@icure/api 7.1.21 → 7.1.23

package/icc-x-api/auth/JwtUtils.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwtClaims = exports.isJwtInvalidOrExpired = void 0;
+const utils_1 = require("../utils");
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Returns true if the jwt is invalid or expired, false otherwise.
+ */
+function isJwtInvalidOrExpired(jwt) {
+    try {
+        const claims = decodeJwtClaims(jwt);
+        // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.
+        return !('exp' in claims) || claims['exp'] * 1000 < new Date().getTime();
+    }
+    catch (e) {
+        return true;
+    }
+}
+exports.isJwtInvalidOrExpired = isJwtInvalidOrExpired;
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Get the claims of the jwt.
+ */
+function decodeJwtClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        throw new Error('Invalid JWT: should be 3 parts');
+    return JSON.parse((0, utils_1.a2b)(parts[1]));
+}
+exports.decodeJwtClaims = decodeJwtClaims;
+//# sourceMappingURL=JwtUtils.js.map

package/icc-x-api/auth/JwtUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtUtils.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtUtils.ts"],"names":[],"mappings":";;;AAAA,oCAA8B;AAE9B;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,IAAI;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACnC,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;KACzE;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,IAAI,CAAA;KACZ;AACH,CAAC;AARD,sDAQC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAJD,0CAIC","sourcesContent":["import { a2b } from '../utils'\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n * Returns true if the jwt is invalid or expired, false otherwise.\n */\nexport function isJwtInvalidOrExpired(jwt: string): boolean {\n  try {\n    const claims = decodeJwtClaims(jwt)\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in claims) || claims['exp'] * 1000 < new Date().getTime()\n  } catch (e) {\n    return true\n  }\n}\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n * Get the claims of the jwt.\n */\nexport function decodeJwtClaims(jwt: string): any {\n  const parts = jwt.split('.')\n  if (parts.length !== 3) throw new Error('Invalid JWT: should be 3 parts')\n  return JSON.parse(a2b(parts[1]))\n}\n"]}

package/icc-x-api/auth/SmartAuthProvider.d.ts

@@ -0,0 +1,120 @@
+import { AuthenticationProvider } from './AuthenticationProvider';
+import { UserGroup } from '../../icc-api/model/UserGroup';
+import { AuthService } from './AuthService';
+import { IccAuthApi } from '../../icc-api';
+/**
+ * Needed by a {@link SmartAuthProvider} to get the secrets (password, token, etc.) for authentication to the iCure SDK as needed.
+ */
+export interface AuthSecretProvider {
+    /**
+     * Provides a secret for authentication to the iCure SDK.
+     *
+     * ## Accepted secrets
+     *
+     * The method will be provided with an array of the secrets types that are acceptable (`acceptedSecrets`). Usually this array will contain multiple
+     * elements, but this depends on the group configuration, the user (if he has 2fa setup or not), or the operation being performed. For groups using
+     * default configurations and for patients without 2fa enabled for example the array will always contain the {@link AuthSecretType.PASSWORD} element.
+     * Usually the array contain also the {@link AuthSecretType.LONG_LIVED_TOKEN} element, but if the user is attempting to perform a sensitive operations
+     * such as changing his password the default group configuration does not allow for the user to authenticate using a JWT obtained from a long-lived
+     * token for this operation, meaning the array will not contain the {@link AuthSecretType.LONG_LIVED_TOKEN} element.
+     *
+     * Regardless of the number of elements in the array only one secret of the accepted types is sufficient for the operation to succeed.
+     *
+     * ## TWO_FACTOR_AUTHENTICATION_TOKEN secret type
+     *
+     * The {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN} secret type is only used when the user has 2fa enabled. In this case the SDK will call
+     * this method twice, once containing the {@link AuthSecretType.PASSWORD} element in the `acceptedSecrets` array, and if the provided secret is a
+     * valid password the SDK will immediately call this method again, this time containing the {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN}
+     * instead of the {@link AuthSecretType.PASSWORD} element.
+     *
+     * Any future call to this method from the same provider instance will not contain the {@link AuthSecretType.PASSWORD} element anymore, as it is
+     * cached, but it may contain the {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN} element instead.
+     *
+     * Note that the 2fa token is not needed for logging in through a long-lived or short-lived token, it is only used in combination with a password.
+     * If the user is using 2fa, and you get in input as `acceptedSecrets` an array `[PASSWORD, LONG_LIVED_TOKEN, SHORT_LIVED_TOKEN]`, and you pass to
+     * authenticate a long-lived token, the SDK will not call this method again to ask for the 2fa token.
+     *
+     * @param acceptedSecrets the types of secrets that are acceptable for the operation being performed.
+     * @param previousAttempts the secrets that were previously attempted by the SDK for this operation. This array will be empty the first time this
+     * method is called for a given operation, but it may contain multiple elements if the SDK has already called this method multiple times because the
+     * previously returned secrets were not valid. The first element is the first secret that was attempted, and the last element is the most recently
+     * attempted.
+     * @return a promise that resolves with the secret and the secret type to use for authentication. If the promise rejects then the ongoing SDK
+     * operation will fail without being re-attempted.
+     */
+    getSecret(acceptedSecrets: AuthSecretType[], previousAttempts: {
+        secret: string;
+        secretType: AuthSecretType;
+    }[]): Promise<{
+        secret: string;
+        secretType: AuthSecretType;
+    }>;
+}
+/**
+ * Represents a type of secret that can be used for authentication with iCure.
+ */
+export declare enum AuthSecretType {
+    /**
+     * Password chosen by the user.
+     */
+    PASSWORD = "PASSWORD",
+    /**
+     * Time based one time password provided by authenticator applications, generated on the basis of a timestamp and a shared secret between the iCure
+     * server and the authenticator application.
+     */
+    TWO_FACTOR_AUTHENTICATION_TOKEN = "TWO_FACTOR_AUTHENTICATION_TOKEN",
+    /**
+     * A short-lived iCure token, an internal authentication token that lasts 5 minutes or less. Unlike passwords these tokens usually are generated by
+     * some component of iCure, and are not chosen by the user.
+     */
+    SHORT_LIVED_TOKEN = "SHORT_LIVED_TOKEN",
+    /**
+     * A long-lived iCure token, an internal authentication token that lasts longer than 5 minutes. Unlike passwords these tokens usually are generated
+     * by some component of iCure, and are not chosen by the user.
+     */
+    LONG_LIVED_TOKEN = "LONG_LIVED_TOKEN"
+}
+/**
+ * @internal this class is meant for internal use only and may be changed without notice. The SmartAuthProvider will be initialised automatically
+ * by the iCure api depending on the authentication options you provide.
+ *
+ * An authentication provider that automatically requests secrets for authentication as needed.
+ *
+ * This authentication provider can be initialised already with some secrets or tokens, and the provider will cache them and use them as needed for
+ * as long as they remain valid. If at any point however the provider needs an updated secret or a secret of a different kind it will automatically
+ * request this to the {@link SmartAuthProvider} to get the secret.
+ *
+ * An advantage of using this provider over others is that in case all the cached tokens and secrets were to expire while performing a request,
+ * instead of having the request fail the provider will ask for new secrets from the {@link SmartAuthProvider} and the request will automatically
+ * be retried with the new secret. Additionally, the provider may request updated secrets also for performing some sensitive operations (e.g. changing
+ * password of the user) even if the cached tokens and/or did not expire. This could be the case for example if the cached secret is a long-lived
+ * token, but in order to change the password the user needs to provide his current password.
+ *
+ * Note that in this context the cache of secrets and token is in memory only, and is not persisted in any way. Different instances of this provider
+ * will not share the same cache.
+ *
+ */
+export declare class SmartAuthProvider implements AuthenticationProvider {
+    private readonly tokenProvider;
+    private readonly groupId;
+    /**
+     * Initialises a {@link SmartAuthProvider}.
+     * @param authApi an "anonymous" {@link IccAuthApi} to use for authentication.
+     * @param login
+     * @param secretProvider
+     * @param props optional initialisation properties.
+     */
+    static initialise(authApi: IccAuthApi, login: string, secretProvider: AuthSecretProvider, props?: {
+        initialSecret?: string;
+        initialAuthToken?: string;
+        initialRefreshToken?: string;
+        loginGroupId?: string;
+    }): SmartAuthProvider;
+    private constructor();
+    getAuthService(): AuthService;
+    switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider>;
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
+}

package/icc-x-api/auth/SmartAuthProvider.js

@@ -0,0 +1,375 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SmartAuthProvider = exports.AuthSecretType = void 0;
+const XHR_1 = require("../../icc-api/api/XHR");
+var XHRError = XHR_1.XHR.XHRError;
+const JwtUtils_1 = require("./JwtUtils");
+/**
+ * Represents a type of secret that can be used for authentication with iCure.
+ */
+var AuthSecretType;
+(function (AuthSecretType) {
+    /**
+     * Password chosen by the user.
+     */
+    AuthSecretType["PASSWORD"] = "PASSWORD";
+    /**
+     * Time based one time password provided by authenticator applications, generated on the basis of a timestamp and a shared secret between the iCure
+     * server and the authenticator application.
+     */
+    AuthSecretType["TWO_FACTOR_AUTHENTICATION_TOKEN"] = "TWO_FACTOR_AUTHENTICATION_TOKEN";
+    /**
+     * A short-lived iCure token, an internal authentication token that lasts 5 minutes or less. Unlike passwords these tokens usually are generated by
+     * some component of iCure, and are not chosen by the user.
+     */
+    AuthSecretType["SHORT_LIVED_TOKEN"] = "SHORT_LIVED_TOKEN";
+    /**
+     * A long-lived iCure token, an internal authentication token that lasts longer than 5 minutes. Unlike passwords these tokens usually are generated
+     * by some component of iCure, and are not chosen by the user.
+     */
+    AuthSecretType["LONG_LIVED_TOKEN"] = "LONG_LIVED_TOKEN";
+    /**
+     * A token provided by an external authentication provider (e.g. Oauth/Google).
+     * Not yet in use.
+     */
+    // EXTERNAL_AUTHENTICATION = 'EXTERNAL_AUTHENTICATION',
+    /**
+     * A special case of external authentication where the provider is a digital identity provider.
+     * Not yet in use.
+     */
+    // DIGITAL_ID = 'DIGITAL_ID',
+})(AuthSecretType = exports.AuthSecretType || (exports.AuthSecretType = {}));
+// Here starts internal entities that should not be used directly.
+/**
+ * @internal this class is meant for internal use only and may be changed without notice. The SmartAuthProvider will be initialised automatically
+ * by the iCure api depending on the authentication options you provide.
+ *
+ * An authentication provider that automatically requests secrets for authentication as needed.
+ *
+ * This authentication provider can be initialised already with some secrets or tokens, and the provider will cache them and use them as needed for
+ * as long as they remain valid. If at any point however the provider needs an updated secret or a secret of a different kind it will automatically
+ * request this to the {@link SmartAuthProvider} to get the secret.
+ *
+ * An advantage of using this provider over others is that in case all the cached tokens and secrets were to expire while performing a request,
+ * instead of having the request fail the provider will ask for new secrets from the {@link SmartAuthProvider} and the request will automatically
+ * be retried with the new secret. Additionally, the provider may request updated secrets also for performing some sensitive operations (e.g. changing
+ * password of the user) even if the cached tokens and/or did not expire. This could be the case for example if the cached secret is a long-lived
+ * token, but in order to change the password the user needs to provide his current password.
+ *
+ * Note that in this context the cache of secrets and token is in memory only, and is not persisted in any way. Different instances of this provider
+ * will not share the same cache.
+ *
+ */
+class SmartAuthProvider {
+    /**
+     * Initialises a {@link SmartAuthProvider}.
+     * @param authApi an "anonymous" {@link IccAuthApi} to use for authentication.
+     * @param login
+     * @param secretProvider
+     * @param props optional initialisation properties.
+     */
+    static initialise(authApi, login, secretProvider, props = {}) {
+        return new SmartAuthProvider(new TokenProvider(login, props.loginGroupId, props.initialSecret ? { value: props.initialSecret, type: undefined } : undefined, props.initialAuthToken, props.initialRefreshToken, authApi, secretProvider), props.loginGroupId);
+    }
+    constructor(tokenProvider, groupId) {
+        this.tokenProvider = tokenProvider;
+        this.groupId = groupId;
+    }
+    getAuthService() {
+        return new SmartAuthService(this.tokenProvider);
+    }
+    switchGroup(newGroupId, matches) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (newGroupId == this.groupId)
+                return Promise.resolve(this);
+            if (!matches.find((match) => match.groupId == newGroupId))
+                throw new Error('New group id not found in matches.');
+            const switchedProvider = yield this.tokenProvider.switchedGroup(newGroupId);
+            return new SmartAuthProvider(switchedProvider, this.groupId);
+        });
+    }
+    getIcureTokens() {
+        return Promise.resolve(undefined);
+    }
+}
+exports.SmartAuthProvider = SmartAuthProvider;
+var ServerAuthenticationClass;
+(function (ServerAuthenticationClass) {
+    // DIGITAL_ID = 60,
+    ServerAuthenticationClass[ServerAuthenticationClass["TWO_FACTOR_AUTHENTICATION"] = 50] = "TWO_FACTOR_AUTHENTICATION";
+    ServerAuthenticationClass[ServerAuthenticationClass["SHORT_LIVED_TOKEN"] = 40] = "SHORT_LIVED_TOKEN";
+    // EXTERNAL_AUTHENTICATION = 30,
+    ServerAuthenticationClass[ServerAuthenticationClass["PASSWORD"] = 20] = "PASSWORD";
+    ServerAuthenticationClass[ServerAuthenticationClass["LONG_LIVED_TOKEN"] = 10] = "LONG_LIVED_TOKEN";
+})(ServerAuthenticationClass || (ServerAuthenticationClass = {}));
+class TokenProvider {
+    constructor(login, groupId, currentLongLivedSecret, cachedToken, cachedRefreshToken, authApi, authSecretProvider) {
+        this.login = login;
+        this.groupId = groupId;
+        this.currentLongLivedSecret = currentLongLivedSecret;
+        this.cachedToken = cachedToken;
+        this.cachedRefreshToken = cachedRefreshToken;
+        this.authApi = authApi;
+        this.authSecretProvider = authSecretProvider;
+    }
+    getCachedOrRefreshedOrNewToken() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!!this.cachedToken && !(0, JwtUtils_1.isJwtInvalidOrExpired)(this.cachedToken)) {
+                return { token: this.cachedToken, type: RetrievedTokenType.CACHED };
+            }
+            else if (!!this.cachedRefreshToken && !(0, JwtUtils_1.isJwtInvalidOrExpired)(this.cachedRefreshToken)) {
+                return this.refreshAndCacheToken(this.cachedRefreshToken);
+            }
+            else {
+                return { token: yield this.getAndCacheNewToken(undefined), type: RetrievedTokenType.NEW };
+            }
+        });
+    }
+    getNewTokenWithClass(minimumAuthenticationClass) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.getAndCacheNewToken(minimumAuthenticationClass);
+        });
+    }
+    getAndCacheNewToken(minimumAuthenticationClassLevel) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { token, refreshToken } = yield this.getNewToken(minimumAuthenticationClassLevel !== null && minimumAuthenticationClassLevel !== void 0 ? minimumAuthenticationClassLevel : 0);
+            this.cachedToken = token;
+            this.cachedRefreshToken = refreshToken;
+            return token;
+        });
+    }
+    refreshAndCacheToken(refreshToken) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.authApi.refreshAuthenticationJWT(refreshToken).then((authResult) => {
+                if (!authResult.token)
+                    throw new Error('Internal error: refresh succeeded but no token was returned. Unsupported backend version?');
+                this.cachedToken = authResult.token;
+                return { token: authResult.token, type: RetrievedTokenType.REFRESHED };
+            }, () => __awaiter(this, void 0, void 0, function* () { return ({ token: yield this.getAndCacheNewToken(undefined), type: RetrievedTokenType.NEW }); }));
+        });
+    }
+    getNewToken(minimumAuthenticationClassLevel) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!!this.currentLongLivedSecret && (!this.currentLongLivedSecret.type || this.currentLongLivedSecret.type >= minimumAuthenticationClassLevel)) {
+                const resultWithCachedSecret = yield this.doGetTokenWithSecret(this.currentLongLivedSecret.value, minimumAuthenticationClassLevel);
+                if ('success' in resultWithCachedSecret) {
+                    return resultWithCachedSecret.success;
+                }
+                else if (resultWithCachedSecret.failure === DoGetTokenResultFailureReason.NEEDS_2FA &&
+                    minimumAuthenticationClassLevel <= ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION) {
+                    return this.askTotpAndGetToken(this.currentLongLivedSecret.value, minimumAuthenticationClassLevel);
+                }
+                else
+                    return this.askSecretAndGetToken(minimumAuthenticationClassLevel, true);
+            }
+            else {
+                return this.askSecretAndGetToken(minimumAuthenticationClassLevel, true);
+            }
+        });
+    }
+    askSecretAndGetToken(minimumAuthenticationClassLevel, passwordIsValidAs2fa) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const acceptedSecrets = [
+                minimumAuthenticationClassLevel <= ServerAuthenticationClass.LONG_LIVED_TOKEN ? [AuthSecretType.LONG_LIVED_TOKEN] : [],
+                minimumAuthenticationClassLevel <= ServerAuthenticationClass.SHORT_LIVED_TOKEN ? [AuthSecretType.SHORT_LIVED_TOKEN] : [],
+                minimumAuthenticationClassLevel <= ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION &&
+                    (passwordIsValidAs2fa || minimumAuthenticationClassLevel <= ServerAuthenticationClass.PASSWORD)
+                    ? [AuthSecretType.PASSWORD]
+                    : [],
+            ].flat();
+            if (!acceptedSecrets.length)
+                throw new Error('Internal error: no secret type is accepted for this request. Group may be misconfigured, or client may be outdated.');
+            const attempts = [];
+            while (true) {
+                const { secret, secretType } = yield this.authSecretProvider.getSecret([...acceptedSecrets], attempts);
+                if (!acceptedSecrets.includes(secretType))
+                    throw new Error(`Accepted secret types are ${JSON.stringify(acceptedSecrets)}, but got a secret of type ${secretType}.`);
+                attempts.push({ secret, secretType });
+                const result = yield this.doGetTokenWithSecret(secret, minimumAuthenticationClassLevel);
+                if ('success' in result) {
+                    this.updateCachedSecret(secret, secretType);
+                    return result.success;
+                }
+                else if (result.failure == DoGetTokenResultFailureReason.NEEDS_2FA) {
+                    return this.askTotpAndGetToken(secret, minimumAuthenticationClassLevel);
+                }
+                else if (secretType == AuthSecretType.PASSWORD && result.failure == DoGetTokenResultFailureReason.INVALID_AUTH_CLASS_LEVEL) {
+                    return this.askSecretAndGetToken(minimumAuthenticationClassLevel, false);
+                } // else retry
+            }
+        });
+    }
+    askTotpAndGetToken(password, minimumAuthenticationClassLevel) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (minimumAuthenticationClassLevel > ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION)
+                throw new Error("Internal error: asking for totp to login but minimumAuthenticationClassLevel is higher than TWO_FACTOR_AUTHENTICATION's level.");
+            const attempts = [];
+            while (true) {
+                const { secret, secretType } = yield this.authSecretProvider.getSecret([AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN], attempts);
+                if (secretType != AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN)
+                    throw new Error(`Was expecting a 2fa token but got a secret of type ${secretType}.`);
+                attempts.push({ secret, secretType });
+                const result = yield this.doGetTokenWithSecret(`${password}|${secret}`, minimumAuthenticationClassLevel);
+                if ('success' in result) {
+                    this.updateCachedSecret(password, AuthSecretType.PASSWORD);
+                    return result.success;
+                }
+                else if (result.failure != DoGetTokenResultFailureReason.INVALID_2FA) {
+                    throw new Error(`Unexpected error while trying to login with (previously) valid password and 2fa token ${result.failure}.`);
+                } // else retry
+            }
+        });
+    }
+    doGetTokenWithSecret(secret, minimumAuthenticationClassLevel) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.authApi.login({ username: this.login, password: secret }, this.groupId).then((authResult) => {
+                const { token, refreshToken } = authResult;
+                if (!token || !refreshToken)
+                    throw new Error('Internal error: login succeeded but no token was returned. Unsupported backend version?');
+                const claims = (0, JwtUtils_1.decodeJwtClaims)(token);
+                const authClassLevel = claims['tac'];
+                if (!authClassLevel || typeof authClassLevel !== 'number')
+                    throw new Error('Internal error: authClassLevel is not a number. Unsupported backend version?');
+                if (authClassLevel < minimumAuthenticationClassLevel) {
+                    return { failure: DoGetTokenResultFailureReason.INVALID_AUTH_CLASS_LEVEL };
+                }
+                else {
+                    return { success: { token, refreshToken } };
+                }
+            }, (error) => {
+                if (!(error instanceof XHRError))
+                    throw error;
+                if (error.statusCode == 401 || error.statusCode == 412) {
+                    // Password is wrong (401) or unacceptable (e.g. too short, 412)
+                    return { failure: DoGetTokenResultFailureReason.INVALID_PW_OR_TOKEN };
+                }
+                else if (error.statusCode == 406) {
+                    // Password is correct, but 2fa token is not
+                    return { failure: DoGetTokenResultFailureReason.INVALID_2FA };
+                }
+                else if (error.statusCode == 417) {
+                    // Password is correct, but the user has 2fa enabled and no 2fa token was provided
+                    return { failure: DoGetTokenResultFailureReason.NEEDS_2FA };
+                }
+                else
+                    throw error;
+            });
+        });
+    }
+    switchedGroup(newGroupId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const groupSwitchedTokens = this.cachedRefreshToken
+                ? yield this.authApi.switchGroup(this.cachedRefreshToken, newGroupId).then((response) => {
+                    if (!response.token || !response.refreshToken)
+                        throw new Error('Internal error: group switch succeeded but no token was returned. Unsupported backend version?');
+                    return { token: response.token, refreshToken: response.refreshToken };
+                }, () => ({ token: undefined, refreshToken: undefined }))
+                : { token: undefined, refreshToken: undefined };
+            return new TokenProvider(this.login, newGroupId, this.currentLongLivedSecret ? { value: this.currentLongLivedSecret.value, type: undefined } : undefined, groupSwitchedTokens.token, groupSwitchedTokens.refreshToken, this.authApi, this.authSecretProvider);
+        });
+    }
+    updateCachedSecret(secret, secretType) {
+        if (secretType == AuthSecretType.LONG_LIVED_TOKEN || secretType == AuthSecretType.PASSWORD) {
+            this.currentLongLivedSecret = { value: secret, type: ServerAuthenticationClass.LONG_LIVED_TOKEN };
+        }
+    }
+}
+var DoGetTokenResultFailureReason;
+(function (DoGetTokenResultFailureReason) {
+    DoGetTokenResultFailureReason[DoGetTokenResultFailureReason["NEEDS_2FA"] = 0] = "NEEDS_2FA";
+    DoGetTokenResultFailureReason[DoGetTokenResultFailureReason["INVALID_2FA"] = 1] = "INVALID_2FA";
+    DoGetTokenResultFailureReason[DoGetTokenResultFailureReason["INVALID_PW_OR_TOKEN"] = 2] = "INVALID_PW_OR_TOKEN";
+    DoGetTokenResultFailureReason[DoGetTokenResultFailureReason["INVALID_AUTH_CLASS_LEVEL"] = 3] = "INVALID_AUTH_CLASS_LEVEL";
+})(DoGetTokenResultFailureReason || (DoGetTokenResultFailureReason = {}));
+var RetrievedTokenType;
+(function (RetrievedTokenType) {
+    RetrievedTokenType[RetrievedTokenType["CACHED"] = 0] = "CACHED";
+    RetrievedTokenType[RetrievedTokenType["REFRESHED"] = 1] = "REFRESHED";
+    RetrievedTokenType[RetrievedTokenType["NEW"] = 2] = "NEW";
+})(RetrievedTokenType || (RetrievedTokenType = {}));
+var SmartAuthServiceState;
+(function (SmartAuthServiceState) {
+    SmartAuthServiceState[SmartAuthServiceState["INITIAL"] = 0] = "INITIAL";
+    SmartAuthServiceState[SmartAuthServiceState["DONE_INITIAL"] = 1] = "DONE_INITIAL";
+    SmartAuthServiceState[SmartAuthServiceState["REATTEMPT"] = 2] = "REATTEMPT";
+    SmartAuthServiceState[SmartAuthServiceState["REATTEMPTED_WITH_NEW_UNBOUND_TOKEN"] = 3] = "REATTEMPTED_WITH_NEW_UNBOUND_TOKEN";
+    SmartAuthServiceState[SmartAuthServiceState["REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN"] = 4] = "REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN";
+    SmartAuthServiceState[SmartAuthServiceState["EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS"] = 5] = "EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS";
+    SmartAuthServiceState[SmartAuthServiceState["TERMINAL_ERROR"] = 6] = "TERMINAL_ERROR";
+})(SmartAuthServiceState || (SmartAuthServiceState = {}));
+class SmartAuthService {
+    constructor(tokenProvider) {
+        this.tokenProvider = tokenProvider;
+        this.currentState = { id: SmartAuthServiceState.INITIAL };
+    }
+    getAuthHeaders(minimumAuthenticationClassLevel) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return [new XHR_1.XHR.Header('Authorization', `Bearer ${yield this.getAuthToken(minimumAuthenticationClassLevel)}`)];
+        });
+    }
+    getAuthToken(minimumAuthenticationClassLevel) {
+        return __awaiter(this, void 0, void 0, function* () {
+            switch (this.currentState.id) {
+                case SmartAuthServiceState.INITIAL:
+                    if (minimumAuthenticationClassLevel != undefined) {
+                        throw new Error('Illegal state: cannot ask for a specific auth class level at the first request attempt.');
+                    }
+                    else {
+                        const { token } = yield this.tokenProvider.getCachedOrRefreshedOrNewToken();
+                        this.currentState = { id: SmartAuthServiceState.DONE_INITIAL, initialToken: token };
+                        return token;
+                    }
+                case SmartAuthServiceState.REATTEMPT:
+                    if (minimumAuthenticationClassLevel != undefined) {
+                        const token = yield this.tokenProvider.getNewTokenWithClass(minimumAuthenticationClassLevel);
+                        this.currentState = { id: SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN };
+                        return token;
+                    }
+                    else {
+                        const { token } = yield this.tokenProvider.getCachedOrRefreshedOrNewToken();
+                        if (token == this.currentState.initialToken)
+                            throw this.currentState.initialError;
+                        this.currentState = { id: SmartAuthServiceState.REATTEMPTED_WITH_NEW_UNBOUND_TOKEN };
+                        return token;
+                    }
+                case SmartAuthServiceState.EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS:
+                    if (minimumAuthenticationClassLevel != undefined) {
+                        const token = yield this.tokenProvider.getNewTokenWithClass(minimumAuthenticationClassLevel);
+                        this.currentState = { id: SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN };
+                        return token;
+                    }
+                    else
+                        throw this.currentState.errorFromNewToken;
+                case SmartAuthServiceState.TERMINAL_ERROR:
+                    throw this.currentState.error;
+                default:
+                    throw new Error(`Illegal state: cannot get token in state ${this.currentState.id}.`);
+            }
+        });
+    }
+    invalidateHeader(error) {
+        switch (this.currentState.id) {
+            case SmartAuthServiceState.DONE_INITIAL:
+                this.currentState = { id: SmartAuthServiceState.REATTEMPT, initialToken: this.currentState.initialToken, initialError: error };
+                break;
+            case SmartAuthServiceState.REATTEMPTED_WITH_NEW_UNBOUND_TOKEN:
+                this.currentState = { id: SmartAuthServiceState.EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS, errorFromNewToken: error };
+                break;
+            case SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN:
+                this.currentState = { id: SmartAuthServiceState.TERMINAL_ERROR, error: error };
+                break;
+            default:
+                throw new Error(`Illegal state: cannot invalidate header in state ${this.currentState.id}.`);
+        }
+    }
+}
+//# sourceMappingURL=SmartAuthProvider.js.map

package/icc-x-api/auth/SmartAuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SmartAuthProvider.js","sourceRoot":"","sources":["../../../icc-x-api/auth/SmartAuthProvider.ts"],"names":[],"mappings":";;;;;;;;;;;;AAIA,+CAA2C;AAC3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAC9B,yCAAmE;AAgDnE;;GAEG;AACH,IAAY,cA8BX;AA9BD,WAAY,cAAc;IACxB;;OAEG;IACH,uCAAqB,CAAA;IACrB;;;OAGG;IACH,qFAAmE,CAAA;IACnE;;;OAGG;IACH,yDAAuC,CAAA;IACvC;;;OAGG;IACH,uDAAqC,CAAA;IACrC;;;OAGG;IACH,uDAAuD;IACvD;;;OAGG;IACH,6BAA6B;AAC/B,CAAC,EA9BW,cAAc,GAAd,sBAAc,KAAd,sBAAc,QA8BzB;AAED,kEAAkE;AAElE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,iBAAiB;IAC5B;;;;;;OAMG;IACH,MAAM,CAAC,UAAU,CACf,OAAmB,EACnB,KAAa,EACb,cAAkC,EAClC,QAKI,EAAE;QAEN,OAAO,IAAI,iBAAiB,CAC1B,IAAI,aAAa,CACf,KAAK,EACL,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EACjF,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,mBAAmB,EACzB,OAAO,EACP,cAAc,CACf,EACD,KAAK,CAAC,YAAY,CACnB,CAAA;IACH,CAAC;IAED,YAAqC,aAA4B,EAAmB,OAA2B;QAA1E,kBAAa,GAAb,aAAa,CAAe;QAAmB,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAEnH,cAAc;QACZ,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACjD,CAAC;IAEK,WAAW,CAAC,UAAkB,EAAE,OAAyB;;YAC7D,IAAI,UAAU,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;YAChH,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;YAC3E,OAAO,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9D,CAAC;KAAA;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACF;AAjDD,8CAiDC;AAED,IAAK,yBAOJ;AAPD,WAAK,yBAAyB;IAC5B,mBAAmB;IACnB,oHAA8B,CAAA;IAC9B,oGAAsB,CAAA;IACtB,gCAAgC;IAChC,kFAAa,CAAA;IACb,kGAAqB,CAAA;AACvB,CAAC,EAPI,yBAAyB,KAAzB,yBAAyB,QAO7B;AAKD,MAAM,aAAa;IACjB,YACU,KAAa,EACb,OAA2B,EAC3B,sBAA4F,EAC5F,WAA+B,EAC/B,kBAAsC,EAC7B,OAAmB,EACnB,kBAAsC;QAN/C,UAAK,GAAL,KAAK,CAAQ;QACb,YAAO,GAAP,OAAO,CAAoB;QAC3B,2BAAsB,GAAtB,sBAAsB,CAAsE;QAC5F,gBAAW,GAAX,WAAW,CAAoB;QAC/B,uBAAkB,GAAlB,kBAAkB,CAAoB;QAC7B,YAAO,GAAP,OAAO,CAAY;QACnB,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAEE,8BAA8B;;YAClC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,gCAAqB,EAAC,IAAI,CAAC,WAAW,CAAC,EAAE;gBAClE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAA;aACpE;iBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,IAAA,gCAAqB,EAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;gBACvF,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;aAC1D;iBAAM;gBACL,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,GAAG,EAAE,CAAA;aAC1F;QACH,CAAC;KAAA;IAEK,oBAAoB,CAAC,0BAAkC;;YAC3D,OAAO,MAAM,IAAI,CAAC,mBAAmB,CAAC,0BAA0B,CAAC,CAAA;QACnE,CAAC;KAAA;IAEa,mBAAmB,CAAC,+BAAmD;;YACnF,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,+BAA+B,aAA/B,+BAA+B,cAA/B,+BAA+B,GAAI,CAAC,CAAC,CAAA;YAC5F,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;YACxB,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAA;YACtC,OAAO,KAAK,CAAA;QACd,CAAC;KAAA;IAEa,oBAAoB,CAAC,YAAoB;;YACrD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,IAAI,CACnE,CAAC,UAAU,EAAE,EAAE;gBACb,IAAI,CAAC,UAAU,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;gBACnI,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,KAAK,CAAA;gBACnC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,EAAE,CAAA;YACxE,CAAC,EACD,GAAS,EAAE,gDAAC,OAAA,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAA,GAAA,CACjG,CAAA;QACH,CAAC;KAAA;IAEa,WAAW,CAAC,+BAAuC;;YAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,IAAI,+BAA+B,CAAC,EAAE;gBAC/I,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAA;gBAClI,IAAI,SAAS,IAAI,sBAAsB,EAAE;oBACvC,OAAO,sBAAsB,CAAC,OAAO,CAAA;iBACtC;qBAAM,IACL,sBAAsB,CAAC,OAAO,KAAK,6BAA6B,CAAC,SAAS;oBAC1E,+BAA+B,IAAI,yBAAyB,CAAC,yBAAyB,EACtF;oBACA,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAA;iBACnG;;oBAAM,OAAO,IAAI,CAAC,oBAAoB,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;aAC/E;iBAAM;gBACL,OAAO,IAAI,CAAC,oBAAoB,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAA;aACxE;QACH,CAAC;KAAA;IAEa,oBAAoB,CAChC,+BAAuC,EACvC,oBAA6B;;YAE7B,MAAM,eAAe,GAAG;gBACtB,+BAA+B,IAAI,yBAAyB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;gBACtH,+BAA+B,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE;gBACxH,+BAA+B,IAAI,yBAAyB,CAAC,yBAAyB;oBACtF,CAAC,oBAAoB,IAAI,+BAA+B,IAAI,yBAAyB,CAAC,QAAQ,CAAC;oBAC7F,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAC3B,CAAC,CAAC,EAAE;aACP,CAAC,IAAI,EAAE,CAAA;YACR,IAAI,CAAC,eAAe,CAAC,MAAM;gBACzB,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAA;YACxI,MAAM,QAAQ,GAAqD,EAAE,CAAA;YACrE,OAAO,IAAI,EAAE;gBACX,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAA;gBACtG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,8BAA8B,UAAU,GAAG,CAAC,CAAA;gBAC1H,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAA;gBACvF,IAAI,SAAS,IAAI,MAAM,EAAE;oBACvB,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;oBAC3C,OAAO,MAAM,CAAC,OAAO,CAAA;iBACtB;qBAAM,IAAI,MAAM,CAAC,OAAO,IAAI,6BAA6B,CAAC,SAAS,EAAE;oBACpE,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAA;iBACxE;qBAAM,IAAI,UAAU,IAAI,cAAc,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,IAAI,6BAA6B,CAAC,wBAAwB,EAAE;oBAC5H,OAAO,IAAI,CAAC,oBAAoB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAA;iBACzE,CAAC,aAAa;aAChB;QACH,CAAC;KAAA;IAEa,kBAAkB,CAAC,QAAgB,EAAE,+BAAuC;;YACxF,IAAI,+BAA+B,GAAG,yBAAyB,CAAC,yBAAyB;gBACvF,MAAM,IAAI,KAAK,CACb,gIAAgI,CACjI,CAAA;YACH,MAAM,QAAQ,GAAqD,EAAE,CAAA;YACrE,OAAO,IAAI,EAAE;gBACX,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,+BAA+B,CAAC,EAAE,QAAQ,CAAC,CAAA;gBAClI,IAAI,UAAU,IAAI,cAAc,CAAC,+BAA+B;oBAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,UAAU,GAAG,CAAC,CAAA;gBACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;gBACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAA;gBACxG,IAAI,SAAS,IAAI,MAAM,EAAE;oBACvB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;oBAC1D,OAAO,MAAM,CAAC,OAAO,CAAA;iBACtB;qBAAM,IAAI,MAAM,CAAC,OAAO,IAAI,6BAA6B,CAAC,WAAW,EAAE;oBACtE,MAAM,IAAI,KAAK,CAAC,yFAAyF,MAAM,CAAC,OAAO,GAAG,CAAC,CAAA;iBAC5H,CAAC,aAAa;aAChB;QACH,CAAC;KAAA;IAEa,oBAAoB,CAAC,MAAc,EAAE,+BAAuC;;YACxF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CACtF,CAAC,UAAU,EAAE,EAAE;gBACb,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;gBAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAA;gBACvI,MAAM,MAAM,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAA;gBACrC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;gBACpC,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;oBACvD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;gBACjG,IAAI,cAAc,GAAG,+BAA+B,EAAE;oBACpD,OAAO,EAAE,OAAO,EAAE,6BAA6B,CAAC,wBAAwB,EAAE,CAAA;iBAC3E;qBAAM;oBACL,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAA;iBAC5C;YACH,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;gBACR,IAAI,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC;oBAAE,MAAM,KAAK,CAAA;gBAC7C,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE;oBACtD,gEAAgE;oBAChE,OAAO,EAAE,OAAO,EAAE,6BAA6B,CAAC,mBAAmB,EAAE,CAAA;iBACtE;qBAAM,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE;oBAClC,4CAA4C;oBAC5C,OAAO,EAAE,OAAO,EAAE,6BAA6B,CAAC,WAAW,EAAE,CAAA;iBAC9D;qBAAM,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE;oBAClC,kFAAkF;oBAClF,OAAO,EAAE,OAAO,EAAE,6BAA6B,CAAC,SAAS,EAAE,CAAA;iBAC5D;;oBAAM,MAAM,KAAK,CAAA;YACpB,CAAC,CACF,CAAA;QACH,CAAC;KAAA;IAEK,aAAa,CAAC,UAAkB;;YACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC,kBAAkB;gBACjD,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,IAAI,CACtE,CAAC,QAAQ,EAAE,EAAE;oBACX,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,YAAY;wBAC3C,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAA;oBACnH,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAA;gBACvE,CAAC,EACD,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CACtD;gBACH,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;YACjD,OAAO,IAAI,aAAa,CACtB,IAAI,CAAC,KAAK,EACV,UAAU,EACV,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,EACvG,mBAAmB,CAAC,KAAK,EACzB,mBAAmB,CAAC,YAAY,EAChC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,kBAAkB,CACxB,CAAA;QACH,CAAC;KAAA;IAEO,kBAAkB,CAAC,MAAc,EAAE,UAA0B;QACnE,IAAI,UAAU,IAAI,cAAc,CAAC,gBAAgB,IAAI,UAAU,IAAI,cAAc,CAAC,QAAQ,EAAE;YAC1F,IAAI,CAAC,sBAAsB,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,gBAAgB,EAAE,CAAA;SAClG;IACH,CAAC;CACF;AAED,IAAK,6BAKJ;AALD,WAAK,6BAA6B;IAChC,2FAAS,CAAA;IACT,+FAAW,CAAA;IACX,+GAAmB,CAAA;IACnB,yHAAwB,CAAA;AAC1B,CAAC,EALI,6BAA6B,KAA7B,6BAA6B,QAKjC;AACD,IAAK,kBAIJ;AAJD,WAAK,kBAAkB;IACrB,+DAAM,CAAA;IACN,qEAAS,CAAA;IACT,yDAAG,CAAA;AACL,CAAC,EAJI,kBAAkB,KAAlB,kBAAkB,QAItB;AAED,IAAK,qBAQJ;AARD,WAAK,qBAAqB;IACxB,uEAAO,CAAA;IACP,iFAAY,CAAA;IACZ,2EAAS,CAAA;IACT,6HAAkC,CAAA;IAClC,6IAA0C,CAAA;IAC1C,uIAAuC,CAAA;IACvC,qFAAc,CAAA;AAChB,CAAC,EARI,qBAAqB,KAArB,qBAAqB,QAQzB;AACD,MAAM,gBAAgB;IAUpB,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;QATjD,iBAAY,GAO6C,EAAE,EAAE,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAA;IAE1C,CAAC;IAEvD,cAAc,CAAC,+BAAmD;;YACtE,OAAO,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAA;QAChH,CAAC;KAAA;IAEa,YAAY,CAAC,+BAAmD;;YAC5E,QAAQ,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;gBAC5B,KAAK,qBAAqB,CAAC,OAAO;oBAChC,IAAI,+BAA+B,IAAI,SAAS,EAAE;wBAChD,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAA;qBAC3G;yBAAM;wBACL,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,8BAA8B,EAAE,CAAA;wBAC3E,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;wBACnF,OAAO,KAAK,CAAA;qBACb;gBACH,KAAK,qBAAqB,CAAC,SAAS;oBAClC,IAAI,+BAA+B,IAAI,SAAS,EAAE;wBAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,+BAA+B,CAAC,CAAA;wBAC5F,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,0CAA0C,EAAE,CAAA;wBAC5F,OAAO,KAAK,CAAA;qBACb;yBAAM;wBACL,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,8BAA8B,EAAE,CAAA;wBAC3E,IAAI,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,YAAY;4BAAE,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAA;wBACjF,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,kCAAkC,EAAE,CAAA;wBACpF,OAAO,KAAK,CAAA;qBACb;gBACH,KAAK,qBAAqB,CAAC,uCAAuC;oBAChE,IAAI,+BAA+B,IAAI,SAAS,EAAE;wBAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,+BAA+B,CAAC,CAAA;wBAC5F,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,0CAA0C,EAAE,CAAA;wBAC5F,OAAO,KAAK,CAAA;qBACb;;wBAAM,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAA;gBAClD,KAAK,qBAAqB,CAAC,cAAc;oBACvC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAA;gBAC/B;oBACE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAA;aACvF;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;QAC3B,QAAQ,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;YAC5B,KAAK,qBAAqB,CAAC,YAAY;gBACrC,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;gBAC9H,MAAK;YACP,KAAK,qBAAqB,CAAC,kCAAkC;gBAC3D,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,uCAAuC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAA;gBACnH,MAAK;YACP,KAAK,qBAAqB,CAAC,0CAA0C;gBACnE,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,qBAAqB,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;gBAC9E,MAAK;YACP;gBACE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAA;SAC/F;IACH,CAAC;CACF","sourcesContent":["import { AuthenticationProvider, NoAuthenticationProvider } from './AuthenticationProvider'\nimport { UserGroup } from '../../icc-api/model/UserGroup'\nimport { AuthService } from './AuthService'\nimport { IccAuthApi } from '../../icc-api'\nimport { XHR } from '../../icc-api/api/XHR'\nimport XHRError = XHR.XHRError\nimport { decodeJwtClaims, isJwtInvalidOrExpired } from './JwtUtils'\n\n/**\n * Needed by a {@link SmartAuthProvider} to get the secrets (password, token, etc.) for authentication to the iCure SDK as needed.\n */\nexport interface AuthSecretProvider {\n  /**\n   * Provides a secret for authentication to the iCure SDK.\n   *\n   * ## Accepted secrets\n   *\n   * The method will be provided with an array of the secrets types that are acceptable (`acceptedSecrets`). Usually this array will contain multiple\n   * elements, but this depends on the group configuration, the user (if he has 2fa setup or not), or the operation being performed. For groups using\n   * default configurations and for patients without 2fa enabled for example the array will always contain the {@link AuthSecretType.PASSWORD} element.\n   * Usually the array contain also the {@link AuthSecretType.LONG_LIVED_TOKEN} element, but if the user is attempting to perform a sensitive operations\n   * such as changing his password the default group configuration does not allow for the user to authenticate using a JWT obtained from a long-lived\n   * token for this operation, meaning the array will not contain the {@link AuthSecretType.LONG_LIVED_TOKEN} element.\n   *\n   * Regardless of the number of elements in the array only one secret of the accepted types is sufficient for the operation to succeed.\n   *\n   * ## TWO_FACTOR_AUTHENTICATION_TOKEN secret type\n   *\n   * The {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN} secret type is only used when the user has 2fa enabled. In this case the SDK will call\n   * this method twice, once containing the {@link AuthSecretType.PASSWORD} element in the `acceptedSecrets` array, and if the provided secret is a\n   * valid password the SDK will immediately call this method again, this time containing the {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN}\n   * instead of the {@link AuthSecretType.PASSWORD} element.\n   *\n   * Any future call to this method from the same provider instance will not contain the {@link AuthSecretType.PASSWORD} element anymore, as it is\n   * cached, but it may contain the {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN} element instead.\n   *\n   * Note that the 2fa token is not needed for logging in through a long-lived or short-lived token, it is only used in combination with a password.\n   * If the user is using 2fa, and you get in input as `acceptedSecrets` an array `[PASSWORD, LONG_LIVED_TOKEN, SHORT_LIVED_TOKEN]`, and you pass to\n   * authenticate a long-lived token, the SDK will not call this method again to ask for the 2fa token.\n   *\n   * @param acceptedSecrets the types of secrets that are acceptable for the operation being performed.\n   * @param previousAttempts the secrets that were previously attempted by the SDK for this operation. This array will be empty the first time this\n   * method is called for a given operation, but it may contain multiple elements if the SDK has already called this method multiple times because the\n   * previously returned secrets were not valid. The first element is the first secret that was attempted, and the last element is the most recently\n   * attempted.\n   * @return a promise that resolves with the secret and the secret type to use for authentication. If the promise rejects then the ongoing SDK\n   * operation will fail without being re-attempted.\n   */\n  getSecret(\n    acceptedSecrets: AuthSecretType[],\n    previousAttempts: { secret: string; secretType: AuthSecretType }[]\n  ): Promise<{ secret: string; secretType: AuthSecretType }> // We may want to add some onSuccess callback in future or similar\n}\n\n/**\n * Represents a type of secret that can be used for authentication with iCure.\n */\nexport enum AuthSecretType {\n  /**\n   * Password chosen by the user.\n   */\n  PASSWORD = 'PASSWORD', // pragma: allowlist secret\n  /**\n   * Time based one time password provided by authenticator applications, generated on the basis of a timestamp and a shared secret between the iCure\n   * server and the authenticator application.\n   */\n  TWO_FACTOR_AUTHENTICATION_TOKEN = 'TWO_FACTOR_AUTHENTICATION_TOKEN',\n  /**\n   * A short-lived iCure token, an internal authentication token that lasts 5 minutes or less. Unlike passwords these tokens usually are generated by\n   * some component of iCure, and are not chosen by the user.\n   */\n  SHORT_LIVED_TOKEN = 'SHORT_LIVED_TOKEN',\n  /**\n   * A long-lived iCure token, an internal authentication token that lasts longer than 5 minutes. Unlike passwords these tokens usually are generated\n   * by some component of iCure, and are not chosen by the user.\n   */\n  LONG_LIVED_TOKEN = 'LONG_LIVED_TOKEN',\n  /**\n   * A token provided by an external authentication provider (e.g. Oauth/Google).\n   * Not yet in use.\n   */\n  // EXTERNAL_AUTHENTICATION = 'EXTERNAL_AUTHENTICATION',\n  /**\n   * A special case of external authentication where the provider is a digital identity provider.\n   * Not yet in use.\n   */\n  // DIGITAL_ID = 'DIGITAL_ID',\n}\n\n// Here starts internal entities that should not be used directly.\n\n/**\n * @internal this class is meant for internal use only and may be changed without notice. The SmartAuthProvider will be initialised automatically\n * by the iCure api depending on the authentication options you provide.\n *\n * An authentication provider that automatically requests secrets for authentication as needed.\n *\n * This authentication provider can be initialised already with some secrets or tokens, and the provider will cache them and use them as needed for\n * as long as they remain valid. If at any point however the provider needs an updated secret or a secret of a different kind it will automatically\n * request this to the {@link SmartAuthProvider} to get the secret.\n *\n * An advantage of using this provider over others is that in case all the cached tokens and secrets were to expire while performing a request,\n * instead of having the request fail the provider will ask for new secrets from the {@link SmartAuthProvider} and the request will automatically\n * be retried with the new secret. Additionally, the provider may request updated secrets also for performing some sensitive operations (e.g. changing\n * password of the user) even if the cached tokens and/or did not expire. This could be the case for example if the cached secret is a long-lived\n * token, but in order to change the password the user needs to provide his current password.\n *\n * Note that in this context the cache of secrets and token is in memory only, and is not persisted in any way. Different instances of this provider\n * will not share the same cache.\n *\n */\nexport class SmartAuthProvider implements AuthenticationProvider {\n  /**\n   * Initialises a {@link SmartAuthProvider}.\n   * @param authApi an \"anonymous\" {@link IccAuthApi} to use for authentication.\n   * @param login\n   * @param secretProvider\n   * @param props optional initialisation properties.\n   */\n  static initialise(\n    authApi: IccAuthApi,\n    login: string,\n    secretProvider: AuthSecretProvider,\n    props: {\n      initialSecret?: string\n      initialAuthToken?: string\n      initialRefreshToken?: string\n      loginGroupId?: string\n    } = {}\n  ): SmartAuthProvider {\n    return new SmartAuthProvider(\n      new TokenProvider(\n        login,\n        props.loginGroupId,\n        props.initialSecret ? { value: props.initialSecret, type: undefined } : undefined,\n        props.initialAuthToken,\n        props.initialRefreshToken,\n        authApi,\n        secretProvider\n      ),\n      props.loginGroupId\n    )\n  }\n\n  private constructor(private readonly tokenProvider: TokenProvider, private readonly groupId: string | undefined) {}\n\n  getAuthService(): AuthService {\n    return new SmartAuthService(this.tokenProvider)\n  }\n\n  async switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider> {\n    if (newGroupId == this.groupId) return Promise.resolve(this)\n    if (!matches.find((match) => match.groupId == newGroupId)) throw new Error('New group id not found in matches.')\n    const switchedProvider = await this.tokenProvider.switchedGroup(newGroupId)\n    return new SmartAuthProvider(switchedProvider, this.groupId)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return Promise.resolve(undefined)\n  }\n}\n\nenum ServerAuthenticationClass {\n  // DIGITAL_ID = 60,\n  TWO_FACTOR_AUTHENTICATION = 50,\n  SHORT_LIVED_TOKEN = 40,\n  // EXTERNAL_AUTHENTICATION = 30,\n  PASSWORD = 20,\n  LONG_LIVED_TOKEN = 10,\n}\ntype LongLivedSecretType =\n  | ServerAuthenticationClass.LONG_LIVED_TOKEN\n  | ServerAuthenticationClass.PASSWORD\n  | ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION\nclass TokenProvider {\n  constructor(\n    private login: string,\n    private groupId: string | undefined,\n    private currentLongLivedSecret: { value: string; type: LongLivedSecretType | undefined } | undefined,\n    private cachedToken: string | undefined,\n    private cachedRefreshToken: string | undefined,\n    private readonly authApi: IccAuthApi,\n    private readonly authSecretProvider: AuthSecretProvider\n  ) {}\n\n  async getCachedOrRefreshedOrNewToken(): Promise<{ token: string; type: RetrievedTokenType }> {\n    if (!!this.cachedToken && !isJwtInvalidOrExpired(this.cachedToken)) {\n      return { token: this.cachedToken, type: RetrievedTokenType.CACHED }\n    } else if (!!this.cachedRefreshToken && !isJwtInvalidOrExpired(this.cachedRefreshToken)) {\n      return this.refreshAndCacheToken(this.cachedRefreshToken)\n    } else {\n      return { token: await this.getAndCacheNewToken(undefined), type: RetrievedTokenType.NEW }\n    }\n  }\n\n  async getNewTokenWithClass(minimumAuthenticationClass: number): Promise<string> {\n    return await this.getAndCacheNewToken(minimumAuthenticationClass)\n  }\n\n  private async getAndCacheNewToken(minimumAuthenticationClassLevel: number | undefined): Promise<string> {\n    const { token, refreshToken } = await this.getNewToken(minimumAuthenticationClassLevel ?? 0)\n    this.cachedToken = token\n    this.cachedRefreshToken = refreshToken\n    return token\n  }\n\n  private async refreshAndCacheToken(refreshToken: string): Promise<{ token: string; type: RetrievedTokenType }> {\n    return await this.authApi.refreshAuthenticationJWT(refreshToken).then(\n      (authResult) => {\n        if (!authResult.token) throw new Error('Internal error: refresh succeeded but no token was returned. Unsupported backend version?')\n        this.cachedToken = authResult.token\n        return { token: authResult.token, type: RetrievedTokenType.REFRESHED }\n      },\n      async () => ({ token: await this.getAndCacheNewToken(undefined), type: RetrievedTokenType.NEW })\n    )\n  }\n\n  private async getNewToken(minimumAuthenticationClassLevel: number): Promise<{ token: string; refreshToken: string }> {\n    if (!!this.currentLongLivedSecret && (!this.currentLongLivedSecret.type || this.currentLongLivedSecret.type >= minimumAuthenticationClassLevel)) {\n      const resultWithCachedSecret = await this.doGetTokenWithSecret(this.currentLongLivedSecret.value, minimumAuthenticationClassLevel)\n      if ('success' in resultWithCachedSecret) {\n        return resultWithCachedSecret.success\n      } else if (\n        resultWithCachedSecret.failure === DoGetTokenResultFailureReason.NEEDS_2FA &&\n        minimumAuthenticationClassLevel <= ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION\n      ) {\n        return this.askTotpAndGetToken(this.currentLongLivedSecret.value, minimumAuthenticationClassLevel)\n      } else return this.askSecretAndGetToken(minimumAuthenticationClassLevel, true)\n    } else {\n      return this.askSecretAndGetToken(minimumAuthenticationClassLevel, true)\n    }\n  }\n\n  private async askSecretAndGetToken(\n    minimumAuthenticationClassLevel: number,\n    passwordIsValidAs2fa: boolean\n  ): Promise<{ token: string; refreshToken: string }> {\n    const acceptedSecrets = [\n      minimumAuthenticationClassLevel <= ServerAuthenticationClass.LONG_LIVED_TOKEN ? [AuthSecretType.LONG_LIVED_TOKEN] : [],\n      minimumAuthenticationClassLevel <= ServerAuthenticationClass.SHORT_LIVED_TOKEN ? [AuthSecretType.SHORT_LIVED_TOKEN] : [],\n      minimumAuthenticationClassLevel <= ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION &&\n      (passwordIsValidAs2fa || minimumAuthenticationClassLevel <= ServerAuthenticationClass.PASSWORD)\n        ? [AuthSecretType.PASSWORD]\n        : [],\n    ].flat()\n    if (!acceptedSecrets.length)\n      throw new Error('Internal error: no secret type is accepted for this request. Group may be misconfigured, or client may be outdated.')\n    const attempts: { secret: string; secretType: AuthSecretType }[] = []\n    while (true) {\n      const { secret, secretType } = await this.authSecretProvider.getSecret([...acceptedSecrets], attempts)\n      if (!acceptedSecrets.includes(secretType))\n        throw new Error(`Accepted secret types are ${JSON.stringify(acceptedSecrets)}, but got a secret of type ${secretType}.`)\n      attempts.push({ secret, secretType })\n      const result = await this.doGetTokenWithSecret(secret, minimumAuthenticationClassLevel)\n      if ('success' in result) {\n        this.updateCachedSecret(secret, secretType)\n        return result.success\n      } else if (result.failure == DoGetTokenResultFailureReason.NEEDS_2FA) {\n        return this.askTotpAndGetToken(secret, minimumAuthenticationClassLevel)\n      } else if (secretType == AuthSecretType.PASSWORD && result.failure == DoGetTokenResultFailureReason.INVALID_AUTH_CLASS_LEVEL) {\n        return this.askSecretAndGetToken(minimumAuthenticationClassLevel, false)\n      } // else retry\n    }\n  }\n\n  private async askTotpAndGetToken(password: string, minimumAuthenticationClassLevel: number): Promise<{ token: string; refreshToken: string }> {\n    if (minimumAuthenticationClassLevel > ServerAuthenticationClass.TWO_FACTOR_AUTHENTICATION)\n      throw new Error(\n        \"Internal error: asking for totp to login but minimumAuthenticationClassLevel is higher than TWO_FACTOR_AUTHENTICATION's level.\"\n      )\n    const attempts: { secret: string; secretType: AuthSecretType }[] = []\n    while (true) {\n      const { secret, secretType } = await this.authSecretProvider.getSecret([AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN], attempts)\n      if (secretType != AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN)\n        throw new Error(`Was expecting a 2fa token but got a secret of type ${secretType}.`)\n      attempts.push({ secret, secretType })\n      const result = await this.doGetTokenWithSecret(`${password}|${secret}`, minimumAuthenticationClassLevel)\n      if ('success' in result) {\n        this.updateCachedSecret(password, AuthSecretType.PASSWORD)\n        return result.success\n      } else if (result.failure != DoGetTokenResultFailureReason.INVALID_2FA) {\n        throw new Error(`Unexpected error while trying to login with (previously) valid password and 2fa token ${result.failure}.`)\n      } // else retry\n    }\n  }\n\n  private async doGetTokenWithSecret(secret: string, minimumAuthenticationClassLevel: number): Promise<DoGetTokenResult> {\n    return this.authApi.login({ username: this.login, password: secret }, this.groupId).then(\n      (authResult) => {\n        const { token, refreshToken } = authResult\n        if (!token || !refreshToken) throw new Error('Internal error: login succeeded but no token was returned. Unsupported backend version?')\n        const claims = decodeJwtClaims(token)\n        const authClassLevel = claims['tac']\n        if (!authClassLevel || typeof authClassLevel !== 'number')\n          throw new Error('Internal error: authClassLevel is not a number. Unsupported backend version?')\n        if (authClassLevel < minimumAuthenticationClassLevel) {\n          return { failure: DoGetTokenResultFailureReason.INVALID_AUTH_CLASS_LEVEL }\n        } else {\n          return { success: { token, refreshToken } }\n        }\n      },\n      (error) => {\n        if (!(error instanceof XHRError)) throw error\n        if (error.statusCode == 401 || error.statusCode == 412) {\n          // Password is wrong (401) or unacceptable (e.g. too short, 412)\n          return { failure: DoGetTokenResultFailureReason.INVALID_PW_OR_TOKEN }\n        } else if (error.statusCode == 406) {\n          // Password is correct, but 2fa token is not\n          return { failure: DoGetTokenResultFailureReason.INVALID_2FA }\n        } else if (error.statusCode == 417) {\n          // Password is correct, but the user has 2fa enabled and no 2fa token was provided\n          return { failure: DoGetTokenResultFailureReason.NEEDS_2FA }\n        } else throw error\n      }\n    )\n  }\n\n  async switchedGroup(newGroupId: string): Promise<TokenProvider> {\n    const groupSwitchedTokens = this.cachedRefreshToken\n      ? await this.authApi.switchGroup(this.cachedRefreshToken, newGroupId).then(\n          (response) => {\n            if (!response.token || !response.refreshToken)\n              throw new Error('Internal error: group switch succeeded but no token was returned. Unsupported backend version?')\n            return { token: response.token, refreshToken: response.refreshToken }\n          },\n          () => ({ token: undefined, refreshToken: undefined })\n        )\n      : { token: undefined, refreshToken: undefined }\n    return new TokenProvider(\n      this.login,\n      newGroupId,\n      this.currentLongLivedSecret ? { value: this.currentLongLivedSecret.value, type: undefined } : undefined,\n      groupSwitchedTokens.token,\n      groupSwitchedTokens.refreshToken,\n      this.authApi,\n      this.authSecretProvider\n    )\n  }\n\n  private updateCachedSecret(secret: string, secretType: AuthSecretType) {\n    if (secretType == AuthSecretType.LONG_LIVED_TOKEN || secretType == AuthSecretType.PASSWORD) {\n      this.currentLongLivedSecret = { value: secret, type: ServerAuthenticationClass.LONG_LIVED_TOKEN }\n    }\n  }\n}\ntype DoGetTokenResult = { success: { token: string; refreshToken: string } } | { failure: DoGetTokenResultFailureReason }\nenum DoGetTokenResultFailureReason {\n  NEEDS_2FA,\n  INVALID_2FA,\n  INVALID_PW_OR_TOKEN,\n  INVALID_AUTH_CLASS_LEVEL,\n}\nenum RetrievedTokenType {\n  CACHED,\n  REFRESHED,\n  NEW,\n}\n\nenum SmartAuthServiceState {\n  INITIAL,\n  DONE_INITIAL,\n  REATTEMPT,\n  REATTEMPTED_WITH_NEW_UNBOUND_TOKEN,\n  REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN,\n  EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS,\n  TERMINAL_ERROR,\n}\nclass SmartAuthService implements AuthService {\n  private currentState:\n    | { id: SmartAuthServiceState.INITIAL }\n    | { id: SmartAuthServiceState.DONE_INITIAL; initialToken: string }\n    | { id: SmartAuthServiceState.REATTEMPT; initialToken: string; initialError: Error }\n    | { id: SmartAuthServiceState.REATTEMPTED_WITH_NEW_UNBOUND_TOKEN }\n    | { id: SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN }\n    | { id: SmartAuthServiceState.EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS; errorFromNewToken: Error }\n    | { id: SmartAuthServiceState.TERMINAL_ERROR; error: Error } = { id: SmartAuthServiceState.INITIAL }\n\n  constructor(private readonly tokenProvider: TokenProvider) {}\n\n  async getAuthHeaders(minimumAuthenticationClassLevel: number | undefined): Promise<Array<XHR.Header>> {\n    return [new XHR.Header('Authorization', `Bearer ${await this.getAuthToken(minimumAuthenticationClassLevel)}`)]\n  }\n\n  private async getAuthToken(minimumAuthenticationClassLevel: number | undefined): Promise<string> {\n    switch (this.currentState.id) {\n      case SmartAuthServiceState.INITIAL:\n        if (minimumAuthenticationClassLevel != undefined) {\n          throw new Error('Illegal state: cannot ask for a specific auth class level at the first request attempt.')\n        } else {\n          const { token } = await this.tokenProvider.getCachedOrRefreshedOrNewToken()\n          this.currentState = { id: SmartAuthServiceState.DONE_INITIAL, initialToken: token }\n          return token\n        }\n      case SmartAuthServiceState.REATTEMPT:\n        if (minimumAuthenticationClassLevel != undefined) {\n          const token = await this.tokenProvider.getNewTokenWithClass(minimumAuthenticationClassLevel)\n          this.currentState = { id: SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN }\n          return token\n        } else {\n          const { token } = await this.tokenProvider.getCachedOrRefreshedOrNewToken()\n          if (token == this.currentState.initialToken) throw this.currentState.initialError\n          this.currentState = { id: SmartAuthServiceState.REATTEMPTED_WITH_NEW_UNBOUND_TOKEN }\n          return token\n        }\n      case SmartAuthServiceState.EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS:\n        if (minimumAuthenticationClassLevel != undefined) {\n          const token = await this.tokenProvider.getNewTokenWithClass(minimumAuthenticationClassLevel)\n          this.currentState = { id: SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN }\n          return token\n        } else throw this.currentState.errorFromNewToken\n      case SmartAuthServiceState.TERMINAL_ERROR:\n        throw this.currentState.error\n      default:\n        throw new Error(`Illegal state: cannot get token in state ${this.currentState.id}.`)\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    switch (this.currentState.id) {\n      case SmartAuthServiceState.DONE_INITIAL:\n        this.currentState = { id: SmartAuthServiceState.REATTEMPT, initialToken: this.currentState.initialToken, initialError: error }\n        break\n      case SmartAuthServiceState.REATTEMPTED_WITH_NEW_UNBOUND_TOKEN:\n        this.currentState = { id: SmartAuthServiceState.EXPECT_REQUEST_WITH_SPECIFIC_AUTH_CLASS, errorFromNewToken: error }\n        break\n      case SmartAuthServiceState.REATTEMPTED_WITH_AUTH_CLASS_SPECIFIC_TOKEN:\n        this.currentState = { id: SmartAuthServiceState.TERMINAL_ERROR, error: error }\n        break\n      default:\n        throw new Error(`Illegal state: cannot invalidate header in state ${this.currentState.id}.`)\n    }\n  }\n}\n"]}