@health-samurai/aidbox-client 0.0.0-alpha.2 → 0.0.0-alpha.4

package/dist/src/smart-backend-services.js

@@ -0,0 +1,685 @@
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _check_private_redeclaration(obj, privateCollection) {
+    if (privateCollection.has(obj)) {
+        throw new TypeError("Cannot initialize the same private elements twice on an object");
+    }
+}
+function _class_apply_descriptor_get(receiver, descriptor) {
+    if (descriptor.get) {
+        return descriptor.get.call(receiver);
+    }
+    return descriptor.value;
+}
+function _class_apply_descriptor_set(receiver, descriptor, value) {
+    if (descriptor.set) {
+        descriptor.set.call(receiver, value);
+    } else {
+        if (!descriptor.writable) {
+            throw new TypeError("attempted to set read only private field");
+        }
+        descriptor.value = value;
+    }
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _class_extract_field_descriptor(receiver, privateMap, action) {
+    if (!privateMap.has(receiver)) {
+        throw new TypeError("attempted to " + action + " private field on non-instance");
+    }
+    return privateMap.get(receiver);
+}
+function _class_private_field_get(receiver, privateMap) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "get");
+    return _class_apply_descriptor_get(receiver, descriptor);
+}
+function _class_private_field_init(obj, privateMap, value) {
+    _check_private_redeclaration(obj, privateMap);
+    privateMap.set(obj, value);
+}
+function _class_private_field_set(receiver, privateMap, value) {
+    var descriptor = _class_extract_field_descriptor(receiver, privateMap, "set");
+    _class_apply_descriptor_set(receiver, descriptor, value);
+    return value;
+}
+function _class_private_method_get(receiver, privateSet, fn) {
+    if (!privateSet.has(receiver)) {
+        throw new TypeError("attempted to get private field on non-instance");
+    }
+    return fn;
+}
+function _class_private_method_init(obj, privateSet) {
+    _check_private_redeclaration(obj, privateSet);
+    privateSet.add(obj);
+}
+function _defineProperties(target, props) {
+    for(var i = 0; i < props.length; i++){
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+    }
+}
+function _create_class(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_without_properties(source, excluded) {
+    if (source == null) return {};
+    var target = _object_without_properties_loose(source, excluded);
+    var key, i;
+    if (Object.getOwnPropertySymbols) {
+        var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
+        for(i = 0; i < sourceSymbolKeys.length; i++){
+            key = sourceSymbolKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+    }
+    return target;
+}
+function _object_without_properties_loose(source, excluded) {
+    if (source == null) return {};
+    var target = {};
+    var sourceKeys = Object.keys(source);
+    var key, i;
+    for(i = 0; i < sourceKeys.length; i++){
+        key = sourceKeys[i];
+        if (excluded.indexOf(key) >= 0) continue;
+        target[key] = source[key];
+    }
+    return target;
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import * as oauth from "oauth4webapi";
+import { mergeHeaders, validateBaseUrl } from "./utils";
+var _config = /*#__PURE__*/ new WeakMap(), _cachedToken = /*#__PURE__*/ new WeakMap(), _pendingTokenRequest = /*#__PURE__*/ new WeakMap(), _discoverAuthServer = /*#__PURE__*/ new WeakSet(), _requestToken = /*#__PURE__*/ new WeakSet(), _sanitizeTokenResponse = /*#__PURE__*/ new WeakSet(), /**
+	 * Get valid cached token if not expired, or null if needs refresh.
+	 */ _getValidCachedToken = /*#__PURE__*/ new WeakSet(), _getAccessToken = /*#__PURE__*/ new WeakSet(), _fetchAndCacheToken = /*#__PURE__*/ new WeakSet();
+/**
+ * SMART Backend Services authentication provider.
+ *
+ * Implements OAuth 2.0 client_credentials grant with JWT bearer assertion
+ * for server-to-server authentication per SMART Backend Services spec.
+ *
+ * @see https://hl7.org/fhir/smart-app-launch/backend-services.html
+ */ export var SmartBackendServicesAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function SmartBackendServicesAuthProvider(config) {
+        _class_call_check(this, SmartBackendServicesAuthProvider);
+        _class_private_method_init(this, _discoverAuthServer);
+        /**
+	 * Request access token from token endpoint using client_credentials grant.
+	 */ _class_private_method_init(this, _requestToken);
+        /**
+	 * Fixes "refresh_token" = null which does not work with oauth4webapi
+	 * Fixed in Aidbox 2601, but kept for backwards compatibility.
+	 */ _class_private_method_init(this, _sanitizeTokenResponse);
+        _class_private_method_init(this, _getValidCachedToken);
+        /**
+	 * Get a valid access token, refreshing if necessary.
+	 * Deduplicates concurrent requests to prevent thundering herd.
+	 */ _class_private_method_init(this, _getAccessToken);
+        /**
+	 * Fetch token from server and cache it.
+	 */ _class_private_method_init(this, _fetchAndCacheToken);
+        _define_property(this, "baseUrl", void 0);
+        _class_private_field_init(this, _config, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_init(this, _cachedToken, {
+            writable: true,
+            value: null
+        });
+        _class_private_field_init(this, _pendingTokenRequest, {
+            writable: true,
+            value: null
+        });
+        this.baseUrl = config.baseUrl;
+        var _config_tokenExpirationBuffer, _config_allowInsecureRequests;
+        _class_private_field_set(this, _config, {
+            baseUrl: config.baseUrl,
+            clientId: config.clientId,
+            privateKey: config.privateKey,
+            keyId: config.keyId,
+            scope: config.scope,
+            tokenExpirationBuffer: (_config_tokenExpirationBuffer = config.tokenExpirationBuffer) !== null && _config_tokenExpirationBuffer !== void 0 ? _config_tokenExpirationBuffer : 30,
+            allowInsecureRequests: (_config_allowInsecureRequests = config.allowInsecureRequests) !== null && _config_allowInsecureRequests !== void 0 ? _config_allowInsecureRequests : false
+        });
+    }
+    _create_class(SmartBackendServicesAuthProvider, [
+        {
+            key: "establishSession",
+            value: /**
+	 * Establish session - for Backend Services this means getting a token.
+	 */ function establishSession() {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                return [
+                                    4,
+                                    _class_private_method_get(this, _getAccessToken, getAccessToken).call(this)
+                                ];
+                            case 1:
+                                _state.sent();
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "revokeSession",
+            value: /**
+	 * Revoke session - clear cached token.
+	 */ function revokeSession() {
+                return _async_to_generator(function() {
+                    var pending, e;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // Wait for any pending token request to settle before clearing
+                                pending = _class_private_field_get(this, _pendingTokenRequest);
+                                if (!pending) return [
+                                    3,
+                                    4
+                                ];
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    3,
+                                    ,
+                                    4
+                                ]);
+                                return [
+                                    4,
+                                    pending
+                                ];
+                            case 2:
+                                _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 3:
+                                e = _state.sent();
+                                return [
+                                    3,
+                                    4
+                                ];
+                            case 4:
+                                _class_private_field_set(this, _cachedToken, null);
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "fetch",
+            value: /**
+	 * Fetch wrapper that adds Bearer token authorization.
+	 * Automatically obtains token on first request and retries once on 401.
+	 */ function fetch1(input, init) {
+                return _async_to_generator(function() {
+                    var accessToken, requestInit, baseHeaders, initHeaders, mergedHeaders, clonedInput, retryBody, _requestInit_body_tee, stream1, stream2, response, newToken;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                validateBaseUrl(input, this.baseUrl);
+                                return [
+                                    4,
+                                    _class_private_method_get(this, _getAccessToken, getAccessToken).call(this)
+                                ];
+                            case 1:
+                                accessToken = _state.sent();
+                                requestInit = init !== null && init !== void 0 ? init : {};
+                                baseHeaders = _instanceof(input, Request) ? input.headers : undefined;
+                                initHeaders = requestInit.headers ? new Headers(requestInit.headers) : undefined;
+                                mergedHeaders = mergeHeaders(baseHeaders, initHeaders);
+                                mergedHeaders.set("Authorization", "Bearer ".concat(accessToken));
+                                requestInit.headers = mergedHeaders;
+                                // Clone input/body to preserve for potential retry
+                                clonedInput = _instanceof(input, Request) ? input.clone() : input;
+                                retryBody = requestInit.body;
+                                // If body is a ReadableStream, tee it for potential retry
+                                if (_instanceof(requestInit.body, ReadableStream)) {
+                                    _requestInit_body_tee = _sliced_to_array(requestInit.body.tee(), 2), stream1 = _requestInit_body_tee[0], stream2 = _requestInit_body_tee[1];
+                                    requestInit.body = stream1;
+                                    retryBody = stream2;
+                                }
+                                return [
+                                    4,
+                                    fetch(clonedInput, requestInit)
+                                ];
+                            case 2:
+                                response = _state.sent();
+                                if (!(response.status === 401)) return [
+                                    3,
+                                    5
+                                ];
+                                _class_private_field_set(this, _cachedToken, null);
+                                return [
+                                    4,
+                                    _class_private_method_get(this, _getAccessToken, getAccessToken).call(this)
+                                ];
+                            case 3:
+                                newToken = _state.sent();
+                                mergedHeaders.set("Authorization", "Bearer ".concat(newToken));
+                                if (retryBody !== undefined) {
+                                    requestInit.body = retryBody;
+                                }
+                                return [
+                                    4,
+                                    fetch(input, requestInit)
+                                ];
+                            case 4:
+                                response = _state.sent();
+                                _state.label = 5;
+                            case 5:
+                                return [
+                                    2,
+                                    response
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        }
+    ]);
+    return SmartBackendServicesAuthProvider;
+}();
+function discoverAuthServer() {
+    return _async_to_generator(function() {
+        var url, response, metadata;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    url = new URL(_class_private_field_get(this, _config).baseUrl);
+                    return [
+                        4,
+                        oauth.discoveryRequest(url, _define_property({
+                            algorithm: "oauth2"
+                        }, oauth.allowInsecureRequests, _class_private_field_get(this, _config).allowInsecureRequests))
+                    ];
+                case 1:
+                    response = _state.sent();
+                    return [
+                        4,
+                        oauth.processDiscoveryResponse(url, response)
+                    ];
+                case 2:
+                    metadata = _state.sent();
+                    if (!metadata.token_endpoint) {
+                        throw new Error("Discovery response missing token_endpoint");
+                    }
+                    return [
+                        2,
+                        metadata
+                    ];
+            }
+        });
+    }).call(this);
+}
+function requestToken() {
+    return _async_to_generator(function() {
+        var as, client, privateKey, clientAuth, params, response, sanitizedResponse;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        _class_private_method_get(this, _discoverAuthServer, discoverAuthServer).call(this)
+                    ];
+                case 1:
+                    as = _state.sent();
+                    client = {
+                        client_id: _class_private_field_get(this, _config).clientId
+                    };
+                    privateKey = {
+                        key: _class_private_field_get(this, _config).privateKey,
+                        kid: _class_private_field_get(this, _config).keyId
+                    };
+                    // Aidbox requires typ: "JWT" in the client assertion JWT header.
+                    // oauth.modifyAssertion is a Symbol that allows customizing the JWT before signing.
+                    clientAuth = oauth.PrivateKeyJwt(privateKey, _define_property({}, oauth.modifyAssertion, function(header) {
+                        header.typ = "JWT";
+                    }));
+                    // Request parameters
+                    params = new URLSearchParams();
+                    params.set("scope", _class_private_field_get(this, _config).scope);
+                    return [
+                        4,
+                        oauth.clientCredentialsGrantRequest(as, client, clientAuth, params, _define_property({}, oauth.allowInsecureRequests, _class_private_field_get(this, _config).allowInsecureRequests))
+                    ];
+                case 2:
+                    response = _state.sent();
+                    return [
+                        4,
+                        _class_private_method_get(this, _sanitizeTokenResponse, sanitizeTokenResponse).call(this, response)
+                    ];
+                case 3:
+                    sanitizedResponse = _state.sent();
+                    return [
+                        2,
+                        oauth.processClientCredentialsResponse(as, client, sanitizedResponse)
+                    ];
+            }
+        });
+    }).call(this);
+}
+function sanitizeTokenResponse(response) {
+    return _async_to_generator(function() {
+        var cloned, body, _, sanitized;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    cloned = response.clone();
+                    return [
+                        4,
+                        cloned.json()
+                    ];
+                case 1:
+                    body = _state.sent();
+                    if (!("refresh_token" in body) || body.refresh_token !== null) {
+                        return [
+                            2,
+                            response
+                        ];
+                    }
+                    _ = body.refresh_token, sanitized = _object_without_properties(body, [
+                        "refresh_token"
+                    ]);
+                    return [
+                        2,
+                        new Response(JSON.stringify(sanitized), {
+                            status: response.status,
+                            statusText: response.statusText,
+                            headers: response.headers
+                        })
+                    ];
+            }
+        });
+    })();
+}
+function getValidCachedToken() {
+    if (!_class_private_field_get(this, _cachedToken)) return null;
+    var bufferMs = _class_private_field_get(this, _config).tokenExpirationBuffer * 1000;
+    if (_class_private_field_get(this, _cachedToken).expiresAt > Date.now() + bufferMs) {
+        return _class_private_field_get(this, _cachedToken).accessToken;
+    }
+    return null;
+}
+function getAccessToken() {
+    return _async_to_generator(function() {
+        var validToken;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    validToken = _class_private_method_get(this, _getValidCachedToken, getValidCachedToken).call(this);
+                    if (validToken) {
+                        return [
+                            2,
+                            validToken
+                        ];
+                    }
+                    // If a token request is already in progress, wait for it
+                    if (_class_private_field_get(this, _pendingTokenRequest)) {
+                        return [
+                            2,
+                            _class_private_field_get(this, _pendingTokenRequest)
+                        ];
+                    }
+                    // Request new token, storing the promise to deduplicate concurrent calls
+                    _class_private_field_set(this, _pendingTokenRequest, _class_private_method_get(this, _fetchAndCacheToken, fetchAndCacheToken).call(this));
+                    _state.label = 1;
+                case 1:
+                    _state.trys.push([
+                        1,
+                        ,
+                        3,
+                        4
+                    ]);
+                    return [
+                        4,
+                        _class_private_field_get(this, _pendingTokenRequest)
+                    ];
+                case 2:
+                    return [
+                        2,
+                        _state.sent()
+                    ];
+                case 3:
+                    _class_private_field_set(this, _pendingTokenRequest, null);
+                    return [
+                        7
+                    ];
+                case 4:
+                    return [
+                        2
+                    ];
+            }
+        });
+    }).call(this);
+}
+function fetchAndCacheToken() {
+    return _async_to_generator(function() {
+        var tokenResponse, now, _tokenResponse_expires_in;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        _class_private_method_get(this, _requestToken, requestToken).call(this)
+                    ];
+                case 1:
+                    tokenResponse = _state.sent();
+                    now = Date.now();
+                    _class_private_field_set(this, _cachedToken, {
+                        accessToken: tokenResponse.access_token,
+                        expiresAt: now + ((_tokenResponse_expires_in = tokenResponse.expires_in) !== null && _tokenResponse_expires_in !== void 0 ? _tokenResponse_expires_in : 300) * 1000
+                    });
+                    return [
+                        2,
+                        _class_private_field_get(this, _cachedToken).accessToken
+                    ];
+            }
+        });
+    }).call(this);
+}