@ovok/core 0.4.43 → 0.4.44

package/README.md

@@ -446,8 +446,9 @@ The backend allows three kinds of read:
 Signed out, a read rejects with `SignInRequiredError` (`isSignInRequiredError(error)`) before
 any request is sent, unless it passes `allowSignedOut: true` and a `tenantCode`. `getLegalPage`,
 `getTranslations` and their hooks turn `allowSignedOut` on by default; pass it yourself only for
-another collection the backend serves without a key or session. A request that returns 401 can
-clear the session storage and call `onUnauthenticated`. A hook that rendered before sign-in needs
+another collection the backend serves without a key or session. A 401 from an ordinary request can
+clear the session storage and call `onUnauthenticated`; a 401 from password sign-in is instead a
+`LoginError` and leaves the active account untouched. A hook that rendered before sign-in needs
 `reload()` once the session exists.
 
 `locale` takes an app language or a CMS locale (`en`, `de`, `fr`, `es`). `toCmsLocale` maps
@@ -541,6 +542,14 @@ if ("nextStep" in result && result.nextStep === "mfa") {
 }
 ```
 
+### Password sign-in errors
+
+Password sign-in failures throw `LoginError`. A 401 has `code: "invalid_credentials"` and the
+server's message; it does not refresh tokens, clear an existing account, or call
+`onUnauthenticated`. A 429 has `code: "rate_limited"` and includes `retryAfterMs` when the server
+provides a retry delay. Show the error or a wait message to the user, then honor that delay before
+another attempt. The backend controls the lockout threshold and duration.
+
 ## Patient registration invitations
 
 When a project invites people with a business email address to join as clinicians,

package/dist/client/auth/session-fetch.js

@@ -3,8 +3,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSessionFetch = createSessionFetch;
 /* eslint-disable max-lines -- one refresh state machine; splitting it would scatter its shared session state. */
 const core_1 = require("@medplum/core");
+const ovok_error_1 = require("../errors/ovok-error");
 const account_storage_1 = require("./account-storage");
 const session_http_1 = require("./session-http");
+const LoginError_1 = require("./types/LoginError");
+/** These POSTs authenticate a new session; a failed attempt must not invalidate an existing one. */
+const isSignInRequest = (url, options, normalizedBaseUrl) => {
+    var _a;
+    if (((_a = options === null || options === void 0 ? void 0 : options.method) === null || _a === void 0 ? void 0 : _a.toUpperCase()) !== "POST") {
+        return false;
+    }
+    const baseUrl = new URL(normalizedBaseUrl);
+    const requestUrl = new URL(url, normalizedBaseUrl);
+    if (requestUrl.origin !== baseUrl.origin) {
+        return false;
+    }
+    const path = (requestUrl.pathname.startsWith(baseUrl.pathname)
+        ? requestUrl.pathname.slice(baseUrl.pathname.length)
+        : requestUrl.pathname.slice(1)).replace(/^\/+|\/+$/g, "");
+    return [
+        /^auth\/login$/,
+        /^v2\/auth\/login$/,
+        /^auth\/tenant\/(?:Patient|Practitioner)\/login\/(?:start|mfa|token)$/,
+        /^v1\/saas\/login(?:\/token)?$/,
+    ].some((route) => route.test(path));
+};
 /**
  * The client's `fetch`: request timeouts, token-refresh retries within the access token's
  * lifetime, and tracking why a session ended, which `onUnauthenticated` reports.
@@ -28,6 +51,7 @@ function createSessionFetch({ config, storage, fetchImplementation, normalizedBa
     };
     const fetchOnce = async (url, options) => {
         const response = await (0, session_http_1.fetchWithTimeout)(fetchImplementation, url, options, config.requestTimeoutMs);
+        const signInRequest = isSignInRequest(url, options, normalizedBaseUrl);
         const retry = !response.ok && !isTokenRefresh(url, options)
             ? { milliseconds: await (0, session_http_1.retryAfterMs)(response) }
             : undefined;
@@ -71,12 +95,18 @@ function createSessionFetch({ config, storage, fetchImplementation, normalizedBa
                 status: response.status,
             };
         }
-        else if (response.status === 401) {
+        else if (response.status === 401 && !signInRequest) {
             unauthenticatedReason = { type: "request-unauthorized", status: 401 };
         }
-        return isTokenRefresh(url, options)
+        const responseWithMetadata = isTokenRefresh(url, options)
             ? response
-            : (0, session_http_1.withHttpErrorMetadata)(response, retry);
+            : await (0, session_http_1.withHttpErrorMetadata)(response, retry);
+        if (signInRequest && (response.status === 401 || response.status === 429)) {
+            const status = response.status;
+            const details = (0, ovok_error_1.readOvokError)({ outcome: await responseWithMetadata.clone().json() });
+            throw new LoginError_1.LoginError(status === 401 ? "invalid_credentials" : "rate_limited", details.message, [], details.requestId, status, details.retryAfterMs);
+        }
+        return responseWithMetadata;
     };
     const fetchWithRefreshRetry = async (url, options) => {
         var _a, _b, _c, _d, _e;

package/dist/client/auth/types/LoginError.d.ts

@@ -1,12 +1,13 @@
 import type { LoginResponse } from "./LoginResponse";
 import type { StartLoginResponse } from "./StartLoginResponse";
-/** A login selection error with fields apps can branch on without parsing prose. */
+/** A typed sign-in error with fields apps can branch on without parsing prose. */
 export declare class LoginError extends Error {
-    readonly code: "profile_not_found" | "tenant_code_required" | "tenant_code_not_found";
+    readonly code: "profile_not_found" | "tenant_code_required" | "tenant_code_not_found" | "invalid_credentials" | "rate_limited";
     readonly profiles: LoginProfile[];
-    readonly status = 400;
+    readonly status: 400 | 401 | 429;
     readonly requestId: string | undefined;
-    constructor(code: "profile_not_found" | "tenant_code_required" | "tenant_code_not_found", message: string, profiles?: LoginProfile[], requestId?: string);
+    readonly retryAfterMs: number | undefined;
+    constructor(code: "profile_not_found" | "tenant_code_required" | "tenant_code_not_found" | "invalid_credentials" | "rate_limited", message: string, profiles?: LoginProfile[], requestId?: string, status?: 400 | 401 | 429, retryAfterMs?: number);
 }
 export type LoginProfile = NonNullable<StartLoginResponse["profiles"]>[number];
 export type TenantLoginStart = {

package/dist/client/auth/types/LoginError.js

@@ -1,15 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoginError = void 0;
-/** A login selection error with fields apps can branch on without parsing prose. */
+/** A typed sign-in error with fields apps can branch on without parsing prose. */
 class LoginError extends Error {
-    constructor(code, message, profiles = [], requestId) {
+    constructor(code, message, profiles = [], requestId, status = 400, retryAfterMs) {
         super(message);
         this.code = code;
         this.profiles = profiles;
-        this.status = 400;
         this.name = "LoginError";
+        this.status = status;
         this.requestId = requestId;
+        this.retryAfterMs = retryAfterMs;
     }
 }
 exports.LoginError = LoginError;

package/dist/client/ovok-client.js

@@ -43,6 +43,7 @@ const errors_1 = require("./auth/errors");
 const authMethods = __importStar(require("./auth/methods"));
 const session_fetch_1 = require("./auth/session-fetch");
 const session_http_1 = require("./auth/session-http");
+const LoginError_1 = require("./auth/types/LoginError");
 const botMethods = __importStar(require("./bot/methods"));
 const changeHistoryMethods = __importStar(require("./change-history/methods"));
 const aiMethods = __importStar(require("./chat/ai/methods"));
@@ -125,7 +126,7 @@ class OvokClient extends core_1.MedplumClient {
         this.refreshState = session.refreshState;
         this.socialLoginClientId = (_e = config.socialLoginClientId) !== null && _e !== void 0 ? _e : "";
         this.addEventListener("profileRefreshed", () => this.syncSavedAccountProfile());
-        this.bindMethods(authMethods);
+        this.bindMethods(authMethods, (error) => error instanceof LoginError_1.LoginError ? error : this.mapError(error));
         this.bindMethods(observationMethods);
         this.bindMethods(questionnaireResponseMethods);
         this.bindMethods(aiMethods);

package/dist/conformance/capability-requirements.js

@@ -48,7 +48,7 @@ exports.OVOK_CORE_REQUIREMENTS = {
     description: "The FHIR surface a server must provide for the @ovok/core client library's own methods to function.",
     software: {
         name: "@ovok/core",
-        version: "0.4.43",
+        version: "0.4.44",
     },
     fhirVersion: "4.0.1",
     format: ["json"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ovok/core",
-  "version": "0.4.43",
+  "version": "0.4.44",
   "private": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",