@schibsted/account-sdk-browser 6.0.0-alpha.4 → 6.0.0-alpha.6

package/src/monetization.ts

@@ -2,18 +2,14 @@
  * See LICENSE.md in the project root.
  */
 
-import { TinyEmitter } from 'tiny-emitter';
 import Cache from './cache.js';
-import { ENDPOINTS } from './config.js';
-import { registerAndDispatchInGlobal } from './global-registry.js';
 import { parseHasAccessResult } from './has-access-response.js';
-import type { SessionUserId } from './identity.js';
 import type RESTClient from './rest-client.js';
 import { buildClientSdrn, createAccountRestClient } from './rest-clients.js';
 import SDKError from './sdk-error.js';
 import * as spidTalk from './spid-talk.js';
 import type { HasAccessResult, MonetizationOptions } from './types/monetization.js';
-import { urlMapper } from './url.js';
+import type { SessionUserId } from './types/session.js';
 import { assert, isNonEmptyString, isStr, isUrl } from './validate.js';
 import version from './version.js';
 
@@ -22,14 +18,10 @@ const globalWindow = () => window;
 /**
  * Provides features related to monetization
  */
-export class Monetization extends TinyEmitter {
-    cache: Cache;
-    clientId: string;
-    env: string;
-    redirectUri?: string;
-    _spid: RESTClient;
-    _sessionService?: RESTClient;
-    private pendingHasAccessRequests: Record<string, Promise<HasAccessResult>>;
+export class Monetization {
+    private readonly cache: Cache;
+    private readonly sessionService?: RESTClient;
+    private readonly pendingHasAccessRequests: Record<string, Promise<HasAccessResult>>;
 
     /**
      * @param options - Monetization configuration
@@ -42,33 +34,25 @@ export class Monetization extends TinyEmitter {
         sessionDomain,
         window = globalWindow(),
     }: MonetizationOptions) {
-        super();
         spidTalk.emulate(window);
         assert(isNonEmptyString(clientId), 'clientId parameter is required');
         assert(isStr(env), `env parameter is invalid: ${env}`);
+        const clientSdrn = buildClientSdrn(env, clientId);
 
         this.cache = new Cache(() => window && window.sessionStorage);
-        this.clientId = clientId;
-        this.env = env;
-        this.redirectUri = redirectUri;
         this.pendingHasAccessRequests = {};
-        this._spid = createAccountRestClient({
-            serverUrl: urlMapper(env, ENDPOINTS.SPiD),
-            defaultParams: { client_id: this.clientId, redirect_uri: this.redirectUri },
-        });
 
         if (sessionDomain) {
             assert(isUrl(sessionDomain), 'sessionDomain parameter is not a valid URL');
-            this._sessionService = createAccountRestClient({
+            this.sessionService = createAccountRestClient({
                 serverUrl: sessionDomain,
                 defaultParams: {
-                    client_sdrn: buildClientSdrn(this.env, this.clientId),
-                    redirect_uri: this.redirectUri,
+                    client_sdrn: clientSdrn,
+                    redirect_uri: redirectUri,
                     sdk_version: version,
                 },
             });
         }
-        registerAndDispatchInGlobal(window, 'schMonetization', this);
     }
 
     /**
@@ -81,7 +65,7 @@ export class Monetization extends TinyEmitter {
      * doesn't have access to any of the given products/features)
      */
     async hasAccess(productIds: string[], userId: SessionUserId): Promise<HasAccessResult | null> {
-        if (!this._sessionService) {
+        if (!this.sessionService) {
             throw new SDKError(`hasAccess can only be called if 'sessionDomain' is configured`);
         }
         if (!userId) {
@@ -92,11 +76,11 @@ export class Monetization extends TinyEmitter {
         }
 
         const sortedIds = [...productIds].sort();
-        const cacheKey = this._accessCacheKey(sortedIds, userId);
+        const cacheKey = this.accessCacheKey(sortedIds, userId);
         let data = this.cache.get(cacheKey) as HasAccessResult | null;
         if (!data) {
             if (!this.pendingHasAccessRequests[cacheKey]) {
-                this.pendingHasAccessRequests[cacheKey] = this._sessionService.get(
+                this.pendingHasAccessRequests[cacheKey] = this.sessionService.get(
                     `/hasAccess/${sortedIds.join(',')}`,
                     undefined,
                     parseHasAccessResult,
@@ -117,7 +101,7 @@ export class Monetization extends TinyEmitter {
         if (!data.entitled) {
             return null;
         }
-        this.emit('hasAccess', { ids: sortedIds, data });
+
         return data;
     }
 
@@ -127,7 +111,7 @@ export class Monetization extends TinyEmitter {
      * @param userId - id of currently logged in user
      */
     clearCachedAccessResult(productIds: string[], userId: SessionUserId): void {
-        this.cache.delete(this._accessCacheKey(productIds, userId));
+        this.cache.delete(this.accessCacheKey(productIds, userId));
     }
 
     /**
@@ -136,29 +120,9 @@ export class Monetization extends TinyEmitter {
      * @param productIds - which products/features to check
      * @param userId - id of currently logged in user
      */
-    private _accessCacheKey(productIds: string[], userId: SessionUserId): string {
+    private accessCacheKey(productIds: string[], userId: SessionUserId): string {
         return `prd_${[...productIds].sort()}_${userId}`;
     }
-
-    /**
-     * Get the url for the end user to review the subscriptions
-     * @param redirectUri
-     * @returns - The url to the subscriptions review page
-     */
-    subscriptionsUrl(redirectUri: string = this.redirectUri ?? ''): string {
-        assert(isUrl(redirectUri), `subscriptionsUrl(): redirectUri is invalid`);
-        return this._spid.makeUrl('account/subscriptions', { redirect_uri: redirectUri });
-    }
-
-    /**
-     * Get the url for the end user to review the products
-     * @param redirectUri
-     * @returns - The url to the products review page
-     */
-    productsUrl(redirectUri: string = this.redirectUri ?? ''): string {
-        assert(isUrl(redirectUri), `productsUrl(): redirectUri is invalid`);
-        return this._spid.makeUrl('account/products', { redirect_uri: redirectUri });
-    }
 }
 
 export default Monetization;

package/src/sdk-error.ts

@@ -14,6 +14,8 @@ const STRINGIFY_TYPES = ['boolean', 'number', 'string'];
  * Custom error class thrown by all SDK methods on failure.
  *
  * All rejected promises from API calls reject with an instance of this class.
+ *
+ * @group Errors
  */
 export default class SDKError extends Error {
     /** HTTP status code from the server error payload;

package/src/types/account.ts

@@ -1,6 +1,11 @@
 import type { AccountBaseConfig, LogFunction } from './common';
 import type { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
 
+/**
+ * Configuration used to create an {@link Account} instance.
+ *
+ * @group Configuration
+ */
 export type AccountConfig = AccountBaseConfig & {
     /** Receives debug log information. If not set, no logging will be done. */
     log?: LogFunction;
@@ -10,18 +15,36 @@ export type AccountConfig = AccountBaseConfig & {
     varnish?: VarnishCookieOptions;
 };
 
-export type AccountSessionEventName =
-    | 'login'
-    | 'logout'
-    | 'userChange'
-    | 'sessionChange'
-    | 'notLoggedin'
-    | 'sessionInit'
-    | 'statusChange'
-    | 'error'
-    | 'simplifiedLoginOpened'
-    | 'simplifiedLoginCancelled';
+type LoginEventDetail = {
+    url: string;
+    method: 'popup' | 'default';
+};
+
+type LogoutEventDetail = {
+    url: string;
+};
+
+export type AccountEventMap = {
+    /** Emitted with the login URL and method when `login()` initiates a login flow. */
+    login: CustomEvent<LoginEventDetail>;
+    /** Emitted with the logout URL when `logout()` is called. */
+    logout: CustomEvent<LogoutEventDetail>;
+    /** Emitted when the simplified login widget is displayed. */
+    simplifiedLoginOpened: Event;
+    /** Emitted when the simplified login widget is closed. */
+    simplifiedLoginCancelled: Event;
+};
 
-export type AccountEventName = AccountSessionEventName | 'hasAccess';
+/** Account event names emitted by the SDK. */
+export type AccountEventName = keyof AccountEventMap;
 
-export type AccountEventHandler = (...args: unknown[]) => void;
+/**
+ * Native event listener used by Account event subscriptions.
+ *
+ * Payload-bearing events are `CustomEvent` instances and expose their payload through `detail`.
+ *
+ * @group Events
+ */
+export type AccountEventListener<EventName extends AccountEventName = AccountEventName> = (
+    event: AccountEventMap[EventName],
+) => void;

package/src/types/common.ts

@@ -3,15 +3,21 @@
 /**
  * Log callback used by the SDK for debug output.
  * Receives a pre-formatted log line.
- * @internal
+ *
+ * @group Configuration
  */
 export type LogFunction = (message: string) => void;
 
 /**
  * Supported Schibsted account environment keys.
+ *
+ * @group Configuration
  */
 export type AccountEnvironment = 'LOCAL' | 'DEV' | 'PRE' | 'PRO' | 'PRO_NO' | 'PRO_FI' | 'PRO_DK';
 
+/**
+ * Shared Account configuration fields.
+ */
 export type AccountBaseConfig = {
     /** Mandatory client id. Example: "1234567890abcdef12345678" */
     clientId: string;

package/src/types/identity.ts

@@ -15,35 +15,6 @@ export type IdentityOptions = AccountBaseConfig & {
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
 };
 
-/**
- * Identity events emitted by the SDK.
- *
- * - `login`: emitted when `hasSession()` resolves with a logged-in user payload.
- * - `logout`: emitted when a previously logged-in user is no longer logged in, or when
- *   `logout()` is called.
- * - `userChange`: emitted when the current session user id changes.
- * - `sessionChange`: emitted when either the previous or current `hasSession()` payload contains
- *   a logged-in user.
- * - `notLoggedin`: emitted when neither the previous nor current `hasSession()` payload contains
- *   a logged-in user.
- * - `sessionInit`: emitted once for the first logged-in session payload.
- * - `statusChange`: emitted when the session `userStatus` changes.
- * - `error`: emitted when `hasSession()` fails.
- * - `simplifiedLoginOpened`: emitted when the simplified login widget is displayed.
- * - `simplifiedLoginCancelled`: emitted when the simplified login widget is closed.
- */
-export type IdentityEventName =
-    | 'login'
-    | 'logout'
-    | 'userChange'
-    | 'sessionChange'
-    | 'notLoggedin'
-    | 'sessionInit'
-    | 'statusChange'
-    | 'error'
-    | 'simplifiedLoginOpened'
-    | 'simplifiedLoginCancelled';
-
 /**
  * Options for {@link Identity#enableVarnishCookie}.
  */

package/src/types/login.ts

@@ -1,5 +1,7 @@
 /**
- * Options accepted by {@link Identity#login} and related login URL helpers.
+ * Options accepted by {@link Account#login} and related login URL helpers.
+ *
+ * @group Login & Widget
  */
 export type LoginOptions = {
     /**
@@ -8,14 +10,11 @@ export type LoginOptions = {
      */
     state: string;
     /**
-     * Authentication Context Class Reference Values. If omitted, the user will be asked to
-     * authenticate using username+password. For 2FA (Two-Factor Authentication) possible values
-     * are `sms`, `otp` (one time password), `password` (will force password confirmation, even if
-     * user is already logged in), `eid`. Those values might be mixed as space-separated string.
-     * To make sure that user has authenticated with 2FA you need to verify AMR (Authentication
-     * Methods References) claim in ID token. Might also be used to ensure additional acr
-     * (sms, otp, eid) for already logged in users. Supported value is also 'otp-email' means one
-     * time password using email.
+     * Authentication Context Class Reference values. If omitted, the default account flow is used.
+     * Supported values include `password`, `otp`, `sms`, `otp-email`, `eid`, `eid-no`, `eid-se`,
+     * `eid-fi`, and `eid-dk`. Values other than `otp-email` may be combined as a space-separated
+     * string. Verify the AMR (Authentication Methods References) claim in the ID token on your
+     * backend if you need to enforce a completed authentication method.
      */
     acrValues?:
         | 'password'
@@ -81,6 +80,8 @@ export type LoginOptions = {
 /**
  * Identical to {@link LoginOptions} except that `state` may also be a (possibly async) function;
  * all other fields reuse the `LoginOptions` documentation.
+ *
+ * @group Login & Widget
  */
 export type SimplifiedLoginWidgetLoginOptions = Omit<LoginOptions, 'state'> & {
     /**
@@ -92,9 +93,11 @@ export type SimplifiedLoginWidgetLoginOptions = Omit<LoginOptions, 'state'> & {
 
 /**
  * Minimal user information used by the simplified login widget flow.
+ *
+ * @group Login & Widget
  */
 export type SimplifiedLoginData = {
-    /** Deprecated: User UUID, to be be used as `loginHint` for {@link Identity#login} */
+    /** Deprecated: User UUID used as `loginHint` for {@link Account#login}. */
     identifier: string;
     /** Human-readable user identifier */
     display_text: string;
@@ -105,7 +108,9 @@ export type SimplifiedLoginData = {
 };
 
 /**
- * Configuration options for {@link Identity#showSimplifiedLoginWidget}.
+ * Configuration options for {@link Account#showSimplifiedLoginWidget}.
+ *
+ * @group Login & Widget
  */
 export type SimplifiedLoginWidgetOptions = {
     /** expected encoding of simplified login widget. Could be utf-8 (default), iso-8859-1 or iso-8859-15 */

package/src/types/monetization.ts

@@ -4,16 +4,21 @@ import type { SessionUserId } from './session';
 /**
  * Result returned by the Session Service `/hasAccess` endpoint, describing whether the user
  * is entitled to a requested set of products/features.
- * @internal
+ *
+ * @group Access Checks
  */
 export interface HasAccessResult {
     /** Whether the user is entitled to at least one of the requested products/features. */
     entitled: boolean;
     /** How long this result stays valid, in seconds, before the cache entry expires. */
     ttl: number;
+    /** Feature ids the user is allowed to access. */
     allowedFeatures: string[];
+    /** User id the access result belongs to. */
     userId: SessionUserId;
+    /** Globally unique user id the access result belongs to. */
     uuid: string;
+    /** Signed response payload. */
     sig: string;
 }
 

package/src/types/session.ts

@@ -7,17 +7,21 @@
  *
  * Session Service historically returned numeric ids, while some integrations and tests use
  * string ids. SDK convenience methods normalize this where they promise a string.
+ *
+ * @group Session
  */
 export type SessionUserId = number | string;
 
 // Session Service object payloads.
 
 /**
- * Successful response returned from {@link Identity#hasSession}.
+ * Successful response returned from {@link Account#hasSession}.
  *
  * `result` means the has-session call itself succeeded. `result: true` means the user is
  * connected to the merchant; `result: false` means a session may exist, but the user is not
  * connected to this client.
+ *
+ * @group Session
  */
 export type SessionSuccessResponse = {
     /** Response status code. Example: 200. */
@@ -31,7 +35,7 @@ export type SessionSuccessResponse = {
      * merchants connected to this user.
      */
     result: boolean;
-    /** Connection status string. Deprecated; use `Identity.isConnected()`. Example: 'connected'. */
+    /** Connection status string. Deprecated; use `Account.isConnected()`. Example: 'connected'. */
     userStatus?: string;
     /** Cookie base domain used as the `SP_ID` cookie domain fallback. Example: 'spid.no'. */
     baseDomain?: string;
@@ -77,6 +81,8 @@ export type SessionSuccessResponse = {
 
 /**
  * Successful has-session response for a user connected to the merchant.
+ *
+ * @group Session
  */
 export type ConnectedSessionResponse = SessionSuccessResponse & {
     result: true;
@@ -84,6 +90,8 @@ export type ConnectedSessionResponse = SessionSuccessResponse & {
 
 /**
  * Connected session response that also carries a usable user id.
+ *
+ * @group Session
  */
 export type ConnectedSessionWithUserIdResponse = ConnectedSessionResponse & {
     userId: SessionUserId;
@@ -94,6 +102,8 @@ export type ConnectedSessionWithUserIdResponse = ConnectedSessionResponse & {
  *
  * API and network failures usually reject with {@link SDKError}; this shape represents a failure
  * payload when one is returned by Session Service and reaches the has-session flow.
+ *
+ * @group Session
  */
 export type SessionFailureResponse = {
     /** Failure payload returned by Session Service. Usually an object, but tests also pass strings. */
@@ -121,9 +131,16 @@ export type SessionFailureResponse = {
  *
  * This intentionally includes `{}`. Historically `hasSession()` could resolve an empty object or
  * other object payloads that callers inspected themselves, so the SDK preserves those responses.
+ *
+ * @group Session
  */
 export type UnrecognizedSessionResponse = object;
 
+/**
+ * Redirect URL returned by `hasSession()` when Session Service needs a full-page session refresh.
+ *
+ * @group Session
+ */
 export type RedirectSessionResponse = string;
 
 export type SessionObjectResponse =
@@ -135,10 +152,18 @@ export type RedirectSessionPayload = {
     redirectURL: string;
 };
 
+/**
+ * Internal shape returned by `normalizeSessionResponse()` before `hasSession()` post-processing.
+ *
+ * It includes regular Session Service object responses and redirect responses used for full-page
+ * session refresh.
+ */
 export type NormalizedSessionPayload = SessionObjectResponse | RedirectSessionPayload;
 
 /**
- * Public response union returned from {@link Identity#hasSession}.
+ * Public response union returned from {@link Account#hasSession}.
+ *
+ * @group Session
  */
 export type SessionResponse =
     | SessionSuccessResponse

package/src/version.ts

@@ -1,4 +1,4 @@
 // Version is bumped automatically by release-please. See release-please-config.json.
 
-const version = '6.0.0-alpha.4'; // x-release-please-version
+const version = '6.0.0-alpha.6'; // x-release-please-version
 export default version;

package/dist/global-registry.d.ts

@@ -1,23 +0,0 @@
-/**
- * Names of the SDK instance properties that can be registered on the global {@link Window} object.
- */
-type Property = 'schAccount' | 'schIdentity' | 'schMonetization';
-/**
- * Registers an SDK instance on the global {@link Window} object's given property and dispatches a ready event.
- *
- * The dispatched event is a {@link CustomEvent} fired on `global` (i.e. `window`) with:
- * - name: `${property}:ready` (e.g. `"schIdentity:ready"` or `"schMonetization:ready"`)
- * - `detail.instance`: the registered SDK instance
- *
- * @typeParam T - Constrained to {@link Property}; inferred from the `property` argument.
- * @param global - The `Window` object to register on.
- * @param property - The window property name to assign the instance to, 'schIdentity' or 'schMonetization'.
- * @param instance - The SDK instance to register. Must be non-nullable.
- *
- * @example
- * registerAndDispatchInGlobal(window, 'schIdentity', identityInstance);
- * / window.schIdentity === identityInstance
- * / CustomEvent 'schIdentity:ready' has been dispatched on window
- */
-export declare const registerAndDispatchInGlobal: <T extends Property>(global: Window, property: T, instance: NonNullable<Window[T]>) => void;
-export {};

package/dist/types/monetization-guards.d.ts

@@ -1,2 +0,0 @@
-import { HasAccessResult } from './monetization.js';
-export declare function parseHasAccessResult(value: unknown): HasAccessResult;

package/dist/types/session-guards.d.ts

@@ -1,36 +0,0 @@
-import { ConnectedSessionResponse, ConnectedSessionWithUserIdResponse, SessionFailureResponse, SessionResponse, SessionSuccessResponse, UnrecognizedSessionResponse } from './session.js';
-type SessionObjectResponse = SessionSuccessResponse | SessionFailureResponse | UnrecognizedSessionResponse;
-type RedirectSessionPayload = {
-    redirectURL: string;
-};
-export type NormalizedSessionPayload = SessionObjectResponse | RedirectSessionPayload;
-export declare function isSessionSuccessResponse(value: unknown): value is SessionSuccessResponse;
-export declare function isConnectedSessionResponse(value: unknown): value is ConnectedSessionResponse;
-export declare function isSessionFailureResponse(value: unknown): value is SessionFailureResponse;
-export declare function isRedirectSessionPayload(value: unknown): value is RedirectSessionPayload;
-export declare function isConnectedSessionWithUserIdResponse(value: SessionResponse): value is ConnectedSessionWithUserIdResponse;
-/**
- * Converts an unknown Session Service `hasSession` payload into one of the shapes the SDK knows how
- * to handle.
- *
- * This function is intentionally tolerant because `hasSession()` historically resolved unknown
- * object payloads instead of rejecting them. The SDK relies on that behavior for backwards
- * compatibility with clients that check the raw response themselves.
- *
- * The normal cases are:
- * - regular success payloads with a boolean `result`;
- * - failure payloads wrapped as `{ error, response? }`;
- * - Safari/session-refresh redirect payloads shaped as `{ redirectURL }`.
- *
- * Any other object is preserved as an unrecognized response so callers can still receive it.
- * Non-object values are normalized to `{}`, matching the old "empty response" fallback used by
- * `hasSession()` and cached-session reads.
- *
- * This is used both for network responses parsed by `RESTClient` and for values restored from the
- * session cache, so the rest of the Identity flow can switch on typed guards instead of repeatedly
- * re-validating unknown data.
- *
- * @internal
- */
-export declare function normalizeSessionResponse(value: unknown): NormalizedSessionPayload;
-export {};

package/src/global-registry.ts

@@ -1,39 +0,0 @@
-import './globals.js';
-
-/**
- * Names of the SDK instance properties that can be registered on the global {@link Window} object.
- */
-type Property = 'schAccount' | 'schIdentity' | 'schMonetization';
-
-/**
- * Registers an SDK instance on the global {@link Window} object's given property and dispatches a ready event.
- *
- * The dispatched event is a {@link CustomEvent} fired on `global` (i.e. `window`) with:
- * - name: `${property}:ready` (e.g. `"schIdentity:ready"` or `"schMonetization:ready"`)
- * - `detail.instance`: the registered SDK instance
- *
- * @typeParam T - Constrained to {@link Property}; inferred from the `property` argument.
- * @param global - The `Window` object to register on.
- * @param property - The window property name to assign the instance to, 'schIdentity' or 'schMonetization'.
- * @param instance - The SDK instance to register. Must be non-nullable.
- *
- * @example
- * registerAndDispatchInGlobal(window, 'schIdentity', identityInstance);
- * / window.schIdentity === identityInstance
- * / CustomEvent 'schIdentity:ready' has been dispatched on window
- */
-
-export const registerAndDispatchInGlobal = <T extends Property>(
-    global: Window,
-    property: T,
-    instance: NonNullable<Window[T]>,
-): void => {
-    if (!global[property]) {
-        global[property] = instance;
-    }
-
-    global.dispatchEvent(
-        //TODO -> https://schibsted.ghe.com/connect/team/issues/645
-        new CustomEvent(`${property}:ready`, { detail: { instance: global[property] } }),
-    );
-};

package/src/types/monetization-guards.ts

@@ -1,35 +0,0 @@
-/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
- * See LICENSE.md in the project root.
- */
-
-import SDKError from '../sdk-error.js';
-import { isObject, isStr } from '../validate.js';
-import type { HasAccessResult } from './monetization.js';
-
-export function parseHasAccessResult(value: unknown): HasAccessResult {
-    if (!isObject(value)) {
-        throw new SDKError('Invalid hasAccess response');
-    }
-
-    const { entitled, ttl, allowedFeatures, userId, uuid, sig } = value;
-
-    if (
-        typeof entitled !== 'boolean' ||
-        typeof ttl !== 'number' ||
-        !Array.isArray(allowedFeatures) ||
-        (typeof userId !== 'number' && typeof userId !== 'string') ||
-        !isStr(uuid) ||
-        !isStr(sig)
-    ) {
-        throw new SDKError('Invalid hasAccess response');
-    }
-
-    return {
-        entitled,
-        ttl,
-        allowedFeatures: allowedFeatures.filter(isStr),
-        userId,
-        uuid,
-        sig,
-    };
-}