@medplum/core 0.2.0 → 0.4.0

package/dist/client.js

@@ -1,530 +0,0 @@
-"use strict";
-// PKCE auth ased on:
-// https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MedplumClient = void 0;
-const cache_1 = require("./cache");
-const crypto_1 = require("./crypto");
-const eventtarget_1 = require("./eventtarget");
-const jwt_1 = require("./jwt");
-const outcomes_1 = require("./outcomes");
-const search_1 = require("./search");
-const storage_1 = require("./storage");
-const types_1 = require("./types");
-const utils_1 = require("./utils");
-const DEFAULT_BASE_URL = 'https://api.medplum.com/';
-const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
-const DEFAULT_BLOB_CACHE_SIZE = 100;
-const JSON_CONTENT_TYPE = 'application/json';
-const FHIR_CONTENT_TYPE = 'application/fhir+json';
-const PATCH_CONTENT_TYPE = 'application/json-patch+json';
-class MedplumClient extends eventtarget_1.EventTarget {
-    fetch;
-    storage;
-    schema;
-    resourceCache;
-    blobUrlCache;
-    baseUrl;
-    clientId;
-    authorizeUrl;
-    tokenUrl;
-    logoutUrl;
-    onUnauthenticated;
-    activeLogin;
-    constructor(options) {
-        super();
-        if (options.baseUrl) {
-            if (!options.baseUrl.startsWith('http')) {
-                throw new Error('Base URL must start with http or https');
-            }
-            if (!options.baseUrl.endsWith('/')) {
-                throw new Error('Base URL must end with a trailing slash');
-            }
-        }
-        if (!options.clientId) {
-            throw new Error('Client ID cannot be empty');
-        }
-        this.fetch = options.fetch || window.fetch.bind(window);
-        this.storage = new storage_1.ClientStorage();
-        this.schema = new Map();
-        this.resourceCache = new cache_1.LRUCache(options.resourceCacheSize ?? DEFAULT_RESOURCE_CACHE_SIZE);
-        this.blobUrlCache = new cache_1.LRUCache(options.blobCacheSize ?? DEFAULT_BLOB_CACHE_SIZE);
-        this.baseUrl = options.baseUrl || DEFAULT_BASE_URL;
-        this.clientId = options.clientId;
-        this.authorizeUrl = options.authorizeUrl || this.baseUrl + 'oauth2/authorize';
-        this.tokenUrl = options.tokenUrl || this.baseUrl + 'oauth2/token';
-        this.logoutUrl = options.logoutUrl || this.baseUrl + 'oauth2/logout';
-        this.onUnauthenticated = options.onUnauthenticated;
-    }
-    /**
-     * Clears all auth state including local storage and session storage.
-     */
-    clear() {
-        this.storage.clear();
-        this.activeLogin = undefined;
-        this.dispatchEvent({ type: 'change' });
-    }
-    get(url, blob) {
-        return this.request('GET', url, undefined, undefined, blob);
-    }
-    post(url, body, contentType) {
-        return this.request('POST', url, contentType, body);
-    }
-    put(url, body, contentType) {
-        return this.request('PUT', url, contentType, body);
-    }
-    /**
-     * Tries to register a new user.
-     * @param request The registration request.
-     * @returns Promise to the user profile resource.
-     */
-    register(request) {
-        return this.post('auth/register', request)
-            .then((response) => this.handleLoginResponse(response));
-    }
-    /**
-     * Tries to sign in with email and password.
-     * @param email The user email address.
-     * @param password The user password.
-     * @param role The login role.
-     * @param scope The OAuth2 login scope.
-     * @param remember Optional flag to "remember" to generate a refresh token and persist in local storage.
-     * @returns Promise to the user profile resource.
-     */
-    signIn(email, password, role, scope, remember) {
-        return this.post('auth/login', {
-            clientId: this.clientId,
-            email,
-            password,
-            role,
-            scope,
-            remember: !!remember
-        }).then((response) => this.handleLoginResponse(response));
-    }
-    /**
-     * Tries to sign in with Google authentication.
-     * The response parameter is the result of a Google authentication.
-     * See: https://developers.google.com/identity/gsi/web/guides/handle-credential-responses-js-functions
-     * @param googleResponse The Google credential response.
-     * @returns Promise to the user profile resource.
-     */
-    signInWithGoogle(googleResponse) {
-        return this.post('auth/google', googleResponse)
-            .then((loginResponse) => this.handleLoginResponse(loginResponse));
-    }
-    /**
-     * Handles a login response.
-     * This can be used for both "register" and "signIn".
-     * @param response The login response.
-     * @returns The user profile.
-     */
-    handleLoginResponse(response) {
-        this.setActiveLogin(response);
-        return response.profile;
-    }
-    /**
-     * Signs out locally.
-     * Does not invalidate tokens with the server.
-     */
-    signOut() {
-        this.clear();
-        return Promise.resolve();
-    }
-    /**
-     * Tries to sign in the user.
-     * Returns true if the user is signed in.
-     * This may result in navigating away to the sign in page.
-     */
-    signInWithRedirect() {
-        const urlParams = new URLSearchParams(window.location.search);
-        const code = urlParams.get('code');
-        if (!code) {
-            this.requestAuthorization();
-            return undefined;
-        }
-        else {
-            return this.processCode(code);
-        }
-    }
-    /**
-     * Tries to sign out the user.
-     * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html
-     */
-    signOutWithRedirect() {
-        window.location.assign(this.logoutUrl);
-    }
-    fhirUrl(...path) {
-        const builder = [this.baseUrl, 'fhir/R4'];
-        path.forEach(p => builder.push('/', encodeURIComponent(p)));
-        return builder.join('');
-    }
-    search(search) {
-        if (typeof search === 'string') {
-            return this.get('fhir/R4/' + search);
-        }
-        else {
-            return this.get(this.fhirUrl(search.resourceType) + (0, search_1.formatSearchQuery)(search));
-        }
-    }
-    /**
-     * Searches a ValueSet resource using the "expand" operation.
-     * See: https://www.hl7.org/fhir/operation-valueset-expand.html
-     * @param system The ValueSet system url.
-     * @param filter The search string.
-     * @returns Promise to expanded ValueSet.
-     */
-    searchValueSet(system, filter) {
-        return this.get(this.fhirUrl('ValueSet', '$expand') +
-            `?url=${encodeURIComponent(system)}` +
-            `&filter=${encodeURIComponent(filter)}`);
-    }
-    read(resourceType, id) {
-        const cacheKey = resourceType + '/' + id;
-        const promise = this.get(this.fhirUrl(resourceType, id))
-            .then((resource) => {
-            this.resourceCache.set(cacheKey, resource);
-            return resource;
-        });
-        this.resourceCache.set(cacheKey, promise);
-        return promise;
-    }
-    readCached(resourceType, id) {
-        const cached = this.resourceCache.get(resourceType + '/' + id);
-        return cached ? Promise.resolve(cached) : this.read(resourceType, id);
-    }
-    readReference(reference) {
-        const refString = reference?.reference;
-        if (!refString) {
-            return Promise.reject('Missing reference');
-        }
-        const [resourceType, id] = refString.split('/');
-        return this.read(resourceType, id);
-    }
-    readCachedReference(reference) {
-        const refString = reference?.reference;
-        if (!refString) {
-            return Promise.reject('Missing reference');
-        }
-        const [resourceType, id] = refString.split('/');
-        return this.readCached(resourceType, id);
-    }
-    getTypeDefinition(resourceType) {
-        if (!resourceType) {
-            return Promise.reject('Missing resourceType');
-        }
-        const cached = this.schema.get(resourceType);
-        if (cached) {
-            return Promise.resolve(cached);
-        }
-        let typeDef;
-        return this.search('StructureDefinition?name:exact=' + encodeURIComponent(resourceType))
-            .then((result) => {
-            if (!result.entry?.length) {
-                throw new Error('StructureDefinition not found');
-            }
-            const resource = result.entry[0].resource;
-            if (!resource) {
-                throw new Error('StructureDefinition not found');
-            }
-            typeDef = (0, types_1.indexStructureDefinition)(resource);
-        })
-            .then(() => this.search({
-            resourceType: 'SearchParameter',
-            count: 100,
-            filters: [{
-                    code: 'base',
-                    operator: search_1.Operator.EQUALS,
-                    value: resourceType
-                }]
-        }))
-            .then((result) => {
-            const entries = result.entry;
-            if (entries) {
-                typeDef.types[resourceType].searchParams = entries
-                    .map(e => e.resource)
-                    .sort((a, b) => a.name?.localeCompare(b.name) ?? 0);
-            }
-            this.schema.set(resourceType, typeDef);
-            return typeDef;
-        });
-    }
-    readHistory(resourceType, id) {
-        return this.get(this.fhirUrl(resourceType, id, '_history'));
-    }
-    readPatientEverything(id) {
-        return this.get(this.fhirUrl('Patient', id, '$everything'));
-    }
-    readBlob(url) {
-        return this.get(url, true);
-    }
-    readBlobAsObjectUrl(url) {
-        const promise = this.readBlob(url)
-            .then(imageBlob => {
-            const imageUrl = URL.createObjectURL(imageBlob);
-            this.blobUrlCache.set(url, imageUrl);
-            return imageUrl;
-        });
-        this.blobUrlCache.set(url, promise);
-        return promise;
-    }
-    readCachedBlobAsObjectUrl(url) {
-        const cached = this.blobUrlCache.get(url);
-        return cached ? Promise.resolve(cached) : this.readBlobAsObjectUrl(url);
-    }
-    readBinary(id) {
-        return this.readBlob(this.fhirUrl('Binary', id));
-    }
-    create(resource) {
-        if (!resource.resourceType) {
-            throw new Error('Missing resourceType');
-        }
-        return this.post(this.fhirUrl(resource.resourceType), resource);
-    }
-    createBinary(data, contentType) {
-        return this.post(this.fhirUrl('Binary'), data, contentType);
-    }
-    update(resource) {
-        if (!resource.resourceType) {
-            throw new Error('Missing resourceType');
-        }
-        if (!resource.id) {
-            throw new Error('Missing id');
-        }
-        return this.put(this.fhirUrl(resource.resourceType, resource.id), resource);
-    }
-    patch(resourceType, id, operations) {
-        return this.request('PATCH', this.fhirUrl(resourceType, id), PATCH_CONTENT_TYPE, operations);
-    }
-    graphql(gql) {
-        return this.post(this.fhirUrl('$graphql'), gql, JSON_CONTENT_TYPE);
-    }
-    subscribe(criteria, handler) {
-        return this.create({
-            resourceType: 'Subscription',
-            status: 'active',
-            criteria: criteria,
-            channel: {
-                type: 'sse'
-            }
-        }).then((sub) => {
-            const eventSource = new EventSource(this.baseUrl + 'sse?subscription=' + encodeURIComponent(sub.id), {
-                withCredentials: true
-            });
-            eventSource.onmessage = (e) => {
-                handler(JSON.parse(e.data));
-            };
-            return eventSource;
-        });
-    }
-    getActiveLogin() {
-        if (!this.activeLogin) {
-            this.activeLogin = this.storage.getObject('activeLogin');
-        }
-        return this.activeLogin;
-    }
-    setActiveLogin(login) {
-        this.activeLogin = login;
-        this.storage.setObject('activeLogin', login);
-        this.addLogin(login);
-        this.dispatchEvent({ type: 'change' });
-    }
-    getLogins() {
-        return this.storage.getObject('logins') ?? [];
-    }
-    addLogin(newLogin) {
-        const logins = this.getLogins().filter(login => login.profile?.id !== newLogin.profile?.id);
-        logins.push(newLogin);
-        this.storage.setObject('logins', logins);
-    }
-    getProfile() {
-        return this.getActiveLogin()?.profile;
-    }
-    /**
-     * Makes an HTTP request.
-     * @param {string} method
-     * @param {string} url
-     * @param {string=} contentType
-     * @param {Object=} body
-     * @param {boolean=} blob
-     */
-    async request(method, url, contentType, body, blob) {
-        if (!url.startsWith('http')) {
-            url = this.baseUrl + url;
-        }
-        const headers = {
-            'Content-Type': contentType || FHIR_CONTENT_TYPE
-        };
-        const accessToken = this.getActiveLogin()?.accessToken;
-        if (accessToken) {
-            headers['Authorization'] = 'Bearer ' + accessToken;
-        }
-        const options = {
-            method: method,
-            cache: 'no-cache',
-            credentials: 'include',
-            headers
-        };
-        if (body) {
-            if (typeof body === 'string' || (typeof File !== 'undefined' && body instanceof File)) {
-                options.body = body;
-            }
-            else {
-                options.body = (0, utils_1.stringify)(body);
-            }
-        }
-        const response = await this.fetch(url, options);
-        if (response.status === 401) {
-            // Refresh and try again
-            return this.handleUnauthenticated(method, url, contentType, body, blob);
-        }
-        if (response.status === 304) {
-            // No change
-            return undefined;
-        }
-        const obj = blob ? await response.blob() : await response.json();
-        if (obj.resourceType === 'OperationOutcome' && !(0, outcomes_1.isOk)(obj)) {
-            return Promise.reject(new outcomes_1.OperationOutcomeError(obj));
-        }
-        return obj;
-    }
-    /**
-     * Handles an unauthenticated response from the server.
-     * First, tries to refresh the access token and retry the request.
-     * Otherwise, calls unauthenticated callbacks and rejects.
-     * @param method The HTTP method of the original request.
-     * @param url The URL of the original request.
-     * @param contentType The content type of the original request.
-     * @param body The body of the original request.
-     * @param blob Optional blob flag of the original request.
-     */
-    async handleUnauthenticated(method, url, contentType, body, blob) {
-        return this.refresh()
-            .then(() => this.request(method, url, contentType, body, blob))
-            .catch(error => {
-            this.clear();
-            if (this.onUnauthenticated) {
-                this.onUnauthenticated();
-            }
-            return Promise.reject(error);
-        });
-    }
-    /**
-     * Redirects the user to the login screen for authorization.
-     * Clears all auth state including local storage and session storage.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
-     */
-    async requestAuthorization() {
-        if (!this.authorizeUrl) {
-            throw new Error('Missing authorize URL');
-        }
-        this.clear();
-        const pkceState = (0, crypto_1.getRandomString)();
-        this.storage.setString('pkceState', pkceState);
-        const codeVerifier = (0, crypto_1.getRandomString)();
-        this.storage.setString('codeVerifier', codeVerifier);
-        const arrayHash = await (0, crypto_1.encryptSHA256)(codeVerifier);
-        const codeChallenge = (0, utils_1.arrayBufferToBase64)(arrayHash);
-        this.storage.setString('codeChallenge', codeChallenge);
-        const scope = 'launch/patient openid fhirUser offline_access user/*.*';
-        window.location.assign(this.authorizeUrl +
-            '?response_type=code' +
-            '&state=' + encodeURIComponent(pkceState) +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +
-            '&scope=' + encodeURIComponent(scope) +
-            '&code_challenge_method=S256' +
-            '&code_challenge=' + encodeURIComponent(codeChallenge));
-    }
-    /**
-     * Processes an OAuth authorization code.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
-     * @param code The authorization code received by URL parameter.
-     */
-    processCode(code) {
-        const pkceState = this.storage.getString('pkceState');
-        if (!pkceState) {
-            this.clear();
-            throw new Error('Invalid PCKE state');
-        }
-        const codeVerifier = this.storage.getString('codeVerifier');
-        if (!codeVerifier) {
-            this.clear();
-            throw new Error('Invalid PCKE code verifier');
-        }
-        return this.fetchTokens('grant_type=authorization_code' +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&code_verifier=' + encodeURIComponent(codeVerifier) +
-            '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +
-            '&code=' + encodeURIComponent(code));
-    }
-    /**
-     * Tries to refresh the auth tokens.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens
-     */
-    async refresh() {
-        const refreshToken = this.getActiveLogin()?.refreshToken;
-        if (!refreshToken) {
-            this.clear();
-            return Promise.reject('Invalid refresh token');
-        }
-        await this.fetchTokens('grant_type=refresh_token' +
-            '&client_id=' + encodeURIComponent(this.clientId) +
-            '&refresh_token=' + encodeURIComponent(refreshToken));
-    }
-    /**
-     * Makes a POST request to the tokens endpoint.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
-     * @param formBody Token parameters in URL encoded format.
-     */
-    async fetchTokens(formBody) {
-        if (!this.tokenUrl) {
-            throw new Error('Missing token URL');
-        }
-        return this.fetch(this.tokenUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: formBody
-        })
-            .then(response => {
-            if (!response.ok) {
-                return Promise.reject('Failed to fetch tokens');
-            }
-            return response.json();
-        })
-            .then(tokens => this.verifyTokens(tokens))
-            .then(() => this.getActiveLogin()?.profile);
-    }
-    /**
-     * Verifies the tokens received from the auth server.
-     * Validates the JWT against the JWKS.
-     * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint
-     * @param tokens
-     */
-    async verifyTokens(tokens) {
-        const token = tokens.access_token;
-        // Verify token has not expired
-        const tokenPayload = (0, jwt_1.parseJWTPayload)(token);
-        if (Date.now() >= tokenPayload.exp * 1000) {
-            this.clear();
-            return Promise.reject('Token expired');
-        }
-        // Verify app_client_id
-        if (tokenPayload.client_id !== this.clientId) {
-            this.clear();
-            return Promise.reject('Token was not issued for this audience');
-        }
-        this.setActiveLogin({
-            ...this.getActiveLogin(),
-            accessToken: token,
-            refreshToken: tokens.refresh_token
-        });
-    }
-}
-exports.MedplumClient = MedplumClient;
-/**
- * Returns the base URL for the current page.
- */
-function getBaseUrl() {
-    return window.location.protocol + '//' + window.location.host + '/';
-}
-//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";AAAA,qBAAqB;AACrB,yIAAyI;;;AAEzI,mCAAmC;AACnC,qCAA0D;AAC1D,+CAA4C;AAE5C,+BAAwC;AACxC,yCAAyD;AACzD,qCAAsE;AACtE,uCAA0C;AAC1C,mCAA+E;AAC/E,mCAA0E;AAE1E,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,2BAA2B,GAAG,IAAI,CAAC;AACzC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAmGzD,MAAa,aAAc,SAAQ,yBAAW;IAC3B,KAAK,CAAY;IACjB,OAAO,CAAgB;IACvB,MAAM,CAA0C;IAChD,aAAa,CAAyC;IACtD,YAAY,CAAqC;IACjD,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,iBAAiB,CAAc;IACxC,WAAW,CAAiB;IAEpC,YAAY,OAA6B;QACvC,KAAK,EAAE,CAAC;QAER,IAAI,OAAO,CAAC,OAAO,EAAE;YACnB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;aAC3D;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;gBAClC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC5D;SACF;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;SAC9C;QAED,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAa,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,gBAAQ,CAAC,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC,CAAC;QAC5F,IAAI,CAAC,YAAY,GAAG,IAAI,gBAAQ,CAAC,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;QACrE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,IAAc;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,GAAW,EAAE,IAAS,EAAE,WAAoB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,IAAS,EAAE,WAAoB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,OAAwB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC;aACvC,IAAI,CAAC,CAAC,QAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CACJ,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,KAAa,EACb,QAAkB;QAElB,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;YACL,QAAQ;YACR,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC,IAAI,CAAC,CAAC,QAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,cAAwC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC;aAC5C,IAAI,CAAC,CAAC,aAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CAAC,QAAuB;QACjD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE;YACT,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,OAAO,SAAS,CAAC;SAClB;aAAM;YACL,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;SAC/B;IACH,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,GAAG,IAAc;QACvB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,CAAqB,MAA8B;QACvD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE;YAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;SACtC;aAAM;YACL,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAA,0BAAiB,EAAC,MAAM,CAAC,CAAC,CAAC;SAChF;IACH,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,MAAc,EAAE,MAAc;QAC3C,OAAO,IAAI,CAAC,GAAG,CACb,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;YACnC,QAAQ,kBAAkB,CAAC,MAAM,CAAC,EAAE;YACpC,WAAW,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAqB,YAAoB,EAAE,EAAU;QACvD,MAAM,QAAQ,GAAG,YAAY,GAAG,GAAG,GAAG,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,QAAW,EAAE,EAAE;YACpB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,UAAU,CAAqB,YAAoB,EAAE,EAAU;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,GAAG,GAAG,GAAG,EAAE,CAA+B,CAAC;QAC7F,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,aAAa,CAAqB,SAAuB;QACvD,MAAM,SAAS,GAAG,SAAS,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;SAC5C;QACD,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,mBAAmB,CAAqB,SAAuB;QAC7D,MAAM,SAAS,GAAG,SAAS,EAAE,SAAS,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;SAC5C;QACD,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,iBAAiB,CAAC,YAAoB;QACpC,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;SAC/C;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAChC;QACD,IAAI,OAAmC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAsB,iCAAiC,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;aAC1G,IAAI,CAAC,CAAC,MAAmC,EAAE,EAAE;YAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;gBACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;aAClD;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC1C,IAAI,CAAC,QAAQ,EAAE;gBACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;aAClD;YACD,OAAO,GAAG,IAAA,gCAAwB,EAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAkB;YACvC,YAAY,EAAE,iBAAiB;YAC/B,KAAK,EAAE,GAAG;YACV,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,iBAAQ,CAAC,MAAM;oBACzB,KAAK,EAAE,YAAY;iBACpB,CAAC;SACH,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,MAA+B,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;YAC7B,IAAI,OAAO,EAAE;gBACX,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,YAAY,GAAG,OAAO;qBAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAA2B,CAAC;qBACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,IAAc,CAAC,IAAI,CAAC,CAAC,CAAC;aACjE;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,WAAW,CAAqB,YAAoB,EAAE,EAAU;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,qBAAqB,CAAC,EAAU;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,mBAAmB,CAAC,GAAW;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;aAC/B,IAAI,CAAC,SAAS,CAAC,EAAE;YAChB,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrC,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,yBAAyB,CAAC,GAAW;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CAAqB,QAAW;QACpC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;SACzC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,YAAY,CAAC,IAAS,EAAE,WAAmB;QACzC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAqB,QAAW;QACpC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;YAC1B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;SACzC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;SAC/B;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAoB,EAAE,EAAU,EAAE,UAAe;QACrD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,CAAC,GAAQ;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,OAA8B;QACxD,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,YAAY,EAAE,cAAc;YAC5B,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE;gBACP,IAAI,EAAE,KAAK;aACZ;SACF,CAAC,CAAC,IAAI,CAAC,CAAC,GAAiB,EAAE,EAAE;YAC5B,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,GAAG,mBAAmB,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAY,CAAC,EAAE;gBAC7G,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,WAAW,CAAC,SAAS,GAAG,CAAC,CAAe,EAAE,EAAE;gBAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAa,CAAC,CAAC;YAC1C,CAAC,CAAC;YAEF,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc;QACZ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YACrB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAgB,aAAa,CAAC,CAAC;SACzE;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,cAAc,CAAC,KAAoB;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAkB,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC;IAED,QAAQ,CAAC,QAAuB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5F,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,GAAW,EACX,WAAoB,EACpB,IAAU,EACV,IAAc;QAEd,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;YAC3B,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;SAC1B;QAED,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,WAAW,IAAI,iBAAiB;SACjD,CAAC;QAEF,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,CAAC;QACvD,IAAI,WAAW,EAAE;YACf,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC;SACpD;QAED,MAAM,OAAO,GAAgB;YAC3B,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,SAAS;YACtB,OAAO;SACR,CAAC;QAEF,IAAI,IAAI,EAAE;YACR,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,EAAE;gBACrF,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;aACrB;iBAAM;gBACL,OAAO,CAAC,IAAI,GAAG,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAC;aAChC;SACF;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;YAC3B,wBAAwB;YACxB,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;SACzE;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE;YAC3B,YAAY;YACZ,OAAO,SAAS,CAAC;SAClB;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,GAAG,CAAC,YAAY,KAAK,kBAAkB,IAAI,CAAC,IAAA,eAAI,EAAC,GAAG,CAAC,EAAE;YACzD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,gCAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;SACvD;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,qBAAqB,CACjC,MAAc,EACd,GAAW,EACX,WAAoB,EACpB,IAAU,EACV,IAAc;QACd,OAAO,IAAI,CAAC,OAAO,EAAE;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;aAC9D,KAAK,CAAC,KAAK,CAAC,EAAE;YACb,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,iBAAiB,EAAE;gBAC1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;aAC1B;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;SAC1C;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,SAAS,GAAG,IAAA,wBAAe,GAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAE/C,MAAM,YAAY,GAAG,IAAA,wBAAe,GAAE,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAErD,MAAM,SAAS,GAAG,MAAM,IAAA,sBAAa,EAAC,YAAY,CAAC,CAAC;QACpD,MAAM,aAAa,GAAG,IAAA,2BAAmB,EAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,wDAAwD,CAAC;QAEvE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;YACtC,qBAAqB;YACrB,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;YACzC,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC;YACnD,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC;YACrC,6BAA6B;YAC7B,kBAAkB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,IAAY;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE;YACd,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;SACvC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,EAAE;YACjB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;SAC/C;QAED,OAAO,IAAI,CAAC,WAAW,CACrB,+BAA+B;YAC/B,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,iBAAiB,GAAG,kBAAkB,CAAC,YAAY,CAAC;YACpD,gBAAgB,GAAG,kBAAkB,CAAC,UAAU,EAAE,CAAC;YACnD,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,OAAO;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,EAAE,YAAY,CAAC;QACzD,IAAI,CAAC,YAAY,EAAE;YACjB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;SAChD;QAED,MAAM,IAAI,CAAC,WAAW,CACpB,0BAA0B;YAC1B,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACjD,iBAAiB,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,QAAgB;QACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;SACtC;QAED,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,QAAQ,EACb;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,QAAQ;SACf,CAAC;aACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YACf,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAChB,OAAO,OAAO,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;aACjD;YACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;aACzC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAA0B,CAAC,CAAC;IACnE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAC,MAAqB;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;QAElC,+BAA+B;QAC/B,MAAM,YAAY,GAAG,IAAA,qBAAe,EAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC,GAAG,GAAG,IAAI,EAAE;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;SACxC;QAED,uBAAuB;QACvB,IAAI,YAAY,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE;YAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;SACjE;QAED,IAAI,CAAC,cAAc,CAAC;YAClB,GAAI,IAAI,CAAC,cAAc,EAAoB;YAC3C,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,MAAM,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;CACF;AA7kBD,sCA6kBC;AAED;;GAEG;AACH,SAAS,UAAU;IACjB,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC;AACtE,CAAC","sourcesContent":["// PKCE auth ased on:\n// https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/\n\nimport { LRUCache } from './cache';\nimport { encryptSHA256, getRandomString } from './crypto';\nimport { EventTarget } from './eventtarget';\nimport { Binary, Bundle, Project, Reference, Resource, SearchParameter, StructureDefinition, Subscription, ValueSet } from './fhir';\nimport { parseJWTPayload } from './jwt';\nimport { isOk, OperationOutcomeError } from './outcomes';\nimport { formatSearchQuery, Operator, SearchRequest } from './search';\nimport { ClientStorage } from './storage';\nimport { IndexedStructureDefinition, indexStructureDefinition } from './types';\nimport { arrayBufferToBase64, ProfileResource, stringify } from './utils';\n\nconst DEFAULT_BASE_URL = 'https://api.medplum.com/';\nconst DEFAULT_RESOURCE_CACHE_SIZE = 1000;\nconst DEFAULT_BLOB_CACHE_SIZE = 100;\nconst JSON_CONTENT_TYPE = 'application/json';\nconst FHIR_CONTENT_TYPE = 'application/fhir+json';\nconst PATCH_CONTENT_TYPE = 'application/json-patch+json';\n\nexport interface MedplumClientOptions {\n  /**\n   * The client ID.\n   * Required.\n   */\n  clientId: string;\n\n  /**\n   * Base server URL.\n   * Optional.  Default value is \"https://api.medplum.com/\".\n   * Use this to point to a custom Medplum deployment.\n   */\n  baseUrl?: string;\n\n  /**\n   * OAuth2 authorize URL.\n   * Optional.  Default value is baseUrl + \"/oauth2/authorize\".\n   * Use this if you want to use a separate OAuth server.\n   */\n  authorizeUrl?: string;\n\n  /**\n   * OAuth2 token URL.\n   * Optional.  Default value is baseUrl + \"/oauth2/token\".\n   * Use this if you want to use a separate OAuth server.\n   */\n  tokenUrl?: string;\n\n  /**\n   * OAuth2 logout URL.\n   * Optional.  Default value is baseUrl + \"/oauth2/logout\".\n   * Use this if you want to use a separate OAuth server.\n   */\n  logoutUrl?: string;\n\n  /**\n   * Number of resources to store in the cache.\n   * Optional.  Default value is 1000.\n   * Consider using this for performance of displaying Patient or Practitioner resources.\n   */\n  resourceCacheSize?: number;\n\n  /**\n   * Number of blob URLs to store in the cache.\n   * Optional.  Default value is 100.\n   * Consider using this for performance of displaying Patient or Practitioner resources.\n   */\n  blobCacheSize?: number;\n\n  /**\n   * Optional fetch implementation.\n   * Optional.  Default is window.fetch.\n   * For nodejs applications, consider the 'node-fetch' package.\n   */\n  fetch?: FetchLike;\n\n  /**\n   * Optional callback for when the client is unauthenticated.\n   * Default is do nothing.\n   * For client side applications, consider redirecting to a sign in page.\n   */\n  onUnauthenticated?: () => void;\n}\n\nexport interface FetchLike {\n  (url: string, options?: any): Promise<any>;\n}\n\ninterface LoginResponse {\n  project: Project;\n  profile: ProfileResource;\n  accessToken: string;\n  refreshToken: string;\n}\n\ninterface TokenResponse {\n  token_type: string;\n  id_token: string;\n  access_token: string;\n  refresh_token: string;\n  expires_in: number;\n}\n\nexport interface RegisterRequest {\n  firstName: string;\n  lastName: string;\n  projectName: string;\n  email: string;\n  password: string;\n  remember?: boolean;\n}\n\nexport interface GoogleCredentialResponse {\n  readonly clientId: string;\n  readonly credential: string;\n}\n\nexport class MedplumClient extends EventTarget {\n  private readonly fetch: FetchLike;\n  private readonly storage: ClientStorage;\n  private readonly schema: Map<string, IndexedStructureDefinition>;\n  private readonly resourceCache: LRUCache<Resource | Promise<Resource>>;\n  private readonly blobUrlCache: LRUCache<string | Promise<string>>;\n  private readonly baseUrl: string;\n  private readonly clientId: string;\n  private readonly authorizeUrl: string;\n  private readonly tokenUrl: string;\n  private readonly logoutUrl: string;\n  private readonly onUnauthenticated?: () => void;\n  private activeLogin?: LoginResponse;\n\n  constructor(options: MedplumClientOptions) {\n    super();\n\n    if (options.baseUrl) {\n      if (!options.baseUrl.startsWith('http')) {\n        throw new Error('Base URL must start with http or https');\n      }\n      if (!options.baseUrl.endsWith('/')) {\n        throw new Error('Base URL must end with a trailing slash');\n      }\n    }\n\n    if (!options.clientId) {\n      throw new Error('Client ID cannot be empty');\n    }\n\n    this.fetch = options.fetch || window.fetch.bind(window);\n    this.storage = new ClientStorage();\n    this.schema = new Map();\n    this.resourceCache = new LRUCache(options.resourceCacheSize ?? DEFAULT_RESOURCE_CACHE_SIZE);\n    this.blobUrlCache = new LRUCache(options.blobCacheSize ?? DEFAULT_BLOB_CACHE_SIZE);\n    this.baseUrl = options.baseUrl || DEFAULT_BASE_URL;\n    this.clientId = options.clientId;\n    this.authorizeUrl = options.authorizeUrl || this.baseUrl + 'oauth2/authorize';\n    this.tokenUrl = options.tokenUrl || this.baseUrl + 'oauth2/token';\n    this.logoutUrl = options.logoutUrl || this.baseUrl + 'oauth2/logout';\n    this.onUnauthenticated = options.onUnauthenticated;\n  }\n\n  /**\n   * Clears all auth state including local storage and session storage.\n   */\n  clear(): void {\n    this.storage.clear();\n    this.activeLogin = undefined;\n    this.dispatchEvent({ type: 'change' });\n  }\n\n  get(url: string, blob?: boolean): Promise<any> {\n    return this.request('GET', url, undefined, undefined, blob);\n  }\n\n  post(url: string, body: any, contentType?: string): Promise<any> {\n    return this.request('POST', url, contentType, body);\n  }\n\n  put(url: string, body: any, contentType?: string): Promise<any> {\n    return this.request('PUT', url, contentType, body);\n  }\n\n  /**\n   * Tries to register a new user.\n   * @param request The registration request.\n   * @returns Promise to the user profile resource.\n   */\n  register(request: RegisterRequest): Promise<ProfileResource> {\n    return this.post('auth/register', request)\n      .then((response: LoginResponse) => this.handleLoginResponse(response));\n  }\n\n  /**\n   * Tries to sign in with email and password.\n   * @param email The user email address.\n   * @param password The user password.\n   * @param role The login role.\n   * @param scope The OAuth2 login scope.\n   * @param remember Optional flag to \"remember\" to generate a refresh token and persist in local storage.\n   * @returns Promise to the user profile resource.\n   */\n  signIn(\n    email: string,\n    password: string,\n    role: string,\n    scope: string,\n    remember?: boolean): Promise<ProfileResource> {\n\n    return this.post('auth/login', {\n      clientId: this.clientId,\n      email,\n      password,\n      role,\n      scope,\n      remember: !!remember\n    }).then((response: LoginResponse) => this.handleLoginResponse(response));\n  }\n\n  /**\n   * Tries to sign in with Google authentication.\n   * The response parameter is the result of a Google authentication.\n   * See: https://developers.google.com/identity/gsi/web/guides/handle-credential-responses-js-functions\n   * @param googleResponse The Google credential response.\n   * @returns Promise to the user profile resource.\n   */\n  signInWithGoogle(googleResponse: GoogleCredentialResponse): Promise<ProfileResource> {\n    return this.post('auth/google', googleResponse)\n      .then((loginResponse: LoginResponse) => this.handleLoginResponse(loginResponse));\n  }\n\n  /**\n   * Handles a login response.\n   * This can be used for both \"register\" and \"signIn\".\n   * @param response The login response.\n   * @returns The user profile.\n   */\n  private handleLoginResponse(response: LoginResponse): ProfileResource {\n    this.setActiveLogin(response);\n    return response.profile;\n  }\n\n  /**\n   * Signs out locally.\n   * Does not invalidate tokens with the server.\n   */\n  signOut(): Promise<void> {\n    this.clear();\n    return Promise.resolve();\n  }\n\n  /**\n   * Tries to sign in the user.\n   * Returns true if the user is signed in.\n   * This may result in navigating away to the sign in page.\n   */\n  signInWithRedirect(): Promise<ProfileResource | void> | undefined {\n    const urlParams = new URLSearchParams(window.location.search);\n    const code = urlParams.get('code');\n    if (!code) {\n      this.requestAuthorization();\n      return undefined;\n    } else {\n      return this.processCode(code);\n    }\n  }\n\n  /**\n   * Tries to sign out the user.\n   * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html\n   */\n  signOutWithRedirect(): void {\n    window.location.assign(this.logoutUrl);\n  }\n\n  fhirUrl(...path: string[]): string {\n    const builder = [this.baseUrl, 'fhir/R4'];\n    path.forEach(p => builder.push('/', encodeURIComponent(p)))\n    return builder.join('');\n  }\n\n  search<T extends Resource>(search: string | SearchRequest): Promise<Bundle<T>> {\n    if (typeof search === 'string') {\n      return this.get('fhir/R4/' + search);\n    } else {\n      return this.get(this.fhirUrl(search.resourceType) + formatSearchQuery(search));\n    }\n  }\n\n  /**\n   * Searches a ValueSet resource using the \"expand\" operation.\n   * See: https://www.hl7.org/fhir/operation-valueset-expand.html\n   * @param system The ValueSet system url.\n   * @param filter The search string.\n   * @returns Promise to expanded ValueSet.\n   */\n  searchValueSet(system: string, filter: string): Promise<ValueSet> {\n    return this.get(\n      this.fhirUrl('ValueSet', '$expand') +\n      `?url=${encodeURIComponent(system)}` +\n      `&filter=${encodeURIComponent(filter)}`);\n  }\n\n  read<T extends Resource>(resourceType: string, id: string): Promise<T> {\n    const cacheKey = resourceType + '/' + id;\n    const promise = this.get(this.fhirUrl(resourceType, id))\n      .then((resource: T) => {\n        this.resourceCache.set(cacheKey, resource);\n        return resource;\n      });\n    this.resourceCache.set(cacheKey, promise);\n    return promise;\n  }\n\n  readCached<T extends Resource>(resourceType: string, id: string): Promise<T> {\n    const cached = this.resourceCache.get(resourceType + '/' + id) as T | Promise<T> | undefined;\n    return cached ? Promise.resolve(cached) : this.read(resourceType, id);\n  }\n\n  readReference<T extends Resource>(reference: Reference<T>): Promise<T> {\n    const refString = reference?.reference;\n    if (!refString) {\n      return Promise.reject('Missing reference');\n    }\n    const [resourceType, id] = refString.split('/');\n    return this.read(resourceType, id);\n  }\n\n  readCachedReference<T extends Resource>(reference: Reference<T>): Promise<T> {\n    const refString = reference?.reference;\n    if (!refString) {\n      return Promise.reject('Missing reference');\n    }\n    const [resourceType, id] = refString.split('/');\n    return this.readCached(resourceType, id);\n  }\n\n  getTypeDefinition(resourceType: string): Promise<IndexedStructureDefinition> {\n    if (!resourceType) {\n      return Promise.reject('Missing resourceType');\n    }\n    const cached = this.schema.get(resourceType);\n    if (cached) {\n      return Promise.resolve(cached);\n    }\n    let typeDef: IndexedStructureDefinition;\n    return this.search<StructureDefinition>('StructureDefinition?name:exact=' + encodeURIComponent(resourceType))\n      .then((result: Bundle<StructureDefinition>) => {\n        if (!result.entry?.length) {\n          throw new Error('StructureDefinition not found');\n        }\n        const resource = result.entry[0].resource;\n        if (!resource) {\n          throw new Error('StructureDefinition not found');\n        }\n        typeDef = indexStructureDefinition(resource);\n      })\n      .then(() => this.search<SearchParameter>({\n        resourceType: 'SearchParameter',\n        count: 100,\n        filters: [{\n          code: 'base',\n          operator: Operator.EQUALS,\n          value: resourceType\n        }]\n      }))\n      .then((result: Bundle<SearchParameter>) => {\n        const entries = result.entry;\n        if (entries) {\n          typeDef.types[resourceType].searchParams = entries\n            .map(e => e.resource as SearchParameter)\n            .sort((a, b) => a.name?.localeCompare(b.name as string) ?? 0);\n        }\n        this.schema.set(resourceType, typeDef);\n        return typeDef;\n      });\n  }\n\n  readHistory<T extends Resource>(resourceType: string, id: string): Promise<Bundle<T>> {\n    return this.get(this.fhirUrl(resourceType, id, '_history'));\n  }\n\n  readPatientEverything(id: string): Promise<Bundle> {\n    return this.get(this.fhirUrl('Patient', id, '$everything'));\n  }\n\n  readBlob(url: string): Promise<Blob> {\n    return this.get(url, true);\n  }\n\n  readBlobAsObjectUrl(url: string): Promise<string> {\n    const promise = this.readBlob(url)\n      .then(imageBlob => {\n        const imageUrl = URL.createObjectURL(imageBlob);\n        this.blobUrlCache.set(url, imageUrl);\n        return imageUrl;\n      });\n    this.blobUrlCache.set(url, promise);\n    return promise;\n  }\n\n  readCachedBlobAsObjectUrl(url: string): Promise<string> {\n    const cached = this.blobUrlCache.get(url);\n    return cached ? Promise.resolve(cached) : this.readBlobAsObjectUrl(url);\n  }\n\n  readBinary(id: string): Promise<Blob> {\n    return this.readBlob(this.fhirUrl('Binary', id));\n  }\n\n  create<T extends Resource>(resource: T): Promise<T> {\n    if (!resource.resourceType) {\n      throw new Error('Missing resourceType');\n    }\n    return this.post(this.fhirUrl(resource.resourceType), resource);\n  }\n\n  createBinary(data: any, contentType: string): Promise<Binary> {\n    return this.post(this.fhirUrl('Binary'), data, contentType);\n  }\n\n  update<T extends Resource>(resource: T): Promise<T> {\n    if (!resource.resourceType) {\n      throw new Error('Missing resourceType');\n    }\n    if (!resource.id) {\n      throw new Error('Missing id');\n    }\n    return this.put(this.fhirUrl(resource.resourceType, resource.id), resource);\n  }\n\n  patch(resourceType: string, id: string, operations: any): Promise<any> {\n    return this.request('PATCH', this.fhirUrl(resourceType, id), PATCH_CONTENT_TYPE, operations);\n  }\n\n  graphql(gql: any): Promise<any> {\n    return this.post(this.fhirUrl('$graphql'), gql, JSON_CONTENT_TYPE);\n  }\n\n  subscribe(criteria: string, handler: (e: Resource) => void): Promise<EventSource> {\n    return this.create({\n      resourceType: 'Subscription',\n      status: 'active',\n      criteria: criteria,\n      channel: {\n        type: 'sse'\n      }\n    }).then((sub: Subscription) => {\n      const eventSource = new EventSource(this.baseUrl + 'sse?subscription=' + encodeURIComponent(sub.id as string), {\n        withCredentials: true\n      });\n\n      eventSource.onmessage = (e: MessageEvent) => {\n        handler(JSON.parse(e.data) as Resource);\n      };\n\n      return eventSource;\n    });\n  }\n\n  getActiveLogin(): LoginResponse | undefined {\n    if (!this.activeLogin) {\n      this.activeLogin = this.storage.getObject<LoginResponse>('activeLogin');\n    }\n    return this.activeLogin;\n  }\n\n  setActiveLogin(login: LoginResponse): void {\n    this.activeLogin = login;\n    this.storage.setObject('activeLogin', login);\n    this.addLogin(login);\n    this.dispatchEvent({ type: 'change' });\n  }\n\n  getLogins(): LoginResponse[] {\n    return this.storage.getObject<LoginResponse[]>('logins') ?? [];\n  }\n\n  addLogin(newLogin: LoginResponse): void {\n    const logins = this.getLogins().filter(login => login.profile?.id !== newLogin.profile?.id);\n    logins.push(newLogin);\n    this.storage.setObject('logins', logins);\n  }\n\n  getProfile(): ProfileResource | undefined {\n    return this.getActiveLogin()?.profile;\n  }\n\n  /**\n   * Makes an HTTP request.\n   * @param {string} method\n   * @param {string} url\n   * @param {string=} contentType\n   * @param {Object=} body\n   * @param {boolean=} blob\n   */\n  private async request(\n    method: string,\n    url: string,\n    contentType?: string,\n    body?: any,\n    blob?: boolean): Promise<any> {\n\n    if (!url.startsWith('http')) {\n      url = this.baseUrl + url;\n    }\n\n    const headers: Record<string, string> = {\n      'Content-Type': contentType || FHIR_CONTENT_TYPE\n    };\n\n    const accessToken = this.getActiveLogin()?.accessToken;\n    if (accessToken) {\n      headers['Authorization'] = 'Bearer ' + accessToken;\n    }\n\n    const options: RequestInit = {\n      method: method,\n      cache: 'no-cache',\n      credentials: 'include',\n      headers\n    };\n\n    if (body) {\n      if (typeof body === 'string' || (typeof File !== 'undefined' && body instanceof File)) {\n        options.body = body;\n      } else {\n        options.body = stringify(body);\n      }\n    }\n\n    const response = await this.fetch(url, options);\n    if (response.status === 401) {\n      // Refresh and try again\n      return this.handleUnauthenticated(method, url, contentType, body, blob);\n    }\n\n    if (response.status === 304) {\n      // No change\n      return undefined;\n    }\n\n    const obj = blob ? await response.blob() : await response.json();\n    if (obj.resourceType === 'OperationOutcome' && !isOk(obj)) {\n      return Promise.reject(new OperationOutcomeError(obj));\n    }\n    return obj;\n  }\n\n  /**\n   * Handles an unauthenticated response from the server.\n   * First, tries to refresh the access token and retry the request.\n   * Otherwise, calls unauthenticated callbacks and rejects.\n   * @param method The HTTP method of the original request.\n   * @param url The URL of the original request.\n   * @param contentType The content type of the original request.\n   * @param body The body of the original request.\n   * @param blob Optional blob flag of the original request.\n   */\n  private async handleUnauthenticated(\n    method: string,\n    url: string,\n    contentType?: string,\n    body?: any,\n    blob?: boolean): Promise<any> {\n    return this.refresh()\n      .then(() => this.request(method, url, contentType, body, blob))\n      .catch(error => {\n        this.clear();\n        if (this.onUnauthenticated) {\n          this.onUnauthenticated();\n        }\n        return Promise.reject(error);\n      });\n  }\n\n  /**\n   * Redirects the user to the login screen for authorization.\n   * Clears all auth state including local storage and session storage.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint\n   */\n  private async requestAuthorization() {\n    if (!this.authorizeUrl) {\n      throw new Error('Missing authorize URL');\n    }\n\n    this.clear();\n\n    const pkceState = getRandomString();\n    this.storage.setString('pkceState', pkceState);\n\n    const codeVerifier = getRandomString();\n    this.storage.setString('codeVerifier', codeVerifier);\n\n    const arrayHash = await encryptSHA256(codeVerifier);\n    const codeChallenge = arrayBufferToBase64(arrayHash);\n    this.storage.setString('codeChallenge', codeChallenge);\n\n    const scope = 'launch/patient openid fhirUser offline_access user/*.*';\n\n    window.location.assign(this.authorizeUrl +\n      '?response_type=code' +\n      '&state=' + encodeURIComponent(pkceState) +\n      '&client_id=' + encodeURIComponent(this.clientId) +\n      '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +\n      '&scope=' + encodeURIComponent(scope) +\n      '&code_challenge_method=S256' +\n      '&code_challenge=' + encodeURIComponent(codeChallenge));\n  }\n\n  /**\n   * Processes an OAuth authorization code.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest\n   * @param code The authorization code received by URL parameter.\n   */\n  private processCode(code: string): Promise<ProfileResource> {\n    const pkceState = this.storage.getString('pkceState');\n    if (!pkceState) {\n      this.clear();\n      throw new Error('Invalid PCKE state');\n    }\n\n    const codeVerifier = this.storage.getString('codeVerifier');\n    if (!codeVerifier) {\n      this.clear();\n      throw new Error('Invalid PCKE code verifier');\n    }\n\n    return this.fetchTokens(\n      'grant_type=authorization_code' +\n      '&client_id=' + encodeURIComponent(this.clientId) +\n      '&code_verifier=' + encodeURIComponent(codeVerifier) +\n      '&redirect_uri=' + encodeURIComponent(getBaseUrl()) +\n      '&code=' + encodeURIComponent(code));\n  }\n\n  /**\n   * Tries to refresh the auth tokens.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokens\n   */\n  private async refresh(): Promise<void> {\n    const refreshToken = this.getActiveLogin()?.refreshToken;\n    if (!refreshToken) {\n      this.clear();\n      return Promise.reject('Invalid refresh token');\n    }\n\n    await this.fetchTokens(\n      'grant_type=refresh_token' +\n      '&client_id=' + encodeURIComponent(this.clientId) +\n      '&refresh_token=' + encodeURIComponent(refreshToken));\n  }\n\n  /**\n   * Makes a POST request to the tokens endpoint.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint\n   * @param formBody Token parameters in URL encoded format.\n   */\n  private async fetchTokens(formBody: string): Promise<ProfileResource> {\n    if (!this.tokenUrl) {\n      throw new Error('Missing token URL');\n    }\n\n    return this.fetch(\n      this.tokenUrl,\n      {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body: formBody\n      })\n      .then(response => {\n        if (!response.ok) {\n          return Promise.reject('Failed to fetch tokens');\n        }\n        return response.json();\n      })\n      .then(tokens => this.verifyTokens(tokens))\n      .then(() => this.getActiveLogin()?.profile as ProfileResource);\n  }\n\n  /**\n   * Verifies the tokens received from the auth server.\n   * Validates the JWT against the JWKS.\n   * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint\n   * @param tokens\n   */\n  private async verifyTokens(tokens: TokenResponse): Promise<void> {\n    const token = tokens.access_token;\n\n    // Verify token has not expired\n    const tokenPayload = parseJWTPayload(token);\n    if (Date.now() >= tokenPayload.exp * 1000) {\n      this.clear();\n      return Promise.reject('Token expired');\n    }\n\n    // Verify app_client_id\n    if (tokenPayload.client_id !== this.clientId) {\n      this.clear();\n      return Promise.reject('Token was not issued for this audience');\n    }\n\n    this.setActiveLogin({\n      ...(this.getActiveLogin() as LoginResponse),\n      accessToken: token,\n      refreshToken: tokens.refresh_token\n    });\n  }\n}\n\n/**\n * Returns the base URL for the current page.\n */\nfunction getBaseUrl() {\n  return window.location.protocol + '//' + window.location.host + '/';\n}\n"]}

package/dist/client.test.d.ts

@@ -1 +0,0 @@
-export {};