@sasjs/adapter 4.17.2 → 4.18.0

package/package.json

@@ -92,12 +92,12 @@
   },
   "main": "index.js",
   "dependencies": {
-    "@sasjs/utils": "^3.5.6",
+    "@sasjs/utils": "^3.6.0",
     "axios": "1.18.1",
     "axios-cookiejar-support": "5.0.5",
     "form-data": "4.0.6",
     "https": "1.0.0",
     "tough-cookie": "4.1.3"
   },
-  "version": "4.17.2"
+  "version": "4.18.0"
 }

package/src/SASViyaApiClient.ts

@@ -18,12 +18,17 @@ import {
 } from './types/errors'
 import { SessionManager } from './SessionManager'
 import { ContextManager } from './ContextManager'
-import { SasAuthResponse, MacroVar, AuthConfig } from '@sasjs/utils/types'
+import {
+  SasAuthResponse,
+  MacroVar,
+  AuthConfig,
+  ServerType
+} from '@sasjs/utils/types'
 import { isAuthorizeFormRequired } from './auth/isAuthorizeFormRequired'
 import { RequestClient } from './request/RequestClient'
 import { prefixMessage } from '@sasjs/utils/error'
 import { pollJobState } from './api/viya/pollJobState'
-import { getTokens } from './auth/getTokens'
+import { getTokens, OnTokensRefreshed } from './auth/getTokens'
 import { uploadTables } from './api/viya/uploadTables'
 import { executeOnComputeApi } from './api/viya/executeOnComputeApi'
 import { getAccessTokenForViya } from './auth/getAccessTokenForViya'
@@ -337,6 +342,7 @@ export class SASViyaApiClient {
    * @param pollOptions - an object that represents poll interval(milliseconds) and maximum amount of attempts. Object example: { maxPollCount: 24 * 60 * 60, pollInterval: 1000 }. More information available at src/api/viya/pollJobState.ts.
    * @param printPid - a boolean that indicates whether the function should print (PID) of the started job.
    * @param variables - an object that represents macro variables.
+   * @param onTokensRefreshed - optional callback invoked with the rotated token pair after a successful internal refresh, so consumers that persist tokens can store the new pair.
    */
   public async executeScript(
     jobPath: string,
@@ -349,7 +355,8 @@ export class SASViyaApiClient {
     waitForResult = true,
     pollOptions?: PollOptions,
     printPid = false,
-    variables?: MacroVar
+    variables?: MacroVar,
+    onTokensRefreshed?: OnTokensRefreshed
   ): Promise<any> {
     return executeOnComputeApi(
       this.requestClient,
@@ -365,7 +372,8 @@ export class SASViyaApiClient {
       waitForResult,
       pollOptions,
       printPid,
-      variables
+      variables,
+      onTokensRefreshed
     )
   }
 
@@ -864,11 +872,17 @@ export class SASViyaApiClient {
     expectWebout = false,
     pollOptions?: PollOptions,
     printPid = false,
-    variables?: MacroVar
+    variables?: MacroVar,
+    onTokensRefreshed?: OnTokensRefreshed
   ) {
     let access_token = (authConfig || {}).access_token
     if (authConfig) {
-      ;({ access_token } = await getTokens(this.requestClient, authConfig))
+      ;({ access_token } = await getTokens(
+        this.requestClient,
+        authConfig,
+        ServerType.SasViya,
+        onTokensRefreshed
+      ))
     }
 
     if (isRelativePath(sasJob) && !this.rootFolderName) {
@@ -943,7 +957,8 @@ export class SASViyaApiClient {
       waitForResult,
       pollOptions,
       printPid,
-      variables
+      variables,
+      onTokensRefreshed
     )
   }
 
@@ -954,18 +969,25 @@ export class SASViyaApiClient {
    * @param debug - sets the _debug flag in the job arguments.
    * @param data - any data to be passed in as input to the job.
    * @param accessToken - an optional access token for an authorized user.
+   * @param onTokensRefreshed - optional callback invoked with the rotated token pair after a successful internal refresh, so consumers that persist tokens can store the new pair.
    */
   public async executeJob(
     sasJob: string,
     contextName: string,
     debug: boolean,
     data?: any,
-    authConfig?: AuthConfig
+    authConfig?: AuthConfig,
+    onTokensRefreshed?: OnTokensRefreshed
   ): Promise<JobExecutionResult> {
     let access_token = (authConfig || {}).access_token
 
     if (authConfig) {
-      ;({ access_token } = await getTokens(this.requestClient, authConfig))
+      ;({ access_token } = await getTokens(
+        this.requestClient,
+        authConfig,
+        ServerType.SasViya,
+        onTokensRefreshed
+      ))
     }
 
     if (isRelativePath(sasJob) && !this.rootFolderName) {
@@ -1050,11 +1072,14 @@ export class SASViyaApiClient {
       access_token
     )
 
-    const jobStatus = await this.pollJobState(postedJob, authConfig).catch(
-      (err) => {
-        throw prefixMessage(err, 'Error while polling job status. ')
-      }
-    )
+    const jobStatus = await this.pollJobState(
+      postedJob,
+      authConfig,
+      undefined,
+      onTokensRefreshed
+    ).catch((err) => {
+      throw prefixMessage(err, 'Error while polling job status. ')
+    })
 
     const { result: currentJob } = await this.requestClient.get<Job>(
       `${this.serverUrl}/jobExecution/jobs/${postedJob.id}`,
@@ -1138,14 +1163,17 @@ export class SASViyaApiClient {
   private async pollJobState(
     postedJob: Job,
     authConfig?: AuthConfig,
-    pollOptions?: PollOptions
+    pollOptions?: PollOptions,
+    onTokensRefreshed?: OnTokensRefreshed
   ) {
     return pollJobState(
       this.requestClient,
       postedJob,
       this.debug,
       authConfig,
-      pollOptions
+      pollOptions,
+      undefined,
+      onTokensRefreshed
     )
   }
 

package/src/SASjs.ts

@@ -16,6 +16,7 @@ import { SASViyaApiClient } from './SASViyaApiClient'
 import { SAS9ApiClient } from './SAS9ApiClient'
 import { SASjsApiClient, SASjsAuthResponse } from './SASjsApiClient'
 import { AuthManager } from './auth'
+import { OnTokensRefreshed } from './auth/getTokens'
 import {
   ServerType,
   MacroVar,
@@ -45,6 +46,7 @@ interface ExecuteScriptParams {
   authConfig?: AuthConfig
   authConfigSas9?: AuthConfigSas9
   debug?: boolean
+  onTokensRefreshed?: OnTokensRefreshed
 }
 
 const defaultConfig: SASjsConfig = {
@@ -101,6 +103,7 @@ export default class SASjs {
    * @param authConfig - (optional) a valid client, secret, refresh and access tokens that are authorised to execute scripts.
    * @param authConfigSas9 - (required for server type sas9) a valid username and password that are authorised to execute scripts.
    * @param debug - (optional) if true, global debug config will be overriden
+   * @param onTokensRefreshed - (optional, SAS Viya only) callback invoked with the rotated token pair after a successful internal refresh, so consumers that persist tokens can store the new pair.
    */
   public async executeScript({
     linesOfCode,
@@ -109,7 +112,8 @@ export default class SASjs {
     runTime,
     authConfig,
     authConfigSas9,
-    debug
+    debug,
+    onTokensRefreshed
   }: ExecuteScriptParams) {
     this.isMethodSupported('executeScript', [
       ServerType.Sas9,
@@ -157,7 +161,13 @@ export default class SASjs {
         contextName,
         authConfig,
         null,
-        debug ? debug : this.sasjsConfig.debug
+        debug ? debug : this.sasjsConfig.debug,
+        false,
+        true,
+        undefined,
+        false,
+        undefined,
+        onTokensRefreshed
       )
     }
   }

package/src/api/viya/executeOnComputeApi.ts

@@ -1,5 +1,5 @@
 import { timestampToYYYYMMDDHHMMSS } from '@sasjs/utils/time'
-import { AuthConfig, MacroVar } from '@sasjs/utils/types'
+import { AuthConfig, MacroVar, ServerType } from '@sasjs/utils/types'
 import { prefixMessage } from '@sasjs/utils/error'
 import {
   PollOptions,
@@ -7,7 +7,7 @@ import {
   ComputeJobExecutionError,
   NotFoundError
 } from '../..'
-import { getTokens } from '../../auth/getTokens'
+import { getTokens, OnTokensRefreshed } from '../../auth/getTokens'
 import { RequestClient } from '../../request/RequestClient'
 import { SessionManager } from '../../SessionManager'
 import { isRelativePath, fetchLogByChunks } from '../../utils'
@@ -32,6 +32,7 @@ interface JobRequestBody {
  * @param pollOptions - an object that represents poll interval(milliseconds) and maximum amount of attempts. Object example: { maxPollCount: 24 * 60 * 60, pollInterval: 1000 }. More information available at src/api/viya/pollJobState.ts.
  * @param printPid - a boolean that indicates whether the function should print (PID) of the started job.
  * @param variables - an object that represents macro variables.
+ * @param onTokensRefreshed - optional callback invoked with the rotated token pair after a successful internal refresh, so consumers that persist tokens can store the new pair.
  */
 export async function executeOnComputeApi(
   requestClient: RequestClient,
@@ -47,12 +48,18 @@ export async function executeOnComputeApi(
   waitForResult = true,
   pollOptions?: PollOptions,
   printPid = false,
-  variables?: MacroVar
+  variables?: MacroVar,
+  onTokensRefreshed?: OnTokensRefreshed
 ): Promise<any> {
   let access_token = (authConfig || {}).access_token
 
   if (authConfig) {
-    ;({ access_token } = await getTokens(requestClient, authConfig))
+    ;({ access_token } = await getTokens(
+      requestClient,
+      authConfig,
+      ServerType.SasViya,
+      onTokensRefreshed
+    ))
   }
 
   const logger = process.logger || console
@@ -173,7 +180,8 @@ export async function executeOnComputeApi(
       {
         session,
         sessionManager
-      }
+      },
+      onTokensRefreshed
     ).catch(async (err) => {
       const error = err?.response?.data
       const result = /err=[0-9]*,/.exec(error)
@@ -196,7 +204,12 @@ export async function executeOnComputeApi(
     })
 
     if (authConfig) {
-      ;({ access_token } = await getTokens(requestClient, authConfig))
+      ;({ access_token } = await getTokens(
+        requestClient,
+        authConfig,
+        ServerType.SasViya,
+        onTokensRefreshed
+      ))
     }
 
     const { result: currentJob } = await requestClient

package/src/api/viya/pollJobState.ts

@@ -1,6 +1,6 @@
-import { AuthConfig } from '@sasjs/utils/types'
+import { AuthConfig, ServerType } from '@sasjs/utils/types'
 import { Job, PollOptions, PollStrategy } from '../..'
-import { getTokens } from '../../auth/getTokens'
+import { getTokens, OnTokensRefreshed } from '../../auth/getTokens'
 import { RequestClient } from '../../request/RequestClient'
 import { JobStatePollError } from '../../types/errors'
 import { Link, WriteStream, SessionState, JobSessionManager } from '../../types'
@@ -46,7 +46,8 @@ export async function pollJobState(
   debug: boolean,
   authConfig?: AuthConfig,
   pollOptions?: PollOptions,
-  jobSessionManager?: JobSessionManager
+  jobSessionManager?: JobSessionManager,
+  onTokensRefreshed?: OnTokensRefreshed
 ): Promise<JobState> {
   const logger = process.logger || console
 
@@ -130,7 +131,8 @@ export async function pollJobState(
     authConfig,
     streamLog,
     logFileStream,
-    jobSessionManager
+    jobSessionManager,
+    onTokensRefreshed
   )
 
   currentState = result.state
@@ -162,7 +164,8 @@ export async function pollJobState(
       authConfig,
       streamLog,
       logFileStream,
-      jobSessionManager
+      jobSessionManager,
+      onTokensRefreshed
     )
 
     currentState = result.state
@@ -179,14 +182,21 @@ const getJobState = async (
   job: Job,
   currentState: string,
   debug: boolean,
-  authConfig?: AuthConfig
+  authConfig?: AuthConfig,
+  onTokensRefreshed?: OnTokensRefreshed
 ): Promise<JobState> => {
   const stateLink = job.links.find((l: any) => l.rel === 'state')!
 
   if (needsRetry(currentState)) {
     let tokens
 
-    if (authConfig) tokens = await getTokens(requestClient, authConfig)
+    if (authConfig)
+      tokens = await getTokens(
+        requestClient,
+        authConfig,
+        ServerType.SasViya,
+        onTokensRefreshed
+      )
 
     const { result: jobState } = await requestClient
       .get<string>(
@@ -236,7 +246,8 @@ export const doPoll = async (
   authConfig?: AuthConfig,
   streamLog?: boolean,
   logStream?: WriteStream,
-  jobSessionManager?: JobSessionManager
+  jobSessionManager?: JobSessionManager,
+  onTokensRefreshed?: OnTokensRefreshed
 ): Promise<{ state: JobState; pollCount: number }> => {
   const { maxPollCount, pollInterval } = pollOptions
   const logger = process.logger || console
@@ -287,7 +298,8 @@ export const doPoll = async (
       postedJob,
       state,
       debug,
-      authConfig
+      authConfig,
+      onTokensRefreshed
     ).catch((err) => {
       errorCount++
 

package/src/auth/getTokens.ts

@@ -8,26 +8,76 @@ import { RequestClient } from '../request/RequestClient'
 import { refreshTokensForViya } from './refreshTokensForViya'
 import { refreshTokensForSasjs } from './refreshTokensForSasjs'
 
+/**
+ * Callback invoked with the rotated token pair after a successful internal
+ * refresh. Viya refresh tokens are single-use/rotating, so consumers that
+ * persist tokens (e.g. the CLI writing `.env.{target}`) should pass a handler
+ * wherever this is accepted to avoid the persisted pair going stale.
+ */
+export type OnTokensRefreshed = (tokens: {
+  access_token: string
+  refresh_token: string
+}) => void | Promise<void>
+
 /**
  * Returns the auth configuration, refreshing the tokens if necessary.
  * This function can only be used by Node, if a server type is SASVIYA.
  * @param requestClient - the pre-configured HTTP request client
  * @param authConfig - an object containing a client ID, secret, access token and refresh token
  * @param serverType - server type for which refreshing the tokens, defaults to SASVIYA
+ * @param onTokensRefreshed - optional callback invoked with the rotated token
+ * pair after a successful internal refresh.
  */
 export async function getTokens(
   requestClient: RequestClient,
   authConfig: AuthConfig,
-  serverType: ServerType = ServerType.SasViya
+  serverType: ServerType = ServerType.SasViya,
+  onTokensRefreshed?: OnTokensRefreshed
 ): Promise<AuthConfig> {
   const logger = process.logger || console
-  let { access_token, refresh_token, client, secret } = authConfig
+  // Note: client/secret are NOT mutated. The sas.cli public-client fallback
+  // is applied only to the refresh call itself, so a caller that round-trips
+  // the returned AuthConfig into persistent storage never ends up saving
+  // fabricated CLIENT/SECRET values.
+  let { access_token, refresh_token } = authConfig
+  const { client, secret } = authConfig
+
+  // Tokens are not always decodable JWTs - some servers issue opaque tokens.
+  // jwt-decode throws InvalidTokenError for these; only in that case is the
+  // token treated as still valid (the server is the authority on expiry and
+  // will reject a genuinely expired token on use/refresh).
+  // Use a 300 s (5 min) safety margin instead of the isAccessTokenExpiring
+  // default of 3600 s (1 h).  Some Viya estates issue access tokens with a
+  // 1-hour TTL; with the 3600 s default a brand-new 1 h token is immediately
+  // considered "expiring", causing a redundant refresh even when the CLI has
+  // already refreshed the token moments earlier.  300 s is short enough that a
+  // fresh 1 h token (TTL ≈ 3600 ≫ 300) is NOT considered expiring, yet long
+  // enough to let a single API call complete before the token actually expires.
+  // Long-running jobs are protected because pollJobState calls getTokens on
+  // every poll, so a token that does expire mid-job is refreshed in-place.
+  let isAccessTokenExpiringSoon = false
+  try {
+    isAccessTokenExpiringSoon = isAccessTokenExpiring(access_token, 300)
+  } catch (e) {
+    if ((e as Error).name !== 'InvalidTokenError') throw e
+  }
+
+  let isRefreshTokenExpired = false
+  try {
+    isRefreshTokenExpired = hasTokenExpired(refresh_token)
+  } catch (e) {
+    if ((e as Error).name !== 'InvalidTokenError') throw e
+  }
+
+  let isRefreshTokenExpiringSoon = false
+  try {
+    isRefreshTokenExpiringSoon = isRefreshTokenExpiring(refresh_token)
+  } catch (e) {
+    if ((e as Error).name !== 'InvalidTokenError') throw e
+  }
 
-  if (
-    isAccessTokenExpiring(access_token) ||
-    isRefreshTokenExpiring(refresh_token)
-  ) {
-    if (hasTokenExpired(refresh_token)) {
+  if (isAccessTokenExpiringSoon || isRefreshTokenExpiringSoon) {
+    if (isRefreshTokenExpired) {
       const error =
         'Unable to obtain new access token. Your refresh token has expired.'
 
@@ -38,16 +88,39 @@ export async function getTokens(
 
     logger.info('Refreshing access and refresh tokens.')
 
+    // Tokens minted without a registered OAuth client (e.g. via the
+    // password grant against the built-in public client) can still be
+    // refreshed using that same secret-less client. A configured client
+    // with a missing secret is treated as a public client (empty secret).
     const tokens =
       serverType === ServerType.SasViya
         ? await refreshTokensForViya(
             requestClient,
-            client,
-            secret,
+            client || 'sas.cli',
+            secret || '',
             refresh_token
           )
         : await refreshTokensForSasjs(requestClient, refresh_token)
     ;({ access_token, refresh_token } = tokens)
+
+    // Viya refresh tokens are single-use/rotating. Callers throughout the
+    // compute-execution chain (executeOnComputeApi, pollJobState's poll
+    // loop, executeComputeJob -> executeJob, etc.) share this same
+    // authConfig object by reference and call getTokens again later in the
+    // same execution - update it in place so a later call in the same chain
+    // refreshes with the token that was just issued, not the one that was
+    // just consumed. client/secret are deliberately left untouched (see
+    // note above).
+    authConfig.access_token = access_token
+    authConfig.refresh_token = refresh_token
+
+    // A failing persistence handler must not turn a successful refresh into
+    // an auth failure - log the error and return the fresh pair regardless.
+    try {
+      await onTokensRefreshed?.({ access_token, refresh_token })
+    } catch (e) {
+      logger.error('onTokensRefreshed handler failed:', e)
+    }
   }
 
   return { access_token, refresh_token, client, secret }

package/src/index.ts

@@ -5,4 +5,5 @@ export * from './SASViyaApiClient'
 export * from './SAS9ApiClient'
 export * from './SASjsApiClient'
 export * from './request/SasjsRequestClient'
+export type { OnTokensRefreshed } from './auth/getTokens'
 export default SASjs