@ovok/core 0.3.1 → 0.3.3

package/README.md

@@ -90,3 +90,16 @@ await client.revokeSessions("other");
 
 Pass `onUnauthenticated` in the normal Medplum client options to react when a request can no
 longer refresh its session.
+
+## Multi-factor authentication
+
+When password login requires MFA, `login()` returns a verification step instead of an
+`AuthResponse`. Submit the one-time code with `verify()` and use the returned `AuthResponse`:
+
+```typescript
+const result = await client.login(loginBody);
+
+if ("nextStep" in result && result.nextStep === "mfa") {
+  const authenticated = await result.verify(oneTimeCode);
+}
+```

package/dist/client/auth/methods/login.d.ts

@@ -1,4 +1,4 @@
 import { OvokClient } from "../../ovok-client";
-import { AuthResponse } from "../types/AuthResponse";
 import { LoginBody } from "../types/LoginBody";
-export declare function login(this: OvokClient, body: LoginBody): Promise<AuthResponse>;
+import { LoginResponse } from "../types/LoginResponse";
+export declare function login(this: OvokClient, body: LoginBody): Promise<LoginResponse>;

package/dist/client/auth/methods/login.js

@@ -12,6 +12,43 @@ async function login(body) {
         body,
         codeChallenge,
     });
+    if (startResponse.nextStep === "mfa") {
+        return {
+            nextStep: "mfa",
+            verify: async (code) => {
+                const tenantCode = body.type === "Practitioner" && !startResponse.profiles
+                    ? body.tenantCode
+                    : (0, handle_tenant_code_1.handleTenantCode)({
+                        profiles: startResponse.profiles,
+                        tenantCode: body.tenantCode,
+                        type: body.type,
+                    });
+                const practitionerTenantCode = tenantCode;
+                if (body.type === "Practitioner" && !practitionerTenantCode) {
+                    throw new Error("No tenant code found");
+                }
+                const mfaResponse = await this.post(`auth/tenant/${body.type}/login/mfa`, {
+                    loginId: startResponse.loginId,
+                    mfaToken: code,
+                }, "application/json");
+                if (body.type === "Practitioner") {
+                    return (0, exchange_code_1.exchangeCode)({
+                        client: this,
+                        type: "Practitioner",
+                        sessionCode: mfaResponse.sessionCode,
+                        codeVerifier,
+                        tenantCode: practitionerTenantCode,
+                    });
+                }
+                return (0, exchange_code_1.exchangeCode)({
+                    client: this,
+                    type: "Patient",
+                    sessionCode: mfaResponse.sessionCode,
+                    codeVerifier,
+                });
+            },
+        };
+    }
     const tenantCode = (0, handle_tenant_code_1.handleTenantCode)({
         profiles: startResponse.profiles,
         tenantCode: body.tenantCode,

package/dist/client/auth/types/LoginResponse.d.ts

@@ -0,0 +1,7 @@
+import { AuthResponse } from "./AuthResponse";
+/** The second step returned when password login requires MFA verification. */
+export type MfaLoginStep = {
+    nextStep: "mfa";
+    verify: (code: string) => Promise<AuthResponse>;
+};
+export type LoginResponse = AuthResponse | MfaLoginStep;

package/dist/client/auth/types/LoginResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/client/auth/types/Session.d.ts

@@ -2,11 +2,8 @@
 export interface OvokSession {
     id: string;
     authMethod?: string;
-    ip?: string;
-    browser?: string;
-    os?: string;
-    createdAt?: string;
-    lastActiveAt?: string;
+    remoteAddress?: string;
+    lastUpdated?: string;
 }
 /** Session selector accepted by the session revocation endpoint. */
 export type SessionRevokeOption = "current" | "other" | "all" | (string & {});

package/dist/client/auth/types/StartLoginResponse.d.ts

@@ -1,9 +1,15 @@
 import { ContactPoint, HumanName, Patient, Practitioner, ProjectLink, Reference } from "@medplum/fhirtypes";
-export interface StartLoginResponse {
-    nextStep: string;
+export type StartLoginResponse = TokenStartLoginResponse | MfaStartLoginResponse;
+export interface TokenStartLoginResponse {
+    nextStep: "token";
     sessionCode: string;
     profiles?: ProfileElement[];
 }
+export interface MfaStartLoginResponse {
+    nextStep: "mfa";
+    loginId: string;
+    profiles?: ProfileElement[];
+}
 interface ProfileElement {
     tenantCode: string;
     project: Project;

package/dist/client/errors/rate-limit-error.js

@@ -4,6 +4,7 @@ exports.RateLimitError = void 0;
 exports.isRateLimitError = isRateLimitError;
 exports.mapRateLimitError = mapRateLimitError;
 const core_1 = require("@medplum/core");
+const RATE_LIMIT_RESET_EXTENSION_URL = "https://medplum.com/fhir/StructureDefinition/rate-limit-reset";
 /** A typed error returned when the server asks the client to slow down. */
 class RateLimitError extends Error {
     constructor(retryAfterMs, options) {
@@ -31,10 +32,33 @@ function mapRateLimitError(error) {
         return error;
     }
     if (error instanceof core_1.OperationOutcomeError && isRateLimitOutcome(error.outcome)) {
-        return new RateLimitError((0, core_1.getRateLimitReset)(error.outcome), { cause: error });
+        return new RateLimitError(rateLimitResetFromOutcome(error.outcome), { cause: error });
     }
     return error;
 }
+function rateLimitResetFromOutcome(outcome) {
+    var _a, _b, _c;
+    if (!outcome || typeof outcome !== "object") {
+        return undefined;
+    }
+    const record = outcome;
+    const extension = (_a = record.extension) === null || _a === void 0 ? void 0 : _a.find((candidate) => candidate.url === RATE_LIMIT_RESET_EXTENSION_URL);
+    if (typeof (extension === null || extension === void 0 ? void 0 : extension.valueUnsignedInt) === "number") {
+        return extension.valueUnsignedInt * 1000;
+    }
+    for (const issue of (_b = record.issue) !== null && _b !== void 0 ? _b : []) {
+        try {
+            const diagnostics = JSON.parse((_c = issue.diagnostics) !== null && _c !== void 0 ? _c : "");
+            if (typeof diagnostics.msBeforeNext === "number") {
+                return diagnostics.msBeforeNext;
+            }
+        }
+        catch (_d) {
+            // Diagnostics are optional and may be ordinary human-readable text.
+        }
+    }
+    return undefined;
+}
 function isRateLimitOutcome(outcome) {
     if (!(0, core_1.isOperationOutcome)(outcome)) {
         return false;

package/dist/conformance/capability-requirements.js

@@ -48,7 +48,7 @@ exports.OVOK_CORE_REQUIREMENTS = {
     description: "The FHIR surface a server must provide for the @ovok/core client library's own methods to function.",
     software: {
         name: "@ovok/core",
-        version: "0.3.0",
+        version: "0.3.2",
     },
     fhirVersion: "4.0.1",
     format: ["json"],

package/dist/types/index.d.ts

@@ -1,4 +1,5 @@
 export * from "../client/auth/types/AuthResponse";
+export * from "../client/auth/types/LoginResponse";
 export * from "../client/auth/types/LoginBody";
 export * from "../client/auth/types/RegisterBody";
 export * from "../client/auth/types/ChangePasswordBody";

package/dist/types/index.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 // Auth types
 __exportStar(require("../client/auth/types/AuthResponse"), exports);
+__exportStar(require("../client/auth/types/LoginResponse"), exports);
 __exportStar(require("../client/auth/types/LoginBody"), exports);
 __exportStar(require("../client/auth/types/RegisterBody"), exports);
 __exportStar(require("../client/auth/types/ChangePasswordBody"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ovok/core",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",