@medplum/core 0.9.35 → 0.9.36

package/dist/cjs/types.d.ts

@@ -1,5 +1,9 @@
 import { Bundle, ElementDefinition, SearchParameter, StructureDefinition } from '@medplum/fhirtypes';
 import { SearchParameterDetails } from './searchparams';
+export interface TypedValue {
+    readonly type: string;
+    readonly value: any;
+}
 /**
  * List of property types.
  * http://www.hl7.org/fhir/valueset-defined-types.html

package/dist/esm/client.d.ts

@@ -461,6 +461,10 @@ export declare class MedplumClient extends EventTarget {
      * @returns Promise to the authentication response.
      */
     startGoogleLogin(loginRequest: GoogleLoginRequest): Promise<LoginAuthenticationResponse>;
+    getCodeChallenge(loginRequest: LoginRequest | GoogleLoginRequest): {
+        codeChallenge?: string;
+        codeChallengeMethod?: string;
+    };
     /**
      * Signs out locally.
      * Does not invalidate tokens with the server.
@@ -623,7 +627,7 @@ export declare class MedplumClient extends EventTarget {
      * @param id The resource ID.
      * @returns The resource if available; undefined otherwise.
      */
-    readResource<K extends ResourceType>(resourceType: K, id: string): ReadablePromise<ExtractResource<K>>;
+    readResource<K extends ResourceType>(resourceType: K, id: string, options?: RequestInit): ReadablePromise<ExtractResource<K>>;
     /**
      * Reads a resource by `Reference`.
      *
@@ -643,7 +647,7 @@ export declare class MedplumClient extends EventTarget {
      * @param reference The FHIR reference object.
      * @returns The resource if available; undefined otherwise.
      */
-    readReference<T extends Resource>(reference: Reference<T>): ReadablePromise<T>;
+    readReference<T extends Resource>(reference: Reference<T>, options?: RequestInit): ReadablePromise<T>;
     /**
      * Returns a cached schema for a resource type.
      * If the schema is not cached, returns undefined.
@@ -681,7 +685,7 @@ export declare class MedplumClient extends EventTarget {
      * @param id The resource ID.
      * @returns Promise to the resource history.
      */
-    readHistory<K extends ResourceType>(resourceType: K, id: string): ReadablePromise<Bundle<ExtractResource<K>>>;
+    readHistory<K extends ResourceType>(resourceType: K, id: string, options?: RequestInit): ReadablePromise<Bundle<ExtractResource<K>>>;
     /**
      * Reads a specific version of a resource by resource type, ID, and version ID.
      *
@@ -699,14 +703,14 @@ export declare class MedplumClient extends EventTarget {
      * @param id The resource ID.
      * @returns The resource if available; undefined otherwise.
      */
-    readVersion<K extends ResourceType>(resourceType: K, id: string, vid: string): ReadablePromise<ExtractResource<K>>;
+    readVersion<K extends ResourceType>(resourceType: K, id: string, vid: string, options?: RequestInit): ReadablePromise<ExtractResource<K>>;
     /**
      *
      * @category Read
      * @param id The Patient Id
      * @returns A Bundle of all Resources related to the Patient
      */
-    readPatientEverything(id: string): ReadablePromise<Bundle>;
+    readPatientEverything(id: string, options?: RequestInit): ReadablePromise<Bundle>;
     /**
      * Creates a new FHIR resource.
      *
@@ -1094,6 +1098,11 @@ export declare class MedplumClient extends EventTarget {
      * @returns Promise to the response body as a blob.
      */
     download(url: URL | string, options?: RequestInit): Promise<Blob>;
+    /**
+     * Starts a new PKCE flow.
+     * These PKCE values are stateful, and must survive redirects and page refreshes.
+     */
+    startPkce(): Promise<void>;
     /**
      * Processes an OAuth authorization code.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest

package/dist/esm/client.js

@@ -10,7 +10,7 @@ import { createReference, arrayBufferToBase64 } from './utils.js';
 
 // PKCE auth based on:
 // https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
-var _MedplumClient_instances, _MedplumClient_fetch, _MedplumClient_createPdf, _MedplumClient_storage, _MedplumClient_requestCache, _MedplumClient_cacheTime, _MedplumClient_baseUrl, _MedplumClient_clientId, _MedplumClient_authorizeUrl, _MedplumClient_tokenUrl, _MedplumClient_logoutUrl, _MedplumClient_onUnauthenticated, _MedplumClient_accessToken, _MedplumClient_refreshToken, _MedplumClient_refreshPromise, _MedplumClient_profilePromise, _MedplumClient_profile, _MedplumClient_config, _MedplumClient_addLogin, _MedplumClient_refreshProfile, _MedplumClient_getCacheEntry, _MedplumClient_setCacheEntry, _MedplumClient_request, _MedplumClient_addFetchOptionsDefaults, _MedplumClient_setRequestContentType, _MedplumClient_setRequestBody, _MedplumClient_handleUnauthenticated, _MedplumClient_startPkce, _MedplumClient_requestAuthorization, _MedplumClient_refresh, _MedplumClient_fetchTokens, _MedplumClient_verifyTokens, _MedplumClient_setupStorageListener;
+var _MedplumClient_instances, _MedplumClient_fetch, _MedplumClient_createPdf, _MedplumClient_storage, _MedplumClient_requestCache, _MedplumClient_cacheTime, _MedplumClient_baseUrl, _MedplumClient_clientId, _MedplumClient_authorizeUrl, _MedplumClient_tokenUrl, _MedplumClient_logoutUrl, _MedplumClient_onUnauthenticated, _MedplumClient_accessToken, _MedplumClient_refreshToken, _MedplumClient_refreshPromise, _MedplumClient_profilePromise, _MedplumClient_profile, _MedplumClient_config, _MedplumClient_addLogin, _MedplumClient_refreshProfile, _MedplumClient_getCacheEntry, _MedplumClient_setCacheEntry, _MedplumClient_request, _MedplumClient_addFetchOptionsDefaults, _MedplumClient_setRequestContentType, _MedplumClient_setRequestBody, _MedplumClient_handleUnauthenticated, _MedplumClient_requestAuthorization, _MedplumClient_refresh, _MedplumClient_fetchTokens, _MedplumClient_verifyTokens, _MedplumClient_setupStorageListener;
 const DEFAULT_BASE_URL = 'https://api.medplum.com/';
 const DEFAULT_SCOPE = 'launch/patient openid fhirUser offline_access user/*.*';
 const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
@@ -279,8 +279,8 @@ class MedplumClient extends EventTarget {
      */
     startNewUser(newUserRequest) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_startPkce).call(this);
-            return this.post('auth/newuser', Object.assign(Object.assign({}, newUserRequest), { codeChallengeMethod: 'S256', codeChallenge: __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('codeChallenge') }));
+            yield this.startPkce();
+            return this.post('auth/newuser', Object.assign(Object.assign({}, newUserRequest), { codeChallengeMethod: 'S256', codeChallenge: sessionStorage.getItem('codeChallenge') }));
         });
     }
     /**
@@ -318,10 +318,9 @@ class MedplumClient extends EventTarget {
     startLogin(loginRequest) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            if (!loginRequest.codeChallenge || !loginRequest.codeChallengeMethod) {
-                yield __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_startPkce).call(this);
-            }
-            return this.post('auth/login', Object.assign(Object.assign({}, loginRequest), { clientId: (_a = loginRequest.clientId) !== null && _a !== void 0 ? _a : __classPrivateFieldGet(this, _MedplumClient_clientId, "f"), scope: (_b = loginRequest.scope) !== null && _b !== void 0 ? _b : DEFAULT_SCOPE, codeChallengeMethod: loginRequest.codeChallengeMethod || 'S256', codeChallenge: loginRequest.codeChallenge || __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('codeChallenge') }));
+            const { codeChallenge, codeChallengeMethod } = this.getCodeChallenge(loginRequest);
+            return this.post('auth/login', Object.assign(Object.assign({}, loginRequest), { clientId: (_a = loginRequest.clientId) !== null && _a !== void 0 ? _a : __classPrivateFieldGet(this, _MedplumClient_clientId, "f"), scope: (_b = loginRequest.scope) !== null && _b !== void 0 ? _b : DEFAULT_SCOPE, codeChallengeMethod,
+                codeChallenge }));
         });
     }
     /**
@@ -335,12 +334,27 @@ class MedplumClient extends EventTarget {
     startGoogleLogin(loginRequest) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            if (!loginRequest.codeChallenge || !loginRequest.codeChallengeMethod) {
-                yield __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_startPkce).call(this);
-            }
-            return this.post('auth/google', Object.assign(Object.assign({}, loginRequest), { clientId: (_a = loginRequest.clientId) !== null && _a !== void 0 ? _a : __classPrivateFieldGet(this, _MedplumClient_clientId, "f"), scope: (_b = loginRequest.scope) !== null && _b !== void 0 ? _b : DEFAULT_SCOPE, codeChallengeMethod: loginRequest.codeChallengeMethod || 'S256', codeChallenge: loginRequest.codeChallenge || __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('codeChallenge') }));
+            const { codeChallenge, codeChallengeMethod } = this.getCodeChallenge(loginRequest);
+            return this.post('auth/google', Object.assign(Object.assign({}, loginRequest), { clientId: (_a = loginRequest.clientId) !== null && _a !== void 0 ? _a : __classPrivateFieldGet(this, _MedplumClient_clientId, "f"), scope: (_b = loginRequest.scope) !== null && _b !== void 0 ? _b : DEFAULT_SCOPE, codeChallengeMethod,
+                codeChallenge }));
         });
     }
+    getCodeChallenge(loginRequest) {
+        if (loginRequest.codeChallenge) {
+            return {
+                codeChallenge: loginRequest.codeChallenge,
+                codeChallengeMethod: loginRequest.codeChallengeMethod,
+            };
+        }
+        const codeChallenge = sessionStorage.getItem('codeChallenge');
+        if (codeChallenge) {
+            return {
+                codeChallenge,
+                codeChallengeMethod: 'S256',
+            };
+        }
+        return {};
+    }
     /**
      * Signs out locally.
      * Does not invalidate tokens with the server.
@@ -570,8 +584,8 @@ class MedplumClient extends EventTarget {
      * @param id The resource ID.
      * @returns The resource if available; undefined otherwise.
      */
-    readResource(resourceType, id) {
-        return this.get(this.fhirUrl(resourceType, id));
+    readResource(resourceType, id, options = {}) {
+        return this.get(this.fhirUrl(resourceType, id), options);
     }
     /**
      * Reads a resource by `Reference`.
@@ -592,7 +606,7 @@ class MedplumClient extends EventTarget {
      * @param reference The FHIR reference object.
      * @returns The resource if available; undefined otherwise.
      */
-    readReference(reference) {
+    readReference(reference, options = {}) {
         const refString = reference === null || reference === void 0 ? void 0 : reference.reference;
         if (!refString) {
             return new ReadablePromise(Promise.reject(new Error('Missing reference')));
@@ -601,7 +615,7 @@ class MedplumClient extends EventTarget {
         if (!resourceType || !id) {
             return new ReadablePromise(Promise.reject(new Error('Invalid reference')));
         }
-        return this.readResource(resourceType, id);
+        return this.readResource(resourceType, id, options);
     }
     /**
      * Returns a cached schema for a resource type.
@@ -685,8 +699,8 @@ class MedplumClient extends EventTarget {
      * @param id The resource ID.
      * @returns Promise to the resource history.
      */
-    readHistory(resourceType, id) {
-        return this.get(this.fhirUrl(resourceType, id, '_history'));
+    readHistory(resourceType, id, options = {}) {
+        return this.get(this.fhirUrl(resourceType, id, '_history'), options);
     }
     /**
      * Reads a specific version of a resource by resource type, ID, and version ID.
@@ -705,8 +719,8 @@ class MedplumClient extends EventTarget {
      * @param id The resource ID.
      * @returns The resource if available; undefined otherwise.
      */
-    readVersion(resourceType, id, vid) {
-        return this.get(this.fhirUrl(resourceType, id, '_history', vid));
+    readVersion(resourceType, id, vid, options = {}) {
+        return this.get(this.fhirUrl(resourceType, id, '_history', vid), options);
     }
     /**
      *
@@ -714,8 +728,8 @@ class MedplumClient extends EventTarget {
      * @param id The Patient Id
      * @returns A Bundle of all Resources related to the Patient
      */
-    readPatientEverything(id) {
-        return this.get(this.fhirUrl('Patient', id, '$everything'));
+    readPatientEverything(id, options = {}) {
+        return this.get(this.fhirUrl('Patient', id, '$everything'), options);
     }
     /**
      * Creates a new FHIR resource.
@@ -1225,28 +1239,36 @@ class MedplumClient extends EventTarget {
             return response.blob();
         });
     }
+    /**
+     * Starts a new PKCE flow.
+     * These PKCE values are stateful, and must survive redirects and page refreshes.
+     */
+    startPkce() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const pkceState = getRandomString();
+            sessionStorage.setItem('pkceState', pkceState);
+            const codeVerifier = getRandomString();
+            sessionStorage.setItem('codeVerifier', codeVerifier);
+            const arrayHash = yield encryptSHA256(codeVerifier);
+            const codeChallenge = arrayBufferToBase64(arrayHash).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+            sessionStorage.setItem('codeChallenge', codeChallenge);
+        });
+    }
     /**
      * Processes an OAuth authorization code.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest
      * @param code The authorization code received by URL parameter.
      */
     processCode(code) {
-        const pkceState = __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('pkceState');
-        if (!pkceState) {
-            this.clear();
-            throw new Error('Invalid PCKE state');
-        }
-        const codeVerifier = __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('codeVerifier');
-        if (!codeVerifier) {
-            this.clear();
-            throw new Error('Invalid PCKE code verifier');
-        }
         const formBody = new URLSearchParams();
         formBody.set('grant_type', 'authorization_code');
         formBody.set('client_id', __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
-        formBody.set('code_verifier', codeVerifier);
         formBody.set('code', code);
         formBody.set('redirect_uri', getBaseUrl());
+        const codeVerifier = sessionStorage.getItem('codeVerifier');
+        if (codeVerifier) {
+            formBody.set('code_verifier', codeVerifier);
+        }
         return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_fetchTokens).call(this, formBody);
     }
     /**
@@ -1370,27 +1392,17 @@ _MedplumClient_fetch = new WeakMap(), _MedplumClient_createPdf = new WeakMap(),
             return Promise.reject(error);
         });
     });
-}, _MedplumClient_startPkce = function _MedplumClient_startPkce() {
-    return __awaiter(this, void 0, void 0, function* () {
-        const pkceState = getRandomString();
-        __classPrivateFieldGet(this, _MedplumClient_storage, "f").setString('pkceState', pkceState);
-        const codeVerifier = getRandomString();
-        __classPrivateFieldGet(this, _MedplumClient_storage, "f").setString('codeVerifier', codeVerifier);
-        const arrayHash = yield encryptSHA256(codeVerifier);
-        const codeChallenge = arrayBufferToBase64(arrayHash).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-        __classPrivateFieldGet(this, _MedplumClient_storage, "f").setString('codeChallenge', codeChallenge);
-    });
 }, _MedplumClient_requestAuthorization = function _MedplumClient_requestAuthorization() {
     return __awaiter(this, void 0, void 0, function* () {
-        yield __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_startPkce).call(this);
+        yield this.startPkce();
         const url = new URL(__classPrivateFieldGet(this, _MedplumClient_authorizeUrl, "f"));
         url.searchParams.set('response_type', 'code');
-        url.searchParams.set('state', __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('pkceState'));
+        url.searchParams.set('state', sessionStorage.getItem('pkceState'));
         url.searchParams.set('client_id', __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
         url.searchParams.set('redirect_uri', getBaseUrl());
         url.searchParams.set('scope', DEFAULT_SCOPE);
         url.searchParams.set('code_challenge_method', 'S256');
-        url.searchParams.set('code_challenge', __classPrivateFieldGet(this, _MedplumClient_storage, "f").getString('codeChallenge'));
+        url.searchParams.set('code_challenge', sessionStorage.getItem('codeChallenge'));
         window.location.assign(url.toString());
     });
 }, _MedplumClient_refresh = function _MedplumClient_refresh() {
@@ -1415,6 +1427,7 @@ _MedplumClient_fetch = new WeakMap(), _MedplumClient_createPdf = new WeakMap(),
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: formBody,
+            credentials: 'include',
         })
             .then((response) => {
             if (!response.ok) {