@medplum/core 1.0.6 → 2.0.0

package/dist/cjs/utils.d.ts

@@ -1,4 +1,4 @@
-import { CodeableConcept, ObservationDefinition, ObservationDefinitionQualifiedInterval, Patient, Practitioner, QuestionnaireResponse, QuestionnaireResponseItemAnswer, Range, Reference, RelatedPerson, Resource } from '@medplum/fhirtypes';
+import { CodeableConcept, Extension, ObservationDefinition, ObservationDefinitionQualifiedInterval, Patient, Practitioner, QuestionnaireResponse, QuestionnaireResponseItemAnswer, Range, Reference, RelatedPerson, Resource } from '@medplum/fhirtypes';
 /**
  * @internal
  */
@@ -93,6 +93,13 @@ export declare function getIdentifier(resource: Resource, system: string): strin
  * @returns The extension value if found; undefined otherwise.
  */
 export declare function getExtensionValue(resource: any, ...urls: string[]): string | undefined;
+/**
+ * Returns an extension by extension URLs.
+ * @param resource The base resource.
+ * @param urls Array of extension URLs. Each entry represents a nested extension.
+ * @returns The extension object if found; undefined otherwise.
+ */
+export declare function getExtension(resource: any, ...urls: string[]): Extension | undefined;
 /**
  * FHIR JSON stringify.
  * Removes properties with empty string values.

package/dist/esm/client.d.ts

@@ -146,6 +146,7 @@ export interface BaseLoginRequest {
     readonly codeChallengeMethod?: string;
     readonly googleClientId?: string;
     readonly launch?: string;
+    readonly redirectUri?: string;
 }
 export interface EmailPasswordLoginRequest extends BaseLoginRequest {
     readonly email: string;
@@ -338,6 +339,12 @@ export declare class MedplumClient extends EventTarget {
      * @category Authentication
      */
     clear(): void;
+    /**
+     * Clears the active login from local storage.
+     * Does not clear all local storage (such as other logins).
+     * @category Authentication
+     */
+    clearActiveLogin(): void;
     /**
      * Invalidates any cached values or cached requests for the given URL.
      * @category Caching
@@ -467,10 +474,15 @@ export declare class MedplumClient extends EventTarget {
      * @returns Promise to the authentication response.
      */
     startGoogleLogin(loginRequest: GoogleLoginRequest): Promise<LoginAuthenticationResponse>;
-    getCodeChallenge(loginRequest: BaseLoginRequest): {
-        codeChallenge?: string;
-        codeChallengeMethod?: string;
-    };
+    /**
+     * Returns the PKCE code challenge and method.
+     * If the login request already includes a code challenge, it is returned.
+     * Otherwise, a new PKCE code challenge is generated.
+     * @category Authentication
+     * @param loginRequest The original login request.
+     * @returns The PKCE code challenge and method.
+     */
+    ensureCodeChallenge<T extends BaseLoginRequest>(loginRequest: T): Promise<T>;
     /**
      * Signs out locally.
      * Does not invalidate tokens with the server.
@@ -482,8 +494,9 @@ export declare class MedplumClient extends EventTarget {
      * Returns true if the user is signed in.
      * This may result in navigating away to the sign in page.
      * @category Authentication
+     * @param loginParams Optional login parameters.
      */
-    signInWithRedirect(): Promise<ProfileResource | void>;
+    signInWithRedirect(loginParams?: Partial<BaseLoginRequest>): Promise<ProfileResource | void>;
     /**
      * Tries to sign out the user.
      * See: https://docs.aws.amazon.com/cognito/latest/developerguide/logout-endpoint.html
@@ -1154,7 +1167,10 @@ export declare class MedplumClient extends EventTarget {
      * Starts a new PKCE flow.
      * These PKCE values are stateful, and must survive redirects and page refreshes.
      */
-    startPkce(): Promise<void>;
+    startPkce(): Promise<{
+        codeChallengeMethod: string;
+        codeChallenge: string;
+    }>;
     /**
      * Processes an OAuth authorization code.
      * See: https://openid.net/specs/openid-connect-core-1_0.html#TokenRequest

package/dist/esm/client.mjs

@@ -11,7 +11,7 @@ import { createReference, arrayBufferToBase64 } from './utils.mjs';
 // PKCE auth based on:
 // https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/
 var _MedplumClient_instances, _MedplumClient_fetch, _MedplumClient_createPdf, _MedplumClient_storage, _MedplumClient_requestCache, _MedplumClient_cacheTime, _MedplumClient_baseUrl, _MedplumClient_authorizeUrl, _MedplumClient_tokenUrl, _MedplumClient_logoutUrl, _MedplumClient_onUnauthenticated, _MedplumClient_clientId, _MedplumClient_clientSecret, _MedplumClient_accessToken, _MedplumClient_refreshToken, _MedplumClient_refreshPromise, _MedplumClient_profilePromise, _MedplumClient_profile, _MedplumClient_config, _MedplumClient_addLogin, _MedplumClient_refreshProfile, _MedplumClient_getCacheEntry, _MedplumClient_setCacheEntry, _MedplumClient_request, _MedplumClient_addFetchOptionsDefaults, _MedplumClient_setRequestContentType, _MedplumClient_setRequestBody, _MedplumClient_handleUnauthenticated, _MedplumClient_requestAuthorization, _MedplumClient_refresh, _MedplumClient_fetchTokens, _MedplumClient_verifyTokens, _MedplumClient_setupStorageListener;
-const MEDPLUM_VERSION = "1.0.6-5860113c";
+const MEDPLUM_VERSION = "2.0.0-7fe99080";
 const DEFAULT_BASE_URL = 'https://api.medplum.com/';
 const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
 const DEFAULT_CACHE_TIME = 60000; // 60 seconds
@@ -132,6 +132,15 @@ class MedplumClient extends EventTarget {
      */
     clear() {
         __classPrivateFieldGet(this, _MedplumClient_storage, "f").clear();
+        this.clearActiveLogin();
+    }
+    /**
+     * Clears the active login from local storage.
+     * Does not clear all local storage (such as other logins).
+     * @category Authentication
+     */
+    clearActiveLogin() {
+        __classPrivateFieldGet(this, _MedplumClient_storage, "f").setString('activeLogin', undefined);
         __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").clear();
         __classPrivateFieldSet(this, _MedplumClient_accessToken, undefined, "f");
         __classPrivateFieldSet(this, _MedplumClient_refreshToken, undefined, "f");
@@ -283,11 +292,11 @@ class MedplumClient extends EventTarget {
      * @returns Promise to the authentication response.
      */
     async startNewUser(newUserRequest) {
-        await this.startPkce();
+        const { codeChallengeMethod, codeChallenge } = await this.startPkce();
         return this.post('auth/newuser', {
             ...newUserRequest,
-            codeChallengeMethod: 'S256',
-            codeChallenge: sessionStorage.getItem('codeChallenge'),
+            codeChallengeMethod,
+            codeChallenge,
         });
     }
     /**
@@ -319,13 +328,10 @@ class MedplumClient extends EventTarget {
      * @returns Promise to the authentication response.
      */
     async startLogin(loginRequest) {
-        const { codeChallenge, codeChallengeMethod } = this.getCodeChallenge(loginRequest);
         return this.post('auth/login', {
-            ...loginRequest,
+            ...(await this.ensureCodeChallenge(loginRequest)),
             clientId: loginRequest.clientId ?? __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
             scope: loginRequest.scope,
-            codeChallengeMethod,
-            codeChallenge,
         });
     }
     /**
@@ -337,30 +343,25 @@ class MedplumClient extends EventTarget {
      * @returns Promise to the authentication response.
      */
     async startGoogleLogin(loginRequest) {
-        const { codeChallenge, codeChallengeMethod } = this.getCodeChallenge(loginRequest);
         return this.post('auth/google', {
-            ...loginRequest,
+            ...(await this.ensureCodeChallenge(loginRequest)),
             clientId: loginRequest.clientId ?? __classPrivateFieldGet(this, _MedplumClient_clientId, "f"),
             scope: loginRequest.scope,
-            codeChallengeMethod,
-            codeChallenge,
         });
     }
-    getCodeChallenge(loginRequest) {
+    /**
+     * Returns the PKCE code challenge and method.
+     * If the login request already includes a code challenge, it is returned.
+     * Otherwise, a new PKCE code challenge is generated.
+     * @category Authentication
+     * @param loginRequest The original login request.
+     * @returns The PKCE code challenge and method.
+     */
+    async ensureCodeChallenge(loginRequest) {
         if (loginRequest.codeChallenge) {
-            return {
-                codeChallenge: loginRequest.codeChallenge,
-                codeChallengeMethod: loginRequest.codeChallengeMethod,
-            };
-        }
-        const codeChallenge = sessionStorage.getItem('codeChallenge');
-        if (codeChallenge) {
-            return {
-                codeChallenge,
-                codeChallengeMethod: 'S256',
-            };
+            return loginRequest;
         }
-        return {};
+        return { ...loginRequest, ...(await this.startPkce()) };
     }
     /**
      * Signs out locally.
@@ -375,12 +376,13 @@ class MedplumClient extends EventTarget {
      * Returns true if the user is signed in.
      * This may result in navigating away to the sign in page.
      * @category Authentication
+     * @param loginParams Optional login parameters.
      */
-    async signInWithRedirect() {
+    async signInWithRedirect(loginParams) {
         const urlParams = new URLSearchParams(window.location.search);
         const code = urlParams.get('code');
         if (!code) {
-            await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_requestAuthorization).call(this);
+            await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_requestAuthorization).call(this, loginParams);
             return undefined;
         }
         else {
@@ -1233,13 +1235,11 @@ class MedplumClient extends EventTarget {
      * @category Authentication
      */
     async setActiveLogin(login) {
+        this.clearActiveLogin();
         __classPrivateFieldSet(this, _MedplumClient_accessToken, login.accessToken, "f");
         __classPrivateFieldSet(this, _MedplumClient_refreshToken, login.refreshToken, "f");
-        __classPrivateFieldSet(this, _MedplumClient_profile, undefined, "f");
-        __classPrivateFieldSet(this, _MedplumClient_config, undefined, "f");
         __classPrivateFieldGet(this, _MedplumClient_storage, "f").setObject('activeLogin', login);
         __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_addLogin).call(this, login);
-        __classPrivateFieldGet(this, _MedplumClient_requestCache, "f").clear();
         __classPrivateFieldSet(this, _MedplumClient_refreshPromise, undefined, "f");
         await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refreshProfile).call(this);
     }
@@ -1318,6 +1318,7 @@ class MedplumClient extends EventTarget {
         const arrayHash = await encryptSHA256(codeVerifier);
         const codeChallenge = arrayBufferToBase64(arrayHash).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
         sessionStorage.setItem('codeChallenge', codeChallenge);
+        return { codeChallengeMethod: 'S256', codeChallenge };
     }
     /**
      * Processes an OAuth authorization code.
@@ -1453,7 +1454,7 @@ async function _MedplumClient_request(method, url, options = {}) {
     if (__classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_refresh).call(this)) {
         return __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_request).call(this, method, url, options);
     }
-    this.clear();
+    this.clearActiveLogin();
     if (__classPrivateFieldGet(this, _MedplumClient_onUnauthenticated, "f")) {
         __classPrivateFieldGet(this, _MedplumClient_onUnauthenticated, "f").call(this);
     }
@@ -1464,15 +1465,16 @@ async function _MedplumClient_request(method, url, options = {}) {
  * Clears all auth state including local storage and session storage.
  * See: https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint
  */
-async function _MedplumClient_requestAuthorization() {
-    await this.startPkce();
+async function _MedplumClient_requestAuthorization(loginParams) {
+    const loginRequest = await this.ensureCodeChallenge(loginParams || {});
     const url = new URL(__classPrivateFieldGet(this, _MedplumClient_authorizeUrl, "f"));
     url.searchParams.set('response_type', 'code');
     url.searchParams.set('state', sessionStorage.getItem('pkceState'));
-    url.searchParams.set('client_id', __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
-    url.searchParams.set('redirect_uri', getBaseUrl());
-    url.searchParams.set('code_challenge_method', 'S256');
-    url.searchParams.set('code_challenge', sessionStorage.getItem('codeChallenge'));
+    url.searchParams.set('client_id', loginRequest.clientId || __classPrivateFieldGet(this, _MedplumClient_clientId, "f"));
+    url.searchParams.set('redirect_uri', loginRequest.redirectUri || getBaseUrl());
+    url.searchParams.set('code_challenge_method', loginRequest.codeChallengeMethod);
+    url.searchParams.set('code_challenge', loginRequest.codeChallenge);
+    url.searchParams.set('scope', loginRequest.scope || 'openid profile');
     window.location.assign(url.toString());
 }, _MedplumClient_refresh = function _MedplumClient_refresh() {
     if (__classPrivateFieldGet(this, _MedplumClient_refreshPromise, "f")) {
@@ -1498,20 +1500,19 @@ async function _MedplumClient_requestAuthorization() {
  * @param formBody Token parameters in URL encoded format.
  */
 async function _MedplumClient_fetchTokens(formBody) {
-    return __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, __classPrivateFieldGet(this, _MedplumClient_tokenUrl, "f"), {
+    const response = await __classPrivateFieldGet(this, _MedplumClient_fetch, "f").call(this, __classPrivateFieldGet(this, _MedplumClient_tokenUrl, "f"), {
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
         body: formBody,
         credentials: 'include',
-    })
-        .then((response) => {
-        if (!response.ok) {
-            throw new Error('Failed to fetch tokens');
-        }
-        return response.json();
-    })
-        .then((tokens) => __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_verifyTokens).call(this, tokens))
-        .then(() => this.getProfile());
+    });
+    if (!response.ok) {
+        this.clearActiveLogin();
+        throw new Error('Failed to fetch tokens');
+    }
+    const tokens = await response.json();
+    await __classPrivateFieldGet(this, _MedplumClient_instances, "m", _MedplumClient_verifyTokens).call(this, tokens);
+    return this.getProfile();
 }, _MedplumClient_verifyTokens = 
 /**
  * Verifies the tokens received from the auth server.
@@ -1524,15 +1525,15 @@ async function _MedplumClient_verifyTokens(tokens) {
     // Verify token has not expired
     const tokenPayload = parseJWTPayload(token);
     if (Date.now() >= tokenPayload.exp * 1000) {
-        this.clear();
+        this.clearActiveLogin();
         throw new Error('Token expired');
     }
     // Verify app_client_id
     if (__classPrivateFieldGet(this, _MedplumClient_clientId, "f") && tokenPayload.client_id !== __classPrivateFieldGet(this, _MedplumClient_clientId, "f")) {
-        this.clear();
+        this.clearActiveLogin();
         throw new Error('Token was not issued for this audience');
     }
-    await this.setActiveLogin({
+    return this.setActiveLogin({
         accessToken: token,
         refreshToken: tokens.refresh_token,
         project: tokens.project,