@medplum/core 2.0.15 → 2.0.16

package/dist/esm/client.mjs

@@ -10,7 +10,7 @@ import { createReference, arrayBufferToBase64 } from './utils.mjs';
 import { encodeBase64 } from './base64.mjs';
 
 // PKCE auth based on:
-const MEDPLUM_VERSION = "2.0.15-025c3c04";
+const MEDPLUM_VERSION = "2.0.16-816ad9bf";
 const DEFAULT_BASE_URL = 'https://api.medplum.com/';
 const DEFAULT_RESOURCE_CACHE_SIZE = 1000;
 const DEFAULT_CACHE_TIME = 60000; // 60 seconds
@@ -18,6 +18,35 @@ const JSON_CONTENT_TYPE = 'application/json';
 const FHIR_CONTENT_TYPE = 'application/fhir+json';
 const PATCH_CONTENT_TYPE = 'application/json-patch+json';
 const system = { resourceType: 'Device', id: 'system', deviceName: [{ name: 'System' }] };
+/**
+ * OAuth 2.0 Grant Type Identifiers
+ * Standard identifiers defined here: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-07#name-grant-types
+ * Token exchange extension defined here: https://datatracker.ietf.org/doc/html/rfc8693
+ */
+var OAuthGrantType;
+(function (OAuthGrantType) {
+    OAuthGrantType["ClientCredentials"] = "client_credentials";
+    OAuthGrantType["AuthorizationCode"] = "authorization_code";
+    OAuthGrantType["RefreshToken"] = "refresh_token";
+    OAuthGrantType["TokenExchange"] = "urn:ietf:params:oauth:grant-type:token-exchange";
+})(OAuthGrantType || (OAuthGrantType = {}));
+/**
+ * OAuth 2.0 Token Type Identifiers
+ * See: https://datatracker.ietf.org/doc/html/rfc8693#name-token-type-identifiers
+ */
+var OAuthTokenType;
+(function (OAuthTokenType) {
+    /** Indicates that the token is an OAuth 2.0 access token issued by the given authorization server. */
+    OAuthTokenType["AccessToken"] = "urn:ietf:params:oauth:token-type:access_token";
+    /** Indicates that the token is an OAuth 2.0 refresh token issued by the given authorization server. */
+    OAuthTokenType["RefreshToken"] = "urn:ietf:params:oauth:token-type:refresh_token";
+    /** Indicates that the token is an ID Token as defined in Section 2 of [OpenID.Core]. */
+    OAuthTokenType["IdToken"] = "urn:ietf:params:oauth:token-type:id_token";
+    /** Indicates that the token is a base64url-encoded SAML 1.1 [OASIS.saml-core-1.1] assertion. */
+    OAuthTokenType["Saml1Token"] = "urn:ietf:params:oauth:token-type:saml1";
+    /** Indicates that the token is a base64url-encoded SAML 2.0 [OASIS.saml-core-2.0-os] assertion. */
+    OAuthTokenType["Saml2Token"] = "urn:ietf:params:oauth:token-type:saml2";
+})(OAuthTokenType || (OAuthTokenType = {}));
 /**
  * The MedplumClient class provides a client for the Medplum FHIR server.
  *
@@ -87,7 +116,6 @@ class MedplumClient extends EventTarget {
         this.authorizeUrl = options?.authorizeUrl || this.baseUrl + 'oauth2/authorize';
         this.tokenUrl = options?.tokenUrl || this.baseUrl + 'oauth2/token';
         this.logoutUrl = options?.logoutUrl || this.baseUrl + 'oauth2/logout';
-        this.exchangeUrl = this.baseUrl + 'auth/exchange';
         this.onUnauthenticated = options?.onUnauthenticated;
         this.cacheTime = options?.cacheTime ?? DEFAULT_CACHE_TIME;
         if (this.cacheTime > 0) {
@@ -159,7 +187,7 @@ class MedplumClient extends EventTarget {
      * @param resourceType The resource type to invalidate.
      */
     invalidateSearches(resourceType) {
-        const url = 'fhir/R4/' + resourceType;
+        const url = this.fhirBaseUrl + resourceType;
         if (this.requestCache) {
             for (const key of this.requestCache.keys()) {
                 if (key.endsWith(url) || key.includes(url + '?')) {
@@ -437,22 +465,12 @@ class MedplumClient extends EventTarget {
         if (!clientId) {
             throw new Error('MedplumClient is missing clientId');
         }
-        const response = await this.fetch(this.exchangeUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({
-                clientId: this.clientId,
-                externalAccessToken: token,
-            }),
-            credentials: 'include',
-        });
-        if (!response.ok) {
-            this.clearActiveLogin();
-            throw new Error('Failed to fetch tokens');
-        }
-        const tokens = await response.json();
-        await this.verifyTokens(tokens);
-        return this.getProfile();
+        const formBody = new URLSearchParams();
+        formBody.set('grant_type', OAuthGrantType.TokenExchange);
+        formBody.set('subject_token_type', OAuthTokenType.AccessToken);
+        formBody.set('client_id', clientId);
+        formBody.set('subject_token', token);
+        return this.fetchTokens(formBody);
     }
     /**
      * Builds the external identity provider redirect URI.
@@ -1284,7 +1302,7 @@ class MedplumClient extends EventTarget {
      * @returns The FHIR batch/transaction response bundle.
      */
     executeBatch(bundle) {
-        return this.post('fhir/R4', bundle);
+        return this.post(this.fhirBaseUrl.slice(0, -1), bundle);
     }
     /**
      * Sends an email using the Medplum Email API.
@@ -1628,7 +1646,7 @@ class MedplumClient extends EventTarget {
             })),
         };
         // Execute the batch request
-        const response = (await this.post('fhir/R4', batch));
+        const response = (await this.post(this.fhirBaseUrl.slice(0, -1), batch));
         // Process the response
         for (let i = 0; i < entries.length; i++) {
             const entry = entries[i];
@@ -1756,7 +1774,7 @@ class MedplumClient extends EventTarget {
      */
     processCode(code, loginParams) {
         const formBody = new URLSearchParams();
-        formBody.set('grant_type', 'authorization_code');
+        formBody.set('grant_type', OAuthGrantType.AuthorizationCode);
         formBody.set('code', code);
         formBody.set('client_id', loginParams?.clientId || this.clientId);
         formBody.set('redirect_uri', loginParams?.redirectUri || getWindowOrigin());
@@ -1778,7 +1796,7 @@ class MedplumClient extends EventTarget {
         }
         if (this.refreshToken) {
             const formBody = new URLSearchParams();
-            formBody.set('grant_type', 'refresh_token');
+            formBody.set('grant_type', OAuthGrantType.RefreshToken);
             formBody.set('client_id', this.clientId);
             formBody.set('refresh_token', this.refreshToken);
             this.refreshPromise = this.fetchTokens(formBody);
@@ -1802,7 +1820,7 @@ class MedplumClient extends EventTarget {
         this.clientId = clientId;
         this.clientSecret = clientSecret;
         const formBody = new URLSearchParams();
-        formBody.set('grant_type', 'client_credentials');
+        formBody.set('grant_type', OAuthGrantType.ClientCredentials);
         formBody.set('client_id', clientId);
         formBody.set('client_secret', clientSecret);
         return this.fetchTokens(formBody);
@@ -1922,5 +1940,5 @@ function ensureTrailingSlash(url) {
     return url.endsWith('/') ? url : url + '/';
 }
 
-export { MEDPLUM_VERSION, MedplumClient };
+export { MEDPLUM_VERSION, MedplumClient, OAuthGrantType, OAuthTokenType };
 //# sourceMappingURL=client.mjs.map