@schibsted/account-sdk-browser 6.0.0-alpha.7 → 6.0.0-alpha.9

package/README.md

@@ -8,23 +8,7 @@ Welcome! This is the home of the Schibsted Account JavaScript SDK for browsers.
 sign up and log in with Schibsted Account, read the current session, and check access to products
 and features.
 
-## Public API
-
-Create one SDK instance with `createAccountSdk()`. Use `getAccountSdk()` when another module needs
-to wait for that initialized `Account` instance.
-
-The package publishes ES modules and modern JavaScript, including async/await and WHATWG browser
-APIs. It does not include polyfills.
-
-## Installation
-
-```sh
-npm install --save @schibsted/account-sdk-browser
-```
-
-```js
-import { createAccountSdk, getAccountSdk } from '@schibsted/account-sdk-browser';
-```
+For detailed Account SDK API documentation, check [TYPEDOC](./TYPEDOC.md).
 
 ## Before You Start
 
@@ -44,261 +28,16 @@ For example, if your pre-production site is `pre.sdk-example.com` and uses
 If this is a new site and you do not have a `sessionDomain` yet, contact
 [support](mailto:schibstedaccount@schibsted.com).
 
-## Initialize the SDK
-
-Create the SDK once during application startup:
-
-```js
-import { createAccountSdk } from '@schibsted/account-sdk-browser';
-
-const account = createAccountSdk({
-    clientId: '56e9a5d1eee0000000000000',
-    redirectUri: 'https://awesomenews.site/callback',
-    sessionDomain: 'https://id.awesomenews.site',
-    env: 'PRE',
-});
-```
-
-Required configuration:
-
-- `clientId`: your Schibsted Account client id
-- `redirectUri`: the callback URL registered for your client
-- `sessionDomain`: your client-configured Session Service domain
-
-Optional configuration:
-
-- `env`: defaults to `PRE`; supported keys include `LOCAL`, `DEV`, `PRE`, `PRO`, `PRO_NO`,
-  `PRO_FI`, and `PRO_DK`
-- `callbackBeforeRedirect`: called before a full-page session refresh redirect
-- `log`: receives SDK debug log lines
-- `varnish`: enables Varnish cookie handling
-- `window`: overrides the browser window object, mostly useful in tests
-
-`createAccountSdk()` registers the instance on `window.schAccount` and emits
-`schAccount:ready` event.
-
-```js
-window.addEventListener('schAccount:ready', (event) => {
-    const account = event.detail.instance;
-});
-```
-
-If another module needs the initialized instance, use `getAccountSdk()`:
-
-```js
-import { getAccountSdk } from '@schibsted/account-sdk-browser';
-
-const account = await getAccountSdk();
-```
+## Development
 
-`getAccountSdk()` resolves immediately if the SDK has already been initialized. Otherwise it waits
-for `schAccount:ready` and rejects if initialization does not happen within 4000 ms.
+Install dependencies and run the standard checks:
 
-## Basic Usage
-
-After initialization, use the `Account` instance to render user state and start login when needed:
-
-```js
-async function renderLoginState() {
-    const container = document.getElementById('login-container');
-
-    if (await account.isConnected()) {
-        const user = await account.getUser();
-        container.textContent = `Hello ${user.givenName || user.displayName || user.userId}`;
-        return;
-    }
-
-    container.innerHTML = '<button type="button">Log in</button>';
-    container.querySelector('button').addEventListener('click', () => {
-        account.login({ state: createLoginState() });
-    });
-}
-```
-
-## Login Flow
-
-Use `account.login()` to start the OAuth authorization flow:
-
-```js
-account.login({
-    state: createLoginState(),
-    scope: 'openid',
-    preferPopup: false,
-});
-```
-
-By default the SDK redirects the current window. Set `preferPopup: true` when login is triggered by
-a user gesture and you want to try a popup first. If the popup cannot be opened, the SDK falls back
-to the redirect flow.
-
-If you only need the URL, use `account.loginUrl()`:
-
-```js
-const url = account.loginUrl({ state: createLoginState() });
-```
-
-### Handling `state`
-
-`state` is an opaque OpenID Connect value that is returned to your `redirectUri` with the
-authorization `code`. Use it to protect against CSRF and to restore application state.
-
-A common pattern is:
-
-1. Your backend creates a random token and stores it temporarily.
-2. Your frontend calls `account.login({ state })` with that token, or with an encoded payload that
-   contains it.
-3. Schibsted Account redirects back to your `redirectUri` with `code` and `state`.
-4. Your backend validates the returned `state` before exchanging `code` for tokens.
-
-Keep Access Tokens and Refresh Tokens on your backend. Do not send them to the browser.
-
-### Authentication Methods
-
-Use `acrValues` when you need to request a specific authentication method:
-
-```js
-account.login({
-    state: createLoginState(),
-    acrValues: 'otp-email',
-});
-```
-
-Supported values include `password`, `otp`, `sms`, `otp-email`, `eid`, `eid-no`, `eid-se`,
-`eid-fi`, and `eid-dk`. Values other than `otp-email` can be combined as a space-separated string
-where supported by the account flow. Verify the resulting AMR claim in the ID token on your backend
-if you need to enforce a completed authentication method.
-
-## Session and User Data
-
-Use these methods to inspect the current Session Service state:
-
-- `account.hasSession()` returns the raw SDK-known session response
-- `account.isLoggedIn()` returns whether the browser has a Schibsted Account session
-- `account.isConnected()` returns whether the user is connected to your client
-- `account.getUser()` returns the connected user session data
-- `account.getUserId()` returns the realm-specific user id as a string
-- `account.getUserUuid()` returns the globally unique user id
-- `account.getUserSDRN()` returns the user SDRN
-- `account.getSpId()` returns the Varnish `sp_id` value when present
-
-Some session methods can trigger a full-page Session Service refresh redirect, especially for
-Safari-based browsers. Use `callbackBeforeRedirect` if you need to persist client state before that
-happens.
-
-```js
-const account = createAccountSdk({
-    clientId,
-    redirectUri,
-    sessionDomain,
-    callbackBeforeRedirect: () => {
-        saveCurrentUiState();
-    },
-});
-```
-
-## Logout and Account Page
-
-Use `account.logout()` to remove the brand Session Service session and redirect the browser:
-
-```js
-account.logout('https://awesomenews.site/logged-out');
-```
-
-Use `account.logoutUrl()` when you need the logout URL without navigating immediately:
-
-```js
-const logoutUrl = account.logoutUrl('https://awesomenews.site/logged-out');
-```
-
-Use `account.accountUrl()` to send the user to their Schibsted Account profile page:
-
-```js
-window.location.href = account.accountUrl('https://awesomenews.site/account-return');
-```
-
-## Access Checks
-
-Use `account.hasAccess()` to check access to Schibsted Account product ids or Zuora feature ids:
-
-```js
-const userId = await account.getUserId();
-const access = await account.hasAccess(['product-id'], userId);
-
-if (access?.entitled) {
-    showPremiumContent();
-} else {
-    showPaywall();
-}
-```
-
-`hasAccess()` requires `sessionDomain`. Results are cached according to the Session Service TTL.
-Use `account.clearCachedAccessResult(productIds, userId)` when you need to invalidate that cache.
-
-## Simplified Login Widget
-
-Before using the simplified login widget, make sure your site has no site-specific terms and
-conditions in the Schibsted Account login flow.
-
-The widget is shown only when the SDK can read enough user context from the global account session.
-Your application decides when and how often to show it.
-
-```js
-if (!(await account.isConnected()) && shouldShowSimplifiedLogin()) {
-    const opened = await account.showSimplifiedLoginWidget(
-        { state: createLoginState },
-        { locale: 'nb' },
-    );
-
-    if (opened) {
-        rememberSimplifiedLoginWasShown();
-    }
-}
-```
-
-`state` may be a string or a function that returns a string or `Promise<string>`. The function is
-called only if the user continues from the widget.
-
-## Events
-
-The SDK exposes fluent `on()` and `off()` aliases for browser-native event listeners.
-Payload-bearing events are `CustomEvent` instances and expose their payload through `detail`:
-
-```ts
-import type { AccountEventListener } from '@schibsted/account-sdk-browser';
-
-const handleLogin: AccountEventListener<'login'> = (event) => {
-    console.log('Login started', event.detail.url, event.detail.method);
-};
-
-account.on('login', handleLogin);
-account.off('login', handleLogin);
-```
-
-Available Account events:
-
-- `login` — a `CustomEvent` whose `detail` contains `url` and the `method` (`popup` or `default`)
-- `logout` — a `CustomEvent` whose `detail` contains the logout `url`
-- `simplifiedLoginOpened` — an `Event` emitted when the widget is displayed
-- `simplifiedLoginCancelled` — an `Event` emitted when the widget is closed
-
-The SDK also emits `schAccount:ready` on `window` when an Account instance is created.
-
-## Errors
-
-Validation, network, and service failures from API calls reject or throw `SDKError`. Convenience
-methods such as `isLoggedIn()`, `isConnected()`, and `getSpId()` return fallback values instead of
-throwing when the session lookup fails.
-
-```js
-import { SDKError } from '@schibsted/account-sdk-browser';
-
-try {
-    await account.getUser();
-} catch (error) {
-    if (error instanceof SDKError) {
-        console.error(error.toString());
-    }
-}
+```sh
+npm ci
+npm run build
+npm test
+npm run lint
+npm run typecheck
 ```
 
 ## API Documentation
@@ -320,9 +59,8 @@ Generated docs are written to `docs/` and are not committed.
 
 ## Example Project
 
-An example integration is available in the
-[sdk-example repository](https://schibsted.ghe.com/user-identity/sdk-example), with a live example
-at [pro.sdk-example.com](https://pro.sdk-example.com).
+The internal example integration is available in the
+[sdk-example repository](https://schibsted.ghe.com/user-identity/sdk-example).
 
 ## Publishing
 

package/dist/account.d.ts

@@ -43,13 +43,24 @@ export declare class Account {
      */
     getUser(): Promise<ConnectedSessionResponse>;
     /**
-     * Returns the realm-specific Schibsted Account user id as a string.
+     * Returns the realm-specific Schibsted Account user id as a number.
      *
      * Use `getUserUuid()` when you need the globally unique user id.
      *
      * @throws {SDKError} If the user is not connected to the configured client.
      */
-    getUserId(): Promise<string>;
+    getUserId(): Promise<number>;
+    /**
+     * Returns an external identifier for the authenticated user, scoped to the configured client
+     * and external party.
+     *
+     * @param externalParty - External party for which the identifier is generated.
+     * @param optionalSuffix - Optional suffix included when generating the identifier.
+     * @throws {SDKError} If the session lookup fails, the session does not contain a `pairId`, or
+     * `externalParty` is empty.
+     * @deprecated Retained for compatibility with existing integrations. Avoid new usage.
+     */
+    getExternalId(externalParty: string, optionalSuffix?: string): Promise<string>;
     /**
      * Returns the globally unique user id from the current session.
      *
@@ -128,16 +139,17 @@ export declare class Account {
      */
     clearCachedUserSession(): void;
     /**
-     * Checks whether a user has access to any of the requested products or features.
+     * Checks whether the current user has access to any of the requested products or features.
      *
+     * When `productIds` is omitted, the ids configured as `defaultProductIds` are used.
      * Results are cached according to the TTL returned by Session Service.
      *
-     * @param productIds - Product or feature ids to check.
-     * @param userId - Current user id, usually from `getUserId()`.
+     * @param productIds - Product or feature ids to check instead of the configured defaults.
      * @returns Access data, or `null` when the user is not entitled.
-     * @throws {SDKError} If `sessionDomain` is missing, input is invalid, or the request fails.
+     * @throws {SDKError} If product ids are not provided or configured, `sessionDomain` is missing,
+     * the current user cannot be resolved, input is invalid, or the request fails.
      */
-    hasAccess(productIds: string[], userId: SessionUserId): Promise<HasAccessResult | null>;
+    hasAccess(productIds?: string[] | undefined): Promise<HasAccessResult | null>;
     /**
      * Removes a cached access-check result.
      *

package/dist/identity.d.ts

@@ -160,7 +160,29 @@ export declare class Identity {
      * @throws {SDKError} If the user isn't connected to the merchant
      * @return The `userId` field (not to be confused with the `uuid`)
      */
-    getUserId(): Promise<string>;
+    getUserId(): Promise<number>;
+    /**
+     * @function
+     * @summary
+     * Retrieves the external identifier (`externalId`) for the authenticated user.
+     *
+     * In Schibsted Account there are multiple ways of identifying users, however for integrations with
+     * third-parties it's recommended to use `externalId` as it does not disclose
+     * any critical data whilst allowing for user identification.
+     *
+     * `externalId` is merchant-scoped using a pairwise identifier (`pairId`),
+     * meaning the same user's ID will differ between merchants.
+     * Additionally, this identifier is bound to the external party provided as argument.
+     *
+     * @param externalParty
+     * @param optionalSuffix
+     * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
+     * effect that it might perform an auto-login on the user
+     * @throws {SDKError} If the `pairId` is missing in user session.
+     * @throws {SDKError} If the `externalParty` is not defined
+     * @return The merchant- and 3rd-party-specific `externalId`
+     */
+    getExternalId(externalParty: string, optionalSuffix?: string): Promise<string>;
     /**
      * @summary Enables brands to programmatically get the current the SDRN based on the user's session.
      * @remarks This function calls {@link Identity#hasSession} internally and thus has the side
@@ -213,7 +235,7 @@ export declare class Identity {
      * @param options.xDomainId
      * @param options.xEnvironmentId
      * @param options.originCampaign
-     * @fires Identity#login
+     * @fires Identity#loginRequested
      * @return - Reference to popup window if created (or `null` otherwise)
      */
     login({ state, acrValues, scope, redirectUri, preferPopup, loginHint, tag, teaser, maxAge, locale, oneStepLogin, prompt, xDomainId, xEnvironmentId, originCampaign, }: LoginOptions): Window | null;
@@ -227,7 +249,7 @@ export declare class Identity {
     /**
      * @summary Logs the user out from the Identity platform
      * @param redirectUri - Where to redirect the browser after logging out of Schibsted account
-     * @fires Identity#logout
+     * @fires Identity#logoutRequested
      */
     logout(redirectUri?: string): void;
     /**

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export { Account } from './account.js';
 export { createAccountSdk, getAccountSdk } from './account-sdk.js';
 export * from './globals.js';
 export { default as SDKError } from './sdk-error.js';
+/** session response type guards */
+export { isConnectedSessionResponse, isConnectedSessionWithUserIdResponse, isSessionFailureResponse, isSessionSuccessResponse, } from './session-response.js';
 export type { AccountConfig, AccountEventListener, AccountEventName, } from './types/account.js';
 export type { AccountEnvironment, LogFunction } from './types/common.js';
 export type { LoginOptions, SimplifiedLoginData, SimplifiedLoginWidgetLoginOptions, SimplifiedLoginWidgetOptions, } from './types/login.js';

package/dist/index.js

@@ -178,10 +178,10 @@ function y(e) {
 }
 //#endregion
 //#region src/popup.ts
-function ee(e) {
+function b(e) {
 	return u(p(e), `Object must be an object but it is '${e}'`), Object.keys(e).map((t) => `${t}=${e[t]}`).join(",");
 }
-var te = {
+var ee = {
 	scrollbars: "yes",
 	location: "yes",
 	status: "no",
@@ -189,11 +189,11 @@ var te = {
 	toolbar: "no",
 	resizable: "yes"
 };
-function b(e, t, n = "", r = {}) {
+function te(e, t, n = "", r = {}) {
 	u(p(e), `window was supposed to be an object but it is ${e}`), u(p(e.screen), "window should be a valid Window object but it lacks a 'screen' property"), u(g(e.open), "window should be a valid Window object but it lacks an 'open' function"), u(h(t), "Invalid URL for popup");
-	let { height: i, width: a } = e.screen, o = v(te, r), { width: s, height: c } = o;
+	let { height: i, width: a } = e.screen, o = v(ee, r), { width: s, height: c } = o;
 	typeof s == "number" && Number.isFinite(s) && Number.isFinite(a) && (o.left = (a - s) / 2), typeof c == "number" && Number.isFinite(c) && Number.isFinite(i) && (o.top = (i - c) / 2);
-	let l = ee(o);
+	let l = b(o);
 	return e.open(t, n, l);
 }
 //#endregion
@@ -218,14 +218,14 @@ function C(e) {
 	};
 	return encodeURIComponent(e).replace(/[!'()~]|%20|%00/g, (e) => t[e]);
 }
-var w = () => window.fetch && window.fetch.bind(window), T = () => {
+var re = () => window.fetch && window.fetch.bind(window), w = () => {
 	throw new t("fetch is not available in this environment");
-}, E = class e {
+}, T = class e {
 	url;
 	defaultParams;
 	log;
 	fetch;
-	constructor({ serverUrl: e = "PRE", envDic: t, fetch: n = w() ?? T, log: r, defaultParams: i = {} }) {
+	constructor({ serverUrl: e = "PRE", envDic: t, fetch: n = re() ?? w, log: r, defaultParams: i = {} }) {
 		u(p(i), "defaultParams should be a non-null object");
 		let a = x(e, t ?? {}), o = a.endsWith("/") ? a : `${a}/`;
 		this.url = new URL(o), this.defaultParams = i, r && (u(g(r), `log must be a function but it is ${r}`), this.log = r), this.fetch = n;
@@ -270,7 +270,7 @@ var w = () => window.fetch && window.fetch.bind(window), T = () => {
 		let r = t ? v(n, e) : v(e);
 		return Object.keys(r).filter((e) => r[e] !== "").map((e) => `${C(e)}=${C(String(r[e]))}`).join("&");
 	}
-}, re = (e) => Object.hasOwn(l, e), D = (e, t) => (u(f(t), "clientId parameter is required"), u(re(e), `env parameter is invalid: ${e}`), `sdrn:${l[e]}:client:${t}`), O = ({ serverUrl: e, log: t, defaultParams: n }) => new E({
+}, E = (e) => Object.hasOwn(l, e), D = (e, t) => (u(f(t), "clientId parameter is required"), u(E(e), `env parameter is invalid: ${e}`), `sdrn:${l[e]}:client:${t}`), O = ({ serverUrl: e, log: t, defaultParams: n }) => new T({
 	serverUrl: e,
 	log: t,
 	defaultParams: n
@@ -290,7 +290,7 @@ function M(e) {
 	return p(e) && Object.keys(e).length === 1 && d(e.redirectURL);
 }
 function N(e) {
-	return A(e) && (typeof e.userId == "number" || typeof e.userId == "string");
+	return A(e) && typeof e.userId == "number";
 }
 function P(e) {
 	return M(e) || j(e) || k(e) || p(e) ? e : {};
@@ -302,7 +302,7 @@ function F(e) {
 }
 //#endregion
 //#region src/types/login.ts
-var I = (e) => typeof e.openSimplifiedLoginWidget == "function", L = "6.0.0-alpha.7", R = "hasSession-cache", z = "sessionCallBlocked-cache", B = 1e3 * 60 * 5, V = "tab-id-cache", H = Math.floor(Math.random() * 1e5), U = 1e3 * 60 * 60 * 24 * 30, W = () => window, G = class {
+var I = (e) => typeof e.openSimplifiedLoginWidget == "function", L = "6.0.0-alpha.9", R = "hasSession-cache", z = "sessionCallBlocked-cache", B = 1e3 * 60 * 5, V = "tab-id-cache", H = Math.floor(Math.random() * 1e5), U = 1e3 * 60 * 60 * 24 * 30, W = () => window, G = class {
 	eventTarget = new EventTarget();
 	window;
 	clientId;
@@ -479,9 +479,16 @@ var I = (e) => typeof e.openSimplifiedLoginWidget == "function", L = "6.0.0-alph
 	}
 	async getUserId() {
 		let e = await this.hasSession();
-		if (N(e)) return String(e.userId);
+		if (N(e)) return e.userId;
 		throw new t("The user is not connected to this merchant");
 	}
+	async getExternalId(e, n = "") {
+		let r = await this.hasSession(), i = k(r) ? r.pairId : void 0;
+		if (!i) throw new t("pairId missing in user session!");
+		if (!e || e.length === 0) throw new t("externalParty cannot be empty");
+		let a = (e) => Array.from(new Uint8Array(e)).map((e) => e.toString(16).padStart(2, "0")).join(""), o = (e) => crypto.subtle.digest("SHA-256", e);
+		return (async (e) => o(new TextEncoder().encode(e)).then((e) => a(e)))(((e, t, n) => n ? `${e}:${t}:${n}` : `${e}:${t}`)(i, e, n));
+	}
 	async getUserSDRN() {
 		let e = await this.hasSession();
 		if (k(e) && e.sdrn) return e.sdrn;
@@ -522,13 +529,13 @@ var I = (e) => typeof e.openSimplifiedLoginWidget == "function", L = "6.0.0-alph
 			xEnvironmentId: p,
 			originCampaign: m
 		});
-		return i && (this.popup = b(this.window, h, "Schibsted account", {
+		return i && (this.popup = te(this.window, h, "Schibsted account", {
 			width: 360,
 			height: 570
-		}), this.popup) ? (this.eventTarget.dispatchEvent(new CustomEvent("login", { detail: {
+		}), this.popup) ? (this.eventTarget.dispatchEvent(new CustomEvent("loginRequested", { detail: {
 			url: h,
 			method: "popup"
-		} })), this.popup) : (this.eventTarget.dispatchEvent(new CustomEvent("login", { detail: {
+		} })), this.popup) : (this.eventTarget.dispatchEvent(new CustomEvent("loginRequested", { detail: {
 			url: h,
 			method: "default"
 		} })), this.window.location.href = h, null);
@@ -546,7 +553,7 @@ var I = (e) => typeof e.openSimplifiedLoginWidget == "function", L = "6.0.0-alph
 	logout(e = this.redirectUri) {
 		this.sessionStorageCache.delete(R), this._maybeClearVarnishCookie();
 		let t = this.logoutUrl(e);
-		this.eventTarget.dispatchEvent(new CustomEvent("logout", { detail: { url: t } })), this.window.location.href = t;
+		this.eventTarget.dispatchEvent(new CustomEvent("logoutRequested", { detail: { url: t } })), this.window.location.href = t;
 	}
 	loginUrl({ state: e, acrValues: t = "", scope: n = "openid", redirectUri: r = this.redirectUri, loginHint: i = "", tag: a = "", teaser: o = "", maxAge: s = "", locale: c, oneStepLogin: l = !1, prompt: d = "select_account", xDomainId: p = "", xEnvironmentId: m = "", originCampaign: g = "" }) {
 		return u(!t || _(t, ["", "otp-email"], !0) || t.split(" ").every((e) => _(e, [
@@ -645,7 +652,7 @@ var I = (e) => typeof e.openSimplifiedLoginWidget == "function", L = "6.0.0-alph
 function K(e) {
 	if (!p(e)) throw new t("Invalid hasAccess response");
 	let { entitled: n, ttl: r, allowedFeatures: i, userId: a, uuid: o, sig: s } = e;
-	if (typeof n != "boolean" || typeof r != "number" || !Array.isArray(i) || typeof a != "number" && typeof a != "string" || !d(o) || !d(s)) throw new t("Invalid hasAccess response");
+	if (typeof n != "boolean" || typeof r != "number" || !Array.isArray(i) || typeof a != "number" || !d(o) || !d(s)) throw new t("Invalid hasAccess response");
 	return {
 		entitled: n,
 		ttl: r,
@@ -700,11 +707,12 @@ var q = () => window, J = class {
 }, Y = (e) => e || (typeof window > "u" ? void 0 : window), X = class {
 	#e;
 	#t;
+	#n;
 	constructor(e) {
 		let n = Y(e.window);
 		if (!n) throw new t("Schibsted Account SDK is not available in this browser context");
 		if (n.schAccount) throw new t("Schibsted Account SDK has already been initialized");
-		let { log: r, callbackBeforeRedirect: i, varnish: a } = e, o = {
+		let { log: r, callbackBeforeRedirect: i, defaultProductIds: a, varnish: o } = e, s = {
 			clientId: e.clientId,
 			redirectUri: e.redirectUri,
 			sessionDomain: e.sessionDomain,
@@ -712,14 +720,15 @@ var q = () => window, J = class {
 			window: n
 		};
 		if (this.#e = new G({
-			...o,
+			...s,
 			log: r,
 			callbackBeforeRedirect: i
-		}), a) {
-			if (typeof a != "object" || Array.isArray(a)) throw new t("Account varnish config must be an object");
-			this.#e.enableVarnishCookie(a);
+		}), a !== void 0 && !Array.isArray(a)) throw new t("Account defaultProductIds config must be an array");
+		if (this.#n = a, o) {
+			if (typeof o != "object" || Array.isArray(o)) throw new t("Account varnish config must be an object");
+			this.#e.enableVarnishCookie(o);
 		}
-		this.#t = new J(o), n.schAccount = this, n.dispatchEvent(new CustomEvent("schAccount:ready", { detail: { instance: this } }));
+		this.#t = new J(s), n.schAccount = this, n.dispatchEvent(new CustomEvent("schAccount:ready", { detail: { instance: this } }));
 	}
 	hasSession() {
 		return this.#e.hasSession();
@@ -736,6 +745,9 @@ var q = () => window, J = class {
 	getUserId() {
 		return this.#e.getUserId();
 	}
+	getExternalId(e, t = "") {
+		return this.#e.getExternalId(e, t);
+	}
 	getUserUuid() {
 		return this.#e.getUserUuid();
 	}
@@ -772,8 +784,11 @@ var q = () => window, J = class {
 	clearCachedUserSession() {
 		this.#e.clearCachedUserSession();
 	}
-	hasAccess(e, t) {
-		return this.#t.hasAccess(e, t);
+	async hasAccess(e = this.#n) {
+		if (!e) throw new t("hasAccess requires productIds or defaultProductIds in the Account config");
+		if (e.length === 0) return null;
+		let n = await this.#e.getUserId();
+		return this.#t.hasAccess(e, n);
 	}
 	clearCachedAccessResult(e, t) {
 		this.#t.clearCachedAccessResult(e, t);
@@ -808,6 +823,6 @@ function se() {
 	}), $);
 }
 //#endregion
-export { X as Account, t as SDKError, oe as createAccountSdk, se as getAccountSdk };
+export { X as Account, t as SDKError, oe as createAccountSdk, se as getAccountSdk, A as isConnectedSessionResponse, N as isConnectedSessionWithUserIdResponse, j as isSessionFailureResponse, k as isSessionSuccessResponse };
 
 //# sourceMappingURL=index.js.map