@medplum/core 0.1.6 → 0.3.0

package/dist/client.js

@@ -1,6 +1,15 @@
 "use strict";
 // PKCE auth ased on:
 // https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MedplumClient = void 0;
 const cache_1 = require("./cache");
@@ -13,25 +22,14 @@ const storage_1 = require("./storage");
 const types_1 = require("./types");
 const utils_1 = require("./utils");
 const DEFAULT_BASE_URL = 'https://api.medplum.com/';
+const DEFAULT_SCOPE = 'launch/patient openid fhirUser offline_access user/*.*';
 const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
-const DEFAULT_BLOB_CACHE_SIZE = 100;
 const JSON_CONTENT_TYPE = 'application/json';
 const FHIR_CONTENT_TYPE = 'application/fhir+json';
 const PATCH_CONTENT_TYPE = 'application/json-patch+json';
 class MedplumClient extends eventtarget_1.EventTarget {
-    fetch;
-    storage;
-    schema;
-    resourceCache;
-    blobUrlCache;
-    baseUrl;
-    clientId;
-    authorizeUrl;
-    tokenUrl;
-    logoutUrl;
-    onUnauthenticated;
-    profile;
     constructor(options) {
+        var _a, _b, _c;
         super();
         if (options.baseUrl) {
             if (!options.baseUrl.startsWith('http')) {
@@ -41,31 +39,36 @@ class MedplumClient extends eventtarget_1.EventTarget {
                 throw new Error('Base URL must end with a trailing slash');
             }
         }
-        if (!options.clientId) {
-            throw new Error('Client ID cannot be empty');
-        }
         this.fetch = options.fetch || window.fetch.bind(window);
-        this.storage = typeof localStorage !== 'undefined' ? new storage_1.LocalStorage() : new storage_1.MemoryStorage();
+        this.storage = new storage_1.ClientStorage();
         this.schema = new Map();
-        this.resourceCache = new cache_1.LRUCache(options.resourceCacheSize ?? DEFAULT_RESOURCE_CACHE_SIZE);
-        this.blobUrlCache = new cache_1.LRUCache(options.blobCacheSize ?? DEFAULT_BLOB_CACHE_SIZE);
+        this.resourceCache = new cache_1.LRUCache((_a = options.resourceCacheSize) !== null && _a !== void 0 ? _a : DEFAULT_RESOURCE_CACHE_SIZE);
         this.baseUrl = options.baseUrl || DEFAULT_BASE_URL;
-        this.clientId = options.clientId;
+        this.clientId = options.clientId || '';
         this.authorizeUrl = options.authorizeUrl || this.baseUrl + 'oauth2/authorize';
         this.tokenUrl = options.tokenUrl || this.baseUrl + 'oauth2/token';
         this.logoutUrl = options.logoutUrl || this.baseUrl + 'oauth2/logout';
         this.onUnauthenticated = options.onUnauthenticated;
+        this.activeLogin = this.storage.getObject('activeLogin');
+        if (!((_c = (_b = this.activeLogin) === null || _b === void 0 ? void 0 : _b.profile) === null || _c === void 0 ? void 0 : _c.reference)) {
+            this.clear();
+        }
+        this.loading = false;
+        this.refreshProfile().catch(console.log);
     }
     /**
      * Clears all auth state including local storage and session storage.
      */
     clear() {
         this.storage.clear();
+        this.schema.clear();
+        this.resourceCache.clear();
+        this.activeLogin = undefined;
         this.profile = undefined;
         this.dispatchEvent({ type: 'change' });
     }
-    get(url, blob) {
-        return this.request('GET', url, undefined, undefined, blob);
+    get(url) {
+        return this.request('GET', url);
     }
     post(url, body, contentType) {
         return this.request('POST', url, contentType, body);
@@ -73,57 +76,53 @@ class MedplumClient extends eventtarget_1.EventTarget {
     put(url, body, contentType) {
         return this.request('PUT', url, contentType, body);
     }
+    delete(url) {
+        return this.request('DELETE', url);
+    }
     /**
      * Tries to register a new user.
      * @param request The registration request.
-     * @returns Promise to the user profile resource.
+     * @returns Promise to the authentication response.
      */
     register(request) {
-        return this.post('auth/register', request)
-            .then((response) => this.handleLoginResponse(response));
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.post('auth/register', request);
+            yield this.setActiveLogin(response);
+        });
     }
     /**
-     * Tries to sign in with email and password.
-     * @param email The user email address.
-     * @param password The user password.
-     * @param role The login role.
-     * @param scope The OAuth2 login scope.
-     * @param remember Optional flag to "remember" to generate a refresh token and persist in local storage.
-     * @returns Promise to the user profile resource.
+     * Initiates a user login flow.
+     * @param email The email address of the user.
+     * @param password The password of the user.
+     * @param remember Optional flag to remember the user.
+     * @returns Promise to the authentication response.
      */
-    signIn(email, password, role, scope, remember) {
-        return this.post('auth/login', {
-            clientId: this.clientId,
-            email,
-            password,
-            role,
-            scope,
-            remember: !!remember
-        }).then((response) => this.handleLoginResponse(response));
+    startLogin(email, password, remember) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.startPkce();
+            return this.post('auth/login', {
+                clientId: this.clientId,
+                scope: DEFAULT_SCOPE,
+                codeChallengeMethod: 'S256',
+                codeChallenge: this.storage.getString('codeChallenge'),
+                email,
+                password,
+                remember: !!remember,
+            });
+        });
     }
     /**
      * Tries to sign in with Google authentication.
      * The response parameter is the result of a Google authentication.
      * See: https://developers.google.com/identity/gsi/web/guides/handle-credential-responses-js-functions
      * @param googleResponse The Google credential response.
-     * @returns Promise to the user profile resource.
-     */
-    signInWithGoogle(googleResponse) {
-        return this.post('auth/google', googleResponse)
-            .then((loginResponse) => this.handleLoginResponse(loginResponse));
-    }
-    /**
-     * Handles a login response.
-     * This can be used for both "register" and "signIn".
-     * @param response The login response.
-     * @returns The user profile.
+     * @returns Promise to the authentication response.
      */
-    handleLoginResponse(response) {
-        this.setAccessToken(response.accessToken);
-        this.setRefreshToken(response.refreshToken);
-        this.setProfile(response.profile);
-        this.dispatchEvent({ type: 'change' });
-        return response.profile;
+    startGoogleLogin(googleResponse) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.startPkce();
+            return this.post('auth/google', googleResponse);
+        });
     }
     /**
      * Signs out locally.
@@ -154,14 +153,11 @@ class MedplumClient extends eventtarget_1.EventTarget {
      * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html
      */
     signOutWithRedirect() {
-        if (!this.logoutUrl) {
-            throw new Error('Missing logout URL');
-        }
         window.location.assign(this.logoutUrl);
     }
     fhirUrl(...path) {
         const builder = [this.baseUrl, 'fhir/R4'];
-        path.forEach(p => builder.push('/', encodeURIComponent(p)));
+        path.forEach((p) => builder.push('/', encodeURIComponent(p)));
         return builder.join('');
     }
     search(search) {
@@ -186,8 +182,7 @@ class MedplumClient extends eventtarget_1.EventTarget {
     }
     read(resourceType, id) {
         const cacheKey = resourceType + '/' + id;
-        const promise = this.get(this.fhirUrl(resourceType, id))
-            .then((resource) => {
+        const promise = this.get(this.fhirUrl(resourceType, id)).then((resource) => {
             this.resourceCache.set(cacheKey, resource);
             return resource;
         });
@@ -199,7 +194,7 @@ class MedplumClient extends eventtarget_1.EventTarget {
         return cached ? Promise.resolve(cached) : this.read(resourceType, id);
     }
     readReference(reference) {
-        const refString = reference?.reference;
+        const refString = reference === null || reference === void 0 ? void 0 : reference.reference;
         if (!refString) {
             return Promise.reject('Missing reference');
         }
@@ -207,7 +202,7 @@ class MedplumClient extends eventtarget_1.EventTarget {
         return this.read(resourceType, id);
     }
     readCachedReference(reference) {
-        const refString = reference?.reference;
+        const refString = reference === null || reference === void 0 ? void 0 : reference.reference;
         if (!refString) {
             return Promise.reject('Missing reference');
         }
@@ -216,7 +211,7 @@ class MedplumClient extends eventtarget_1.EventTarget {
     }
     getTypeDefinition(resourceType) {
         if (!resourceType) {
-            throw new Error('Missing resourceType');
+            return Promise.reject('Missing resourceType');
         }
         const cached = this.schema.get(resourceType);
         if (cached) {
@@ -225,7 +220,8 @@ class MedplumClient extends eventtarget_1.EventTarget {
         let typeDef;
         return this.search('StructureDefinition?name:exact=' + encodeURIComponent(resourceType))
             .then((result) => {
-            if (!result.entry?.length) {
+            var _a;
+            if (!((_a = result.entry) === null || _a === void 0 ? void 0 : _a.length)) {
                 throw new Error('StructureDefinition not found');
             }
             const resource = result.entry[0].resource;
@@ -237,18 +233,20 @@ class MedplumClient extends eventtarget_1.EventTarget {
             .then(() => this.search({
             resourceType: 'SearchParameter',
             count: 100,
-            filters: [{
+            filters: [
+                {
                     code: 'base',
                     operator: search_1.Operator.EQUALS,
-                    value: resourceType
-                }]
+                    value: resourceType,
+                },
+            ],
         }))
             .then((result) => {
             const entries = result.entry;
             if (entries) {
                 typeDef.types[resourceType].searchParams = entries
-                    .map(e => e.resource)
-                    .sort((a, b) => a.name?.localeCompare(b.name) ?? 0);
+                    .map((e) => e.resource)
+                    .sort((a, b) => { var _a, _b; return (_b = (_a = a.name) === null || _a === void 0 ? void 0 : _a.localeCompare(b.name)) !== null && _b !== void 0 ? _b : 0; });
             }
             this.schema.set(resourceType, typeDef);
             return typeDef;
@@ -260,26 +258,6 @@ class MedplumClient extends eventtarget_1.EventTarget {
     readPatientEverything(id) {
         return this.get(this.fhirUrl('Patient', id, '$everything'));
     }
-    readBlob(url) {
-        return this.get(url, true);
-    }
-    readBlobAsObjectUrl(url) {
-        const promise = this.readBlob(url)
-            .then(imageBlob => {
-            const imageUrl = URL.createObjectURL(imageBlob);
-            this.blobUrlCache.set(url, imageUrl);
-            return imageUrl;
-        });
-        this.blobUrlCache.set(url, promise);
-        return promise;
-    }
-    readCachedBlobAsObjectUrl(url) {
-        const cached = this.blobUrlCache.get(url);
-        return cached ? Promise.resolve(cached) : this.readBlobAsObjectUrl(url);
-    }
-    readBinary(id) {
-        return this.readBlob(this.fhirUrl('Binary', id));
-    }
     create(resource) {
         if (!resource.resourceType) {
             throw new Error('Missing resourceType');
@@ -301,6 +279,9 @@ class MedplumClient extends eventtarget_1.EventTarget {
     patch(resourceType, id, operations) {
         return this.request('PATCH', this.fhirUrl(resourceType, id), PATCH_CONTENT_TYPE, operations);
     }
+    deleteResource(resourceType, id) {
+        return this.delete(this.fhirUrl(resourceType, id));
+    }
     graphql(gql) {
         return this.post(this.fhirUrl('$graphql'), gql, JSON_CONTENT_TYPE);
     }
@@ -310,11 +291,11 @@ class MedplumClient extends eventtarget_1.EventTarget {
             status: 'active',
             criteria: criteria,
             channel: {
-                type: 'sse'
-            }
+                type: 'sse',
+            },
         }).then((sub) => {
             const eventSource = new EventSource(this.baseUrl + 'sse?subscription=' + encodeURIComponent(sub.id), {
-                withCredentials: true
+                withCredentials: true,
             });
             eventSource.onmessage = (e) => {
                 handler(JSON.parse(e.data));
@@ -322,27 +303,46 @@ class MedplumClient extends eventtarget_1.EventTarget {
             return eventSource;
         });
     }
-    getProfile() {
-        if (!this.profile) {
-            this.profile = this.storage.getObject('profile');
-        }
-        return this.profile;
-    }
-    setProfile(profile) {
-        this.storage.setObject('profile', profile);
-        this.profile = profile;
-    }
-    getAccessToken() {
-        return this.storage.getString('accessToken');
+    getActiveLogin() {
+        return this.activeLogin;
+    }
+    setActiveLogin(login) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.activeLogin = login;
+            this.storage.setObject('activeLogin', login);
+            this.addLogin(login);
+            this.resourceCache.clear();
+            this.refreshPromise = undefined;
+            yield this.refreshProfile();
+        });
     }
-    setAccessToken(accessToken) {
-        this.storage.setString('accessToken', accessToken);
+    getLogins() {
+        var _a;
+        return (_a = this.storage.getObject('logins')) !== null && _a !== void 0 ? _a : [];
+    }
+    addLogin(newLogin) {
+        const logins = this.getLogins().filter((login) => { var _a, _b; return ((_a = login.profile) === null || _a === void 0 ? void 0 : _a.reference) !== ((_b = newLogin.profile) === null || _b === void 0 ? void 0 : _b.reference); });
+        logins.push(newLogin);
+        this.storage.setObject('logins', logins);
+    }
+    refreshProfile() {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const reference = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile;
+            if (reference === null || reference === void 0 ? void 0 : reference.reference) {
+                this.loading = true;
+                this.profile = yield this.readCachedReference(reference);
+                this.loading = false;
+                this.dispatchEvent({ type: 'change' });
+            }
+            return this.profile;
+        });
     }
-    getRefreshToken() {
-        return this.storage.getString('refreshToken');
+    getProfile() {
+        return this.profile;
     }
-    setRefreshToken(refreshToken) {
-        this.storage.setString('refreshToken', refreshToken);
+    isLoading() {
+        return this.loading;
     }
     /**
      * Makes an HTTP request.
@@ -350,43 +350,52 @@ class MedplumClient extends eventtarget_1.EventTarget {
      * @param {string} url
      * @param {string=} contentType
      * @param {Object=} body
-     * @param {boolean=} blob
      */
-    async request(method, url, contentType, body, blob) {
-        if (!url.startsWith('http')) {
-            url = this.baseUrl + url;
-        }
-        const headers = {
-            'Content-Type': contentType || FHIR_CONTENT_TYPE
-        };
-        const accessToken = this.getAccessToken();
-        if (accessToken) {
-            headers['Authorization'] = 'Bearer ' + accessToken;
-        }
-        const options = {
-            method: method,
-            cache: 'no-cache',
-            credentials: 'include',
-            headers
-        };
-        if (body) {
-            if (typeof body === 'string' || (typeof File !== 'undefined' && body instanceof File)) {
-                options.body = body;
+    request(method, url, contentType, body) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.refreshPromise) {
+                yield this.refreshPromise;
             }
-            else {
-                options.body = (0, utils_1.stringify)(body);
+            if (!url.startsWith('http')) {
+                url = this.baseUrl + url;
             }
-        }
-        const response = await this.fetch(url, options);
-        if (response.status === 401) {
-            // Refresh and try again
-            return this.handleUnauthenticated(method, url, contentType, body, blob);
-        }
-        const obj = blob ? await response.blob() : await response.json();
-        if (obj.resourceType === 'OperationOutcome' && !(0, outcomes_1.isOk)(obj)) {
-            return Promise.reject(new outcomes_1.OperationOutcomeError(obj));
-        }
-        return obj;
+            const headers = {
+                'Content-Type': contentType || FHIR_CONTENT_TYPE,
+            };
+            const accessToken = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.accessToken;
+            if (accessToken) {
+                headers['Authorization'] = 'Bearer ' + accessToken;
+            }
+            const options = {
+                method: method,
+                cache: 'no-cache',
+                credentials: 'include',
+                headers,
+            };
+            if (body) {
+                if (typeof body === 'string' || (typeof File !== 'undefined' && body instanceof File)) {
+                    options.body = body;
+                }
+                else {
+                    options.body = (0, utils_1.stringify)(body);
+                }
+            }
+            const response = yield this.fetch(url, options);
+            if (response.status === 401) {
+                // Refresh and try again
+                return this.handleUnauthenticated(method, url, contentType, body);
+            }
+            if (response.status === 204 || response.status === 304) {
+                // No content or change
+                return undefined;
+            }
+            const obj = yield response.json();
+            if (obj.resourceType === 'OperationOutcome' && !(0, outcomes_1.isOk)(obj)) {
+                return Promise.reject(new outcomes_1.OperationOutcomeError(obj));
+            }
+            return obj;
+        });
     }
     /**
      * Handles an unauthenticated response from the server.
@@ -396,17 +405,33 @@ class MedplumClient extends eventtarget_1.EventTarget {
      * @param url The URL of the original request.
      * @param contentType The content type of the original request.
      * @param body The body of the original request.
-     * @param blob Optional blob flag of the original request.
      */
-    async handleUnauthenticated(method, url, contentType, body, blob) {
-        return this.refresh()
-            .then(() => this.request(method, url, contentType, body, blob))
-            .catch(error => {
-            this.clear();
-            if (this.onUnauthenticated) {
-                this.onUnauthenticated();
-            }
-            return Promise.reject(error);
+    handleUnauthenticated(method, url, contentType, body) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.refresh()
+                .then(() => this.request(method, url, contentType, body))
+                .catch((error) => {
+                this.clear();
+                if (this.onUnauthenticated) {
+                    this.onUnauthenticated();
+                }
+                return Promise.reject(error);
+            });
+        });
+    }
+    /**
+     * Starts a new PKCE flow.
+     * These PKCE values are stateful, and must survive redirects and page refreshes.
+     */
+    startPkce() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const pkceState = (0, crypto_1.getRandomString)();
+            this.storage.setString('pkceState', pkceState);
+            const codeVerifier = (0, crypto_1.getRandomString)();
+            this.storage.setString('codeVerifier', codeVerifier);
+            const arrayHash = yield (0, crypto_1.encryptSHA256)(codeVerifier);
+            const codeChallenge = (0, utils_1.arrayBufferToBase64)(arrayHash).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+            this.storage.setString('codeChallenge', codeChallenge);
         });
     }
     /**
@@ -414,27 +439,26 @@ class MedplumClient extends eventtarget_1.EventTarget {
      * Clears all auth state including local storage and session storage.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
      */
-    async requestAuthorization() {
-        if (!this.authorizeUrl) {
-            throw new Error('Missing authorize URL');
-        }
-        this.clear();
-        const pkceState = (0, crypto_1.getRandomString)();
-        this.storage.setString('pkceState', pkceState);
-        const codeVerifier = (0, crypto_1.getRandomString)();
-        this.storage.setString('codeVerifier', codeVerifier);
-        const arrayHash = await (0, crypto_1.encryptSHA256)(codeVerifier);
-        const codeChallenge = (0, utils_1.arrayBufferToBase64)(arrayHash);
-        this.storage.setString('codeChallenge', codeChallenge);
-        const scope = 'launch/patient openid fhirUser offline_access user/*.*';
-        window.location.assign(this.authorizeUrl +
-            '?response_type=code' +
-            '&state=' + encodeURIComponent(pkceState) +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +
-            '&scope=' + encodeURIComponent(scope) +
-            '&code_challenge_method=S256' +
-            '&code_challenge=' + encodeURIComponent(codeChallenge));
+    requestAuthorization() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.authorizeUrl) {
+                throw new Error('Missing authorize URL');
+            }
+            this.startPkce();
+            window.location.assign(this.authorizeUrl +
+                '?response_type=code' +
+                '&state=' +
+                encodeURIComponent(this.storage.getString('pkceState')) +
+                '&client_id=' +
+                encodeURIComponent(this.clientId) +
+                '&redirect_uri=' +
+                encodeURIComponent(getBaseUrl()) +
+                '&scope=' +
+                encodeURIComponent(DEFAULT_SCOPE) +
+                '&code_challenge_method=S256' +
+                '&code_challenge=' +
+                encodeURIComponent(this.storage.getString('codeChallenge')));
+        });
     }
     /**
      * Processes an OAuth authorization code.
@@ -453,47 +477,61 @@ class MedplumClient extends eventtarget_1.EventTarget {
             throw new Error('Invalid PCKE code verifier');
         }
         return this.fetchTokens('grant_type=authorization_code' +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&code_verifier=' + encodeURIComponent(codeVerifier) +
-            '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +
-            '&code=' + encodeURIComponent(code));
+            (this.clientId ? '&client_id=' + encodeURIComponent(this.clientId) : '') +
+            '&code_verifier=' +
+            encodeURIComponent(codeVerifier) +
+            '&redirect_uri=' +
+            encodeURIComponent(getBaseUrl()) +
+            '&code=' +
+            encodeURIComponent(code));
     }
     /**
      * Tries to refresh the auth tokens.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens
      */
-    async refresh() {
-        const refreshToken = this.getRefreshToken();
-        if (!refreshToken) {
-            this.clear();
-            return Promise.reject('Invalid refresh token');
-        }
-        await this.fetchTokens('grant_type=refresh_token' +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&refresh_token=' + encodeURIComponent(refreshToken));
+    refresh() {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.refreshPromise) {
+                return this.refreshPromise;
+            }
+            const refreshToken = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.refreshToken;
+            if (!refreshToken) {
+                this.clear();
+                return Promise.reject('Invalid refresh token');
+            }
+            this.refreshPromise = this.fetchTokens('grant_type=refresh_token' +
+                '&client_id=' +
+                encodeURIComponent(this.clientId) +
+                '&refresh_token=' +
+                encodeURIComponent(refreshToken));
+            yield this.refreshPromise;
+        });
     }
     /**
      * Makes a POST request to the tokens endpoint.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
      * @param formBody Token parameters in URL encoded format.
      */
-    async fetchTokens(formBody) {
-        if (!this.tokenUrl) {
-            throw new Error('Missing token URL');
-        }
-        return this.fetch(this.tokenUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: formBody
-        })
-            .then(response => {
-            if (!response.ok) {
-                return Promise.reject('Failed to fetch tokens');
+    fetchTokens(formBody) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.tokenUrl) {
+                return Promise.reject('Missing token URL');
             }
-            return response.json();
-        })
-            .then(tokens => this.verifyTokens(tokens))
-            .then(() => this.getProfile());
+            return this.fetch(this.tokenUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: formBody,
+            })
+                .then((response) => {
+                if (!response.ok) {
+                    return Promise.reject('Failed to fetch tokens');
+                }
+                return response.json();
+            })
+                .then((tokens) => this.verifyTokens(tokens))
+                .then(() => this.profile);
+        });
     }
     /**
      * Verifies the tokens received from the auth server.
@@ -501,21 +539,27 @@ class MedplumClient extends eventtarget_1.EventTarget {
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
      * @param tokens
      */
-    async verifyTokens(tokens) {
-        const token = tokens.access_token;
-        // Verify token has not expired
-        const tokenPayload = (0, jwt_1.parseJWTPayload)(token);
-        if (Date.now() >= tokenPayload.exp * 1000) {
-            this.clear();
-            return Promise.reject('Token expired');
-        }
-        // Verify app_client_id
-        if (tokenPayload.client_id !== this.clientId) {
-            this.clear();
-            return Promise.reject('Token was not issued for this audience');
-        }
-        this.setAccessToken(token);
-        this.setRefreshToken(tokens.refresh_token);
+    verifyTokens(tokens) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const token = tokens.access_token;
+            // Verify token has not expired
+            const tokenPayload = (0, jwt_1.parseJWTPayload)(token);
+            if (Date.now() >= tokenPayload.exp * 1000) {
+                this.clear();
+                return Promise.reject('Token expired');
+            }
+            // Verify app_client_id
+            if (this.clientId && tokenPayload.client_id !== this.clientId) {
+                this.clear();
+                return Promise.reject('Token was not issued for this audience');
+            }
+            yield this.setActiveLogin({
+                accessToken: token,
+                refreshToken: tokens.refresh_token,
+                project: tokens.project,
+                profile: tokens.profile,
+            });
+        });
     }
 }
 exports.MedplumClient = MedplumClient;