@ovok/core 0.3.1 → 0.3.2

package/README.md

@@ -90,3 +90,16 @@ await client.revokeSessions("other");
 
 Pass `onUnauthenticated` in the normal Medplum client options to react when a request can no
 longer refresh its session.
+
+## Multi-factor authentication
+
+When password login requires MFA, `login()` returns a verification step instead of an
+`AuthResponse`. Submit the one-time code with `verify()` and use the returned `AuthResponse`:
+
+```typescript
+const result = await client.login(loginBody);
+
+if ("nextStep" in result && result.nextStep === "mfa") {
+  const authenticated = await result.verify(oneTimeCode);
+}
+```

package/dist/client/auth/methods/login.d.ts

@@ -1,4 +1,4 @@
 import { OvokClient } from "../../ovok-client";
-import { AuthResponse } from "../types/AuthResponse";
 import { LoginBody } from "../types/LoginBody";
-export declare function login(this: OvokClient, body: LoginBody): Promise<AuthResponse>;
+import { LoginResponse } from "../types/LoginResponse";
+export declare function login(this: OvokClient, body: LoginBody): Promise<LoginResponse>;

package/dist/client/auth/methods/login.js

@@ -20,6 +20,32 @@ async function login(body) {
     if (!tenantCode) {
         throw new Error("No tenant code found");
     }
+    if (startResponse.nextStep === "mfa") {
+        return {
+            nextStep: "mfa",
+            verify: async (code) => {
+                const mfaResponse = await this.post(`auth/tenant/${body.type}/login/mfa`, {
+                    loginId: startResponse.loginId,
+                    mfaToken: code,
+                }, "application/json");
+                if (body.type === "Practitioner") {
+                    return (0, exchange_code_1.exchangeCode)({
+                        client: this,
+                        type: "Practitioner",
+                        sessionCode: mfaResponse.sessionCode,
+                        codeVerifier,
+                        tenantCode,
+                    });
+                }
+                return (0, exchange_code_1.exchangeCode)({
+                    client: this,
+                    type: "Patient",
+                    sessionCode: mfaResponse.sessionCode,
+                    codeVerifier,
+                });
+            },
+        };
+    }
     const exchangeCodeProps = body.type === "Practitioner"
         ? {
             client: this,

package/dist/client/auth/types/LoginResponse.d.ts

@@ -0,0 +1,7 @@
+import { AuthResponse } from "./AuthResponse";
+/** The second step returned when password login requires MFA verification. */
+export type MfaLoginStep = {
+    nextStep: "mfa";
+    verify: (code: string) => Promise<AuthResponse>;
+};
+export type LoginResponse = AuthResponse | MfaLoginStep;

package/dist/client/auth/types/LoginResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/client/auth/types/StartLoginResponse.d.ts

@@ -1,9 +1,15 @@
 import { ContactPoint, HumanName, Patient, Practitioner, ProjectLink, Reference } from "@medplum/fhirtypes";
-export interface StartLoginResponse {
-    nextStep: string;
+export type StartLoginResponse = TokenStartLoginResponse | MfaStartLoginResponse;
+export interface TokenStartLoginResponse {
+    nextStep: "token";
     sessionCode: string;
     profiles?: ProfileElement[];
 }
+export interface MfaStartLoginResponse {
+    nextStep: "mfa";
+    loginId: string;
+    profiles?: ProfileElement[];
+}
 interface ProfileElement {
     tenantCode: string;
     project: Project;

package/dist/conformance/capability-requirements.js

@@ -48,7 +48,7 @@ exports.OVOK_CORE_REQUIREMENTS = {
     description: "The FHIR surface a server must provide for the @ovok/core client library's own methods to function.",
     software: {
         name: "@ovok/core",
-        version: "0.3.0",
+        version: "0.3.1",
     },
     fhirVersion: "4.0.1",
     format: ["json"],

package/dist/types/index.d.ts

@@ -1,4 +1,5 @@
 export * from "../client/auth/types/AuthResponse";
+export * from "../client/auth/types/LoginResponse";
 export * from "../client/auth/types/LoginBody";
 export * from "../client/auth/types/RegisterBody";
 export * from "../client/auth/types/ChangePasswordBody";

package/dist/types/index.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 // Auth types
 __exportStar(require("../client/auth/types/AuthResponse"), exports);
+__exportStar(require("../client/auth/types/LoginResponse"), exports);
 __exportStar(require("../client/auth/types/LoginBody"), exports);
 __exportStar(require("../client/auth/types/RegisterBody"), exports);
 __exportStar(require("../client/auth/types/ChangePasswordBody"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ovok/core",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "private": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",