@icure/api 7.1.22 → 7.1.24

package/icc-x-api/auth/EnsembleAuthService.js

@@ -30,14 +30,14 @@ class EnsembleAuthService {
         var _a, _b;
         return (_b = (_a = this.jwtAuth) === null || _a === void 0 ? void 0 : _a.getIcureTokens()) !== null && _b !== void 0 ? _b : Promise.resolve();
     }
-    getAuthHeaders() {
+    getAuthHeaders(minimumAuthenticationClass) {
         return __awaiter(this, void 0, void 0, function* () {
             this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState;
             if (!!this.currentState) {
                 // If I have a state I return the headers, otherwise I return empty headers
                 // And delegate the responsibility of handling the error to the next call
                 return !!this.stateMap[this.currentState].state
-                    ? this.stateMap[this.currentState].state.getAuthHeaders().catch((e) => {
+                    ? this.stateMap[this.currentState].state.getAuthHeaders(minimumAuthenticationClass).catch((e) => {
                         if (e instanceof XHRError && e.statusCode === 417) {
                             throw e;
                         }

package/icc-x-api/auth/EnsembleAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"EnsembleAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/EnsembleAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAK3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAG9B,MAAa,mBAAmB;IAK9B,YACmB,OAAsD,EACtD,WAA0B,EAC1B,SAA2B;QAF3B,YAAO,GAAP,OAAO,CAA+C;QACtD,gBAAW,GAAX,WAAW,CAAe;QAC1B,cAAS,GAAT,SAAS,CAAkB;QANtC,UAAK,GAAiB,IAAI,CAAA;QAQhC,IAAI,CAAC,QAAQ,GAAG;YACd,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YACnC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7C,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;IAC7B,CAAC;IAED,cAAc;;QACZ,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,cAAc,EAAE,mCAAK,OAAO,CAAC,OAAO,EAAyB,CAAA;IACpF,CAAC;IAEK,cAAc;;YAClB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAA;YAEnG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;gBACvB,2EAA2E;gBAC3E,yEAAyE;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK;oBAC7C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAM,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBACnE,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;4BACjD,MAAM,CAAC,CAAA;yBACR;wBACD,sFAAsF;wBACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;wBACvB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;wBAEd,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC;oBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;aACxB;iBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;gBACvB,oEAAoE;gBACpE,MAAM,IAAI,CAAC,KAAK,CAAA;aACjB;iBAAM;gBACL,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;aACvC;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;YACvB,MAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,0CAAE,gBAAgB,CAAC,KAAK,CAAC,CAAA;SAChE;IACH,CAAC;CACF;AAvDD,kDAuDC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { JwtBridgedAuthService } from './JwtBridgedAuthService'\nimport { NoAuthService } from './NoAuthService'\nimport { BasicAuthService } from './BasicAuthService'\nimport Header = XHR.Header\nimport XHRError = XHR.XHRError\nimport { JwtAuthService } from './JwtAuthService'\n\nexport class EnsembleAuthService implements AuthService {\n  private currentState: string | null\n  private error: Error | null = null\n  private stateMap: { [key: string]: { state: AuthService | null; next: string | null } }\n\n  constructor(\n    private readonly jwtAuth: JwtBridgedAuthService | JwtAuthService | null,\n    private readonly sessionAuth: NoAuthService,\n    private readonly basicAuth: BasicAuthService\n  ) {\n    this.stateMap = {\n      start: { state: null, next: 'jwt' },\n      jwt: { state: this.jwtAuth, next: 'session' },\n      session: { state: this.sessionAuth, next: 'basic' },\n      basic: { state: this.basicAuth, next: null },\n    }\n    this.currentState = 'start'\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.jwtAuth?.getIcureTokens() ?? (Promise.resolve() as Promise<undefined>)\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState\n\n    if (!!this.currentState) {\n      // If I have a state I return the headers, otherwise I return empty headers\n      // And delegate the responsibility of handling the error to the next call\n      return !!this.stateMap[this.currentState].state\n        ? this.stateMap[this.currentState].state!.getAuthHeaders().catch((e) => {\n            if (e instanceof XHRError && e.statusCode === 417) {\n              throw e\n            }\n            // If I get an error, it is also responsibility of the next call, but I give a warning\n            console.warn(e.message)\n            this.error = e\n\n            return []\n          })\n        : Promise.resolve([])\n    } else if (!!this.error) {\n      // If I have no more states, I throw the last error or a default one\n      throw this.error\n    } else {\n      throw new Error('Cannot authenticate')\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this.error = error\n    if (!!this.currentState) {\n      this.stateMap[this.currentState].state?.invalidateHeader(error)\n    }\n  }\n}\n"]}
+{"version":3,"file":"EnsembleAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/EnsembleAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAK3C,IAAO,QAAQ,GAAG,SAAG,CAAC,QAAQ,CAAA;AAG9B,MAAa,mBAAmB;IAK9B,YACmB,OAAsD,EACtD,WAA0B,EAC1B,SAA2B;QAF3B,YAAO,GAAP,OAAO,CAA+C;QACtD,gBAAW,GAAX,WAAW,CAAe;QAC1B,cAAS,GAAT,SAAS,CAAkB;QANtC,UAAK,GAAiB,IAAI,CAAA;QAQhC,IAAI,CAAC,QAAQ,GAAG;YACd,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;YACnC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;SAC7C,CAAA;QACD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;IAC7B,CAAC;IAED,cAAc;;QACZ,OAAO,MAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,cAAc,EAAE,mCAAK,OAAO,CAAC,OAAO,EAAyB,CAAA;IACpF,CAAC;IAEK,cAAc,CAAC,0BAA8C;;YACjE,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAA;YAEnG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;gBACvB,2EAA2E;gBAC3E,yEAAyE;gBACzE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK;oBAC7C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAM,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBAC7F,IAAI,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE;4BACjD,MAAM,CAAC,CAAA;yBACR;wBACD,sFAAsF;wBACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;wBACvB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;wBAEd,OAAO,EAAE,CAAA;oBACX,CAAC,CAAC;oBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;aACxB;iBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;gBACvB,oEAAoE;gBACpE,MAAM,IAAI,CAAC,KAAK,CAAA;aACjB;iBAAM;gBACL,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;aACvC;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE;YACvB,MAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,0CAAE,gBAAgB,CAAC,KAAK,CAAC,CAAA;SAChE;IACH,CAAC;CACF;AAvDD,kDAuDC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { JwtBridgedAuthService } from './JwtBridgedAuthService'\nimport { NoAuthService } from './NoAuthService'\nimport { BasicAuthService } from './BasicAuthService'\nimport Header = XHR.Header\nimport XHRError = XHR.XHRError\nimport { JwtAuthService } from './JwtAuthService'\n\nexport class EnsembleAuthService implements AuthService {\n  private currentState: string | null\n  private error: Error | null = null\n  private stateMap: { [key: string]: { state: AuthService | null; next: string | null } }\n\n  constructor(\n    private readonly jwtAuth: JwtBridgedAuthService | JwtAuthService | null,\n    private readonly sessionAuth: NoAuthService,\n    private readonly basicAuth: BasicAuthService\n  ) {\n    this.stateMap = {\n      start: { state: null, next: 'jwt' },\n      jwt: { state: this.jwtAuth, next: 'session' },\n      session: { state: this.sessionAuth, next: 'basic' },\n      basic: { state: this.basicAuth, next: null },\n    }\n    this.currentState = 'start'\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this.jwtAuth?.getIcureTokens() ?? (Promise.resolve() as Promise<undefined>)\n  }\n\n  async getAuthHeaders(minimumAuthenticationClass: number | undefined): Promise<Array<Header>> {\n    this.currentState = !!this.currentState ? this.stateMap[this.currentState].next : this.currentState\n\n    if (!!this.currentState) {\n      // If I have a state I return the headers, otherwise I return empty headers\n      // And delegate the responsibility of handling the error to the next call\n      return !!this.stateMap[this.currentState].state\n        ? this.stateMap[this.currentState].state!.getAuthHeaders(minimumAuthenticationClass).catch((e) => {\n            if (e instanceof XHRError && e.statusCode === 417) {\n              throw e\n            }\n            // If I get an error, it is also responsibility of the next call, but I give a warning\n            console.warn(e.message)\n            this.error = e\n\n            return []\n          })\n        : Promise.resolve([])\n    } else if (!!this.error) {\n      // If I have no more states, I throw the last error or a default one\n      throw this.error\n    } else {\n      throw new Error('Cannot authenticate')\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this.error = error\n    if (!!this.currentState) {\n      this.stateMap[this.currentState].state?.invalidateHeader(error)\n    }\n  }\n}\n"]}

package/icc-x-api/auth/JwtAuthService.d.ts

@@ -20,8 +20,6 @@ export declare class JwtAuthService implements AuthService {
     } | undefined>;
     getAuthHeaders(): Promise<Array<Header>>;
     private _refreshAuthJwt;
-    private _isJwtInvalidOrExpired;
-    private _base64Decode;
     invalidateHeader(error: Error): void;
     isInErrorState(): boolean;
 }

package/icc-x-api/auth/JwtAuthService.js

@@ -11,7 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtAuthService = void 0;
 const XHR_1 = require("../../icc-api/api/XHR");
-const utils_1 = require("../utils");
+const JwtUtils_1 = require("./JwtUtils");
 /**
  * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens
  */
@@ -36,7 +36,7 @@ class JwtAuthService {
                 .then((x) => {
                 const authJwt = x === null || x === void 0 ? void 0 : x.authJwt;
                 const refreshJwt = x === null || x === void 0 ? void 0 : x.refreshJwt;
-                if ((!authJwt || this._isJwtInvalidOrExpired(authJwt)) && refreshJwt) {
+                if ((!authJwt || (0, JwtUtils_1.isJwtInvalidOrExpired)(authJwt)) && refreshJwt) {
                     // If it does not have the JWT, tries to get it
                     // If the JWT is expired, tries to refresh it
                     this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {
@@ -62,7 +62,7 @@ class JwtAuthService {
         return __awaiter(this, void 0, void 0, function* () {
             // If I do not have a refresh JWT or the refresh JWT is expired,
             // I have to log in again
-            if (this._isJwtInvalidOrExpired(refreshJwt)) {
+            if ((0, JwtUtils_1.isJwtInvalidOrExpired)(refreshJwt)) {
                 throw Error('Missing or expired refresh token: please log in again');
             }
             else {
@@ -73,18 +73,6 @@ class JwtAuthService {
             }
         });
     }
-    _isJwtInvalidOrExpired(jwt) {
-        const parts = jwt.split('.');
-        if (parts.length !== 3) {
-            return true;
-        }
-        const payload = this._base64Decode(parts[1]);
-        // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.
-        return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime();
-    }
-    _base64Decode(encodedString) {
-        return JSON.parse((0, utils_1.a2b)(encodedString));
-    }
     invalidateHeader(error) {
         this._error = error;
     }

package/icc-x-api/auth/JwtAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAI3C,oCAA8B;AAI9B;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBACpE,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE;gBAC3C,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAEO,sBAAsB,CAAC,GAAW;QACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;YACtB,OAAO,IAAI,CAAA;SACZ;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5E,CAAC;IAEO,aAAa,CAAC,aAAqB;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,aAAa,CAAC,CAAC,CAAA;IACvC,CAAC;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAjFD,wCAiFC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || this._isJwtInvalidOrExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (this._isJwtInvalidOrExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  private _isJwtInvalidOrExpired(jwt: string): boolean {\n    const parts = jwt.split('.')\n    if (parts.length !== 3) {\n      return true\n    }\n    const payload = this._base64Decode(parts[1])\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in payload) || payload['exp'] * 1000 < new Date().getTime()\n  }\n\n  private _base64Decode(encodedString: string): any {\n    return JSON.parse(a2b(encodedString))\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}
+{"version":3,"file":"JwtAuthService.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,+CAA2C;AAO3C,yCAAkD;AAElD;;GAEG;AACH,MAAa,cAAc;IAIzB,YAA6B,OAAmB,EAAE,UAAoD;QAAzE,YAAO,GAAP,OAAO,CAAY;QAHxC,WAAM,GAAiB,IAAI,CAAA;QAC3B,oBAAe,GAAiE,OAAO,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAA;QAGvH,IAAI,CAAC,CAAC,UAAU,EAAE;YAChB,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAiB,CAAC,CAAA;IAC/D,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7G,CAAC;IAEK,cAAc;;YAClB,OAAO,IAAI,CAAC,eAAe;iBACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,MAAM,OAAO,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA;gBAC1B,MAAM,UAAU,GAAG,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,UAAU,CAAA;gBAEhC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC,IAAI,UAAU,EAAE;oBAC9D,+CAA+C;oBAC/C,6CAA6C;oBAE7C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;wBAC7E,6BAA6B;wBAC7B,iCAAiC;wBACjC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;4BAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;yBACnF;wBAED,OAAO,aAAa,CAAA;oBACtB,CAAC,CAAC,CAAA;iBACH;qBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACxB,MAAM,IAAI,CAAC,MAAM,CAAA;iBAClB;gBACD,OAAO,IAAI,CAAC,eAAe,CAAA;YAC7B,CAAC,CAAC;iBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACV,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,EAAC,CAAC,CAAC,CAAC,IAAI,SAAG,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;YAC9H,CAAC,CAAC,CAAA;QACN,CAAC;KAAA;IAEa,eAAe,CAAC,UAAkB;;YAC9C,gEAAgE;YAChE,yBAAyB;YACzB,IAAI,IAAA,gCAAqB,EAAC,UAAU,CAAC,EAAE;gBACrC,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;aACrE;iBAAM;gBACL,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;oBAClF,OAAO,EAAE,eAAe,CAAC,KAAM;oBAC/B,UAAU,EAAE,UAAU;iBACvB,CAAC,CAAC,CAAA;aACJ;QACH,CAAC;KAAA;IAED,gBAAgB,CAAC,KAAY;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,cAAc;QACZ,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACtB,CAAC;CACF;AAnED,wCAmEC","sourcesContent":["import { AuthService } from './AuthService'\nimport { XHR } from '../../icc-api/api/XHR'\nimport { IccAuthApi, OAuthThirdParty } from '../../icc-api'\nimport { LoginCredentials } from '../../icc-api/model/LoginCredentials'\nimport Header = XHR.Header\nimport { a2b } from '../utils'\nimport { AuthenticationResponse } from '../../icc-api/model/AuthenticationResponse'\nimport XHRError = XHR.XHRError\nimport { isJwtInvalidOrExpired } from './JwtUtils'\n\n/**\n * Differs from JwtBridgedAuthService in that it cannot create new refresh tokens\n */\nexport class JwtAuthService implements AuthService {\n  private _error: Error | null = null\n  private _currentPromise: Promise<{ authJwt: string; refreshJwt: string } | undefined> = Promise.resolve(undefined as any)\n\n  constructor(private readonly authApi: IccAuthApi, initialJwt?: { authJwt: string; refreshJwt: string }) {\n    if (!!initialJwt) {\n      this._currentPromise = Promise.resolve(initialJwt)\n    }\n  }\n\n  get refreshToken(): Promise<string | undefined> {\n    return this._currentPromise.then((x) => x?.refreshJwt as any)\n  }\n\n  getIcureTokens(): Promise<{ token: string; refreshToken: string } | undefined> {\n    return this._currentPromise.then((x) => (x ? { token: x.authJwt, refreshToken: x.refreshJwt } : undefined))\n  }\n\n  async getAuthHeaders(): Promise<Array<Header>> {\n    return this._currentPromise\n      .then((x) => {\n        const authJwt = x?.authJwt\n        const refreshJwt = x?.refreshJwt\n\n        if ((!authJwt || isJwtInvalidOrExpired(authJwt)) && refreshJwt) {\n          // If it does not have the JWT, tries to get it\n          // If the JWT is expired, tries to refresh it\n\n          this._currentPromise = this._refreshAuthJwt(refreshJwt).then((updatedTokens) => {\n            // If here the token is null,\n            // it goes in a suspension status\n            if (!updatedTokens.authJwt) {\n              throw new Error('Your iCure back-end version does not support JWT authentication')\n            }\n\n            return updatedTokens\n          })\n        } else if (!!this._error) {\n          throw this._error\n        }\n        return this._currentPromise\n      })\n      .then((x) => {\n        return x?.authJwt ? [new XHR.Header('Authorization', `Bearer ${x.authJwt}`)] : Promise.reject('Cannot provide auth: No JWT')\n      })\n  }\n\n  private async _refreshAuthJwt(refreshJwt: string): Promise<{ authJwt: string; refreshJwt: string }> {\n    // If I do not have a refresh JWT or the refresh JWT is expired,\n    // I have to log in again\n    if (isJwtInvalidOrExpired(refreshJwt)) {\n      throw Error('Missing or expired refresh token: please log in again')\n    } else {\n      return this.authApi.refreshAuthenticationJWT(refreshJwt).then((refreshResponse) => ({\n        authJwt: refreshResponse.token!,\n        refreshJwt: refreshJwt,\n      }))\n    }\n  }\n\n  invalidateHeader(error: Error): void {\n    this._error = error\n  }\n\n  isInErrorState(): boolean {\n    return !!this._error\n  }\n}\n"]}

package/icc-x-api/auth/JwtUtils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Returns true if the jwt is invalid or expired, false otherwise.
+ */
+export declare function isJwtInvalidOrExpired(jwt: string): boolean;
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Get the claims of the jwt.
+ */
+export declare function decodeJwtClaims(jwt: string): any;

package/icc-x-api/auth/JwtUtils.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwtClaims = exports.isJwtInvalidOrExpired = void 0;
+const utils_1 = require("../utils");
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Returns true if the jwt is invalid or expired, false otherwise.
+ */
+function isJwtInvalidOrExpired(jwt) {
+    try {
+        const claims = decodeJwtClaims(jwt);
+        // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.
+        return !('exp' in claims) || claims['exp'] * 1000 < new Date().getTime();
+    }
+    catch (e) {
+        return true;
+    }
+}
+exports.isJwtInvalidOrExpired = isJwtInvalidOrExpired;
+/**
+ * @internal this function is for internal use only and may be changed without notice
+ * Get the claims of the jwt.
+ */
+function decodeJwtClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        throw new Error('Invalid JWT: should be 3 parts');
+    return JSON.parse((0, utils_1.a2b)(parts[1]));
+}
+exports.decodeJwtClaims = decodeJwtClaims;
+//# sourceMappingURL=JwtUtils.js.map

package/icc-x-api/auth/JwtUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtUtils.js","sourceRoot":"","sources":["../../../icc-x-api/auth/JwtUtils.ts"],"names":[],"mappings":";;;AAAA,oCAA8B;AAE9B;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,GAAW;IAC/C,IAAI;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACnC,mGAAmG;QACnG,OAAO,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;KACzE;IAAC,OAAO,CAAC,EAAE;QACV,OAAO,IAAI,CAAA;KACZ;AACH,CAAC;AARD,sDAQC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,WAAG,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAJD,0CAIC","sourcesContent":["import { a2b } from '../utils'\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n * Returns true if the jwt is invalid or expired, false otherwise.\n */\nexport function isJwtInvalidOrExpired(jwt: string): boolean {\n  try {\n    const claims = decodeJwtClaims(jwt)\n    // Using the 'exp' string is safe to use as it is part of the JWT RFC and cannot be modified by us.\n    return !('exp' in claims) || claims['exp'] * 1000 < new Date().getTime()\n  } catch (e) {\n    return true\n  }\n}\n\n/**\n * @internal this function is for internal use only and may be changed without notice\n * Get the claims of the jwt.\n */\nexport function decodeJwtClaims(jwt: string): any {\n  const parts = jwt.split('.')\n  if (parts.length !== 3) throw new Error('Invalid JWT: should be 3 parts')\n  return JSON.parse(a2b(parts[1]))\n}\n"]}

package/icc-x-api/auth/SmartAuthProvider.d.ts

@@ -0,0 +1,120 @@
+import { AuthenticationProvider } from './AuthenticationProvider';
+import { UserGroup } from '../../icc-api/model/UserGroup';
+import { AuthService } from './AuthService';
+import { IccAuthApi } from '../../icc-api';
+/**
+ * Needed by a {@link SmartAuthProvider} to get the secrets (password, token, etc.) for authentication to the iCure SDK as needed.
+ */
+export interface AuthSecretProvider {
+    /**
+     * Provides a secret for authentication to the iCure SDK.
+     *
+     * ## Accepted secrets
+     *
+     * The method will be provided with an array of the secrets types that are acceptable (`acceptedSecrets`). Usually this array will contain multiple
+     * elements, but this depends on the group configuration, the user (if he has 2fa setup or not), or the operation being performed. For groups using
+     * default configurations and for patients without 2fa enabled for example the array will always contain the {@link AuthSecretType.PASSWORD} element.
+     * Usually the array contain also the {@link AuthSecretType.LONG_LIVED_TOKEN} element, but if the user is attempting to perform a sensitive operations
+     * such as changing his password the default group configuration does not allow for the user to authenticate using a JWT obtained from a long-lived
+     * token for this operation, meaning the array will not contain the {@link AuthSecretType.LONG_LIVED_TOKEN} element.
+     *
+     * Regardless of the number of elements in the array only one secret of the accepted types is sufficient for the operation to succeed.
+     *
+     * ## TWO_FACTOR_AUTHENTICATION_TOKEN secret type
+     *
+     * The {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN} secret type is only used when the user has 2fa enabled. In this case the SDK will call
+     * this method twice, once containing the {@link AuthSecretType.PASSWORD} element in the `acceptedSecrets` array, and if the provided secret is a
+     * valid password the SDK will immediately call this method again, this time containing the {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN}
+     * instead of the {@link AuthSecretType.PASSWORD} element.
+     *
+     * Any future call to this method from the same provider instance will not contain the {@link AuthSecretType.PASSWORD} element anymore, as it is
+     * cached, but it may contain the {@link AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN} element instead.
+     *
+     * Note that the 2fa token is not needed for logging in through a long-lived or short-lived token, it is only used in combination with a password.
+     * If the user is using 2fa, and you get in input as `acceptedSecrets` an array `[PASSWORD, LONG_LIVED_TOKEN, SHORT_LIVED_TOKEN]`, and you pass to
+     * authenticate a long-lived token, the SDK will not call this method again to ask for the 2fa token.
+     *
+     * @param acceptedSecrets the types of secrets that are acceptable for the operation being performed.
+     * @param previousAttempts the secrets that were previously attempted by the SDK for this operation. This array will be empty the first time this
+     * method is called for a given operation, but it may contain multiple elements if the SDK has already called this method multiple times because the
+     * previously returned secrets were not valid. The first element is the first secret that was attempted, and the last element is the most recently
+     * attempted.
+     * @return a promise that resolves with the secret and the secret type to use for authentication. If the promise rejects then the ongoing SDK
+     * operation will fail without being re-attempted.
+     */
+    getSecret(acceptedSecrets: AuthSecretType[], previousAttempts: {
+        secret: string;
+        secretType: AuthSecretType;
+    }[]): Promise<{
+        secret: string;
+        secretType: AuthSecretType;
+    }>;
+}
+/**
+ * Represents a type of secret that can be used for authentication with iCure.
+ */
+export declare enum AuthSecretType {
+    /**
+     * Password chosen by the user.
+     */
+    PASSWORD = "PASSWORD",
+    /**
+     * Time based one time password provided by authenticator applications, generated on the basis of a timestamp and a shared secret between the iCure
+     * server and the authenticator application.
+     */
+    TWO_FACTOR_AUTHENTICATION_TOKEN = "TWO_FACTOR_AUTHENTICATION_TOKEN",
+    /**
+     * A short-lived iCure token, an internal authentication token that lasts 5 minutes or less. Unlike passwords these tokens usually are generated by
+     * some component of iCure, and are not chosen by the user.
+     */
+    SHORT_LIVED_TOKEN = "SHORT_LIVED_TOKEN",
+    /**
+     * A long-lived iCure token, an internal authentication token that lasts longer than 5 minutes. Unlike passwords these tokens usually are generated
+     * by some component of iCure, and are not chosen by the user.
+     */
+    LONG_LIVED_TOKEN = "LONG_LIVED_TOKEN"
+}
+/**
+ * @internal this class is meant for internal use only and may be changed without notice. The SmartAuthProvider will be initialised automatically
+ * by the iCure api depending on the authentication options you provide.
+ *
+ * An authentication provider that automatically requests secrets for authentication as needed.
+ *
+ * This authentication provider can be initialised already with some secrets or tokens, and the provider will cache them and use them as needed for
+ * as long as they remain valid. If at any point however the provider needs an updated secret or a secret of a different kind it will automatically
+ * request this to the {@link SmartAuthProvider} to get the secret.
+ *
+ * An advantage of using this provider over others is that in case all the cached tokens and secrets were to expire while performing a request,
+ * instead of having the request fail the provider will ask for new secrets from the {@link SmartAuthProvider} and the request will automatically
+ * be retried with the new secret. Additionally, the provider may request updated secrets also for performing some sensitive operations (e.g. changing
+ * password of the user) even if the cached tokens and/or did not expire. This could be the case for example if the cached secret is a long-lived
+ * token, but in order to change the password the user needs to provide his current password.
+ *
+ * Note that in this context the cache of secrets and token is in memory only, and is not persisted in any way. Different instances of this provider
+ * will not share the same cache.
+ *
+ */
+export declare class SmartAuthProvider implements AuthenticationProvider {
+    private readonly tokenProvider;
+    private readonly groupId;
+    /**
+     * Initialises a {@link SmartAuthProvider}.
+     * @param authApi an "anonymous" {@link IccAuthApi} to use for authentication.
+     * @param login
+     * @param secretProvider
+     * @param props optional initialisation properties.
+     */
+    static initialise(authApi: IccAuthApi, login: string, secretProvider: AuthSecretProvider, props?: {
+        initialSecret?: string;
+        initialAuthToken?: string;
+        initialRefreshToken?: string;
+        loginGroupId?: string;
+    }): SmartAuthProvider;
+    private constructor();
+    getAuthService(): AuthService;
+    switchGroup(newGroupId: string, matches: Array<UserGroup>): Promise<AuthenticationProvider>;
+    getIcureTokens(): Promise<{
+        token: string;
+        refreshToken: string;
+    } | undefined>;
+}