 
     /**
      * Set a cache entry
-     * @param {string} key
-     * @param {*} value
-     * @param {Number} expiresIn - Value in milliseconds until the entry expires
+     * @param key
+     * @param value
+     * @param expiresIn - Value in milliseconds until the entry expires
      * @private
-     * @returns {void}
      */
-    set(key, value, expiresIn = 0) {
+    set(key: string, value: unknown, expiresIn = 0): void {
         if (expiresIn <= 0) {
             return;
         }
@@ -138,21 +154,20 @@ export default class Cache {
             this.cache.set(key, JSON.stringify({ expiresOn, value }));
             setTimeout(() => this.delete(key), expiresIn);
         } catch (e) {
-            throw new SDKError(e);
+            throw new SDKError(String(e));
         }
     }
 
     /**
      * Delete a cache entry
-     * @param {string} key
+     * @param key
      * @private
-     * @returns {void}
      */
-    delete(key) {
+    delete(key: string): void {
         try {
             this.cache.delete(key);
         } catch (e) {
-            throw new SDKError(e);
+            throw new SDKError(String(e));
         }
     }
 }

package/src/{config.js → config.ts}

@@ -2,8 +2,6 @@
  * See LICENSE.md in the project root.
  */
 
-'use strict';
-
 /*
  * This file declares configs that are essentially part of how the SDK works and interacts with our
  * backend servers.
@@ -18,34 +16,11 @@
  */
 
 /**
- * Core configuration used by the SDK
- * @type {Object}
- * @memberof core
- * @prop {object} ENDPOINTS - URL to some of the services that users of this SDK may interact with
- * @prop {object} ENDPOINTS.SPiD - SPiD endpoints
- * @prop {string} ENDPOINTS.SPiD.LOCAL - Local endpoint (for Identity team)
- * @prop {string} ENDPOINTS.SPiD.DEV - Dev environment (for Identity team)
- * @prop {string} ENDPOINTS.SPiD.PRE - Staging environment
- * @prop {string} ENDPOINTS.SPiD.PRO - Production environment Sweden
- * @prop {string} ENDPOINTS.SPiD.PRO_NO - Production environment Norway
- * @prop {string} ENDPOINTS.SPiD.PRO_FI - Production environment Finland
- * @prop {string} ENDPOINTS.SPiD.PRO_DK - Production environment Denmark
- * @prop {object} ENDPOINTS.BFF - Endpoints used with new GDPR-compliant web flows
- * @prop {string} ENDPOINTS.BFF.LOCAL - Local endpoint (for Identity team)
- * @prop {string} ENDPOINTS.BFF.DEV - Dev environment (for Identity team)
- * @prop {string} ENDPOINTS.BFF.PRE - Staging environment
- * @prop {string} ENDPOINTS.BFF.PRO - Production environment Sweden
- * @prop {string} ENDPOINTS.BFF.PRO_NO - Production environment Norway
- * @prop {string} ENDPOINTS.BFF.PRO_FI - Production environment Finland
- * @prop {string} ENDPOINTS.BFF.PRO_DK - Production environment Denmark
- * @prop {object} ENDPOINTS.SESSION_SERVICE - Endpoints to check global user session data
- * @prop {string} ENDPOINTS.SESSION_SERVICE.LOCAL - Local endpoint (for Identity team)
- * @prop {string} ENDPOINTS.SESSION_SERVICE.DEV - Dev environment (for Identity team)
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRE - Staging environment
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO - Production environment Sweden
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO_NO - Production environment Norway
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO_FI - Production environment Finland
- * @prop {string} ENDPOINTS.SESSION_SERVICE.PRO_DK - Production environment Denmark
+ * Core configuration used by the SDK.
+ * - `ENDPOINTS.SPiD` — SPiD endpoints per environment
+ * - `ENDPOINTS.BFF` — Endpoints used with new GDPR-compliant web flows
+ * - `ENDPOINTS.SESSION_SERVICE` — Endpoints to check global user session data
+ *
  */
 const config = {
     ENDPOINTS: {
@@ -85,8 +60,8 @@ const config = {
         PRO_NO: 'spid.no',
         PRO_FI: 'schibsted.fi',
         PRO_DK: 'schibsted.dk',
-    }
-};
+    },
+} as const;
 
 export default config;
 export const ENDPOINTS = config.ENDPOINTS;

package/src/get-account-sdk.ts

@@ -0,0 +1,94 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { Account } from './account.js';
+import { resolveBrowserWindow } from './resolve-browser-window.js';
+import type { AccountConfig } from './types/account.js';
+
+const ACCOUNT_READY_EVENT = 'schAccount:ready';
+const GET_ACCOUNT_SDK_TIMEOUT_MS = 4000;
+const IGNORED_CONFIG_WARNING =
+    'Schibsted Account SDK has already been initialized. The config passed to getAccountSdk() was ignored.';
+
+let pendingAccountPromise: Promise<Account> | undefined;
+let ignoredConfigWarningSent = false;
+
+const createUnavailableError = (): Error =>
+    new Error('Schibsted Account SDK is not available in this browser context');
+
+const createTimeoutError = (): Error =>
+    new Error(`Schibsted Account SDK was not initialized within ${GET_ACCOUNT_SDK_TIMEOUT_MS} ms`);
+
+const warnIgnoredConfigOnce = (): void => {
+    if (ignoredConfigWarningSent) {
+        return;
+    }
+
+    console.warn(IGNORED_CONFIG_WARNING);
+    ignoredConfigWarningSent = true;
+};
+
+export function getAccountSdk(config?: AccountConfig): Promise<Account> {
+    const browserWindow = resolveBrowserWindow(config?.window);
+
+    if (!browserWindow) {
+        const error = createUnavailableError();
+        console.error(error.message);
+        return Promise.reject(error);
+    }
+
+    if (browserWindow.schAccount) {
+        if (config) {
+            warnIgnoredConfigOnce();
+        }
+
+        return Promise.resolve(browserWindow.schAccount);
+    }
+
+    if (config) {
+        return Promise.resolve(new Account(config));
+    }
+
+    if (pendingAccountPromise) {
+        return pendingAccountPromise;
+    }
+
+    pendingAccountPromise = new Promise<Account>((resolve, reject) => {
+        let timeoutId: number | undefined;
+
+        const cleanup = () => {
+            browserWindow.removeEventListener(ACCOUNT_READY_EVENT, handleReady);
+            if (timeoutId !== undefined) {
+                browserWindow.clearTimeout(timeoutId);
+            }
+            pendingAccountPromise = undefined;
+        };
+
+        const resolveRegisteredAccount = () => {
+            const account = browserWindow.schAccount;
+            if (!account) {
+                return;
+            }
+
+            cleanup();
+            resolve(account);
+        };
+
+        const handleReady = () => {
+            resolveRegisteredAccount();
+        };
+
+        browserWindow.addEventListener(ACCOUNT_READY_EVENT, handleReady);
+        timeoutId = browserWindow.setTimeout(() => {
+            const error = createTimeoutError();
+            console.error(error.message);
+            cleanup();
+            reject(error);
+        }, GET_ACCOUNT_SDK_TIMEOUT_MS);
+
+        resolveRegisteredAccount();
+    });
+
+    return pendingAccountPromise;
+}

package/src/global-registry.ts

@@ -0,0 +1,39 @@
+import './globals.js';
+
+/**
+ * Names of the SDK instance properties that can be registered on the global {@link Window} object.
+ */
+type Property = 'schAccount' | 'schIdentity' | 'schMonetization';
+
+/**
+ * Registers an SDK instance on the global {@link Window} object's given property and dispatches a ready event.
+ *
+ * The dispatched event is a {@link CustomEvent} fired on `global` (i.e. `window`) with:
+ * - name: `${property}:ready` (e.g. `"schIdentity:ready"` or `"schMonetization:ready"`)
+ * - `detail.instance`: the registered SDK instance
+ *
+ * @typeParam T - Constrained to {@link Property}; inferred from the `property` argument.
+ * @param global - The `Window` object to register on.
+ * @param property - The window property name to assign the instance to, 'schIdentity' or 'schMonetization'.
+ * @param instance - The SDK instance to register. Must be non-nullable.
+ *
+ * @example
+ * registerAndDispatchInGlobal(window, 'schIdentity', identityInstance);
+ * / window.schIdentity === identityInstance
+ * / CustomEvent 'schIdentity:ready' has been dispatched on window
+ */
+
+export const registerAndDispatchInGlobal = <T extends Property>(
+    global: Window,
+    property: T,
+    instance: NonNullable<Window[T]>,
+): void => {
+    if (!global[property]) {
+        global[property] = instance;
+    }
+
+    global.dispatchEvent(
+        //TODO -> https://schibsted.ghe.com/connect/team/issues/645
+        new CustomEvent(`${property}:ready`, { detail: { instance: global[property] } }),
+    );
+};

package/src/globals.ts

@@ -0,0 +1,12 @@
+import type { Account } from './account.js';
+import type { Identity } from './identity.js';
+import type { Monetization } from './monetization.js';
+
+declare global {
+    interface Window {
+        schAccount?: Account;
+        schIdentity?: Identity;
+        schMonetization?: Monetization;
+        SPiD?: { Talk?: { response?: (callbackName: string, data: unknown) => unknown } };
+    }
+}

package/src/has-access-response.ts

@@ -0,0 +1,35 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import SDKError from './sdk-error.js';
+import type { HasAccessResult } from './types/monetization.js';
+import { isObject, isStr } from './validate.js';
+
+export function parseHasAccessResult(value: unknown): HasAccessResult {
+    if (!isObject(value)) {
+        throw new SDKError('Invalid hasAccess response');
+    }
+
+    const { entitled, ttl, allowedFeatures, userId, uuid, sig } = value;
+
+    if (
+        typeof entitled !== 'boolean' ||
+        typeof ttl !== 'number' ||
+        !Array.isArray(allowedFeatures) ||
+        (typeof userId !== 'number' && typeof userId !== 'string') ||
+        !isStr(uuid) ||
+        !isStr(sig)
+    ) {
+        throw new SDKError('Invalid hasAccess response');
+    }
+
+    return {
+        entitled,
+        ttl,
+        allowedFeatures: allowedFeatures.filter(isStr),
+        userId,
+        uuid,
+        sig,
+    };
+}