Enable the online_access scope #61

smart-on-fhir · Dec 27, 2019 · 4f0339e · 4f0339e
1 parent aa5a484
commit 4f0339e
Show file tree

Hide file tree

Showing 3 changed files with 524 additions and 489 deletions.
diff --git a/src/Client.js b/src/Client.js
@@ -705,8 +705,8 @@ export default class FhirClient
         }
 
         const scopes = getPath(this, "state.tokenResponse.scope") || "";
-        if (scopes.indexOf("offline_access") == -1) {
-            throw new Error("Unable to refresh. No offline_access scope found.");
+        if (scopes.indexOf("offline_access") == -1 && scopes.indexOf("online_access") == -1) {
+            throw new Error("Unable to refresh. No offline_access or online_access scope found.");
         }
 
         // This method is typically called internally from `request` if certain
@@ -720,7 +720,8 @@ export default class FhirClient
                 headers: {
                     "content-type": "application/x-www-form-urlencoded"
                 },
-                body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`
+                body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
+                credentials: "include"
             }).then(data => {
                 if (!data.access_token) {
                     throw new Error("No access token received");

diff --git a/test/Client.test.js b/test/Client.test.js
@@ -2240,7 +2240,7 @@ describe("FHIR.client", () => {
                     scope        : "test"
                 }
             }).refresh(),
-            "throws with no offline_access scope"
+            "throws with no offline_access or online_access scope"
         ).to.throw(Error, /\boffline_access\b/);
 
         expect(
@@ -2276,6 +2276,28 @@ describe("FHIR.client", () => {
             })(),
             "throws if the token endpoint does not return access_token"
         ).to.reject(Error, "No access token received");
+
+        await expect(
+            (() => {
+                const env = new BrowserEnv();
+                mockServer.mock({
+                    headers: { "content-type": "application/json" },
+                    status: 200,
+                    body: { result: false }
+                });
+                const client = new Client(env, {
+                    serverUrl: "http://whatever",
+                    tokenUri : mockUrl,
+                    tokenResponse: {
+                        access_token : "whatever",
+                        refresh_token: "whatever",
+                        scope        : "online_access"
+                    }
+                });
+                return client.refresh();
+            })(),
+            "throws if the token endpoint does not return access_token for online_access"
+        ).to.reject(Error, "No access token received");
     });
 
     it ("client.refresh", async () => {