@ovok/core 0.4.30 → 0.4.31

package/dist/client/ovok-client.d.ts

@@ -32,6 +32,24 @@ export type SaveObservationsResult = {
     queueId: string;
 };
 export type OvokFhirVersion = "R4" | "R5";
+export type OvokUnauthenticatedReason = {
+    type: "refresh-rejected";
+    status: 400 | 401 | 403;
+} | {
+    type: "refresh-unavailable";
+    status?: number;
+} | {
+    type: "authentication-rejected";
+    status: number;
+} | {
+    type: "request-unauthorized";
+    status: 401;
+};
+export type OvokClientOptions = Omit<MedplumClientOptions, "onUnauthenticated"> & {
+    onUnauthenticated?: (reason: OvokUnauthenticatedReason) => void;
+    socialLoginClientId?: string;
+    offlineQueue?: OfflineMeasurementQueueOptions;
+};
 export declare class OvokClient extends MedplumClient {
     protected socialLoginClientId: string;
     clientStorage: IClientStorage | undefined;
@@ -42,10 +60,7 @@ export declare class OvokClient extends MedplumClient {
      * @param config - The configuration for the client.
      * @param config.socialLoginClientId - The social login client id to use for the client.
      */
-    constructor(config: MedplumClientOptions & {
-        socialLoginClientId?: string;
-        offlineQueue?: OfflineMeasurementQueueOptions;
-    });
+    constructor(config: OvokClientOptions);
     /** Lists saved accounts without exposing their access or refresh tokens. */
     getSavedAccounts(): OvokSavedAccount[];
     /** Activates a previously saved account without asking for its password again. */

package/dist/client/ovok-client.js

@@ -64,6 +64,53 @@ const slimMethods = __importStar(require("./slim/methods"));
 exports.MAX_CONDITIONAL_OBSERVATION_ENTRIES = 8;
 var observation_bundle_utils_2 = require("./observation/observation-bundle-utils");
 Object.defineProperty(exports, "MAX_OBSERVATION_BUNDLE_BYTES", { enumerable: true, get: function () { return observation_bundle_utils_2.MAX_OBSERVATION_BUNDLE_BYTES; } });
+const retryAfterMs = (response) => {
+    var _a, _b;
+    const value = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, "Retry-After");
+    if (!value) {
+        return undefined;
+    }
+    const seconds = Number(value);
+    if (Number.isFinite(seconds)) {
+        return Math.max(0, seconds * 1000);
+    }
+    const date = Date.parse(value);
+    return Number.isFinite(date) ? Math.max(0, date - Date.now()) : undefined;
+};
+const waitForRetry = (milliseconds, signal) => new Promise((resolve, reject) => {
+    var _a;
+    if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
+        const error = new Error("Token refresh aborted");
+        error.name = "AbortError";
+        reject((_a = signal.reason) !== null && _a !== void 0 ? _a : error);
+        return;
+    }
+    const timer = setTimeout(() => {
+        signal === null || signal === void 0 ? void 0 : signal.removeEventListener("abort", abort);
+        resolve();
+    }, milliseconds);
+    const abort = () => {
+        var _a;
+        clearTimeout(timer);
+        const error = new Error("Token refresh aborted");
+        error.name = "AbortError";
+        reject((_a = signal === null || signal === void 0 ? void 0 : signal.reason) !== null && _a !== void 0 ? _a : error);
+    };
+    signal === null || signal === void 0 ? void 0 : signal.addEventListener("abort", abort, { once: true });
+});
+const isTemporaryRefreshFailure = (status) => status === 429 || (status >= 500 && status <= 599);
+const refreshUnavailableError = (response) => {
+    const error = new Error("Token refresh is temporarily unavailable");
+    error.name = "NetworkError";
+    Object.assign(error, { cause: response });
+    return error;
+};
+const refreshResponseError = (response) => {
+    const error = new Error(`Token refresh returned HTTP ${response.status}`);
+    error.name = "TokenRefreshError";
+    Object.assign(error, { status: response.status, cause: response });
+    return error;
+};
 const isNetworkError = (error) => {
     if (!(error instanceof Error)) {
         return false;
@@ -87,25 +134,174 @@ class OvokClient extends core_1.MedplumClient {
         const baseUrl = (_c = config.baseUrl) !== null && _c !== void 0 ? _c : "https://api.medplum.com/";
         const normalizedBaseUrl = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
         const tokenUrl = new URL((_d = config.tokenUrl) !== null && _d !== void 0 ? _d : "oauth2/token", normalizedBaseUrl).href;
-        super({
-            ...config,
-            storage,
-            fetch: async (url, options) => {
-                var _a, _b;
-                const response = await fetchImplementation(url, options);
-                const requestUrl = new URL(url, normalizedBaseUrl);
-                const refreshRefused = requestUrl.href === tokenUrl && [400, 401, 403].includes(response.status);
-                const sessionEnded = requestUrl.pathname.endsWith("/auth/session/current") && response.status === 401;
-                if (refreshRefused || sessionEnded) {
+        let unauthenticatedReason;
+        let clearActiveLogin = () => undefined;
+        let terminalRefreshToken;
+        let terminalRefreshError;
+        const isTokenRefresh = (url, options) => new URL(url, normalizedBaseUrl).href === tokenUrl &&
+            (options === null || options === void 0 ? void 0 : options.method) === "POST" &&
+            typeof options.body === "string" &&
+            new URLSearchParams(options.body).get("grant_type") === "refresh_token";
+        const markActiveAccountExpired = () => {
+            var _a, _b;
+            const accountId = (_b = (_a = storage.getObject("activeLogin")) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
+            if (accountId) {
+                (0, account_storage_1.setStoredAccountExpired)(storage, accountId, true);
+            }
+        };
+        const fetchOnce = async (url, options) => {
+            var _a, _b;
+            const response = await fetchImplementation(url, options);
+            const requestUrl = new URL(url, normalizedBaseUrl);
+            if (isTokenRefresh(url, options)) {
+                if (response.status === 400) {
+                    let invalidGrant = false;
+                    try {
+                        invalidGrant = (await response.clone().json()).error === "invalid_grant";
+                    }
+                    catch (_c) {
+                        // Do not sign out unless the response confirms that the refresh token was revoked.
+                    }
+                    if (!invalidGrant) {
+                        throw refreshResponseError(response);
+                    }
+                }
+                if ([400, 401, 403].includes(response.status)) {
+                    unauthenticatedReason = {
+                        type: "refresh-rejected",
+                        status: response.status,
+                    };
+                    markActiveAccountExpired();
+                }
+                else if (response.ok) {
                     const accountId = (_b = (_a = storage.getObject("activeLogin")) === null || _a === void 0 ? void 0 : _a.profile) === null || _b === void 0 ? void 0 : _b.reference;
                     if (accountId) {
-                        (0, account_storage_1.setStoredAccountExpired)(storage, accountId, true);
+                        (0, account_storage_1.setStoredAccountExpired)(storage, accountId, false);
                     }
+                    unauthenticatedReason = undefined;
+                }
+            }
+            else if (requestUrl.href === tokenUrl && !response.ok) {
+                unauthenticatedReason = {
+                    type: "authentication-rejected",
+                    status: response.status,
+                };
+            }
+            else if (response.status === 401) {
+                unauthenticatedReason = { type: "request-unauthorized", status: 401 };
+            }
+            return response;
+        };
+        const fetchWithRefreshRetry = async (url, options) => {
+            var _a, _b, _c, _d;
+            const requestUrl = new URL(url, normalizedBaseUrl);
+            if (!isTokenRefresh(url, options)) {
+                const response = await fetchOnce(url, options);
+                const sessionEnded = requestUrl.pathname.endsWith("/auth/session/current") && response.status === 401;
+                if (sessionEnded) {
+                    markActiveAccountExpired();
                 }
                 return response;
+            }
+            const login = storage.getObject("activeLogin");
+            if (terminalRefreshError) {
+                if ((login === null || login === void 0 ? void 0 : login.accessToken) && login.accessToken !== terminalRefreshToken) {
+                    terminalRefreshToken = undefined;
+                    terminalRefreshError = undefined;
+                }
+                else {
+                    throw terminalRefreshError;
+                }
+            }
+            const expiresAt = (login === null || login === void 0 ? void 0 : login.accessToken) ? (0, core_1.tryGetJwtExpiration)(login.accessToken) : undefined;
+            const signal = options === null || options === void 0 ? void 0 : options.signal;
+            if (expiresAt !== undefined && options) {
+                const tokenRequestOptions = options;
+                tokenRequestOptions.maxRetries = 0;
+                tokenRequestOptions.maxRetryTime = 0;
+            }
+            if (expiresAt === undefined) {
+                const response = await fetchOnce(url, options);
+                if (isTemporaryRefreshFailure(response.status)) {
+                    void ((_a = response.body) === null || _a === void 0 ? void 0 : _a.cancel().catch(() => undefined));
+                    throw refreshUnavailableError(response);
+                }
+                return response;
+            }
+            let attempt = 0;
+            let firstAttempt = true;
+            let lastResponse;
+            let lastNetworkError;
+            while (firstAttempt || Date.now() < expiresAt) {
+                firstAttempt = false;
+                try {
+                    lastResponse = await fetchOnce(url, options);
+                }
+                catch (error) {
+                    if ((signal === null || signal === void 0 ? void 0 : signal.aborted) || !isNetworkError(error)) {
+                        throw error;
+                    }
+                    if (Date.now() >= expiresAt) {
+                        lastNetworkError = error;
+                        break;
+                    }
+                    lastNetworkError = error;
+                    const remainingMs = expiresAt - Date.now();
+                    const backoffMs = Math.min(500 * (2 ** Math.min(attempt, 6)), 30000);
+                    await waitForRetry(Math.min(backoffMs, remainingMs), signal);
+                    attempt += 1;
+                    continue;
+                }
+                if (!isTemporaryRefreshFailure(lastResponse.status)) {
+                    return lastResponse;
+                }
+                const remainingMs = expiresAt - Date.now();
+                if (remainingMs <= 0) {
+                    break;
+                }
+                const backoffMs = Math.min(500 * (2 ** Math.min(attempt, 6)), 30000);
+                const waitMs = Math.min(Math.max((_b = retryAfterMs(lastResponse)) !== null && _b !== void 0 ? _b : 0, backoffMs), remainingMs);
+                if (waitMs >= remainingMs) {
+                    await waitForRetry(remainingMs, signal);
+                    break;
+                }
+                void ((_c = lastResponse.body) === null || _c === void 0 ? void 0 : _c.cancel().catch(() => undefined));
+                await waitForRetry(waitMs, signal);
+                attempt += 1;
+            }
+            const status = lastResponse === null || lastResponse === void 0 ? void 0 : lastResponse.status;
+            const reason = {
+                type: "refresh-unavailable",
+                ...(status === undefined ? {} : { status }),
+            };
+            unauthenticatedReason = reason;
+            markActiveAccountExpired();
+            if (lastResponse) {
+                return lastResponse;
+            }
+            terminalRefreshToken = login === null || login === void 0 ? void 0 : login.accessToken;
+            terminalRefreshError = lastNetworkError !== null && lastNetworkError !== void 0 ? lastNetworkError : refreshUnavailableError(undefined);
+            clearActiveLogin();
+            (_d = config.onUnauthenticated) === null || _d === void 0 ? void 0 : _d.call(config, reason);
+            unauthenticatedReason = undefined;
+            throw terminalRefreshError;
+        };
+        super({
+            ...config,
+            storage,
+            onUnauthenticated: () => {
+                var _a;
+                const reason = unauthenticatedReason !== null && unauthenticatedReason !== void 0 ? unauthenticatedReason : {
+                    type: "request-unauthorized",
+                    status: 401,
+                };
+                unauthenticatedReason = undefined;
+                (_a = config.onUnauthenticated) === null || _a === void 0 ? void 0 : _a.call(config, reason);
             },
+            fetch: fetchWithRefreshRetry,
         });
         this.socialLoginClientId = "";
+        clearActiveLogin = this.clearActiveLogin.bind(this);
         this.hasExplicitStorageAdapter = config.storage !== undefined;
         this.socialLoginClientId = (_e = config.socialLoginClientId) !== null && _e !== void 0 ? _e : "";
         this.addEventListener("profileRefreshed", () => this.syncSavedAccountProfile());

package/dist/conformance/capability-requirements.js

@@ -48,7 +48,7 @@ exports.OVOK_CORE_REQUIREMENTS = {
     description: "The FHIR surface a server must provide for the @ovok/core client library's own methods to function.",
     software: {
         name: "@ovok/core",
-        version: "0.4.30",
+        version: "0.4.31",
     },
     fhirVersion: "4.0.1",
     format: ["json"],

package/dist/index.d.ts

@@ -923,6 +923,7 @@ declare const Medplum: {
 };
 export { Medplum };
 export { OvokClient } from "./client/ovok-client";
+export type { OvokClientOptions, OvokUnauthenticatedReason } from "./client/ovok-client";
 export * from "./client/errors/rate-limit-error";
 export * from "./client/errors/sign-in-required-error";
 export * from "./client/errors/ovok-error";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ovok/core",
-  "version": "0.4.30",
+  "version": "0.4.31",
   "private": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",