@schibsted/account-sdk-browser 6.0.0-alpha.2 → 6.0.0-alpha.4

package/src/identity.ts

@@ -4,202 +4,62 @@
 
 import { TinyEmitter } from 'tiny-emitter';
 import Cache from './cache.js';
-import { ENDPOINTS, NAMESPACE } from './config.js';
+import { ENDPOINTS } from './config.js';
 import { registerAndDispatchInGlobal } from './global-registry.js';
 import { cloneDeep } from './object.js';
 import * as popup from './popup.js';
-import RESTClient from './RESTClient.js';
-import SDKError from './SDKError.js';
-import * as spidTalk from './spidTalk.js';
+import type RESTClient from './rest-client.js';
+import { buildClientSdrn, createAccountRestClient } from './rest-clients.js';
+import SDKError from './sdk-error.js';
+import {
+    isConnectedSessionResponse,
+    isConnectedSessionWithUserIdResponse,
+    isRedirectSessionPayload,
+    isSessionFailureResponse,
+    isSessionSuccessResponse,
+    normalizeSessionResponse,
+} from './session-response.js';
+import * as spidTalk from './spid-talk.js';
+import type { LogFunction } from './types/common.js';
+import type {
+    IdentityBeforeRedirectCallback,
+    IdentityOptions,
+    VarnishCookieOptions,
+} from './types/identity.js';
+import {
+    hasOpenSimplifiedLoginWidget,
+    type LoginOptions,
+    type OpenSimplifiedLoginWidget,
+    type SimplifiedLoginData,
+    type SimplifiedLoginWidgetInitialParams,
+    type SimplifiedLoginWidgetLoginOptions,
+    type SimplifiedLoginWidgetOptions,
+} from './types/login.js';
+import type {
+    ConnectedSessionResponse,
+    NormalizedSessionPayload,
+    SessionObjectResponse,
+    SessionResponse,
+} from './types/session.js';
 import { urlMapper } from './url.js';
 import { assert, isNonEmptyString, isObject, isStr, isStrIn, isUrl } from './validate.js';
 import version from './version.js';
 
-/**
- * Options accepted by {@link Identity#login} and related login URL helpers.
- */
-export type LoginOptions = {
-    /**
-     * An opaque value used by the client to maintain state between the request and callback.
-     * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
-     */
-    state: string;
-    /**
-     * Authentication Context Class Reference Values. If omitted, the user will be asked to
-     * authenticate using username+password. For 2FA (Two-Factor Authentication) possible values
-     * are `sms`, `otp` (one time password), `password` (will force password confirmation, even if
-     * user is already logged in), `eid`. Those values might be mixed as space-separated string.
-     * To make sure that user has authenticated with 2FA you need to verify AMR (Authentication
-     * Methods References) claim in ID token. Might also be used to ensure additional acr
-     * (sms, otp, eid) for already logged in users. Supported value is also 'otp-email' means one
-     * time password using email.
-     */
-    acrValues?: string;
-    /**
-     * The OAuth scopes for the tokens. This is a list of scopes, separated by space. If the list
-     * of scopes contains `openid`, the generated tokens includes the id token which can be useful
-     * for getting information about the user. Omitting scope is allowed, while `invalid_scope` is
-     * returned when the client asks for a scope you aren't allowed to request.
-     * {@link https://tools.ietf.org/html/rfc6749#section-3.3}
-     * Defaults to `openid`.
-     */
-    scope?: string;
-    /**
-     * Redirect uri that will receive the code. Must exactly match a redirectUri from your client
-     * in self-service
-     */
-    redirectUri?: string;
-    /** Should we try to open a popup window? Defaults to `false`. */
-    preferPopup?: boolean;
-    /** user email or UUID hint */
-    loginHint?: string;
-    /** Pulse tag */
-    tag?: string;
-    /** Teaser slug. Teaser with given slug will be displayed in place of default teaser */
-    teaser?: string;
-    /**
-     * Specifies the allowable elapsed time in seconds since the last time the End-User was actively
-     * authenticated. If last authentication time is more than maxAge seconds in the past,
-     * re-authentication will be required. See the OpenID Connect spec section 3.1.2.1 for more
-     * information
-     */
-    maxAge?: number | string;
-    /**
-     * Optional parameter to overwrite client locale setting.
-     * New flows supports nb_NO, fi_FI, sv_SE, en_US
-     */
-    locale?: string;
-    /** display username and password on one screen. Defaults to `false`. */
-    oneStepLogin?: boolean;
-    /**
-     * String that specifies whether the Authorization Server prompts the End-User for
-     * reauthentication or confirm account screen. Supported values: `select_account` or `login`.
-     * Defaults to `select_account`.
-     */
-    prompt?: string;
-    /** Identifier for cross-domain tracking in Pulse */
-    xDomainId?: string;
-    /** Environment for cross-domain tracking in Pulse */
-    xEnvironmentId?: string;
-    /** Campaign identifier for tracking in Pulse */
-    originCampaign?: string;
-};
-
-/**
- * Identical to {@link LoginOptions} except that `state` may also be a (possibly async) function;
- * all other fields reuse the `LoginOptions` documentation.
- */
-export type SimplifiedLoginWidgetLoginOptions = Omit<LoginOptions, 'state'> & {
-    /**
-     * An opaque value used by the client to maintain state between the request and callback.
-     * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
-     */
-    state: string | (() => string | Promise<string>);
-};
-
-/**
- * Successful response returned from {@link Identity#hasSession}.
- */
-export type HasSessionSuccessResponse = {
-    /**
-     * Is the user connected to the merchant? (it means that the merchant id is in the list of
-     * merchants listed of this user in the database)? Example: false
-     */
-    result: boolean;
-    /** Example: 'notConnected' or 'connected'. Deprecated, use `Identity.isConnected()` */
-    userStatus: string;
-    /** Example: 'localhost' */
-    baseDomain: string;
-    /** Example: '58eca10fdbb9f6df72c3368f'. Obsolete */
-    id: string;
-    /** Example: 37162 */
-    userId: number;
-    /** Example: 'b3b23aa7-34f2-5d02-a10e-5a3455c6ab2c' */
-    uuid: string;
-    /** Example: 'eyJjbGllbnRfaWQ...' */
-    sp_id: string;
-    /** Example: 30 * 60 * 1000 (for 30 minutes) */
-    expiresIn: number;
-    /** Example: 1506285759 */
-    serverTime: number;
-    /**
-     * Example: 'NCdzXaz4ZRb7...' The sig parameter is a concatenation of an HMAC SHA-256 signature
-     * string, a dot (.) and a base64url encoded JSON object (session).
-     * {@link http://techdocs.spid.no/sdks/js/response-signature-and-validation/}
-     */
-    sig: string;
-    /** (Only for connected users) Example: 'batman' */
-    displayName: string;
-    /** (Only for connected users) Example: 'Bruce' */
-    givenName: string;
-    /** (Only for connected users) Example: 'Wayne' */
-    familyName: string;
-    /** (Only for connected users) Example: 'male', 'female', 'undisclosed' */
-    gender: string;
-    /** (Only for connected users) Example: 'http://www.srv.com/some/picture.jpg' */
-    photo: string;
-    /** (Only for connected users) */
-    tracking: boolean;
-    /** (Only for connected users) */
-    clientAgreementAccepted: boolean;
-    /** (Only for connected users) */
-    defaultAgreementAccepted: boolean;
-    pairId: string;
-    sdrn: string;
-};
-
-/**
- * Failure response returned from {@link Identity#hasSession}.
- */
-export type HasSessionFailureResponse = {
-    error: {
-        /** Typically an HTTP response code. Example: 401 */
-        code: number;
-        /** Example: "No session found!" */
-        description: string;
-        /** Example: "UserException" */
-        type: string;
-    };
-    response: {
-        /** Example: "localhost" */
-        baseDomain: string;
-        /** Time span in milliseconds. Example: 30 * 60 * 1000 (for 30 minutes) */
-        expiresIn: number;
-        result: boolean;
-        /** Server time in seconds since the Unix Epoch. Example: 1506287788 */
-        serverTime: number;
-    };
-};
-
-/**
- * Minimal user information used by the simplified login widget flow.
- */
-export type SimplifiedLoginData = {
-    /** Deprecated: User UUID, to be be used as `loginHint` for {@link Identity#login} */
-    identifier: string;
-    /** Human-readable user identifier */
-    display_text: string;
-    /** Client name */
-    client_name: string;
-};
-
-/**
- * Configuration options for {@link Identity#showSimplifiedLoginWidget}.
- */
-export type SimplifiedLoginWidgetOptions = {
-    /** expected encoding of simplified login widget. Could be utf-8 (default), iso-8859-1 or iso-8859-15 */
-    encoding: string;
-    /**
-     * expected locale of simplified login widget. Should be provided in a short format like 'nb',
-     * 'sv'. If not set, a value from the env variable is used.
-     */
-    locale?: 'nb' | 'sv' | 'fi' | 'da' | 'en';
-};
-
-/**
- * Emitted when an error happens (useful for debugging)
- * @event Identity#error
- */
+export { isConnectedSessionResponse, isSessionSuccessResponse } from './session-response.js';
+export type {
+    ConnectedSessionResponse,
+    SessionFailureResponse,
+    SessionObjectResponse,
+    SessionResponse,
+    SessionSuccessResponse,
+    SessionUserId,
+} from './types/session.js';
+
+declare global {
+    interface Window {
+        openSimplifiedLoginWidget?: OpenSimplifiedLoginWidget;
+    }
+}
 
 const HAS_SESSION_CACHE_KEY = 'hasSession-cache';
 const SESSION_CALL_BLOCKED_CACHE_KEY = 'sessionCallBlocked-cache';
@@ -216,24 +76,28 @@ const globalWindow = () => window;
  */
 export class Identity extends TinyEmitter {
     _sessionInitiatedSent: boolean;
-    window: any;
+    window: Window;
     clientId: string;
-    sessionStorageCache: any;
-    localStorageCache: any;
+    sessionStorageCache: Cache;
+    localStorageCache: Cache;
     redirectUri: string;
     env: string;
-    log?: Function;
-    callbackBeforeRedirect: Function;
+    log?: LogFunction;
+    callbackBeforeRedirect: IdentityBeforeRedirectCallback;
     _sessionDomain: string;
     _enableSessionCaching: boolean;
-    _session: any;
-    _spid!: RESTClient;
-    _oauthService!: RESTClient;
-    _bffService!: RESTClient;
-    _sessionService!: RESTClient;
-    _globalSessionService!: RESTClient;
-    _usedSessionServiceGetSessionEndpoint: any;
-    _hasSessionInProgress?: boolean | Promise<any>;
+    /**
+     * @internal Starts as `{}` before the first `hasSession()` call, then stores the latest
+     * object response from hasSession().
+     */
+    _session: SessionObjectResponse;
+    _spid: RESTClient;
+    _oauthService: RESTClient;
+    _bffService: RESTClient;
+    _sessionService: RESTClient;
+    _globalSessionService: RESTClient;
+    _usedSessionServiceGetSessionEndpoint: 'v2/session' | 'session';
+    _hasSessionInProgress?: false | Promise<SessionResponse>;
     popup?: Window | null;
     setVarnishCookie?: boolean;
     varnishExpiresIn?: number;
@@ -259,15 +123,7 @@ export class Identity extends TinyEmitter {
         log,
         window = globalWindow(),
         callbackBeforeRedirect = () => {},
-    }: {
-        clientId: string;
-        sessionDomain: string;
-        redirectUri: string;
-        env?: string;
-        log?: Function;
-        window?: Window;
-        callbackBeforeRedirect?: Function;
-    }) {
+    }: IdentityOptions) {
         super();
         assert(isNonEmptyString(clientId), 'clientId parameter is required');
         assert(isObject(window), 'The reference to window is missing');
@@ -276,6 +132,7 @@ export class Identity extends TinyEmitter {
             isNonEmptyString(sessionDomain) && isUrl(sessionDomain),
             'sessionDomain parameter is not a valid URL',
         );
+        assert(isStr(env), `env parameter is invalid: ${env}`);
 
         spidTalk.emulate(window);
         this._sessionInitiatedSent = false;
@@ -295,16 +152,43 @@ export class Identity extends TinyEmitter {
         // Old session
         this._session = {};
 
-        this._setSessionServiceUrl(sessionDomain);
+        const accountClientParams = { client_id: this.clientId, redirect_uri: this.redirectUri };
+        const clientSdrn = buildClientSdrn(this.env, this.clientId);
+
+        this._sessionService = createAccountRestClient({
+            serverUrl: sessionDomain,
+            log: this.log,
+            defaultParams: {
+                client_sdrn: clientSdrn,
+                redirect_uri: this.redirectUri,
+                sdk_version: version,
+            },
+        });
         this._usedSessionServiceGetSessionEndpoint =
             this._sessionService.url.pathname && this._sessionService.url.pathname.length <= 1
                 ? 'v2/session'
                 : 'session';
 
-        this._setSpidServerUrl(env);
-        this._setBffServerUrl(env);
-        this._setOauthServerUrl(env);
-        this._setGlobalSessionServiceUrl(env);
+        this._spid = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SPiD),
+            log: this.log,
+            defaultParams: accountClientParams,
+        });
+        this._bffService = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.BFF),
+            log: this.log,
+            defaultParams: accountClientParams,
+        });
+        this._oauthService = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SPiD),
+            log: this.log,
+            defaultParams: accountClientParams,
+        });
+        this._globalSessionService = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SESSION_SERVICE),
+            log: this.log,
+            defaultParams: { client_sdrn: clientSdrn, sdk_version: version },
+        });
 
         this._unblockSessionCall();
 
@@ -318,7 +202,7 @@ export class Identity extends TinyEmitter {
     _getTabId(): number | undefined {
         if (this._enableSessionCaching) {
             const tabId = this.sessionStorageCache.get(TAB_ID_KEY);
-            if (!tabId) {
+            if (typeof tabId !== 'number') {
                 this.sessionStorageCache.set(TAB_ID_KEY, TAB_ID, TAB_ID_TTL);
                 return TAB_ID;
             }
@@ -332,8 +216,8 @@ export class Identity extends TinyEmitter {
      * @private
      *
      */
-    _isSessionCallBlocked(): boolean | void {
-        return this.localStorageCache.get(SESSION_CALL_BLOCKED_CACHE_KEY);
+    _isSessionCallBlocked(): boolean {
+        return Boolean(this.localStorageCache.get(SESSION_CALL_BLOCKED_CACHE_KEY));
     }
 
     /**
@@ -361,97 +245,34 @@ export class Identity extends TinyEmitter {
     }
 
     /**
-     * Set SPiD server URL
-     * @private
-     * @param url - real URL or 'PRE' style key
-     */
-    _setSpidServerUrl(url: string): void {
-        assert(isStr(url), `url parameter is invalid: ${url}`);
-        this._spid = new RESTClient({
-            serverUrl: urlMapper(url, ENDPOINTS.SPiD),
-            log: this.log,
-            defaultParams: { client_id: this.clientId, redirect_uri: this.redirectUri },
-        });
-    }
-
-    /**
-     * Set OAuth server URL
-     * @private
-     * @param url - real URL or 'PRE' style key
-     */
-    _setOauthServerUrl(url: string): void {
-        assert(isStr(url), `url parameter is invalid: ${url}`);
-        this._oauthService = new RESTClient({
-            serverUrl: urlMapper(url, ENDPOINTS.SPiD),
-            log: this.log,
-            defaultParams: { client_id: this.clientId, redirect_uri: this.redirectUri },
-        });
-    }
-
-    /**
-     * Set BFF server URL
-     * @private
-     * @param url  - real URL or 'PRE' style key
-     */
-    _setBffServerUrl(url: string): void {
-        assert(isStr(url), `url parameter is invalid: ${url}`);
-        this._bffService = new RESTClient({
-            serverUrl: urlMapper(url, ENDPOINTS.BFF),
-            log: this.log,
-            defaultParams: { client_id: this.clientId, redirect_uri: this.redirectUri },
-        });
-    }
-
-    /**
-     * Set site-specific session-service domain
-     * @private
-     * @param domain - real URL — (**not** 'PRE' style env key)
-     */
-    _setSessionServiceUrl(domain: string): void {
-        assert(isStr(domain), `domain parameter is invalid: ${domain}`);
-        const client_sdrn = `sdrn:${NAMESPACE[this.env as keyof typeof NAMESPACE]}:client:${this.clientId}`;
-        this._sessionService = new RESTClient({
-            serverUrl: domain,
-            log: this.log,
-            defaultParams: { client_sdrn, redirect_uri: this.redirectUri, sdk_version: version },
-        });
-    }
-
-    /**
-     * Set global session-service server URL
-     * @private
-     * @param url - real URL or 'PRE' style key
-     */
-    _setGlobalSessionServiceUrl(url: string): void {
-        assert(isStr(url), `url parameter is invalid: ${url}`);
-        const client_sdrn = `sdrn:${NAMESPACE[this.env as keyof typeof NAMESPACE]}:client:${this.clientId}`;
-        this._globalSessionService = new RESTClient({
-            serverUrl: urlMapper(url, ENDPOINTS.SESSION_SERVICE),
-            log: this.log,
-            defaultParams: { client_sdrn, sdk_version: version },
-        });
-    }
-
-    /**
-     * Emits the relevant events based on the previous and new reply from hassession
+     * Emits the relevant events based on the previous and new reply from hasSession
      * @private
      * @param previous
      * @param current
      */
-    _emitSessionEvent(previous: any, current: any): void {
+    _emitSessionEvent(previous: object, current: object): void {
+        const previousUserId = isSessionSuccessResponse(previous) ? previous.userId : undefined;
+        const currentUserId = isSessionSuccessResponse(current) ? current.userId : undefined;
+        const previousUserStatus = isSessionSuccessResponse(previous)
+            ? previous.userStatus
+            : undefined;
+        const currentUserStatus = isSessionSuccessResponse(current)
+            ? current.userStatus
+            : undefined;
+
         /**
          * Emitted when the user is logged in (This happens as a result of calling
          * {@link Identity#hasSession}, so it is also emitted if the user was previously logged in)
          * @event Identity#login
          */
-        if (current.userId) {
+        if (currentUserId) {
             this.emit('login', current);
         }
         /**
          * Emitted when the user logged out
          * @event Identity#logout
          */
-        if (previous.userId && !current.userId) {
+        if (previousUserId && !currentUserId) {
             this.emit('logout', current);
         }
         /**
@@ -460,10 +281,10 @@ export class Identity extends TinyEmitter {
          * this invocation, and the userId has now changed
          * @event Identity#userChange
          */
-        if (previous.userId && current.userId && previous.userId !== current.userId) {
+        if (previousUserId && currentUserId && previousUserId !== currentUserId) {
             this.emit('userChange', current);
         }
-        if (previous.userId || current.userId) {
+        if (previousUserId || currentUserId) {
             /**
              * Emitted when the session is changed. More accurately, this event is emitted if there
              * was a logged-in user either before or after {@link Identity#hasSession} was called.
@@ -483,7 +304,7 @@ export class Identity extends TinyEmitter {
          * Emitted when the session is first created
          * @event Identity#sessionInit
          */
-        if (current.userId && !this._sessionInitiatedSent) {
+        if (currentUserId && !this._sessionInitiatedSent) {
             this._sessionInitiatedSent = true;
             this.emit('sessionInit', current);
         }
@@ -492,7 +313,7 @@ export class Identity extends TinyEmitter {
          * {@link Identity#hasSession}
          * @event Identity#statusChange
          */
-        if (previous.userStatus !== current.userStatus) {
+        if (previousUserStatus !== currentUserStatus) {
             this.emit('statusChange', current);
         }
     }
@@ -518,16 +339,13 @@ export class Identity extends TinyEmitter {
      * cookie expires. The default is to use the same time that hasSession responses are cached for
      * @param options.domain Override cookie domain. E.g. «vg.no» instead of «www.vg.no»
      */
-    enableVarnishCookie(options?: { expiresIn?: number; domain?: string }): void {
-        let expiresIn = 0;
-        let domain: string | undefined;
-        if (Number.isInteger(options)) {
-            expiresIn = options as any;
-        } else if (typeof options == 'object') {
-            expiresIn = (options as any).expiresIn || expiresIn;
-            domain = (options as any).domain || domain;
+    enableVarnishCookie(options: VarnishCookieOptions): void {
+        if (typeof options !== 'object') {
+            throw new SDKError('VarnishCookieOptions must be an object');
         }
 
+        const { expiresIn = 0, domain } = options;
+
         assert(Number.isInteger(expiresIn), `'expiresIn' must be an integer`);
         assert(expiresIn >= 0, `'expiresIn' cannot be negative`);
         this.setVarnishCookie = true;
@@ -540,8 +358,8 @@ export class Identity extends TinyEmitter {
      * @private
      * @param sessionData
      */
-    _maybeSetVarnishCookie(sessionData: HasSessionSuccessResponse): void {
-        if (!this.setVarnishCookie) {
+    _maybeSetVarnishCookie(sessionData: object): void {
+        if (!this.setVarnishCookie || !isSessionSuccessResponse(sessionData)) {
             return;
         }
         const date = new Date();
@@ -549,7 +367,7 @@ export class Identity extends TinyEmitter {
             this.varnishExpiresIn ||
             (typeof sessionData.expiresIn === 'number' && sessionData.expiresIn > 0);
         if (validExpires) {
-            const expires = this.varnishExpiresIn || sessionData.expiresIn;
+            const expires = this.varnishExpiresIn || sessionData.expiresIn || 0;
             date.setTime(date.getTime() + expires * 1000);
         } else {
             date.setTime(0);
@@ -560,7 +378,7 @@ export class Identity extends TinyEmitter {
             this.varnishCookieDomain ||
             (typeof sessionData.baseDomain === 'string'
                 ? sessionData.baseDomain
-                : document.domain) ||
+                : this.window.location.hostname) ||
             '';
 
         const cookie = [
@@ -588,9 +406,11 @@ export class Identity extends TinyEmitter {
      */
     _clearVarnishCookie(): void {
         const baseDomain =
-            this._session && typeof this._session.baseDomain === 'string'
+            this._session &&
+            isSessionSuccessResponse(this._session) &&
+            typeof this._session.baseDomain === 'string'
                 ? this._session.baseDomain
-                : document.domain;
+                : this.window.location.hostname;
 
         const domain = this.varnishCookieDomain || baseDomain || '';
 
@@ -634,21 +454,24 @@ export class Identity extends TinyEmitter {
      * @fires Identity#statusChange
      * @fires Identity#error
      */
-    hasSession(): Promise<HasSessionSuccessResponse | HasSessionFailureResponse> {
+    hasSession(): Promise<SessionResponse> {
         const isSessionCallBlocked = this._isSessionCallBlocked();
+
         if (isSessionCallBlocked) {
-            return this._session;
+            const sessionData = normalizeSessionResponse(this._session);
+            return Promise.resolve(isRedirectSessionPayload(sessionData) ? {} : sessionData);
         }
 
         if (this._hasSessionInProgress) {
-            return this._hasSessionInProgress as Promise<
-                HasSessionSuccessResponse | HasSessionFailureResponse
-            >;
+            return this._hasSessionInProgress;
         }
 
-        const _postProcess = (sessionData: any) => {
-            if (sessionData.error) {
-                throw new SDKError('HasSession failed', sessionData.error);
+        const _postProcess = (sessionData: SessionObjectResponse): SessionObjectResponse => {
+            if (isSessionFailureResponse(sessionData)) {
+                const errorObject = isObject(sessionData.error)
+                    ? sessionData.error
+                    : { description: String(sessionData.error) };
+                throw new SDKError('HasSession failed', errorObject);
             }
             this._maybeSetVarnishCookie(sessionData);
             this._emitSessionEvent(this._session, sessionData);
@@ -656,31 +479,45 @@ export class Identity extends TinyEmitter {
             return sessionData;
         };
 
-        const _checkRedirectionNeed = (sessionData: any = {}) => {
-            const sessionDataKeys = Object.keys(sessionData);
-
-            return sessionDataKeys.length === 1 && sessionDataKeys[0] === 'redirectURL';
+        const _getCachedSession = (): NormalizedSessionPayload | null => {
+            const cachedSession = this.sessionStorageCache.get(HAS_SESSION_CACHE_KEY);
+            return cachedSession ? normalizeSessionResponse(cachedSession) : null;
         };
 
-        const _getSession = async () => {
+        const _getSession = async (): Promise<SessionResponse> => {
             if (this._enableSessionCaching) {
                 // Try to resolve from cache (it has a TTL)
-                const cachedSession = this.sessionStorageCache.get(HAS_SESSION_CACHE_KEY);
+                const cachedSession = _getCachedSession();
                 if (cachedSession) {
+                    if (isRedirectSessionPayload(cachedSession)) {
+                        return {};
+                    }
                     return _postProcess(cachedSession);
                 }
             }
-            let sessionData = null;
+            let sessionData: NormalizedSessionPayload | null = null;
             try {
                 sessionData = await this._sessionService.get(
                     this._usedSessionServiceGetSessionEndpoint,
                     { tabId: this._getTabId() },
+                    normalizeSessionResponse,
                 );
-            } catch (err: any) {
-                if (err && err.code === 400 && this._enableSessionCaching) {
-                    const expiresIn = 1000 * (err.expiresIn || 300);
+            } catch (err: unknown) {
+                const cacheableError = isObject(err) ? err : undefined;
+                if (cacheableError?.code === 400 && this._enableSessionCaching) {
+                    const errorExpiresIn =
+                        typeof cacheableError.expiresIn === 'number'
+                            ? cacheableError.expiresIn
+                            : 300;
+                    const expiresIn = 1000 * errorExpiresIn;
                     this.sessionStorageCache.set(HAS_SESSION_CACHE_KEY, { error: err }, expiresIn);
-                } else if (err && err.code >= 500 && err.code < 600 && this._enableSessionCaching) {
+                } else if (
+                    cacheableError &&
+                    typeof cacheableError.code === 'number' &&
+                    cacheableError.code >= 500 &&
+                    cacheableError.code < 600 &&
+                    this._enableSessionCaching
+                ) {
                     // Temporary fix: 30 seconds cache to limit number of calls when service is unavailable
                     this.sessionStorageCache.set(HAS_SESSION_CACHE_KEY, { error: err }, 30 * 1000);
                 }
@@ -689,33 +526,35 @@ export class Identity extends TinyEmitter {
 
             if (sessionData) {
                 // for expiring session and safari browser do full page redirect to gain new session
-                if (_checkRedirectionNeed(sessionData)) {
+                if (isRedirectSessionPayload(sessionData)) {
                     this._blockSessionCall();
 
                     await this.callbackBeforeRedirect();
 
-                    return this._sessionService.makeUrl(sessionData.redirectURL, {
+                    const redirectUrl = this._sessionService.makeUrl(sessionData.redirectURL, {
                         tabId: this._getTabId(),
                     });
+                    return redirectUrl;
                 }
 
                 if (this._enableSessionCaching) {
-                    const expiresIn = 1000 * (sessionData.expiresIn || 300);
+                    const expiresIn =
+                        1000 *
+                        (isSessionSuccessResponse(sessionData)
+                            ? sessionData.expiresIn || 300
+                            : 300);
                     this.sessionStorageCache.set(HAS_SESSION_CACHE_KEY, sessionData, expiresIn);
                 }
             }
 
-            return _postProcess(sessionData);
+            return _postProcess(sessionData ?? {});
         };
         this._hasSessionInProgress = _getSession().then(
             (sessionData) => {
                 this._hasSessionInProgress = false;
-
-                if (isUrl(sessionData)) {
+                if (typeof sessionData === 'string') {
                     this.window.location.href = sessionData;
-                    return sessionData;
                 }
-
                 return sessionData;
             },
             (err) => {
@@ -725,9 +564,7 @@ export class Identity extends TinyEmitter {
             },
         );
 
-        return this._hasSessionInProgress as Promise<
-            HasSessionSuccessResponse | HasSessionFailureResponse
-        >;
+        return this._hasSessionInProgress;
     }
 
     /**
@@ -738,7 +575,7 @@ export class Identity extends TinyEmitter {
     async isLoggedIn(): Promise<boolean> {
         try {
             const data = await this.hasSession();
-            return 'result' in data;
+            return isSessionSuccessResponse(data);
         } catch (_) {
             return false;
         }
@@ -761,10 +598,7 @@ export class Identity extends TinyEmitter {
      */
     async isConnected(): Promise<boolean> {
         try {
-            const data = (await this.hasSession()) as any;
-            // if data is not an object, the promise will fail.
-            // if the result is present, it's boolean. But if it's not, it should be assumed false.
-            return !!data.result;
+            return isConnectedSessionResponse(await this.hasSession());
         } catch (_) {
             return false;
         }
@@ -777,9 +611,9 @@ export class Identity extends TinyEmitter {
      * @throws {SDKError} If the user isn't connected to the merchant
      * @throws {SDKError} If we couldn't get the user
      */
-    async getUser(): Promise<HasSessionSuccessResponse> {
-        const user = (await this.hasSession()) as any;
-        if (!user.result) {
+    async getUser(): Promise<ConnectedSessionResponse> {
+        const user = await this.hasSession();
+        if (!isConnectedSessionResponse(user)) {
             throw new SDKError('The user is not connected to this merchant');
         }
         return cloneDeep(user);
@@ -800,9 +634,9 @@ export class Identity extends TinyEmitter {
      * @return The `userId` field (not to be confused with the `uuid`)
      */
     async getUserId(): Promise<string> {
-        const user = (await this.hasSession()) as any;
-        if (user.userId && user.result) {
-            return user.userId;
+        const user = await this.hasSession();
+        if (isConnectedSessionWithUserIdResponse(user)) {
+            return String(user.userId);
         }
         throw new SDKError('The user is not connected to this merchant');
     }
@@ -829,30 +663,35 @@ export class Identity extends TinyEmitter {
      * @return The merchant- and 3rd-party-specific `externalId`
      */
     async getExternalId(externalParty: string, optionalSuffix: string = ''): Promise<string> {
-        const { pairId } = (await this.hasSession()) as any;
+        const user = await this.hasSession();
+        const pairId = isSessionSuccessResponse(user) ? user.pairId : undefined;
 
         if (!pairId) throw new SDKError('pairId missing in user session!');
 
         if (!externalParty || externalParty.length === 0) {
             throw new SDKError('externalParty cannot be empty');
         }
-        const _toHexDigest = (hashBuffer: any) => {
+        const _toHexDigest = (hashBuffer: ArrayBuffer) => {
             // convert buffer to byte array
             const hashArray = Array.from(new Uint8Array(hashBuffer));
             // convert bytes to hex string
             return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
         };
 
-        const _getSha256Digest = (data: any) => {
+        const _getSha256Digest = (data: BufferSource) => {
             return crypto.subtle.digest('SHA-256', data);
         };
 
-        const _hashMessage = async (message: any) => {
+        const _hashMessage = async (message: string) => {
             const msgUint8 = new TextEncoder().encode(message);
-            return _getSha256Digest(msgUint8).then((it: any) => _toHexDigest(it));
+            return _getSha256Digest(msgUint8).then((it) => _toHexDigest(it));
         };
 
-        const _constructMessage = (pairId: any, externalParty: any, optionalSuffix: any) => {
+        const _constructMessage = (
+            pairId: string,
+            externalParty: string,
+            optionalSuffix: string,
+        ) => {
             return optionalSuffix
                 ? `${pairId}:${externalParty}:${optionalSuffix}`
                 : `${pairId}:${externalParty}`;
@@ -868,9 +707,9 @@ export class Identity extends TinyEmitter {
      * @throws {SDKError} If the SDRN is missing in user session object.
      */
     async getUserSDRN(): Promise<string> {
-        const { sdrn } = (await this.hasSession()) as any;
-        if (sdrn) {
-            return sdrn;
+        const user = await this.hasSession();
+        if (isSessionSuccessResponse(user) && user.sdrn) {
+            return user.sdrn;
         }
         throw new SDKError('Failed to get SDRN from user session');
     }
@@ -888,8 +727,8 @@ export class Identity extends TinyEmitter {
      * @return The `uuid` field (not to be confused with the `userId`)
      */
     async getUserUuid(): Promise<string> {
-        const user = (await this.hasSession()) as any;
-        if (user.uuid && user.result) {
+        const user = await this.hasSession();
+        if (isSessionSuccessResponse(user) && user.uuid && user.result) {
             return user.uuid;
         }
         throw new SDKError('The user is not connected to this merchant');
@@ -905,7 +744,16 @@ export class Identity extends TinyEmitter {
      */
     async getUserContextData(): Promise<SimplifiedLoginData | null> {
         try {
-            return await this._globalSessionService.get('user-context');
+            return await this._globalSessionService.get('user-context', undefined, (value) =>
+                isObject(value) && isStr(value.identifier)
+                    ? {
+                          identifier: value.identifier,
+                          display_text: isStr(value.display_text) ? value.display_text : '',
+                          client_name: isStr(value.client_name) ? value.client_name : '',
+                          provider_id: isStr(value.provider_id) ? value.provider_id : undefined,
+                      }
+                    : null,
+            );
         } catch (_) {
             return null;
         }
@@ -938,7 +786,7 @@ export class Identity extends TinyEmitter {
      */
     login({
         state,
-        acrValues = '',
+        acrValues,
         scope = 'openid',
         redirectUri = this.redirectUri,
         preferPopup = false,
@@ -946,7 +794,7 @@ export class Identity extends TinyEmitter {
         tag = '',
         teaser = '',
         maxAge = '',
-        locale = '',
+        locale,
         oneStepLogin = false,
         prompt = 'select_account',
         xDomainId = '',
@@ -993,8 +841,12 @@ export class Identity extends TinyEmitter {
      */
     async getSpId(): Promise<string | null> {
         try {
-            const user = (await this.hasSession()) as any;
-            return user.sp_id || null;
+            const user = await this.hasSession();
+            if (isSessionSuccessResponse(user)) {
+                return user.sp_id || null;
+            }
+            const spId = isObject(user) && 'sp_id' in user ? user.sp_id : undefined;
+            return isStr(spId) ? spId : null;
         } catch (_) {
             return null;
         }
@@ -1031,37 +883,23 @@ export class Identity extends TinyEmitter {
      * @param options.originCampaign
      * @return - The url
      */
-    loginUrl(
-        {
-            state,
-            acrValues = '',
-            scope = 'openid',
-            redirectUri = this.redirectUri,
-            loginHint = '',
-            tag = '',
-            teaser = '',
-            maxAge = '',
-            locale = '',
-            oneStepLogin = false,
-            prompt = 'select_account',
-            xDomainId = '',
-            xEnvironmentId = '',
-            originCampaign = '',
-        }: LoginOptions,
-        ..._args: any[]
-    ): string {
-        if (typeof arguments[0] !== 'object') {
-            // backward compatibility
-            state = arguments[0];
-            acrValues = arguments[1];
-            scope = arguments[2] || scope;
-            redirectUri = arguments[3] || redirectUri;
-            loginHint = arguments[4] || loginHint;
-            tag = arguments[5] || tag;
-            teaser = arguments[6] || teaser;
-            maxAge = isNaN(arguments[7]) ? maxAge : arguments[7];
-        }
-        const isValidAcrValue = (acrValue: any) =>
+    loginUrl({
+        state,
+        acrValues = '',
+        scope = 'openid',
+        redirectUri = this.redirectUri,
+        loginHint = '',
+        tag = '',
+        teaser = '',
+        maxAge = '',
+        locale,
+        oneStepLogin = false,
+        prompt = 'select_account',
+        xDomainId = '',
+        xEnvironmentId = '',
+        originCampaign = '',
+    }: LoginOptions): string {
+        const isValidAcrValue = (acrValue: string) =>
             isStrIn(
                 acrValue,
                 ['password', 'otp', 'sms', 'eid-dk', 'eid-no', 'eid-se', 'eid-fi', 'eid'],
@@ -1074,7 +912,7 @@ export class Identity extends TinyEmitter {
             `The acrValues parameter is not acceptable: ${acrValues}`,
         );
         assert(
-            isUrl(redirectUri as string),
+            isUrl(redirectUri),
             `loginUrl(): redirectUri must be a valid url but is ${redirectUri}`,
         );
         assert(
@@ -1144,12 +982,13 @@ export class Identity extends TinyEmitter {
      * @param options - additional configuration of Simplified Login Widget
      * @fires Identity#simplifiedLoginOpened
      * @fires Identity#simplifiedLoginCancelled
-     * @return - will resolve to true if widget will be display. Otherwise, will throw SDKError
+     * @throws {SDKError} - If user context data is missing or the widget script cannot be loaded
+     * @return - will resolve to true if widget will be displayed
      */
     async showSimplifiedLoginWidget(
         loginParams: SimplifiedLoginWidgetLoginOptions,
         options?: SimplifiedLoginWidgetOptions,
-    ): Promise<boolean | SDKError> {
+    ): Promise<boolean> {
         // getUserContextData doesn't throw exception
         const userData = await this.getUserContextData();
 
@@ -1159,25 +998,32 @@ export class Identity extends TinyEmitter {
         }
         const widgetUrl = this._bffService.makeUrl('simplified-login-widget', queryParams, false);
 
-        const prepareLoginParams = async (loginPrams: any) => {
-            if (typeof loginPrams.state === 'function') {
-                loginPrams.state = await loginPrams.state();
-            }
-
-            return loginPrams;
+        const prepareLoginParams = async (
+            loginParams: SimplifiedLoginWidgetLoginOptions,
+        ): Promise<LoginOptions> => {
+            const state =
+                typeof loginParams.state === 'function'
+                    ? await loginParams.state()
+                    : loginParams.state;
+
+            return {
+                ...loginParams,
+                state,
+            };
         };
 
-        return new Promise((resolve, reject) => {
-            if (!userData || !userData.display_text || !userData.identifier) {
-                return reject(new SDKError('Missing user data'));
+        return new Promise<boolean>((resolve, reject) => {
+            if (!userData?.display_text || !userData.identifier) {
+                reject(new SDKError('Missing user data'));
+                return;
             }
 
-            const initialParams: Record<string, any> = {
+            const initialParams: SimplifiedLoginWidgetInitialParams = {
                 displayText: userData.display_text,
                 env: this.env,
-                clientName: userData.client_name,
+                clientName: userData.client_name || '',
                 clientId: this.clientId,
-                providerId: (userData as any).provider_id,
+                providerId: userData.provider_id,
                 windowWidth: () => window.innerWidth,
                 windowOnResize: (f: () => void) => {
                     window.onresize = f;
@@ -1214,15 +1060,11 @@ export class Identity extends TinyEmitter {
             };
 
             const cancelLoginHandler = () => {
-                /**
-                 * Emitted when the user closes the simplified login widget
-                 * @event Identity#simplifiedLoginCancelled
-                 */
                 this.emit('simplifiedLoginCancelled');
             };
 
-            if ((window as any).openSimplifiedLoginWidget) {
-                (window as any).openSimplifiedLoginWidget(
+            if (hasOpenSimplifiedLoginWidget(window)) {
+                window.openSimplifiedLoginWidget(
                     initialParams,
                     loginHandler,
                     loginNotYouHandler,
@@ -1236,7 +1078,11 @@ export class Identity extends TinyEmitter {
             simplifiedLoginWidget.type = 'text/javascript';
             simplifiedLoginWidget.src = widgetUrl;
             simplifiedLoginWidget.onload = () => {
-                (window as any).openSimplifiedLoginWidget(
+                if (!hasOpenSimplifiedLoginWidget(window)) {
+                    reject(new SDKError('Error when loading simplified login widget content'));
+                    return;
+                }
+                window.openSimplifiedLoginWidget(
                     initialParams,
                     loginHandler,
                     loginNotYouHandler,