@schibsted/account-sdk-browser 6.0.0-alpha.7 → 6.0.0-alpha.8

package/dist/session-response.d.ts

@@ -1,8 +1,32 @@
 import { ConnectedSessionResponse, ConnectedSessionWithUserIdResponse, NormalizedSessionPayload, RedirectSessionPayload, SessionFailureResponse, SessionResponse, SessionSuccessResponse } from './types/session.js';
+/**
+ * Checks whether a value is a successful session response.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export declare function isSessionSuccessResponse(value: unknown): value is SessionSuccessResponse;
+/**
+ * Checks whether a successful session response represents a user connected to the merchant.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export declare function isConnectedSessionResponse(value: unknown): value is ConnectedSessionResponse;
+/**
+ * Checks whether a value is a session failure response.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export declare function isSessionFailureResponse(value: unknown): value is SessionFailureResponse;
 export declare function isRedirectSessionPayload(value: unknown): value is RedirectSessionPayload;
+/**
+ * Checks whether a connected session response contains a usable user id.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export declare function isConnectedSessionWithUserIdResponse(value: SessionResponse): value is ConnectedSessionWithUserIdResponse;
 /**
  * Converts an unknown Session Service `hasSession` payload into one of the shapes the SDK knows how

package/dist/types/account.d.ts

@@ -10,6 +10,8 @@ export type AccountConfig = AccountBaseConfig & {
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Product or feature ids used by `hasAccess()` when no ids are passed to the method. */
+    defaultProductIds?: string[];
     /** Optional Varnish cookie setup applied during Account initialization. */
     varnish?: VarnishCookieOptions;
 };

package/dist/types/session.d.ts

@@ -1,12 +1,9 @@
 /**
- * User identifier returned by Session Service responses.
- *
- * Session Service historically returned numeric ids, while some integrations and tests use
- * string ids. SDK convenience methods normalize this where they promise a string.
+ * Numeric Schibsted Account user id.
  *
  * @group Session
  */
-export type SessionUserId = number | string;
+export type SessionUserId = number;
 /**
  * Successful response returned from {@link Account#hasSession}.
  *

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const version = "6.0.0-alpha.7";
+declare const version = "6.0.0-alpha.8";
 export default version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schibsted/account-sdk-browser",
-  "version": "6.0.0-alpha.7",
+  "version": "6.0.0-alpha.8",
   "description": "Schibsted account SDK for browsers",
   "main": "dist/index.js",
   "type": "module",

package/src/account.ts

@@ -28,6 +28,7 @@ import type { ConnectedSessionResponse, SessionResponse, SessionUserId } from '.
 export class Account {
     #identity: Identity;
     #monetization: Monetization;
+    #defaultProductIds?: string[];
 
     constructor(config: AccountConfig) {
         const browserWindow = resolveBrowserWindow(config.window);
@@ -40,7 +41,7 @@ export class Account {
             throw new SDKError('Schibsted Account SDK has already been initialized');
         }
 
-        const { log, callbackBeforeRedirect, varnish } = config;
+        const { log, callbackBeforeRedirect, defaultProductIds, varnish } = config;
         const sharedConfig = {
             clientId: config.clientId,
             redirectUri: config.redirectUri,
@@ -55,6 +56,11 @@ export class Account {
             callbackBeforeRedirect,
         });
 
+        if (defaultProductIds !== undefined && !Array.isArray(defaultProductIds)) {
+            throw new SDKError('Account defaultProductIds config must be an array');
+        }
+        this.#defaultProductIds = defaultProductIds;
+
         if (varnish) {
             if (typeof varnish !== 'object' || Array.isArray(varnish)) {
                 throw new SDKError('Account varnish config must be an object');
@@ -111,16 +117,30 @@ export class Account {
     }
 
     /**
-     * Returns the realm-specific Schibsted Account user id as a string.
+     * Returns the realm-specific Schibsted Account user id as a number.
      *
      * Use `getUserUuid()` when you need the globally unique user id.
      *
      * @throws {SDKError} If the user is not connected to the configured client.
      */
-    getUserId(): Promise<string> {
+    getUserId(): Promise<number> {
         return this.#identity.getUserId();
     }
 
+    /**
+     * Returns an external identifier for the authenticated user, scoped to the configured client
+     * and external party.
+     *
+     * @param externalParty - External party for which the identifier is generated.
+     * @param optionalSuffix - Optional suffix included when generating the identifier.
+     * @throws {SDKError} If the session lookup fails, the session does not contain a `pairId`, or
+     * `externalParty` is empty.
+     * @deprecated Retained for compatibility with existing integrations. Avoid new usage.
+     */
+    getExternalId(externalParty: string, optionalSuffix: string = ''): Promise<string> {
+        return this.#identity.getExternalId(externalParty, optionalSuffix);
+    }
+
     /**
      * Returns the globally unique user id from the current session.
      *
@@ -238,16 +258,27 @@ export class Account {
     }
 
     /**
-     * Checks whether a user has access to any of the requested products or features.
+     * Checks whether the current user has access to any of the requested products or features.
      *
+     * When `productIds` is omitted, the ids configured as `defaultProductIds` are used.
      * Results are cached according to the TTL returned by Session Service.
      *
-     * @param productIds - Product or feature ids to check.
-     * @param userId - Current user id, usually from `getUserId()`.
+     * @param productIds - Product or feature ids to check instead of the configured defaults.
      * @returns Access data, or `null` when the user is not entitled.
-     * @throws {SDKError} If `sessionDomain` is missing, input is invalid, or the request fails.
+     * @throws {SDKError} If product ids are not provided or configured, `sessionDomain` is missing,
+     * the current user cannot be resolved, input is invalid, or the request fails.
      */
-    hasAccess(productIds: string[], userId: SessionUserId): Promise<HasAccessResult | null> {
+    async hasAccess(productIds = this.#defaultProductIds): Promise<HasAccessResult | null> {
+        if (!productIds) {
+            throw new SDKError(
+                'hasAccess requires productIds or defaultProductIds in the Account config',
+            );
+        }
+        if (productIds.length === 0) {
+            return null;
+        }
+
+        const userId = await this.#identity.getUserId();
         return this.#monetization.hasAccess(productIds, userId);
     }
 

package/src/has-access-response.ts

@@ -17,7 +17,7 @@ export function parseHasAccessResult(value: unknown): HasAccessResult {
         typeof entitled !== 'boolean' ||
         typeof ttl !== 'number' ||
         !Array.isArray(allowedFeatures) ||
-        (typeof userId !== 'number' && typeof userId !== 'string') ||
+        typeof userId !== 'number' ||
         !isStr(uuid) ||
         !isStr(sig)
     ) {

package/src/identity.ts

@@ -535,14 +535,73 @@ export class Identity {
      * @throws {SDKError} If the user isn't connected to the merchant
      * @return The `userId` field (not to be confused with the `uuid`)
      */
-    async getUserId(): Promise<string> {
+    async getUserId(): Promise<number> {
         const user = await this.hasSession();
         if (isConnectedSessionWithUserIdResponse(user)) {
-            return String(user.userId);
+            return user.userId;
         }
         throw new SDKError('The user is not connected to this merchant');
     }
 
+    /**
+     * @function
+     * @summary
+     * Retrieves the external identifier (`externalId`) for the authenticated user.
+     *
+     * In Schibsted Account there are multiple ways of identifying users, however for integrations with
+     * third-parties it's recommended to use `externalId` as it does not disclose
+     * any critical data whilst allowing for user identification.
+     *
+     * `externalId` is merchant-scoped using a pairwise identifier (`pairId`),
+     * meaning the same user's ID will differ between merchants.
+     * Additionally, this identifier is bound to the external party provided as argument.
+     *
+     * @param externalParty
+     * @param optionalSuffix
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the `pairId` is missing in user session.
+     * @throws {SDKError} If the `externalParty` is not defined
+     * @return The merchant- and 3rd-party-specific `externalId`
+     */
+    async getExternalId(externalParty: string, optionalSuffix: string = ''): Promise<string> {
+        const user = await this.hasSession();
+        const pairId = isSessionSuccessResponse(user) ? user.pairId : undefined;
+
+        if (!pairId) throw new SDKError('pairId missing in user session!');
+
+        if (!externalParty || externalParty.length === 0) {
+            throw new SDKError('externalParty cannot be empty');
+        }
+        const _toHexDigest = (hashBuffer: ArrayBuffer) => {
+            // convert buffer to byte array
+            const hashArray = Array.from(new Uint8Array(hashBuffer));
+            // convert bytes to hex string
+            return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+        };
+
+        const _getSha256Digest = (data: BufferSource) => {
+            return crypto.subtle.digest('SHA-256', data);
+        };
+
+        const _hashMessage = async (message: string) => {
+            const msgUint8 = new TextEncoder().encode(message);
+            return _getSha256Digest(msgUint8).then((it) => _toHexDigest(it));
+        };
+
+        const _constructMessage = (
+            pairId: string,
+            externalParty: string,
+            optionalSuffix: string,
+        ) => {
+            return optionalSuffix
+                ? `${pairId}:${externalParty}:${optionalSuffix}`
+                : `${pairId}:${externalParty}`;
+        };
+
+        return _hashMessage(_constructMessage(pairId, externalParty, optionalSuffix));
+    }
+
     /**
      * @summary Enables brands to programmatically get the current the SDRN based on the user's session.
      * @remarks This function calls {@link Identity#hasSession} internally and thus has the side

package/src/index.ts

@@ -7,6 +7,14 @@ export { createAccountSdk, getAccountSdk } from './account-sdk.js';
 export * from './globals.js';
 export { default as SDKError } from './sdk-error.js';
 
+/** session response type guards */
+export {
+    isConnectedSessionResponse,
+    isConnectedSessionWithUserIdResponse,
+    isSessionFailureResponse,
+    isSessionSuccessResponse,
+} from './session-response.js';
+
 /* public available types */
 export type {
     AccountConfig,

package/src/session-response.ts

@@ -13,14 +13,32 @@ import type {
 } from './types/session.js';
 import { isObject, isStr } from './validate.js';
 
+/**
+ * Checks whether a value is a successful session response.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export function isSessionSuccessResponse(value: unknown): value is SessionSuccessResponse {
     return isObject(value) && typeof value.result === 'boolean';
 }
 
+/**
+ * Checks whether a successful session response represents a user connected to the merchant.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export function isConnectedSessionResponse(value: unknown): value is ConnectedSessionResponse {
     return isSessionSuccessResponse(value) && value.result === true;
 }
 
+/**
+ * Checks whether a value is a session failure response.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export function isSessionFailureResponse(value: unknown): value is SessionFailureResponse {
     return isObject(value) && Boolean(value.error);
 }
@@ -29,13 +47,16 @@ export function isRedirectSessionPayload(value: unknown): value is RedirectSessi
     return isObject(value) && Object.keys(value).length === 1 && isStr(value.redirectURL);
 }
 
+/**
+ * Checks whether a connected session response contains a usable user id.
+ *
+ * @param value - The value to check.
+ * @group Session
+ */
 export function isConnectedSessionWithUserIdResponse(
     value: SessionResponse,
 ): value is ConnectedSessionWithUserIdResponse {
-    return (
-        isConnectedSessionResponse(value) &&
-        (typeof value.userId === 'number' || typeof value.userId === 'string')
-    );
+    return isConnectedSessionResponse(value) && typeof value.userId === 'number';
 }
 
 /**

package/src/types/account.ts

@@ -11,6 +11,8 @@ export type AccountConfig = AccountBaseConfig & {
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Product or feature ids used by `hasAccess()` when no ids are passed to the method. */
+    defaultProductIds?: string[];
     /** Optional Varnish cookie setup applied during Account initialization. */
     varnish?: VarnishCookieOptions;
 };

package/src/types/session.ts

@@ -3,14 +3,11 @@
  */
 
 /**
- * User identifier returned by Session Service responses.
- *
- * Session Service historically returned numeric ids, while some integrations and tests use
- * string ids. SDK convenience methods normalize this where they promise a string.
+ * Numeric Schibsted Account user id.
  *
  * @group Session
  */
-export type SessionUserId = number | string;
+export type SessionUserId = number;
 
 // Session Service object payloads.
 

package/src/version.ts

@@ -1,4 +1,4 @@
 // Version is bumped automatically by release-please. See release-please-config.json.
 
-const version = '6.0.0-alpha.7'; // x-release-please-version
+const version = '6.0.0-alpha.8'; // x-release-please-version
 export default version;