@schibsted/account-sdk-browser 6.0.0-alpha.13 → 6.0.0-alpha.14

package/dist/types/account.d.ts

@@ -1,5 +1,5 @@
 import { AccountBaseConfig, LogFunction } from './common';
-import { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+import { ConsentReader, IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
 import { SessionResponse } from './session';
 /**
  * Configuration used to create an {@link Account} instance.
@@ -9,10 +9,17 @@ import { SessionResponse } from './session';
 export type AccountConfig = Omit<AccountBaseConfig, 'env'> & {
     /** Schibsted account environment. Defaults to PRE. */
     env?: AccountBaseConfig['env'];
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
+    /** Refresh consents of rendered login links when clicked. Defaults to true. */
+    refreshLoginLinks?: boolean;
     /** Product or feature ids used by `hasAccess()` when no ids are passed to the method. */
     defaultProductIds?: readonly string[];
     /** Optional Varnish cookie setup applied during Account initialization. */

package/dist/types/common.d.ts

@@ -1,10 +1,10 @@
 /**
  * Log callback used by the SDK for debug output.
- * Receives a pre-formatted log line.
+ * Receives a pre-formatted log line and, when reading consents fails, the error.
  *
  * @group Configuration
  */
-export type LogFunction = (message: string) => void;
+export type LogFunction = (message: string, error?: unknown) => void;
 /**
  * Supported Schibsted account environment keys.
  *

package/dist/types/identity.d.ts

@@ -1,4 +1,8 @@
 import { AccountBaseConfig, LogFunction } from './common';
+/**
+ * Synchronously returns the current consents as query parameters; must not wait for the user's decision.
+ */
+export type ConsentReader = () => URLSearchParams | null;
 /**
  * Callback invoked before the SDK performs a full-page session refresh redirect.
  */
@@ -7,10 +11,15 @@ export type IdentityBeforeRedirectCallback = () => void | Promise<void>;
  * Options accepted by the {@link Identity} constructor.
  */
 export type IdentityOptions = AccountBaseConfig & {
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
 };
 /**
  * Options for {@link Identity#enableVarnishCookie}.

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const version = "6.0.0-alpha.13";
+declare const version = "6.0.0-alpha.14";
 export default version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schibsted/account-sdk-browser",
-  "version": "6.0.0-alpha.13",
+  "version": "6.0.0-alpha.14",
   "description": "Schibsted account SDK for browsers",
   "main": "dist/index.js",
   "type": "module",
@@ -35,6 +35,7 @@
   "license": "MIT",
   "devDependencies": {
     "@biomejs/biome": "2.4.15",
+    "@schibsted/consent-url-utils": "^2.0.1",
     "@vitest/coverage-v8": "^4.1.7",
     "jsdom": "^29.1.1",
     "rimraf": "^6.1.3",
@@ -48,5 +49,8 @@
   "repository": {
     "type": "git",
     "url": "git://schibsted.ghe.com/user-identity/account-sdk-browser.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
   }
 }

package/src/account.ts

@@ -17,6 +17,7 @@ import type {
 } from './types/login.js';
 import type { HasAccessResult } from './types/monetization.js';
 import type { ConnectedSessionResponse, SessionResponse, SessionUserId } from './types/session.js';
+import { assert } from './validate.js';
 
 /**
  * Unified client-side interface for a configured Schibsted Account integration.
@@ -46,7 +47,14 @@ export class Account {
             throw new SDKError('Schibsted Account SDK has already been initialized');
         }
 
-        const { log, callbackBeforeRedirect, defaultProductIds, varnish } = config;
+        const {
+            log,
+            callbackBeforeRedirect,
+            getConsents,
+            refreshLoginLinks = true,
+            defaultProductIds,
+            varnish,
+        } = config;
         const sharedConfig = {
             clientId: config.clientId,
             redirectUri: config.redirectUri,
@@ -55,10 +63,16 @@ export class Account {
             window: browserWindow,
         };
 
+        assert(
+            typeof refreshLoginLinks === 'boolean',
+            'refreshLoginLinks parameter must be a boolean',
+        );
+
         this.#identity = new Identity({
             ...sharedConfig,
             log,
             callbackBeforeRedirect,
+            getConsents,
         });
 
         if (defaultProductIds !== undefined && !Array.isArray(defaultProductIds)) {
@@ -84,6 +98,9 @@ export class Account {
         if (sessionState) {
             sessionStates.set(this, sessionState);
         }
+        if (refreshLoginLinks) {
+            this.#identity.enableLoginLinkRefresh();
+        }
         browserWindow.schAccount = this;
         browserWindow.dispatchEvent(
             new CustomEvent('schAccount:ready', { detail: { instance: this } }),

package/src/consents.ts

@@ -0,0 +1,94 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { getConsentsSync, serializeConsents } from '@schibsted/consent-url-utils';
+
+const LINK_ACTIVATION_EVENTS = ['click', 'auxclick'];
+
+/**
+ * Reads consents from the Schibsted Sourcepoint integration, the default consent reader.
+ * Pages without the integration have no consents to forward, so they are skipped before
+ * `getConsentsSync` would warn about the missing consent manager on every login URL.
+ * @private
+ */
+export function readSourcepointConsents(window: Window): URLSearchParams | null {
+    if (!window._tcf_ && !window._scc_) {
+        return null;
+    }
+    return serializeConsents(getConsentsSync(window));
+}
+
+/**
+ * Sets the given parameters on a URL, replacing previous values of the same parameters.
+ * @private
+ * @param href
+ * @param consentParams
+ * @return - The URL with the parameters replaced
+ */
+export function replaceConsentParams(href: string, consentParams: URLSearchParams): string {
+    const url = new URL(href);
+    // Two passes on purpose: the reader may return repeated keys (e.g. `purpose=a&purpose=b`).
+    // A single `set()` pass would keep only the last value, and a single `append()` pass would keep
+    // stale values of the link. So first drop every stale value, then append all fresh ones.
+    consentParams.forEach((_, key) => {
+        url.searchParams.delete(key);
+    });
+    consentParams.forEach((value, key) => {
+        url.searchParams.append(key, value);
+    });
+    return url.href;
+}
+
+/**
+ * Finds the link that was activated by a click, including links inside open shadow roots.
+ * @private
+ * @param event
+ */
+function findActivatedLink(event: Event): HTMLAnchorElement | undefined {
+    const path = typeof event.composedPath === 'function' ? event.composedPath() : [event.target];
+    return path.find((node): node is HTMLAnchorElement => {
+        const link = node as Partial<HTMLAnchorElement> | null;
+        return !!link && link.tagName === 'A' && typeof link.href === 'string';
+    });
+}
+
+/**
+ * Refreshes consents of already rendered login links right before the browser follows them.
+ * Links are often generated before the user answers the consent dialog, so their consents are stale.
+ * The listener runs in the capture phase, before page handlers read the link.
+ * @private
+ * @param document
+ * @param options
+ * @param options.isLoginUrl - Tells whether a URL is a login URL to refresh
+ * @param options.getConsentParams - Current consent parameters
+ */
+export function refreshLoginLinksOnActivation(
+    document: Document,
+    {
+        isLoginUrl,
+        getConsentParams,
+    }: {
+        isLoginUrl: (href: string) => boolean;
+        getConsentParams: () => URLSearchParams;
+    },
+): void {
+    const refreshLink = (event: Event) => {
+        const link = findActivatedLink(event);
+        if (!link || !isLoginUrl(link.href)) {
+            return;
+        }
+
+        const consentParams = getConsentParams();
+        // Unknown consents never overwrite the ones the link was created with.
+        if (consentParams.toString() === '') {
+            return;
+        }
+
+        link.href = replaceConsentParams(link.href, consentParams);
+    };
+
+    LINK_ACTIVATION_EVENTS.forEach((type) => {
+        document.addEventListener(type, refreshLink, true);
+    });
+}

package/src/identity.ts

@@ -4,6 +4,11 @@
 
 import Cache from './cache.js';
 import { ENDPOINTS } from './config.js';
+import {
+    readSourcepointConsents,
+    refreshLoginLinksOnActivation,
+    replaceConsentParams,
+} from './consents.js';
 import { cloneDeep } from './object.js';
 import * as popup from './popup.js';
 import type RESTClient from './rest-client.js';
@@ -22,6 +27,7 @@ import * as spidTalk from './spid-talk.js';
 import type { AccountEventName } from './types/account.js';
 import type { LogFunction } from './types/common.js';
 import type {
+    ConsentReader,
     IdentityBeforeRedirectCallback,
     IdentityOptions,
     VarnishCookieOptions,
@@ -42,7 +48,15 @@ import type {
     SessionResponse,
 } from './types/session.js';
 import { urlMapper } from './url.js';
-import { assert, isNonEmptyString, isObject, isStr, isStrIn, isUrl } from './validate.js';
+import {
+    assert,
+    isFunction,
+    isNonEmptyString,
+    isObject,
+    isStr,
+    isStrIn,
+    isUrl,
+} from './validate.js';
 import version from './version.js';
 
 declare global {
@@ -75,6 +89,7 @@ export class Identity {
     private readonly env: string;
     private readonly log?: LogFunction;
     private readonly callbackBeforeRedirect: IdentityBeforeRedirectCallback;
+    private readonly getConsents: ConsentReader;
 
     // Caches
     private readonly sessionStorageCache: Cache;
@@ -109,10 +124,12 @@ export class Identity {
      * @param options.sessionDomain - Example: "https://id.site.com"
      * @param options.redirectUri - Example: "https://site.com"
      * @param options.env - Schibsted account environment: `PRE` (default), `PRO`, `PRO_NO`, `PRO_FI` or `PRO_DK`
-     * @param options.log - A function that receives debug log information. If not set,
-     * no logging will be done
+     * @param options.log - Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
      * @param options.window - window object
      * @param options.callbackBeforeRedirect - callback triggered before session refresh redirect happen
+     * @param options.getConsents - reads consents forwarded in login URLs.
+     * Defaults to the Schibsted Sourcepoint integration
      * @throws {SDKError} - If any of options are invalid
      */
     constructor({
@@ -123,6 +140,7 @@ export class Identity {
         log,
         window = globalWindow(),
         callbackBeforeRedirect = () => {},
+        getConsents = () => readSourcepointConsents(window),
     }: IdentityOptions) {
         assert(isNonEmptyString(clientId), 'clientId parameter is required');
         assert(isObject(window), 'The reference to window is missing');
@@ -133,6 +151,8 @@ export class Identity {
         );
         assert(isStr(env), `env parameter is invalid: ${env}`);
 
+        assert(isFunction(getConsents), 'getConsents parameter must be a function');
+
         spidTalk.emulate(window);
         this.window = window;
         this.clientId = clientId;
@@ -140,6 +160,7 @@ export class Identity {
         this.env = env;
         this.log = log;
         this.callbackBeforeRedirect = callbackBeforeRedirect;
+        this.getConsents = getConsents;
 
         this.sessionStorageCache = new Cache(() => this.window && this.window.sessionStorage);
         this.localStorageCache = new Cache(() => this.window && this.window.localStorage);
@@ -189,6 +210,17 @@ export class Identity {
         this._unblockSessionCall();
     }
 
+    /** @internal */
+    enableLoginLinkRefresh(): void {
+        const { document } = this.window;
+        if (document && isFunction(document.addEventListener)) {
+            refreshLoginLinksOnActivation(document, {
+                isLoginUrl: (href) => this.isLoginUrl(href),
+                getConsentParams: () => this.getConsentParams(),
+            });
+        }
+    }
+
     addEventListener(type: AccountEventName, listener: EventListener): void {
         this.eventTarget.addEventListener(type, listener);
     }
@@ -855,23 +887,65 @@ export class Identity {
             `the state parameter should be a non empty string but it is ${state}`,
         );
 
-        return this.oauthService.makeUrl('oauth/authorize', {
-            response_type: 'code',
-            redirect_uri: redirectUri,
-            scope,
-            state,
-            acr_values: acrValues,
-            login_hint: loginHint,
-            tag,
-            teaser,
-            max_age: maxAge,
-            locale,
-            one_step_login: oneStepLogin || '',
-            prompt: acrValues ? '' : prompt,
-            x_domain_id: xDomainId,
-            x_env_id: xEnvironmentId,
-            utm_campaign: originCampaign,
-        });
+        return replaceConsentParams(
+            this.oauthService.makeUrl('oauth/authorize', {
+                response_type: 'code',
+                redirect_uri: redirectUri,
+                scope,
+                state,
+                acr_values: acrValues,
+                login_hint: loginHint,
+                tag,
+                teaser,
+                max_age: maxAge,
+                locale,
+                one_step_login: oneStepLogin || '',
+                prompt: acrValues ? '' : prompt,
+                x_domain_id: xDomainId,
+                x_env_id: xEnvironmentId,
+                utm_campaign: originCampaign,
+            }),
+            this.getConsentParams(),
+        );
+    }
+
+    /**
+     * Reads the current consent parameters. A failing consent reader must not prevent a login,
+     * so the failure is logged and the login continues without consents.
+     * @private
+     * @return - Consent query parameters; empty when unavailable
+     */
+    private getConsentParams(): URLSearchParams {
+        try {
+            const consentParams = this.getConsents() || new URLSearchParams();
+            assert(
+                consentParams instanceof URLSearchParams,
+                `getConsents must return URLSearchParams but it returned ${consentParams}`,
+            );
+            return consentParams;
+        } catch (error) {
+            const log = this.log || console.warn;
+            log('Schibsted account SDK: could not read consents, logging in without them', error);
+            return new URLSearchParams();
+        }
+    }
+
+    /**
+     * Tells whether a URL is a login URL generated by this instance
+     * @private
+     * @param href
+     */
+    private isLoginUrl(href: string): boolean {
+        if (!isUrl(href)) {
+            return false;
+        }
+        const url = new URL(href);
+        const authorizeUrl = new URL(this.oauthService.makeUrl('oauth/authorize', {}, false));
+        return (
+            url.origin === authorizeUrl.origin &&
+            url.pathname === authorizeUrl.pathname &&
+            url.searchParams.get('client_id') === this.clientId
+        );
     }
 
     /**

package/src/index.ts

@@ -25,6 +25,7 @@ export type {
     LogoutRequestedEventDetail,
 } from './types/account.js';
 export type { AccountEnvironment, LogFunction } from './types/common.js';
+export type { ConsentReader } from './types/identity.js';
 export type {
     LoginOptions,
     SimplifiedLoginData,

package/src/types/account.ts

@@ -1,5 +1,9 @@
 import type { AccountBaseConfig, LogFunction } from './common';
-import type { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+import type {
+    ConsentReader,
+    IdentityBeforeRedirectCallback,
+    VarnishCookieOptions,
+} from './identity';
 import type { SessionResponse } from './session';
 
 /**
@@ -10,10 +14,17 @@ import type { SessionResponse } from './session';
 export type AccountConfig = Omit<AccountBaseConfig, 'env'> & {
     /** Schibsted account environment. Defaults to PRE. */
     env?: AccountBaseConfig['env'];
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
+    /** Refresh consents of rendered login links when clicked. Defaults to true. */
+    refreshLoginLinks?: boolean;
     /** Product or feature ids used by `hasAccess()` when no ids are passed to the method. */
     defaultProductIds?: readonly string[];
     /** Optional Varnish cookie setup applied during Account initialization. */

package/src/types/common.ts

@@ -2,11 +2,11 @@
 
 /**
  * Log callback used by the SDK for debug output.
- * Receives a pre-formatted log line.
+ * Receives a pre-formatted log line and, when reading consents fails, the error.
  *
  * @group Configuration
  */
-export type LogFunction = (message: string) => void;
+export type LogFunction = (message: string, error?: unknown) => void;
 
 /**
  * Supported Schibsted account environment keys.

package/src/types/identity.ts

@@ -1,5 +1,10 @@
 import type { AccountBaseConfig, LogFunction } from './common';
 
+/**
+ * Synchronously returns the current consents as query parameters; must not wait for the user's decision.
+ */
+export type ConsentReader = () => URLSearchParams | null;
+
 /**
  * Callback invoked before the SDK performs a full-page session refresh redirect.
  */
@@ -9,10 +14,15 @@ export type IdentityBeforeRedirectCallback = () => void | Promise<void>;
  * Options accepted by the {@link Identity} constructor.
  */
 export type IdentityOptions = AccountBaseConfig & {
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
 };
 
 /**

package/src/version.ts

@@ -1,4 +1,4 @@
 // Version is bumped automatically by release-please. See release-please-config.json.
 
-const version = '6.0.0-alpha.13'; // x-release-please-version
+const version = '6.0.0-alpha.14'; // x-release-please-version
 export default version;