@sasjs/api 0.1.0 → 0.2.1

package/README.md

@@ -30,6 +30,8 @@ The same cases are meant to run against a live server and against the browser bu
 npm install @sasjs/api
 ```
 
+Requires Node `^22.14.0 || >=24.10.0` - the floor the release toolchain needs, and what CI runs.
+
 A host supplies a store and, later, an identity.
 In node:
 

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.1.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.2.1 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -203,6 +203,8 @@ var SASjsApi = (() => {
               409,
               stat.directory ? "Folder with new name already exists." : "File with new name already exists."
             );
+          if (!stat.directory && hasBlockedExtension(to))
+            throw new ApiError(400, "Invalid file extension");
           await store.move(from, to);
           return { status: "success" };
         }
@@ -2398,6 +2400,26 @@ var SASjsApi = (() => {
       request: { body: { oldPath: "/data/nope.csv", newPath: "/data/x.csv" } },
       expect: { status: 404, error: "No file/folder found for provided path." }
     },
+    {
+      id: "rename-file-to-blocked-extension",
+      route: "POST /SASjsApi/drive/rename",
+      description: "refuses a rename that would produce a name the file routes refuse",
+      seed: { "/data/report.csv": "a,b" },
+      request: {
+        body: { oldPath: "/data/report.csv", newPath: "/data/report.sh" }
+      },
+      expect: { status: 400, error: "Invalid file extension" }
+    },
+    {
+      id: "rename-folder-to-dotted-name",
+      route: "POST /SASjsApi/drive/rename",
+      description: "renames a folder whose new name carries a blocked suffix",
+      seed: { "/data/reports/a.csv": "a" },
+      request: {
+        body: { oldPath: "/data/reports", newPath: "/data/reports.sh" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
     {
       id: "rename-folder-into-itself",
       route: "POST /SASjsApi/drive/rename",

package/build/cjs/corpus/drive.js

@@ -238,6 +238,26 @@ exports.DRIVE_CORPUS = [
         request: { body: { oldPath: '/data/nope.csv', newPath: '/data/x.csv' } },
         expect: { status: 404, error: 'No file/folder found for provided path.' }
     },
+    {
+        id: 'rename-file-to-blocked-extension',
+        route: 'POST /SASjsApi/drive/rename',
+        description: 'refuses a rename that would produce a name the file routes refuse',
+        seed: { '/data/report.csv': 'a,b' },
+        request: {
+            body: { oldPath: '/data/report.csv', newPath: '/data/report.sh' }
+        },
+        expect: { status: 400, error: 'Invalid file extension' }
+    },
+    {
+        id: 'rename-folder-to-dotted-name',
+        route: 'POST /SASjsApi/drive/rename',
+        description: 'renames a folder whose new name carries a blocked suffix',
+        seed: { '/data/reports/a.csv': 'a' },
+        request: {
+            body: { oldPath: '/data/reports', newPath: '/data/reports.sh' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
     {
         id: 'rename-folder-into-itself',
         route: 'POST /SASjsApi/drive/rename',

package/build/cjs/drive/service.js

@@ -124,6 +124,14 @@ const createDriveService = (store) => {
                     throw new types_js_1.ApiError(409, stat.directory
                         ? 'Folder with new name already exists.'
                         : 'File with new name already exists.');
+                // the extension rule is the drive's file-path rule, so a rename may not
+                // be the way around it: without this a file could be renamed into a name
+                // that GET, PATCH and DELETE then refuse, leaving an entry the API that
+                // created it can no longer read or remove. A folder is not subject to it
+                // (nothing puts a folder through the file-path schema), so only a file
+                // move is checked.
+                if (!stat.directory && (0, paths_js_1.hasBlockedExtension)(to))
+                    throw new types_js_1.ApiError(400, 'Invalid file extension');
                 await store.move(from, to);
                 return { status: 'success' };
             }

package/build/esm/corpus/drive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drive.d.ts","sourceRoot":"","sources":["../../../src/corpus/drive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAA;IAC1C,OAAO,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;QAC9B,yDAAyD;QACzD,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAWD,eAAO,MAAM,YAAY,EAAE,UAAU,EAyRpC,CAAA"}
+{"version":3,"file":"drive.d.ts","sourceRoot":"","sources":["../../../src/corpus/drive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAErD,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAA;IAC1C,OAAO,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;QAC9B,yDAAyD;QACzD,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAWD,eAAO,MAAM,YAAY,EAAE,UAAU,EA8SpC,CAAA"}

package/build/esm/corpus/drive.js

@@ -235,6 +235,26 @@ export const DRIVE_CORPUS = [
         request: { body: { oldPath: '/data/nope.csv', newPath: '/data/x.csv' } },
         expect: { status: 404, error: 'No file/folder found for provided path.' }
     },
+    {
+        id: 'rename-file-to-blocked-extension',
+        route: 'POST /SASjsApi/drive/rename',
+        description: 'refuses a rename that would produce a name the file routes refuse',
+        seed: { '/data/report.csv': 'a,b' },
+        request: {
+            body: { oldPath: '/data/report.csv', newPath: '/data/report.sh' }
+        },
+        expect: { status: 400, error: 'Invalid file extension' }
+    },
+    {
+        id: 'rename-folder-to-dotted-name',
+        route: 'POST /SASjsApi/drive/rename',
+        description: 'renames a folder whose new name carries a blocked suffix',
+        seed: { '/data/reports/a.csv': 'a' },
+        request: {
+            body: { oldPath: '/data/reports', newPath: '/data/reports.sh' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
     {
         id: 'rename-folder-into-itself',
         route: 'POST /SASjsApi/drive/rename',

package/build/esm/drive/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/drive/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAUvD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IAC7B,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CAC9C;AAqBD,eAAO,MAAM,kBAAkB,GAAI,OAAO,UAAU,KAAG,YA4ItD,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/drive/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAWvD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IAC7B,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,QAAQ,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAChD,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7E,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC/C,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC9D,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CAC9C;AAqBD,eAAO,MAAM,kBAAkB,GAAI,OAAO,UAAU,KAAG,YAoJtD,CAAA"}

package/build/esm/drive/service.js

@@ -1,5 +1,5 @@
 import { ApiError } from '../types.js';
-import { basename, checkFilePath, dirname, isRoot, normaliseDrivePath } from './paths.js';
+import { basename, checkFilePath, dirname, hasBlockedExtension, isRoot, normaliseDrivePath } from './paths.js';
 /** A path a file operation may act on, or the refusal the operation answers. */
 const filePath = (input, outside) => {
     const checked = checkFilePath(input);
@@ -121,6 +121,14 @@ export const createDriveService = (store) => {
                     throw new ApiError(409, stat.directory
                         ? 'Folder with new name already exists.'
                         : 'File with new name already exists.');
+                // the extension rule is the drive's file-path rule, so a rename may not
+                // be the way around it: without this a file could be renamed into a name
+                // that GET, PATCH and DELETE then refuse, leaving an entry the API that
+                // created it can no longer read or remove. A folder is not subject to it
+                // (nothing puts a folder through the file-path schema), so only a file
+                // move is checked.
+                if (!stat.directory && hasBlockedExtension(to))
+                    throw new ApiError(400, 'Invalid file extension');
                 await store.move(from, to);
                 return { status: 'success' };
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/api",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "The SASjs Server API, described once - a generated route table, the services behind it, and the conformance corpus both hosts run",
   "license": "MIT",
   "author": "SASjs",
@@ -26,7 +26,7 @@
   ],
   "sideEffects": false,
   "engines": {
-    "node": ">=18"
+    "node": "^22.14.0 || >=24.10.0"
   },
   "scripts": {
     "build": "rimraf build && tsc -p tsconfig.build.cjs.json && tsc -p tsconfig.build.esm.json && node scripts/postbuild.mjs && node scripts/build-browser.mjs",
@@ -43,15 +43,21 @@
     "@semantic-release/github": "12.0.10",
     "@semantic-release/npm": "13.2.0",
     "@semantic-release/release-notes-generator": "14.1.1",
-    "@types/jest": "29.5.14",
+    "@types/jest": "30.0.0",
     "@types/node": "22.20.5",
+    "deepmerge": "file:./vendor/deepmerge",
     "esbuild": "0.28.2",
-    "jest": "29.7.0",
+    "jest": "30.5.2",
     "prettier": "3.9.10",
     "rimraf": "6.1.4",
     "semantic-release": "25.0.9",
     "ts-jest": "29.4.15",
     "typescript": "5.9.3",
     "yaml": "2.9.1"
+  },
+  "overrides": {
+    "deepmerge": "$deepmerge",
+    "glob": "14.0.3",
+    "minimatch": "11.0.4"
   }
 }