@medplum/core 1.0.6 → 2.0.0

package/dist/cjs/client.d.ts

@@ -146,6 +146,7 @@ export interface BaseLoginRequest {
     readonly codeChallengeMethod?: string;
     readonly googleClientId?: string;
     readonly launch?: string;
+    readonly redirectUri?: string;
 }
 export interface EmailPasswordLoginRequest extends BaseLoginRequest {
     readonly email: string;
@@ -338,6 +339,12 @@ export declare class MedplumClient extends EventTarget {
      * @category Authentication
      */
     clear(): void;
+    /**
+     * Clears the active login from local storage.
+     * Does not clear all local storage (such as other logins).
+     * @category Authentication
+     */
+    clearActiveLogin(): void;
     /**
      * Invalidates any cached values or cached requests for the given URL.
      * @category Caching
@@ -467,10 +474,15 @@ export declare class MedplumClient extends EventTarget {
      * @returns Promise to the authentication response.
      */
     startGoogleLogin(loginRequest: GoogleLoginRequest): Promise<LoginAuthenticationResponse>;
-    getCodeChallenge(loginRequest: BaseLoginRequest): {
-        codeChallenge?: string;
-        codeChallengeMethod?: string;
-    };
+    /**
+     * Returns the PKCE code challenge and method.
+     * If the login request already includes a code challenge, it is returned.
+     * Otherwise, a new PKCE code challenge is generated.
+     * @category Authentication
+     * @param loginRequest The original login request.
+     * @returns The PKCE code challenge and method.
+     */
+    ensureCodeChallenge<T extends BaseLoginRequest>(loginRequest: T): Promise<T>;
     /**
      * Signs out locally.
      * Does not invalidate tokens with the server.
@@ -482,8 +494,9 @@ export declare class MedplumClient extends EventTarget {
      * Returns true if the user is signed in.
      * This may result in navigating away to the sign in page.
      * @category Authentication
+     * @param loginParams Optional login parameters.
      */
-    signInWithRedirect(): Promise<ProfileResource | void>;
+    signInWithRedirect(loginParams?: Partial<BaseLoginRequest>): Promise<ProfileResource | void>;
     /**
      * Tries to sign out the user.
      * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html
@@ -1154,7 +1167,10 @@ export declare class MedplumClient extends EventTarget {
      * Starts a new PKCE flow.
      * These PKCE values are stateful, and must survive redirects and page refreshes.
      */
-    startPkce(): Promise<void>;
+    startPkce(): Promise<{
+        codeChallengeMethod: string;
+        codeChallenge: string;
+    }>;
     /**
      * Processes an OAuth authorization code.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest

package/dist/cjs/index.cjs

@@ -721,6 +721,21 @@
         }
         return curr?.valueString;
     }
+    /**
+     * Returns an extension by extension URLs.
+     * @param resource The base resource.
+     * @param urls Array of extension URLs. Each entry represents a nested extension.
+     * @returns The extension object if found; undefined otherwise.
+     */
+    function getExtension(resource, ...urls) {
+        // Let curr be the current resource or extension. Extensions can be nested.
+        let curr = resource;
+        // For each of the urls, try to find a matching nested extension.
+        for (let i = 0; i < urls.length && curr; i++) {
+            curr = curr?.extension?.find((e) => e.url === urls[i]);
+        }
+        return curr;
+    }
     /**
      * FHIR JSON stringify.
      * Removes properties with empty string values.
@@ -6468,7 +6483,7 @@
     // PKCE auth based on:
     // https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
     var _MedplumClient_instances, _MedplumClient_fetch, _MedplumClient_createPdf, _MedplumClient_storage, _MedplumClient_requestCache, _MedplumClient_cacheTime, _MedplumClient_baseUrl, _MedplumClient_authorizeUrl, _MedplumClient_tokenUrl, _MedplumClient_logoutUrl, _MedplumClient_onUnauthenticated, _MedplumClient_clientId, _MedplumClient_clientSecret, _MedplumClient_accessToken, _MedplumClient_refreshToken, _MedplumClient_refreshPromise, _MedplumClient_profilePromise, _MedplumClient_profile, _MedplumClient_config, _MedplumClient_addLogin, _MedplumClient_refreshProfile, _MedplumClient_getCacheEntry, _MedplumClient_setCacheEntry, _MedplumClient_request, _MedplumClient_addFetchOptionsDefaults, _MedplumClient_setRequestContentType, _MedplumClient_setRequestBody, _MedplumClient_handleUnauthenticated, _MedplumClient_requestAuthorization, _MedplumClient_refresh, _MedplumClient_fetchTokens, _MedplumClient_verifyTokens, _MedplumClient_setupStorageListener;
-    const MEDPLUM_VERSION = "1.0.6-5860113c";
+    const MEDPLUM_VERSION = "2.0.0-7fe99080";
     const DEFAULT_BASE_URL = 'https://api.medplum.com/';
     const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
     const DEFAULT_CACHE_TIME = 60000; // 60 seconds
@@ -6589,6 +6604,15 @@
          */
         clear() {
             __classPrivateFieldGet(this, _MedplumClient_storage, "f").clear();
+            this.clearActiveLogin();
+        }
+        /**
+         * Clears the active login from local storage.
+         * Does not clear all local storage (such as other logins).
+         * @category Authentication
+         */
+        clearActiveLogin() {
+            __classPrivateFieldGet(this, _MedplumClient_storage, "f").setString('activeLogin', undefined);
             __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").clear();
             __classPrivateFieldSet(this, _MedplumClient_accessToken, undefined, "f");
             __classPrivateFieldSet(this, _MedplumClient_refreshToken, undefined, "f");
@@ -6740,11 +6764,11 @@
          * @returns Promise to the authentication response.
          */
         async startNewUser(newUserRequest) {
-            await this.startPkce();
+            const { codeChallengeMethod, codeChallenge } = await this.startPkce();
             return this.post('auth/newuser', {
                 ...newUserRequest,
-                codeChallengeMethod: 'S256',
-                codeChallenge: sessionStorage.getItem('codeChallenge'),
+                codeChallengeMethod,
+                codeChallenge,
             });
         }
         /**
@@ -6776,13 +6800,10 @@
          * @returns Promise to the authentication response.
          */
         async startLogin(loginRequest) {
-            const { codeChallenge, codeChallengeMethod } = this.getCodeChallenge(loginRequest);
             return this.post('auth/login', {
-                ...loginRequest,
+                ...(await this.ensureCodeChallenge(loginRequest)),
                 clientId: loginRequest.clientId ?? __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
                 scope: loginRequest.scope,
-                codeChallengeMethod,
-                codeChallenge,
             });
         }
         /**
@@ -6794,30 +6815,25 @@
          * @returns Promise to the authentication response.
          */
         async startGoogleLogin(loginRequest) {
-            const { codeChallenge, codeChallengeMethod } = this.getCodeChallenge(loginRequest);
             return this.post('auth/google', {
-                ...loginRequest,
+                ...(await this.ensureCodeChallenge(loginRequest)),
                 clientId: loginRequest.clientId ?? __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
                 scope: loginRequest.scope,
-                codeChallengeMethod,
-                codeChallenge,
             });
         }
-        getCodeChallenge(loginRequest) {
+        /**
+         * Returns the PKCE code challenge and method.
+         * If the login request already includes a code challenge, it is returned.
+         * Otherwise, a new PKCE code challenge is generated.
+         * @category Authentication
+         * @param loginRequest The original login request.
+         * @returns The PKCE code challenge and method.
+         */
+        async ensureCodeChallenge(loginRequest) {
             if (loginRequest.codeChallenge) {
-                return {
-                    codeChallenge: loginRequest.codeChallenge,
-                    codeChallengeMethod: loginRequest.codeChallengeMethod,
-                };
-            }
-            const codeChallenge = sessionStorage.getItem('codeChallenge');
-            if (codeChallenge) {
-                return {
-                    codeChallenge,
-                    codeChallengeMethod: 'S256',
-                };
+                return loginRequest;
             }
-            return {};
+            return { ...loginRequest, ...(await this.startPkce()) };
         }
         /**
          * Signs out locally.
@@ -6832,12 +6848,13 @@
          * Returns true if the user is signed in.
          * This may result in navigating away to the sign in page.
          * @category Authentication
+         * @param loginParams Optional login parameters.
          */
-        async signInWithRedirect() {
+        async signInWithRedirect(loginParams) {
             const urlParams = new URLSearchParams(window.location.search);
             const code = urlParams.get('code');
             if (!code) {
-                await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_requestAuthorization).call(this);
+                await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_requestAuthorization).call(this, loginParams);
                 return undefined;
             }
             else {
@@ -7690,13 +7707,11 @@
          * @category Authentication
          */
         async setActiveLogin(login) {
+            this.clearActiveLogin();
             __classPrivateFieldSet(this, _MedplumClient_accessToken, login.accessToken, "f");
             __classPrivateFieldSet(this, _MedplumClient_refreshToken, login.refreshToken, "f");
-            __classPrivateFieldSet(this, _MedplumClient_profile, undefined, "f");
-            __classPrivateFieldSet(this, _MedplumClient_config, undefined, "f");
             __classPrivateFieldGet(this, _MedplumClient_storage, "f").setObject('activeLogin', login);
             __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_addLogin).call(this, login);
-            __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").clear();
             __classPrivateFieldSet(this, _MedplumClient_refreshPromise, undefined, "f");
             await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refreshProfile).call(this);
         }
@@ -7775,6 +7790,7 @@
             const arrayHash = await encryptSHA256(codeVerifier);
             const codeChallenge = arrayBufferToBase64(arrayHash).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
             sessionStorage.setItem('codeChallenge', codeChallenge);
+            return { codeChallengeMethod: 'S256', codeChallenge };
         }
         /**
          * Processes an OAuth authorization code.
@@ -7910,7 +7926,7 @@
         if (__classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refresh).call(this)) {
             return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, method, url, options);
         }
-        this.clear();
+        this.clearActiveLogin();
         if (__classPrivateFieldGet(this, _MedplumClient_onUnauthenticated, "f")) {
             __classPrivateFieldGet(this, _MedplumClient_onUnauthenticated, "f").call(this);
         }
@@ -7921,15 +7937,16 @@
      * Clears all auth state including local storage and session storage.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
      */
-    async function _MedplumClient_requestAuthorization() {
-        await this.startPkce();
+    async function _MedplumClient_requestAuthorization(loginParams) {
+        const loginRequest = await this.ensureCodeChallenge(loginParams || {});
         const url = new URL(__classPrivateFieldGet(this, _MedplumClient_authorizeUrl, "f"));
         url.searchParams.set('response_type', 'code');
         url.searchParams.set('state', sessionStorage.getItem('pkceState'));
-        url.searchParams.set('client_id', __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
-        url.searchParams.set('redirect_uri', getBaseUrl());
-        url.searchParams.set('code_challenge_method', 'S256');
-        url.searchParams.set('code_challenge', sessionStorage.getItem('codeChallenge'));
+        url.searchParams.set('client_id', loginRequest.clientId || __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
+        url.searchParams.set('redirect_uri', loginRequest.redirectUri || getBaseUrl());
+        url.searchParams.set('code_challenge_method', loginRequest.codeChallengeMethod);
+        url.searchParams.set('code_challenge', loginRequest.codeChallenge);
+        url.searchParams.set('scope', loginRequest.scope || 'openid profile');
         window.location.assign(url.toString());
     }, _MedplumClient_refresh = function _MedplumClient_refresh() {
         if (__classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f")) {
@@ -7955,20 +7972,19 @@
      * @param formBody Token parameters in URL encoded format.
      */
     async function _MedplumClient_fetchTokens(formBody) {
-        return __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, __classPrivateFieldGet(this, _MedplumClient_tokenUrl, "f"), {
+        const response = await __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, __classPrivateFieldGet(this, _MedplumClient_tokenUrl, "f"), {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: formBody,
             credentials: 'include',
-        })
-            .then((response) => {
-            if (!response.ok) {
-                throw new Error('Failed to fetch tokens');
-            }
-            return response.json();
-        })
-            .then((tokens) => __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_verifyTokens).call(this, tokens))
-            .then(() => this.getProfile());
+        });
+        if (!response.ok) {
+            this.clearActiveLogin();
+            throw new Error('Failed to fetch tokens');
+        }
+        const tokens = await response.json();
+        await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_verifyTokens).call(this, tokens);
+        return this.getProfile();
     }, _MedplumClient_verifyTokens = 
     /**
      * Verifies the tokens received from the auth server.
@@ -7981,15 +7997,15 @@
         // Verify token has not expired
         const tokenPayload = parseJWTPayload(token);
         if (Date.now() >= tokenPayload.exp * 1000) {
-            this.clear();
+            this.clearActiveLogin();
             throw new Error('Token expired');
         }
         // Verify app_client_id
         if (__classPrivateFieldGet(this, _MedplumClient_clientId, "f") && tokenPayload.client_id !== __classPrivateFieldGet(this, _MedplumClient_clientId, "f")) {
-            this.clear();
+            this.clearActiveLogin();
             throw new Error('Token was not issued for this audience');
         }
-        await this.setActiveLogin({
+        return this.setActiveLogin({
             accessToken: token,
             refreshToken: tokens.refresh_token,
             project: tokens.project,
@@ -11731,6 +11747,7 @@
     exports.getDisplayString = getDisplayString;
     exports.getElementDefinition = getElementDefinition;
     exports.getExpressionForResourceType = getExpressionForResourceType;
+    exports.getExtension = getExtension;
     exports.getExtensionValue = getExtensionValue;
     exports.getIdentifier = getIdentifier;
     exports.getImageSrc = getImageSrc;