@schibsted/account-sdk-browser 6.0.0-alpha.1 → 6.0.0-alpha.3

package/src/rest-clients.ts

@@ -0,0 +1,30 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { NAMESPACE } from './config.js';
+import RESTClient from './rest-client.js';
+import type { LogFunction } from './types/common.js';
+import { assert, isNonEmptyString } from './validate.js';
+
+type AccountRestClientOptions = {
+    serverUrl: string;
+    log?: LogFunction;
+    defaultParams: Record<string, string | number | boolean | undefined>;
+};
+
+const isKnownNamespace = (env: string): env is keyof typeof NAMESPACE =>
+    Object.hasOwn(NAMESPACE, env);
+
+export const buildClientSdrn = (env: string, clientId: string): string => {
+    assert(isNonEmptyString(clientId), 'clientId parameter is required');
+    assert(isKnownNamespace(env), `env parameter is invalid: ${env}`);
+
+    return `sdrn:${NAMESPACE[env]}:client:${clientId}`;
+};
+
+export const createAccountRestClient = ({
+    serverUrl,
+    log,
+    defaultParams,
+}: AccountRestClientOptions): RESTClient => new RESTClient({ serverUrl, log, defaultParams });

package/src/sdk-error.ts

@@ -0,0 +1,59 @@
+/* Copyright 2024 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+/*
+ * Note: this module can't have any internal dependencies because it's used in ./validate which
+ * in turn is used as a dependency to a lot of other modules. Doing so may create a circular
+ * dependency that's hard to debug in Node.
+ */
+
+const STRINGIFY_TYPES = ['boolean', 'number', 'string'];
+
+/**
+ * Custom error class thrown by all SDK methods on failure.
+ *
+ * All rejected promises from API calls reject with an instance of this class.
+ */
+export default class SDKError extends Error {
+    /** HTTP status code from the server error payload;
+     * declared explicitly to allow numeric comparisons without type-casting.
+     */
+    code?: number;
+    /**
+     * Properties copied from the server error object.
+     * @internal
+     */
+    [key: string]: unknown;
+
+    /**
+     * @param message - Human-readable error message
+     * @param errorObject - Optional server error payload. All enumerable properties are
+     * shallow-copied onto this instance.
+     */
+    constructor(message: string, errorObject?: Record<string, unknown>) {
+        super(message);
+        this.name = 'SDKError';
+
+        if (errorObject) {
+            try {
+                Object.assign(this, errorObject);
+            } catch {
+                // silent
+            }
+        }
+    }
+
+    /**
+     * Returns a multi-line string with the error name, message, and any other properties copied
+     * from the server error payload.
+     */
+    toString(): string {
+        const ret = `${this.name}: ${this.message}`;
+        const additionalInfo = Object.keys(this)
+            .filter((key) => key !== 'name' && STRINGIFY_TYPES.includes(typeof this[key]))
+            .map((key) => `    ${key}: ${this[key]}`)
+            .join('\n');
+        return additionalInfo ? `${ret}\n${additionalInfo}` : ret;
+    }
+}

package/src/session-response.ts

@@ -0,0 +1,85 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import type {
+    ConnectedSessionResponse,
+    ConnectedSessionWithUserIdResponse,
+    NormalizedSessionPayload,
+    RedirectSessionPayload,
+    SessionFailureResponse,
+    SessionResponse,
+    SessionSuccessResponse,
+} from './types/session.js';
+import { isObject, isStr } from './validate.js';
+
+export function isSessionSuccessResponse(value: unknown): value is SessionSuccessResponse {
+    return (
+        isObject(value) &&
+        typeof value.code === 'number' &&
+        isStr(value.type) &&
+        isStr(value.description) &&
+        typeof value.result === 'boolean'
+    );
+}
+
+export function isConnectedSessionResponse(value: unknown): value is ConnectedSessionResponse {
+    return isSessionSuccessResponse(value) && value.result === true;
+}
+
+export function isSessionFailureResponse(value: unknown): value is SessionFailureResponse {
+    return isObject(value) && Boolean(value.error);
+}
+
+export function isRedirectSessionPayload(value: unknown): value is RedirectSessionPayload {
+    return isObject(value) && Object.keys(value).length === 1 && isStr(value.redirectURL);
+}
+
+export function isConnectedSessionWithUserIdResponse(
+    value: SessionResponse,
+): value is ConnectedSessionWithUserIdResponse {
+    return (
+        isConnectedSessionResponse(value) &&
+        (typeof value.userId === 'number' || typeof value.userId === 'string')
+    );
+}
+
+/**
+ * Converts an unknown Session Service `hasSession` payload into one of the shapes the SDK knows how
+ * to handle.
+ *
+ * This function is intentionally tolerant because `hasSession()` historically resolved unknown
+ * object payloads instead of rejecting them. The SDK relies on that behavior for backwards
+ * compatibility with clients that check the raw response themselves.
+ *
+ * The normal cases are:
+ * - regular success payloads with a boolean `result`;
+ * - failure payloads wrapped as `{ error, response? }`;
+ * - Safari/session-refresh redirect payloads shaped as `{ redirectURL }`.
+ *
+ * Any other object is preserved as an unrecognized response so callers can still receive it.
+ * Non-object values are normalized to `{}`, matching the old "empty response" fallback used by
+ * `hasSession()` and cached-session reads.
+ *
+ * This is used both for network responses parsed by `RESTClient` and for values restored from the
+ * session cache, so the rest of the Identity flow can switch on typed guards instead of repeatedly
+ * re-validating unknown data.
+ *
+ * @internal
+ */
+export function normalizeSessionResponse(value: unknown): NormalizedSessionPayload {
+    if (isRedirectSessionPayload(value)) {
+        return value;
+    }
+    if (isSessionFailureResponse(value)) {
+        return value;
+    }
+    if (isSessionSuccessResponse(value)) {
+        return value;
+    }
+    if (isObject(value)) {
+        return value;
+    }
+
+    return {};
+}

package/src/{spidTalk.js → spid-talk.ts}

@@ -2,13 +2,12 @@
  * See LICENSE.md in the project root.
  */
 
-'use strict';
-
 /**
  * A workaround for how Schibsted account handles JSONP calls in the browser
  * @private
  */
 
+import './globals.js';
 import { isFunction } from './validate.js';
 
 /**
@@ -20,20 +19,19 @@ import { isFunction } from './validate.js';
  * The old SPiD JSONP APIs relied on SPiD.Talk.response(callbackName, data) but fetch-jsonp merely
  * calls window[callbackName](data) which is more common practice. This module simply acts as an
  * adapter to modernize the old mechanism until we support CORS. To see how the SPiD solution works,
- * try to run a simple JSONP request or debug it in netowrk tab. This module will be removed when
- * CORS is supported.
- * @memberof core
- * @param {object} global - a reference to the global object
- * @return {void}
+ * try to run a simple JSONP request or debug it in the network tab. This module will be removed
+ * when CORS is supported.
+ * @param global - A reference to the global object, typically the `Window`.
  */
-export function emulate(global) {
-    if (global.SPiD === null || typeof global.SPiD !== 'object') {
+export function emulate(global: Window): void {
+    if (!global.SPiD || typeof global.SPiD !== 'object') {
         global.SPiD = {};
     }
-    if (global.SPiD.Talk === null || typeof global.SPiD.Talk !== 'object') {
-        global.SPiD.Talk = {}
+    if (!global.SPiD.Talk || typeof global.SPiD.Talk !== 'object') {
+        global.SPiD.Talk = {};
     }
     if (!isFunction(global.SPiD.Talk.response)) {
-        global.SPiD.Talk.response = (callbackName, data) => global[callbackName](data);
+        global.SPiD.Talk.response = (callbackName: string, data: unknown) =>
+            (global as any)[callbackName](data);
     }
 }

package/src/types/account.ts

@@ -0,0 +1,27 @@
+import type { AccountBaseConfig, LogFunction } from './common';
+import type { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+
+export type AccountConfig = AccountBaseConfig & {
+    /** Receives debug log information. If not set, no logging will be done. */
+    log?: LogFunction;
+    /** Callback triggered before a session refresh redirect happens. */
+    callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Optional Varnish cookie setup applied during Account initialization. */
+    varnish?: VarnishCookieOptions;
+};
+
+export type AccountSessionEventName =
+    | 'login'
+    | 'logout'
+    | 'userChange'
+    | 'sessionChange'
+    | 'notLoggedin'
+    | 'sessionInit'
+    | 'statusChange'
+    | 'error'
+    | 'simplifiedLoginOpened'
+    | 'simplifiedLoginCancelled';
+
+export type AccountEventName = AccountSessionEventName | 'hasAccess';
+
+export type AccountEventHandler = (...args: unknown[]) => void;

package/src/types/common.ts

@@ -0,0 +1,26 @@
+/* Common types used across the SDK */
+
+/**
+ * Log callback used by the SDK for debug output.
+ * Receives a pre-formatted log line.
+ * @internal
+ */
+export type LogFunction = (message: string) => void;
+
+/**
+ * Supported Schibsted account environment keys.
+ */
+export type AccountEnvironment = 'LOCAL' | 'DEV' | 'PRE' | 'PRO' | 'PRO_NO' | 'PRO_FI' | 'PRO_DK';
+
+export type AccountBaseConfig = {
+    /** Mandatory client id. Example: "1234567890abcdef12345678" */
+    clientId: string;
+    /** Redirect uri. Example: "https://site.com" */
+    redirectUri: string;
+    /** Session Service domain. Example: "https://id.site.com" */
+    sessionDomain: string;
+    /** Schibsted account environment. Defaults to PRE. */
+    env?: AccountEnvironment;
+    /** Window object to use. Defaults to the global `window`. */
+    window?: Window;
+};

package/src/types/identity.ts

@@ -0,0 +1,55 @@
+import type { AccountBaseConfig, LogFunction } from './common';
+
+/**
+ * Callback invoked before the SDK performs a full-page session refresh redirect.
+ */
+export type IdentityBeforeRedirectCallback = () => void | Promise<void>;
+
+/**
+ * Options accepted by the {@link Identity} constructor.
+ */
+export type IdentityOptions = AccountBaseConfig & {
+    /** Receives debug log information. If not set, no logging will be done. */
+    log?: LogFunction;
+    /** Callback triggered before a session refresh redirect happens. */
+    callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+};
+
+/**
+ * Identity events emitted by the SDK.
+ *
+ * - `login`: emitted when `hasSession()` resolves with a logged-in user payload.
+ * - `logout`: emitted when a previously logged-in user is no longer logged in, or when
+ *   `logout()` is called.
+ * - `userChange`: emitted when the current session user id changes.
+ * - `sessionChange`: emitted when either the previous or current `hasSession()` payload contains
+ *   a logged-in user.
+ * - `notLoggedin`: emitted when neither the previous nor current `hasSession()` payload contains
+ *   a logged-in user.
+ * - `sessionInit`: emitted once for the first logged-in session payload.
+ * - `statusChange`: emitted when the session `userStatus` changes.
+ * - `error`: emitted when `hasSession()` fails.
+ * - `simplifiedLoginOpened`: emitted when the simplified login widget is displayed.
+ * - `simplifiedLoginCancelled`: emitted when the simplified login widget is closed.
+ */
+export type IdentityEventName =
+    | 'login'
+    | 'logout'
+    | 'userChange'
+    | 'sessionChange'
+    | 'notLoggedin'
+    | 'sessionInit'
+    | 'statusChange'
+    | 'error'
+    | 'simplifiedLoginOpened'
+    | 'simplifiedLoginCancelled';
+
+/**
+ * Options for {@link Identity#enableVarnishCookie}.
+ */
+export type VarnishCookieOptions = {
+    /** Override number of seconds before the Varnish cookie expires. */
+    expiresIn?: number;
+    /** Override cookie domain. E.g. "vg.no" instead of "www.vg.no". */
+    domain?: string;
+};

package/src/types/login.ts

@@ -0,0 +1,145 @@
+/**
+ * Options accepted by {@link Identity#login} and related login URL helpers.
+ */
+export type LoginOptions = {
+    /**
+     * An opaque value used by the client to maintain state between the request and callback.
+     * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
+     */
+    state: string;
+    /**
+     * Authentication Context Class Reference Values. If omitted, the user will be asked to
+     * authenticate using username+password. For 2FA (Two-Factor Authentication) possible values
+     * are `sms`, `otp` (one time password), `password` (will force password confirmation, even if
+     * user is already logged in), `eid`. Those values might be mixed as space-separated string.
+     * To make sure that user has authenticated with 2FA you need to verify AMR (Authentication
+     * Methods References) claim in ID token. Might also be used to ensure additional acr
+     * (sms, otp, eid) for already logged in users. Supported value is also 'otp-email' means one
+     * time password using email.
+     */
+    acrValues?:
+        | 'password'
+        | 'otp'
+        | 'sms'
+        | 'eid-dk'
+        | 'eid-no'
+        | 'eid-se'
+        | 'eid-fi'
+        | 'eid'
+        | 'otp-email'
+        | (string & {});
+    /**
+     * The OAuth scopes for the tokens. This is a list of scopes, separated by space. If the list
+     * of scopes contains `openid`, the generated tokens includes the id token which can be useful
+     * for getting information about the user. Omitting scope is allowed, while `invalid_scope` is
+     * returned when the client asks for a scope you aren't allowed to request.
+     * {@link https://tools.ietf.org/html/rfc6749#section-3.3}
+     * Defaults to `openid`.
+     */
+    scope?: 'openid' | (string & {});
+    /**
+     * Redirect uri that will receive the code. Must exactly match a redirectUri from your client
+     * in self-service
+     */
+    redirectUri?: string;
+    /** Should we try to open a popup window? Defaults to `false`. */
+    preferPopup?: boolean;
+    /** user email or UUID hint */
+    loginHint?: string;
+    /** Pulse tag */
+    tag?: string;
+    /** Teaser slug. Teaser with given slug will be displayed in place of default teaser */
+    teaser?: string;
+    /**
+     * Specifies the allowable elapsed time in seconds since the last time the End-User was actively
+     * authenticated. If last authentication time is more than maxAge seconds in the past,
+     * re-authentication will be required. See the OpenID Connect spec section 3.1.2.1 for more
+     * information. Prefer a number of seconds; strings remain accepted for legacy callers.
+     */
+    maxAge?: number | string;
+    /**
+     * Optional parameter to overwrite client locale setting.
+     * New flows supports nb_NO, fi_FI, sv_SE, en_US
+     */
+    locale?: 'nb_NO' | 'fi_FI' | 'sv_SE' | 'en_US';
+    /** display username and password on one screen. Defaults to `false`. */
+    oneStepLogin?: boolean;
+    /**
+     * String that specifies whether the Authorization Server prompts the End-User for
+     * reauthentication or confirm account screen. Supported values: `select_account` or `login`.
+     * Defaults to `select_account`.
+     */
+    prompt?: 'select_account' | 'login';
+    /** Identifier for cross-domain tracking in Pulse */
+    xDomainId?: string;
+    /** Environment for cross-domain tracking in Pulse */
+    xEnvironmentId?: string;
+    /** Campaign identifier for tracking in Pulse */
+    originCampaign?: string;
+};
+
+/**
+ * Identical to {@link LoginOptions} except that `state` may also be a (possibly async) function;
+ * all other fields reuse the `LoginOptions` documentation.
+ */
+export type SimplifiedLoginWidgetLoginOptions = Omit<LoginOptions, 'state'> & {
+    /**
+     * An opaque value used by the client to maintain state between the request and callback.
+     * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
+     */
+    state: string | (() => string | Promise<string>);
+};
+
+/**
+ * Minimal user information used by the simplified login widget flow.
+ */
+export type SimplifiedLoginData = {
+    /** Deprecated: User UUID, to be be used as `loginHint` for {@link Identity#login} */
+    identifier: string;
+    /** Human-readable user identifier */
+    display_text: string;
+    /** Client name */
+    client_name: string;
+    /** Provider id used by the simplified login widget when supplied by the backend. */
+    provider_id?: string;
+};
+
+/**
+ * Configuration options for {@link Identity#showSimplifiedLoginWidget}.
+ */
+export type SimplifiedLoginWidgetOptions = {
+    /** expected encoding of simplified login widget. Could be utf-8 (default), iso-8859-1 or iso-8859-15 */
+    encoding?: string;
+    /**
+     * expected locale of simplified login widget. Should be provided in a short format like 'nb',
+     * 'sv'. If not set, a value from the env variable is used.
+     */
+    locale?: 'nb' | 'sv' | 'fi' | 'da' | 'en';
+};
+
+export type SimplifiedLoginWidgetInitialParams = {
+    displayText: string;
+    env: string;
+    clientName: string;
+    clientId: string;
+    providerId?: string;
+    locale?: SimplifiedLoginWidgetOptions['locale'];
+    windowWidth: () => number;
+    windowOnResize: (handler: () => void) => void;
+};
+
+export type SimplifiedLoginWidgetHandler = () => void | Promise<void>;
+
+export type OpenSimplifiedLoginWidget = (
+    initialParams: SimplifiedLoginWidgetInitialParams,
+    loginHandler: SimplifiedLoginWidgetHandler,
+    loginNotYouHandler: SimplifiedLoginWidgetHandler,
+    initHandler: SimplifiedLoginWidgetHandler,
+    cancelLoginHandler: SimplifiedLoginWidgetHandler,
+) => unknown;
+
+export const hasOpenSimplifiedLoginWidget = (
+    targetWindow: Window,
+): targetWindow is Window & { openSimplifiedLoginWidget: OpenSimplifiedLoginWidget } => {
+    return typeof targetWindow.openSimplifiedLoginWidget === 'function';
+};

package/src/types/monetization-guards.ts

@@ -0,0 +1,35 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import SDKError from '../sdk-error.js';
+import { isObject, isStr } from '../validate.js';
+import type { HasAccessResult } from './monetization.js';
+
+export function parseHasAccessResult(value: unknown): HasAccessResult {
+    if (!isObject(value)) {
+        throw new SDKError('Invalid hasAccess response');
+    }
+
+    const { entitled, ttl, allowedFeatures, userId, uuid, sig } = value;
+
+    if (
+        typeof entitled !== 'boolean' ||
+        typeof ttl !== 'number' ||
+        !Array.isArray(allowedFeatures) ||
+        (typeof userId !== 'number' && typeof userId !== 'string') ||
+        !isStr(uuid) ||
+        !isStr(sig)
+    ) {
+        throw new SDKError('Invalid hasAccess response');
+    }
+
+    return {
+        entitled,
+        ttl,
+        allowedFeatures: allowedFeatures.filter(isStr),
+        userId,
+        uuid,
+        sig,
+    };
+}

package/src/types/monetization.ts

@@ -0,0 +1,24 @@
+import type { AccountBaseConfig } from './common';
+import type { SessionUserId } from './session';
+
+/**
+ * Result returned by the Session Service `/hasAccess` endpoint, describing whether the user
+ * is entitled to a requested set of products/features.
+ * @internal
+ */
+export interface HasAccessResult {
+    /** Whether the user is entitled to at least one of the requested products/features. */
+    entitled: boolean;
+    /** How long this result stays valid, in seconds, before the cache entry expires. */
+    ttl: number;
+    allowedFeatures: string[];
+    userId: SessionUserId;
+    uuid: string;
+    sig: string;
+}
+
+/**
+ * Options accepted by the {@link Monetization} constructor.
+ */
+export type MonetizationOptions = Pick<AccountBaseConfig, 'clientId' | 'env' | 'window'> &
+    Partial<Pick<AccountBaseConfig, 'redirectUri' | 'sessionDomain'>>;

package/src/types/session-guards.ts

@@ -0,0 +1,89 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { isObject, isStr } from '../validate.js';
+import type {
+    ConnectedSessionResponse,
+    ConnectedSessionWithUserIdResponse,
+    SessionFailureResponse,
+    SessionResponse,
+    SessionSuccessResponse,
+    UnrecognizedSessionResponse,
+} from './session.js';
+
+type SessionObjectResponse =
+    | SessionSuccessResponse
+    | SessionFailureResponse
+    | UnrecognizedSessionResponse;
+
+type RedirectSessionPayload = {
+    redirectURL: string;
+};
+
+export type NormalizedSessionPayload = SessionObjectResponse | RedirectSessionPayload;
+
+export function isSessionSuccessResponse(value: unknown): value is SessionSuccessResponse {
+    return isObject(value) && typeof value.result === 'boolean';
+}
+
+export function isConnectedSessionResponse(value: unknown): value is ConnectedSessionResponse {
+    return isSessionSuccessResponse(value) && value.result === true;
+}
+
+export function isSessionFailureResponse(value: unknown): value is SessionFailureResponse {
+    return isObject(value) && Boolean(value.error);
+}
+
+export function isRedirectSessionPayload(value: unknown): value is RedirectSessionPayload {
+    return isObject(value) && Object.keys(value).length === 1 && isStr(value.redirectURL);
+}
+
+export function isConnectedSessionWithUserIdResponse(
+    value: SessionResponse,
+): value is ConnectedSessionWithUserIdResponse {
+    return (
+        isConnectedSessionResponse(value) &&
+        (typeof value.userId === 'number' || typeof value.userId === 'string')
+    );
+}
+
+/**
+ * Converts an unknown Session Service `hasSession` payload into one of the shapes the SDK knows how
+ * to handle.
+ *
+ * This function is intentionally tolerant because `hasSession()` historically resolved unknown
+ * object payloads instead of rejecting them. The SDK relies on that behavior for backwards
+ * compatibility with clients that check the raw response themselves.
+ *
+ * The normal cases are:
+ * - regular success payloads with a boolean `result`;
+ * - failure payloads wrapped as `{ error, response? }`;
+ * - Safari/session-refresh redirect payloads shaped as `{ redirectURL }`.
+ *
+ * Any other object is preserved as an unrecognized response so callers can still receive it.
+ * Non-object values are normalized to `{}`, matching the old "empty response" fallback used by
+ * `hasSession()` and cached-session reads.
+ *
+ * This is used both for network responses parsed by `RESTClient` and for values restored from the
+ * session cache, so the rest of the Identity flow can switch on typed guards instead of repeatedly
+ * re-validating unknown data.
+ *
+ * @internal
+ */
+export function normalizeSessionResponse(value: unknown): NormalizedSessionPayload {
+    if (isRedirectSessionPayload(value)) {
+        return value;
+    }
+    if (isSessionFailureResponse(value)) {
+        return value;
+    }
+    if (isSessionSuccessResponse(value)) {
+        return value;
+    }
+    if (isObject(value)) {
+        return value;
+    }
+
+    return {};
+}