@ovok/core 0.4.21 → 0.4.23

package/dist/client/auth/types/Account.d.ts

@@ -0,0 +1,10 @@
+import { ProfileResource } from "@medplum/core";
+import { Project, Reference } from "@medplum/fhirtypes";
+/** Safe account metadata for account pickers; authentication tokens are omitted. */
+export interface OvokSavedAccount {
+    id: string;
+    profile: Reference<ProfileResource>;
+    project: Reference<Project>;
+    active: boolean;
+    expired: boolean;
+}

package/dist/client/auth/types/Account.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/client/offline/offline-measurement-queue.d.ts

@@ -1,6 +1,6 @@
 import { IClientStorage } from "@medplum/core";
 import { Bundle, BundleEntry, Observation } from "@medplum/fhirtypes";
-declare const DEFAULT_STORAGE_KEY = "ovok.core.offline-measurements";
+export declare const OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY = "ovok.core.offline-measurements";
 declare const IDENTIFIER_SYSTEM = "https://api.ovok.com/fhir/StructureDefinition/offline-measurement-id";
 export type OfflineMeasurementQueueOptions = {
     enabled?: boolean;
@@ -8,6 +8,8 @@ export type OfflineMeasurementQueueOptions = {
     maxRetries?: number;
     retryBackoffMs?: number;
     maxRetryBackoffMs?: number;
+    /** Returns the active account key. Queue items are delivered only to their owner. */
+    getOwnerKey?: () => string | undefined;
 };
 export type OfflineMeasurementFlushOptions = {
     includeExhausted?: boolean;
@@ -30,6 +32,7 @@ export declare class OfflineMeasurementQueue {
     private readonly maxRetries;
     private readonly retryBackoffMs;
     private readonly maxRetryBackoffMs;
+    private readonly getOwnerKey?;
     private operation;
     constructor(storage: IClientStorage, transport: MeasurementTransport, options?: OfflineMeasurementQueueOptions);
     enqueueAndFlush: (observations: Observation[]) => Promise<{
@@ -42,4 +45,4 @@ export declare class OfflineMeasurementQueue {
     private writeQueue;
     private flushQueue;
 }
-export { DEFAULT_STORAGE_KEY as DEFAULT_OFFLINE_MEASUREMENT_QUEUE_KEY, IDENTIFIER_SYSTEM as OFFLINE_MEASUREMENT_IDENTIFIER_SYSTEM, entryForObservation, stableMeasurementId, };
+export { OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY as DEFAULT_OFFLINE_MEASUREMENT_QUEUE_KEY, IDENTIFIER_SYSTEM as OFFLINE_MEASUREMENT_IDENTIFIER_SYSTEM, entryForObservation, stableMeasurementId, };

package/dist/client/offline/offline-measurement-queue.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.stableMeasurementId = exports.entryForObservation = exports.OFFLINE_MEASUREMENT_IDENTIFIER_SYSTEM = exports.DEFAULT_OFFLINE_MEASUREMENT_QUEUE_KEY = exports.OfflineMeasurementQueue = void 0;
-const DEFAULT_STORAGE_KEY = "ovok.core.offline-measurements";
-exports.DEFAULT_OFFLINE_MEASUREMENT_QUEUE_KEY = DEFAULT_STORAGE_KEY;
+exports.stableMeasurementId = exports.entryForObservation = exports.OFFLINE_MEASUREMENT_IDENTIFIER_SYSTEM = exports.DEFAULT_OFFLINE_MEASUREMENT_QUEUE_KEY = exports.OfflineMeasurementQueue = exports.OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY = void 0;
+exports.OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY = "ovok.core.offline-measurements";
+exports.DEFAULT_OFFLINE_MEASUREMENT_QUEUE_KEY = exports.OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY;
 const DEFAULT_MAX_RETRIES = 8;
 const DEFAULT_RETRY_BACKOFF_MS = 5000;
 const DEFAULT_MAX_RETRY_BACKOFF_MS = 60 * 60 * 1000;
@@ -82,14 +82,19 @@ class OfflineMeasurementQueue {
         this.transport = transport;
         this.operation = Promise.resolve();
         this.enqueueAndFlush = (observations) => this.runExclusive(async () => {
-            var _a, _b;
+            var _a, _b, _c;
             await ((_b = (_a = this.storage).getInitPromise) === null || _b === void 0 ? void 0 : _b.call(_a));
             const queue = this.readQueue();
             const entries = observations.map(entryForObservation);
-            const id = stableValueId(entries);
+            const ownerKey = (_c = this.getOwnerKey) === null || _c === void 0 ? void 0 : _c.call(this);
+            if (this.getOwnerKey && !ownerKey) {
+                throw new Error("Offline measurements require an active account to prevent cross-account delivery.");
+            }
+            const id = stableValueId({ ownerKey, entries });
             if (!queue.some((item) => item.id === id)) {
                 queue.push({
                     id,
+                    ownerKey,
                     queuedAt: new Date().toISOString(),
                     attempt: 0,
                     nextAttemptAt: 0,
@@ -130,6 +135,7 @@ class OfflineMeasurementQueue {
             }
         };
         this.flushQueue = async (queue, options = {}) => {
+            var _a;
             const result = {
                 attempted: 0,
                 saved: 0,
@@ -138,6 +144,7 @@ class OfflineMeasurementQueue {
                 responses: {},
             };
             const now = Date.now();
+            const ownerKey = (_a = this.getOwnerKey) === null || _a === void 0 ? void 0 : _a.call(this);
             let changed = false;
             for (const item of [...queue]) {
                 if (item.exhausted && options.resetExhausted) {
@@ -156,6 +163,10 @@ class OfflineMeasurementQueue {
                     }
                     continue;
                 }
+                if (this.getOwnerKey && (!ownerKey || item.ownerKey !== ownerKey)) {
+                    result.queued++;
+                    continue;
+                }
                 result.attempted++;
                 const attempt = item.attempt + 1;
                 try {
@@ -172,7 +183,7 @@ class OfflineMeasurementQueue {
                     result.responses[item.id] = response;
                     changed = true;
                 }
-                catch (_a) {
+                catch (_b) {
                     item.attempt = attempt;
                     item.exhausted = attempt >= this.maxRetries;
                     item.nextAttemptAt = item.exhausted
@@ -193,10 +204,12 @@ class OfflineMeasurementQueue {
             }
             return result;
         };
-        this.storageKey = (_a = options.storageKey) !== null && _a !== void 0 ? _a : DEFAULT_STORAGE_KEY;
+        this.storageKey =
+            (_a = options.storageKey) !== null && _a !== void 0 ? _a : exports.OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY;
         this.maxRetries = Math.max(1, (_b = options.maxRetries) !== null && _b !== void 0 ? _b : DEFAULT_MAX_RETRIES);
         this.retryBackoffMs = Math.max(1, (_c = options.retryBackoffMs) !== null && _c !== void 0 ? _c : DEFAULT_RETRY_BACKOFF_MS);
         this.maxRetryBackoffMs = Math.max(this.retryBackoffMs, (_d = options.maxRetryBackoffMs) !== null && _d !== void 0 ? _d : DEFAULT_MAX_RETRY_BACKOFF_MS);
+        this.getOwnerKey = options.getOwnerKey;
     }
 }
 exports.OfflineMeasurementQueue = OfflineMeasurementQueue;

package/dist/client/ovok-client.d.ts

@@ -1,8 +1,9 @@
-import { IClientStorage, MedplumClient, MedplumClientOptions, SubscriptionManager } from "@medplum/core";
+import { IClientStorage, LoginState, MedplumClient, MedplumClientOptions, SubscriptionManager } from "@medplum/core";
 import { Bundle, CapabilityStatement, Observation } from "@medplum/fhirtypes";
 import { OvokPublicApiEndpoint } from "../conformance/capability";
 import * as aiFhirMethods from "./ai-fhir/methods";
 import * as authMethods from "./auth/methods";
+import { OvokSavedAccount } from "./auth/types/Account";
 import * as botMethods from "./bot/methods";
 import * as changeHistoryMethods from "./change-history/methods";
 import * as aiMethods from "./chat/ai/methods";
@@ -34,6 +35,7 @@ export type OvokFhirVersion = "R4" | "R5";
 export declare class OvokClient extends MedplumClient {
     protected socialLoginClientId: string;
     clientStorage: IClientStorage | undefined;
+    private readonly hasExplicitStorageAdapter;
     private readonly offlineQueueOptions;
     private offlineMeasurementQueue;
     /**
@@ -44,6 +46,19 @@ export declare class OvokClient extends MedplumClient {
         socialLoginClientId?: string;
         offlineQueue?: OfflineMeasurementQueueOptions;
     });
+    /** Lists saved accounts without exposing their access or refresh tokens. */
+    getSavedAccounts(): OvokSavedAccount[];
+    /** Activates a previously saved account without asking for its password again. */
+    switchAccount(accountId: string): Promise<void>;
+    /**
+     * Ends the selected account's current server session and removes its saved login.
+     * The account is retained locally if the server cannot confirm the logout.
+     */
+    removeAccount(accountId: string): Promise<void>;
+    /** Removes every saved account and expiry marker from client storage. */
+    clearAllAccounts(): void;
+    /** Reauthentication clears the expired marker for the account that signed in. */
+    setActiveLogin(login: LoginState): Promise<void>;
     /** Saves a measurement immediately, or durably queues it when the opt-in queue is enabled. */
     saveMeasurement(params: GenerateObservationBodyParams): Promise<SaveObservationsResult>;
     /** Reads Ovok's composed FHIR and public-route capability statement. */
@@ -55,6 +70,16 @@ export declare class OvokClient extends MedplumClient {
     /** Flushes measurements queued while offline. Call this on connectivity/app-resume events. */
     flushOfflineMeasurementQueue(options?: OfflineMeasurementFlushOptions): Promise<OfflineMeasurementFlushResult>;
     private getOfflineMeasurementQueue;
+    /**
+     * Medplum clears its entire client storage after an unrecoverable 401. Keep
+     * saved accounts (marking only the active one expired) and queued measurements.
+     * Use clearAllAccounts() when the caller intends to remove all saved accounts.
+     */
+    clear(): void;
+    private getLogin;
+    private getExpiredAccountIds;
+    private setAccountExpired;
+    private restoreActiveLogin;
     private executeConditionalObservationCreates;
     private executeObservationBundle;
     private bindMethods;

package/dist/client/ovok-client.js

@@ -63,16 +63,20 @@ const slimMethods = __importStar(require("./slim/methods"));
 exports.MAX_CONDITIONAL_OBSERVATION_ENTRIES = 8;
 var observation_bundle_utils_2 = require("./observation/observation-bundle-utils");
 Object.defineProperty(exports, "MAX_OBSERVATION_BUNDLE_BYTES", { enumerable: true, get: function () { return observation_bundle_utils_2.MAX_OBSERVATION_BUNDLE_BYTES; } });
+const LOGINS_STORAGE_KEY = "logins";
+const EXPIRED_ACCOUNTS_STORAGE_KEY = "ovok.core.expired-accounts";
 class OvokClient extends core_1.MedplumClient {
     /**
      * @param config - The configuration for the client.
      * @param config.socialLoginClientId - The social login client id to use for the client.
      */
     constructor(config) {
-        var _a, _b;
-        super(config);
+        var _a, _b, _c;
+        const storage = (_a = config.storage) !== null && _a !== void 0 ? _a : new core_1.ClientStorage();
+        super({ ...config, storage });
         this.socialLoginClientId = "";
-        this.socialLoginClientId = (_a = config.socialLoginClientId) !== null && _a !== void 0 ? _a : "";
+        this.hasExplicitStorageAdapter = config.storage !== undefined;
+        this.socialLoginClientId = (_b = config.socialLoginClientId) !== null && _b !== void 0 ? _b : "";
         this.bindMethods(authMethods);
         this.bindMethods(observationMethods);
         this.bindMethods(questionnaireResponseMethods);
@@ -96,8 +100,88 @@ class OvokClient extends core_1.MedplumClient {
             });
             return (0, errors_1.isSignalsError)(mapped) ? mapped : (0, ovok_error_1.mapOvokApiError)(mapped);
         });
-        this.clientStorage = config.storage;
-        this.offlineQueueOptions = (_b = config.offlineQueue) !== null && _b !== void 0 ? _b : {};
+        this.clientStorage = storage;
+        this.offlineQueueOptions = (_c = config.offlineQueue) !== null && _c !== void 0 ? _c : {};
+    }
+    /** Lists saved accounts without exposing their access or refresh tokens. */
+    getSavedAccounts() {
+        var _a, _b;
+        const activeAccountId = (_b = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
+        const expiredAccountIds = new Set(this.getExpiredAccountIds());
+        return this.getLogins().flatMap((login) => {
+            var _a;
+            const id = (_a = login.profile) === null || _a === void 0 ? void 0 : _a.reference;
+            return id
+                ? [{
+                        id,
+                        profile: login.profile,
+                        project: login.project,
+                        active: id === activeAccountId,
+                        expired: expiredAccountIds.has(id),
+                    }]
+                : [];
+        });
+    }
+    /** Activates a previously saved account without asking for its password again. */
+    async switchAccount(accountId) {
+        const login = this.getLogin(accountId);
+        if (!login) {
+            throw new Error(`No saved account found for ${accountId}.`);
+        }
+        if (this.getExpiredAccountIds().includes(accountId)) {
+            throw new Error("This account's session has expired. Sign in again.");
+        }
+        await this.setActiveLogin(login);
+    }
+    /**
+     * Ends the selected account's current server session and removes its saved login.
+     * The account is retained locally if the server cannot confirm the logout.
+     */
+    async removeAccount(accountId) {
+        var _a, _b;
+        const login = this.getLogin(accountId);
+        if (!login) {
+            throw new Error(`No saved account found for ${accountId}.`);
+        }
+        const previousLogin = this.getActiveLogin();
+        try {
+            await this.setActiveLogin(login);
+            await this.delete("auth/session/current");
+        }
+        catch (error) {
+            if (previousLogin && previousLogin.profile.reference !== accountId) {
+                await this.restoreActiveLogin(previousLogin);
+            }
+            throw error;
+        }
+        this.clearActiveLogin();
+        const remainingLogins = this.getLogins().filter((savedLogin) => savedLogin.profile.reference !== accountId);
+        (_a = this.clientStorage) === null || _a === void 0 ? void 0 : _a.setObject(LOGINS_STORAGE_KEY, remainingLogins);
+        this.setAccountExpired(accountId, false);
+        const nextLogin = (_b = ((previousLogin === null || previousLogin === void 0 ? void 0 : previousLogin.profile.reference) !== accountId ? previousLogin : undefined)) !== null && _b !== void 0 ? _b : remainingLogins[0];
+        if (nextLogin) {
+            await this.restoreActiveLogin(nextLogin);
+        }
+    }
+    /** Removes every saved account and expiry marker from client storage. */
+    clearAllAccounts() {
+        var _a;
+        const storage = this.clientStorage;
+        const queueKey = (_a = this.offlineQueueOptions.storageKey) !== null && _a !== void 0 ? _a : offline_1.OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY;
+        const queuedMeasurements = storage === null || storage === void 0 ? void 0 : storage.getObject(queueKey);
+        super.clear();
+        if (Array.isArray(queuedMeasurements)) {
+            storage === null || storage === void 0 ? void 0 : storage.setObject(queueKey, queuedMeasurements);
+        }
+    }
+    /** Reauthentication clears the expired marker for the account that signed in. */
+    async setActiveLogin(login) {
+        var _a;
+        await super.setActiveLogin(login);
+        const accountId = (_a = login.profile) === null || _a === void 0 ? void 0 : _a.reference;
+        if (accountId) {
+            this.setAccountExpired(accountId, false);
+        }
     }
     /** Saves a measurement immediately, or durably queues it when the opt-in queue is enabled. */
     async saveMeasurement(params) {
@@ -145,12 +229,85 @@ class OvokClient extends core_1.MedplumClient {
         if (this.offlineQueueOptions.enabled !== true) {
             return undefined;
         }
-        if (!this.clientStorage) {
+        if (!this.clientStorage || !this.hasExplicitStorageAdapter) {
             throw new Error("Offline measurement queue requires a durable client storage adapter.");
         }
-        (_a = this.offlineMeasurementQueue) !== null && _a !== void 0 ? _a : (this.offlineMeasurementQueue = new offline_1.OfflineMeasurementQueue(this.clientStorage, (bundle) => this.executeObservationBundle(bundle), this.offlineQueueOptions));
+        (_a = this.offlineMeasurementQueue) !== null && _a !== void 0 ? _a : (this.offlineMeasurementQueue = new offline_1.OfflineMeasurementQueue(this.clientStorage, (bundle) => this.executeObservationBundle(bundle), {
+            ...this.offlineQueueOptions,
+            getOwnerKey: () => {
+                var _a, _b, _c;
+                const login = this.getActiveLogin();
+                const profileReference = (_a = login === null || login === void 0 ? void 0 : login.profile) === null || _a === void 0 ? void 0 : _a.reference;
+                if (!profileReference) {
+                    return undefined;
+                }
+                return [
+                    this.getBaseUrl(),
+                    (_c = (_b = login === null || login === void 0 ? void 0 : login.project) === null || _b === void 0 ? void 0 : _b.reference) !== null && _c !== void 0 ? _c : "",
+                    profileReference,
+                ].join("|");
+            },
+        }));
         return this.offlineMeasurementQueue;
     }
+    /**
+     * Medplum clears its entire client storage after an unrecoverable 401. Keep
+     * saved accounts (marking only the active one expired) and queued measurements.
+     * Use clearAllAccounts() when the caller intends to remove all saved accounts.
+     */
+    clear() {
+        var _a, _b, _c;
+        const storage = this.clientStorage;
+        const logins = this.getLogins();
+        const activeAccountId = (_b = (_a = this.getActiveLogin()) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
+        const expiredAccountIds = new Set(this.getExpiredAccountIds());
+        if (activeAccountId) {
+            expiredAccountIds.add(activeAccountId);
+        }
+        const queueKey = (_c = this.offlineQueueOptions.storageKey) !== null && _c !== void 0 ? _c : offline_1.OFFLINE_MEASUREMENT_QUEUE_STORAGE_KEY;
+        const queuedMeasurements = storage === null || storage === void 0 ? void 0 : storage.getObject(queueKey);
+        super.clear();
+        if (logins.length > 0) {
+            storage === null || storage === void 0 ? void 0 : storage.setObject(LOGINS_STORAGE_KEY, logins);
+        }
+        if (expiredAccountIds.size > 0) {
+            storage === null || storage === void 0 ? void 0 : storage.setObject(EXPIRED_ACCOUNTS_STORAGE_KEY, Array.from(expiredAccountIds));
+        }
+        if (Array.isArray(queuedMeasurements)) {
+            storage === null || storage === void 0 ? void 0 : storage.setObject(queueKey, queuedMeasurements);
+        }
+    }
+    getLogin(accountId) {
+        return this.getLogins().find((login) => { var _a; return ((_a = login.profile) === null || _a === void 0 ? void 0 : _a.reference) === accountId; });
+    }
+    getExpiredAccountIds() {
+        var _a, _b;
+        return ((_b = (_a = this.clientStorage) === null || _a === void 0 ? void 0 : _a.getObject(EXPIRED_ACCOUNTS_STORAGE_KEY)) !== null && _b !== void 0 ? _b : []);
+    }
+    setAccountExpired(accountId, expired) {
+        var _a, _b;
+        const expiredAccountIds = new Set(this.getExpiredAccountIds());
+        if (expired) {
+            expiredAccountIds.add(accountId);
+        }
+        else {
+            expiredAccountIds.delete(accountId);
+        }
+        if (expiredAccountIds.size > 0) {
+            (_a = this.clientStorage) === null || _a === void 0 ? void 0 : _a.setObject(EXPIRED_ACCOUNTS_STORAGE_KEY, Array.from(expiredAccountIds));
+        }
+        else {
+            (_b = this.clientStorage) === null || _b === void 0 ? void 0 : _b.setString(EXPIRED_ACCOUNTS_STORAGE_KEY, undefined);
+        }
+    }
+    async restoreActiveLogin(login) {
+        try {
+            await this.setActiveLogin(login);
+        }
+        catch (_a) {
+            // Keep the saved login available for a later retry if restoration is offline.
+        }
+    }
     async executeConditionalObservationCreates(observations) {
         const entries = observations.map(offline_1.entryForObservation);
         return this.executeObservationBundle({

package/dist/conformance/capability-requirements.js

@@ -48,7 +48,7 @@ exports.OVOK_CORE_REQUIREMENTS = {
     description: "The FHIR surface a server must provide for the @ovok/core client library's own methods to function.",
     software: {
         name: "@ovok/core",
-        version: "0.4.21",
+        version: "0.4.23",
     },
     fhirVersion: "4.0.1",
     format: ["json"],

package/dist/index.d.ts

@@ -929,6 +929,7 @@ export * from "./client/errors/ovok-error";
 export * from "./client/auth/errors";
 export type { RegisterBody } from "./client/auth/types/RegisterBody";
 export type { RegisterPractitionerBody } from "./client/auth/types/RegisterPractitionerBody";
+export type { OvokSavedAccount } from "./client/auth/types/Account";
 export { MAX_CONDITIONAL_OBSERVATION_ENTRIES, MAX_OBSERVATION_BUNDLE_BYTES, } from "./client/ovok-client";
 export type { SaveObservationsResult } from "./client/ovok-client";
 export * from "./client/offline";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ovok/core",
-  "version": "0.4.21",
+  "version": "0.4.23",
   "private": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",