@schibsted/account-sdk-browser 6.0.0-alpha.2 → 6.0.0-alpha.4

package/src/index.ts

@@ -2,6 +2,31 @@
  * See LICENSE.md in the project root.
  */
 
-export * from './identity.js';
-export * from './monetization.js';
-export { default as SDKError } from './SDKError.js';
+export { Account } from './account.js';
+export { createAccountSdk, getAccountSdk } from './account-sdk.js';
+export { default as SDKError } from './sdk-error.js';
+
+/* public available types */
+export type {
+    AccountConfig,
+    AccountEventHandler,
+    AccountEventName,
+    AccountSessionEventName,
+} from './types/account.js';
+export type { AccountEnvironment, LogFunction } from './types/common.js';
+export type {
+    LoginOptions,
+    SimplifiedLoginData,
+    SimplifiedLoginWidgetLoginOptions,
+    SimplifiedLoginWidgetOptions,
+} from './types/login.js';
+export type { HasAccessResult } from './types/monetization.js';
+export type {
+    ConnectedSessionResponse,
+    ConnectedSessionWithUserIdResponse,
+    RedirectSessionResponse,
+    SessionFailureResponse,
+    SessionResponse,
+    SessionSuccessResponse,
+    SessionUserId,
+} from './types/session.js';

package/src/monetization.ts

@@ -4,33 +4,21 @@
 
 import { TinyEmitter } from 'tiny-emitter';
 import Cache from './cache.js';
-import { ENDPOINTS, NAMESPACE } from './config.js';
+import { ENDPOINTS } from './config.js';
 import { registerAndDispatchInGlobal } from './global-registry.js';
-import RESTClient from './RESTClient.js';
-import SDKError from './SDKError.js';
-import * as spidTalk from './spidTalk.js';
+import { parseHasAccessResult } from './has-access-response.js';
+import type { SessionUserId } from './identity.js';
+import type RESTClient from './rest-client.js';
+import { buildClientSdrn, createAccountRestClient } from './rest-clients.js';
+import SDKError from './sdk-error.js';
+import * as spidTalk from './spid-talk.js';
+import type { HasAccessResult, MonetizationOptions } from './types/monetization.js';
 import { urlMapper } from './url.js';
 import { assert, isNonEmptyString, isStr, isUrl } from './validate.js';
 import version from './version.js';
 
 const globalWindow = () => window;
 
-/**
- * Result returned by the Session Service `/hasAccess` endpoint, describing whether the user
- * is entitled to a requested set of products/features.
- * @internal
- */
-export interface HasAccessResult {
-    /** Whether the user is entitled to at least one of the requested products/features. */
-    entitled: boolean;
-    /** How long this result stays valid, in seconds, before the cache entry expires. */
-    ttl: number;
-    allowedFeatures: string[];
-    userId: number;
-    uuid: string;
-    sig: string;
-}
-
 /**
  * Provides features related to monetization
  */
@@ -38,8 +26,8 @@ export class Monetization extends TinyEmitter {
     cache: Cache;
     clientId: string;
     env: string;
-    redirectUri: string;
-    _spid!: RESTClient;
+    redirectUri?: string;
+    _spid: RESTClient;
     _sessionService?: RESTClient;
     private pendingHasAccessRequests: Record<string, Promise<HasAccessResult>>;
 
@@ -53,63 +41,36 @@ export class Monetization extends TinyEmitter {
         env = 'PRE',
         sessionDomain,
         window = globalWindow(),
-    }: {
-        /** Mandatory client id */
-        clientId: string;
-        /** Redirect uri */
-        redirectUri: string;
-        /** Example: `"https://id.site.com"` */
-        sessionDomain: string;
-        /** Schibsted account environment: `PRE` (default), `PRO`, `PRO_NO` */
-        env?: string;
-        /** Window object to use (defaults to the global `window`). */
-        window?: Window;
-    }) {
+    }: MonetizationOptions) {
         super();
         spidTalk.emulate(window);
         assert(isNonEmptyString(clientId), 'clientId parameter is required');
+        assert(isStr(env), `env parameter is invalid: ${env}`);
 
         this.cache = new Cache(() => window && window.sessionStorage);
         this.clientId = clientId;
         this.env = env;
         this.redirectUri = redirectUri;
         this.pendingHasAccessRequests = {};
-        this._setSpidServerUrl(env);
+        this._spid = createAccountRestClient({
+            serverUrl: urlMapper(env, ENDPOINTS.SPiD),
+            defaultParams: { client_id: this.clientId, redirect_uri: this.redirectUri },
+        });
 
         if (sessionDomain) {
             assert(isUrl(sessionDomain), 'sessionDomain parameter is not a valid URL');
-            this._setSessionServiceUrl(sessionDomain);
+            this._sessionService = createAccountRestClient({
+                serverUrl: sessionDomain,
+                defaultParams: {
+                    client_sdrn: buildClientSdrn(this.env, this.clientId),
+                    redirect_uri: this.redirectUri,
+                    sdk_version: version,
+                },
+            });
         }
         registerAndDispatchInGlobal(window, 'schMonetization', this);
     }
 
-    /**
-     * Set SPiD server URL
-     * @private
-     * @param url
-     */
-    private _setSpidServerUrl(url: string): void {
-        assert(isStr(url), `url parameter is invalid: ${url}`);
-        this._spid = new RESTClient({
-            serverUrl: urlMapper(url, ENDPOINTS.SPiD),
-            defaultParams: { client_id: this.clientId, redirect_uri: this.redirectUri },
-        });
-    }
-
-    /**
-     * Set session-service domain
-     * @private
-     * @param domain - real URL — (**not** 'PRE' style env key)
-     */
-    private _setSessionServiceUrl(domain: string): void {
-        assert(isStr(domain), `domain parameter is invalid: ${domain}`);
-        const client_sdrn = `sdrn:${NAMESPACE[this.env as keyof typeof NAMESPACE]}:client:${this.clientId}`;
-        this._sessionService = new RESTClient({
-            serverUrl: domain,
-            defaultParams: { client_sdrn, redirect_uri: this.redirectUri, sdk_version: version },
-        });
-    }
-
     /**
      * Checks if the user has access to a set of products or features.
      * @param productIds - which products/features to check
@@ -119,7 +80,7 @@ export class Monetization extends TinyEmitter {
      * @returns The data object returned from Schibsted account (or `null` if the user
      * doesn't have access to any of the given products/features)
      */
-    async hasAccess(productIds: string[], userId: number): Promise<HasAccessResult | null> {
+    async hasAccess(productIds: string[], userId: SessionUserId): Promise<HasAccessResult | null> {
         if (!this._sessionService) {
             throw new SDKError(`hasAccess can only be called if 'sessionDomain' is configured`);
         }
@@ -137,6 +98,8 @@ export class Monetization extends TinyEmitter {
             if (!this.pendingHasAccessRequests[cacheKey]) {
                 this.pendingHasAccessRequests[cacheKey] = this._sessionService.get(
                     `/hasAccess/${sortedIds.join(',')}`,
+                    undefined,
+                    parseHasAccessResult,
                 );
             }
             const promise = this.pendingHasAccessRequests[cacheKey];
@@ -163,7 +126,7 @@ export class Monetization extends TinyEmitter {
      * @param productIds - which products/features to check
      * @param userId - id of currently logged in user
      */
-    clearCachedAccessResult(productIds: string[], userId: number): void {
+    clearCachedAccessResult(productIds: string[], userId: SessionUserId): void {
         this.cache.delete(this._accessCacheKey(productIds, userId));
     }
 
@@ -173,7 +136,7 @@ export class Monetization extends TinyEmitter {
      * @param productIds - which products/features to check
      * @param userId - id of currently logged in user
      */
-    private _accessCacheKey(productIds: string[], userId: number): string {
+    private _accessCacheKey(productIds: string[], userId: SessionUserId): string {
         return `prd_${[...productIds].sort()}_${userId}`;
     }
 
@@ -182,7 +145,7 @@ export class Monetization extends TinyEmitter {
      * @param redirectUri
      * @returns - The url to the subscriptions review page
      */
-    subscriptionsUrl(redirectUri: string = this.redirectUri): string {
+    subscriptionsUrl(redirectUri: string = this.redirectUri ?? ''): string {
         assert(isUrl(redirectUri), `subscriptionsUrl(): redirectUri is invalid`);
         return this._spid.makeUrl('account/subscriptions', { redirect_uri: redirectUri });
     }
@@ -192,7 +155,7 @@ export class Monetization extends TinyEmitter {
      * @param redirectUri
      * @returns - The url to the products review page
      */
-    productsUrl(redirectUri: string = this.redirectUri): string {
+    productsUrl(redirectUri: string = this.redirectUri ?? ''): string {
         assert(isUrl(redirectUri), `productsUrl(): redirectUri is invalid`);
         return this._spid.makeUrl('account/products', { redirect_uri: redirectUri });
     }

package/src/object.ts

@@ -7,7 +7,7 @@
  * @private
  */
 
-import SDKError from './SDKError.js';
+import SDKError from './sdk-error.js';
 import { assert, isNonEmptyObj, isObject } from './validate.js';
 
 /**

package/src/resolve-browser-window.ts

@@ -0,0 +1,11 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+export const resolveBrowserWindow = (providedWindow?: Window): Window | undefined => {
+    if (providedWindow) {
+        return providedWindow;
+    }
+
+    return typeof window === 'undefined' ? undefined : window;
+};

package/src/{RESTClient.ts → rest-client.ts}

@@ -3,7 +3,8 @@
  */
 
 import { cloneDefined } from './object.js';
-import SDKError from './SDKError.js';
+import SDKError from './sdk-error.js';
+import type { LogFunction } from './types/common.js';
 import { urlMapper } from './url.js';
 import { assert, isFunction, isNonEmptyString, isObject, isStr } from './validate.js';
 
@@ -15,13 +16,7 @@ import { assert, isFunction, isNonEmptyString, isObject, isStr } from './validat
 const logString = (msg: unknown[]): string =>
     msg.map((m) => (isObject(m) ? JSON.stringify(m, null, 2) : m)).join(' ');
 
-/**
- * Calls a log function passing a string
- * @private
- * @param fn - The log function
- * @param msg - The values to log
- */
-const logFn = (fn: Function | undefined, ...msg: unknown[]): void => {
+const logFn = (fn: LogFunction | undefined, ...msg: unknown[]): void => {
     if (fn) {
         fn(logString(msg));
     }
@@ -65,6 +60,20 @@ type QueryParams = Record<string, QueryValue>;
  */
 type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
 
+type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue };
+
+type ResponseParser<T> = (value: JsonValue) => T;
+
+type RESTRequestOptions<T = JsonValue> = {
+    method: HttpMethod;
+    pathname: string;
+    data?: QueryParams;
+    headers?: Record<string, string>;
+    useDefaultParams?: boolean;
+    fetchOptions?: RequestInit;
+    parseResponse?: ResponseParser<T>;
+};
+
 /**
  * This class can be used for creating a wrapper around a server and all its endpoints.
  * Its functionality is extended by {@link JSONPClient}
@@ -78,7 +87,7 @@ type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH';
 export class RESTClient {
     url: URL;
     defaultParams: QueryParams;
-    log?: Function;
+    log?: LogFunction;
     fetch: FetchFunction;
 
     /**
@@ -103,7 +112,7 @@ export class RESTClient {
         serverUrl?: string;
         envDic?: Record<string, string>;
         fetch?: FetchFunction;
-        log?: Function;
+        log?: LogFunction;
         defaultParams?: QueryParams;
     }) {
         assert(isObject(defaultParams), `defaultParams should be a non-null object`);
@@ -135,21 +144,23 @@ export class RESTClient {
      * @param options.fetchOptions - Additional fetch options
      * @throws {SDKError} - If the call can't be made for whatever reason.
      */
-    async go({
-        method,
-        headers,
-        pathname,
-        data = {},
-        useDefaultParams = true,
-        fetchOptions = { method, credentials: 'include' },
-    }: {
-        method: HttpMethod;
-        pathname: string;
-        data?: QueryParams;
-        headers?: Record<string, string>;
-        useDefaultParams?: boolean;
-        fetchOptions?: RequestInit;
-    }): Promise<any> {
+    // Overloads describe the two supported modes:
+    // - without a parser: return the parsed JSON response as-is;
+    // - with a parser: return the parser's typed result.
+    async go(options: RESTRequestOptions): Promise<JsonValue>;
+    async go<T>(options: RESTRequestOptions<T> & { parseResponse: ResponseParser<T> }): Promise<T>;
+
+    // TypeScript requires one implementation signature for the overloads above.
+    async go<T = JsonValue>(options: RESTRequestOptions<T>): Promise<JsonValue | T> {
+        const {
+            method,
+            headers,
+            pathname,
+            data = {},
+            useDefaultParams = true,
+            fetchOptions = { method: options.method, credentials: 'include' },
+            parseResponse,
+        } = options;
         assert(isNonEmptyString(method), `Method must be a non empty string but it is "${method}"`);
         assert(isNonEmptyString(pathname), `Pathname must be string but it is "${pathname}"`);
         assert(isObject(data), `data must be a non-null object`);
@@ -167,9 +178,9 @@ export class RESTClient {
                 // status code not in range 200-299
                 throw new SDKError(response.statusText, { code: response.status });
             }
-            const responseObject = await response.json();
+            const responseObject: JsonValue = await response.json();
             logFn(this.log, 'Response Parsed:', responseObject);
-            return responseObject;
+            return parseResponse ? parseResponse(responseObject) : responseObject;
         } catch (err: unknown) {
             let msg = isStr(err) ? err : 'Unknown RESTClient error';
             if (isObject(err) && isStr(err.message)) {
@@ -199,7 +210,23 @@ export class RESTClient {
      * @param pathname - WHATWG pathname ie. 'api/2/endpoint-name'
      * @param data - Query parameters
      */
-    get(pathname: string, data?: QueryParams): Promise<any> {
+    // Mirrors `go()` overloads for the common GET helper.
+    get(pathname: string, data?: QueryParams): Promise<JsonValue>;
+    get<T>(
+        pathname: string,
+        data: QueryParams | undefined,
+        parseResponse: ResponseParser<T>,
+    ): Promise<T>;
+
+    // TypeScript requires one implementation signature for the overloads above.
+    get<T>(
+        pathname: string,
+        data?: QueryParams,
+        parseResponse?: ResponseParser<T>,
+    ): Promise<JsonValue | T> {
+        if (parseResponse) {
+            return this.go({ method: 'GET', pathname, data, parseResponse });
+        }
         return this.go({ method: 'GET', pathname, data });
     }
 

package/src/rest-clients.ts

@@ -0,0 +1,30 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { NAMESPACE } from './config.js';
+import RESTClient from './rest-client.js';
+import type { LogFunction } from './types/common.js';
+import { assert, isNonEmptyString } from './validate.js';
+
+type AccountRestClientOptions = {
+    serverUrl: string;
+    log?: LogFunction;
+    defaultParams: Record<string, string | number | boolean | undefined>;
+};
+
+const isKnownNamespace = (env: string): env is keyof typeof NAMESPACE =>
+    Object.hasOwn(NAMESPACE, env);
+
+export const buildClientSdrn = (env: string, clientId: string): string => {
+    assert(isNonEmptyString(clientId), 'clientId parameter is required');
+    assert(isKnownNamespace(env), `env parameter is invalid: ${env}`);
+
+    return `sdrn:${NAMESPACE[env]}:client:${clientId}`;
+};
+
+export const createAccountRestClient = ({
+    serverUrl,
+    log,
+    defaultParams,
+}: AccountRestClientOptions): RESTClient => new RESTClient({ serverUrl, log, defaultParams });

package/src/session-response.ts

@@ -0,0 +1,79 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import type {
+    ConnectedSessionResponse,
+    ConnectedSessionWithUserIdResponse,
+    NormalizedSessionPayload,
+    RedirectSessionPayload,
+    SessionFailureResponse,
+    SessionResponse,
+    SessionSuccessResponse,
+} from './types/session.js';
+import { isObject, isStr } from './validate.js';
+
+export function isSessionSuccessResponse(value: unknown): value is SessionSuccessResponse {
+    return isObject(value) && typeof value.result === 'boolean';
+}
+
+export function isConnectedSessionResponse(value: unknown): value is ConnectedSessionResponse {
+    return isSessionSuccessResponse(value) && value.result === true;
+}
+
+export function isSessionFailureResponse(value: unknown): value is SessionFailureResponse {
+    return isObject(value) && Boolean(value.error);
+}
+
+export function isRedirectSessionPayload(value: unknown): value is RedirectSessionPayload {
+    return isObject(value) && Object.keys(value).length === 1 && isStr(value.redirectURL);
+}
+
+export function isConnectedSessionWithUserIdResponse(
+    value: SessionResponse,
+): value is ConnectedSessionWithUserIdResponse {
+    return (
+        isConnectedSessionResponse(value) &&
+        (typeof value.userId === 'number' || typeof value.userId === 'string')
+    );
+}
+
+/**
+ * Converts an unknown Session Service `hasSession` payload into one of the shapes the SDK knows how
+ * to handle.
+ *
+ * This function is intentionally tolerant because `hasSession()` historically resolved unknown
+ * object payloads instead of rejecting them. The SDK relies on that behavior for backwards
+ * compatibility with clients that check the raw response themselves.
+ *
+ * The normal cases are:
+ * - regular success payloads with a boolean `result`;
+ * - failure payloads wrapped as `{ error, response? }`;
+ * - Safari/session-refresh redirect payloads shaped as `{ redirectURL }`.
+ *
+ * Any other object is preserved as an unrecognized response so callers can still receive it.
+ * Non-object values are normalized to `{}`, matching the old "empty response" fallback used by
+ * `hasSession()` and cached-session reads.
+ *
+ * This is used both for network responses parsed by `RESTClient` and for values restored from the
+ * session cache, so the rest of the Identity flow can switch on typed guards instead of repeatedly
+ * re-validating unknown data.
+ *
+ * @internal
+ */
+export function normalizeSessionResponse(value: unknown): NormalizedSessionPayload {
+    if (isRedirectSessionPayload(value)) {
+        return value;
+    }
+    if (isSessionFailureResponse(value)) {
+        return value;
+    }
+    if (isSessionSuccessResponse(value)) {
+        return value;
+    }
+    if (isObject(value)) {
+        return value;
+    }
+
+    return {};
+}

package/src/types/account.ts

@@ -0,0 +1,27 @@
+import type { AccountBaseConfig, LogFunction } from './common';
+import type { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+
+export type AccountConfig = AccountBaseConfig & {
+    /** Receives debug log information. If not set, no logging will be done. */
+    log?: LogFunction;
+    /** Callback triggered before a session refresh redirect happens. */
+    callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Optional Varnish cookie setup applied during Account initialization. */
+    varnish?: VarnishCookieOptions;
+};
+
+export type AccountSessionEventName =
+    | 'login'
+    | 'logout'
+    | 'userChange'
+    | 'sessionChange'
+    | 'notLoggedin'
+    | 'sessionInit'
+    | 'statusChange'
+    | 'error'
+    | 'simplifiedLoginOpened'
+    | 'simplifiedLoginCancelled';
+
+export type AccountEventName = AccountSessionEventName | 'hasAccess';
+
+export type AccountEventHandler = (...args: unknown[]) => void;

package/src/types/common.ts

@@ -0,0 +1,26 @@
+/* Common types used across the SDK */
+
+/**
+ * Log callback used by the SDK for debug output.
+ * Receives a pre-formatted log line.
+ * @internal
+ */
+export type LogFunction = (message: string) => void;
+
+/**
+ * Supported Schibsted account environment keys.
+ */
+export type AccountEnvironment = 'LOCAL' | 'DEV' | 'PRE' | 'PRO' | 'PRO_NO' | 'PRO_FI' | 'PRO_DK';
+
+export type AccountBaseConfig = {
+    /** Mandatory client id. Example: "1234567890abcdef12345678" */
+    clientId: string;
+    /** Redirect uri. Example: "https://site.com" */
+    redirectUri: string;
+    /** Session Service domain. Example: "https://id.site.com" */
+    sessionDomain: string;
+    /** Schibsted account environment. Defaults to PRE. */
+    env?: AccountEnvironment;
+    /** Window object to use. Defaults to the global `window`. */
+    window?: Window;
+};

package/src/types/identity.ts

@@ -0,0 +1,55 @@
+import type { AccountBaseConfig, LogFunction } from './common';
+
+/**
+ * Callback invoked before the SDK performs a full-page session refresh redirect.
+ */
+export type IdentityBeforeRedirectCallback = () => void | Promise<void>;
+
+/**
+ * Options accepted by the {@link Identity} constructor.
+ */
+export type IdentityOptions = AccountBaseConfig & {
+    /** Receives debug log information. If not set, no logging will be done. */
+    log?: LogFunction;
+    /** Callback triggered before a session refresh redirect happens. */
+    callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+};
+
+/**
+ * Identity events emitted by the SDK.
+ *
+ * - `login`: emitted when `hasSession()` resolves with a logged-in user payload.
+ * - `logout`: emitted when a previously logged-in user is no longer logged in, or when
+ *   `logout()` is called.
+ * - `userChange`: emitted when the current session user id changes.
+ * - `sessionChange`: emitted when either the previous or current `hasSession()` payload contains
+ *   a logged-in user.
+ * - `notLoggedin`: emitted when neither the previous nor current `hasSession()` payload contains
+ *   a logged-in user.
+ * - `sessionInit`: emitted once for the first logged-in session payload.
+ * - `statusChange`: emitted when the session `userStatus` changes.
+ * - `error`: emitted when `hasSession()` fails.
+ * - `simplifiedLoginOpened`: emitted when the simplified login widget is displayed.
+ * - `simplifiedLoginCancelled`: emitted when the simplified login widget is closed.
+ */
+export type IdentityEventName =
+    | 'login'
+    | 'logout'
+    | 'userChange'
+    | 'sessionChange'
+    | 'notLoggedin'
+    | 'sessionInit'
+    | 'statusChange'
+    | 'error'
+    | 'simplifiedLoginOpened'
+    | 'simplifiedLoginCancelled';
+
+/**
+ * Options for {@link Identity#enableVarnishCookie}.
+ */
+export type VarnishCookieOptions = {
+    /** Override number of seconds before the Varnish cookie expires. */
+    expiresIn?: number;
+    /** Override cookie domain. E.g. "vg.no" instead of "www.vg.no". */
+    domain?: string;
+};