@sasjs/api 0.10.0 → 0.11.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.10.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.11.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -41,6 +41,7 @@ var SASjsApi = (() => {
     PROVIDER_MANAGED: () => PROVIDER_MANAGED,
     RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
+    SESSION_CORPUS: () => SESSION_CORPUS,
     STATIC_AUTHORIZED_ROUTES: () => STATIC_AUTHORIZED_ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
     TOP_LEVEL_ROUTES: () => TOP_LEVEL_ROUTES,
@@ -892,6 +893,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
         }
       ]
     },
@@ -920,6 +929,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
         }
       ]
     },
@@ -2461,7 +2478,6 @@ var SASjsApi = (() => {
   };
   var DIRECTORY = "Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.";
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
-  var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
@@ -2639,22 +2655,13 @@ var SASjsApi = (() => {
       implemented: true,
       responses: { 200: user }
     },
-    "GET /SASjsApi/session/{sessionId}": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/log": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/output": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/state": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
+    // The port takes the owner as a uid and falls back to a username, which is
+    // what sasjs/server records today - a host hands its sessions through as they
+    // are, and the comparison tries the identifier first.
+    "GET /SASjsApi/session/{sessionId}": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/log": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/output": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/state": { implemented: true },
     // STP - a stored program, on the runtime port
     "GET /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
@@ -2811,6 +2818,14 @@ var SASjsApi = (() => {
     const query = request.query || {};
     const body = request.body || {};
     const params = request.params || {};
+    const sessionRequired = () => {
+      if (!services.session)
+        throw new ApiError(
+          501,
+          `This host has no session service, so it cannot answer ${routeId}.`
+        );
+      return services.session;
+    };
     const required = () => {
       if (!records)
         throw new ApiError(
@@ -2910,6 +2925,43 @@ var SASjsApi = (() => {
       }
       case "GET /SASjsApi/drive/filetree":
         return { status: 200, body: await drive.tree(query._folderPath) };
+      // ------------------------------------------------------------- sessions
+      case "GET /SASjsApi/session/{sessionId}": {
+        return {
+          status: 200,
+          body: await sessionRequired().summary(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/log": {
+        return {
+          status: 200,
+          contents: await sessionRequired().log(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/output": {
+        return {
+          status: 200,
+          contents: await sessionRequired().output(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/state": {
+        return {
+          status: 200,
+          body: await sessionRequired().state(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
       // ------------------------------------------------------------- records
       //
       // The administration routes: users, groups, permission rules, clients and the
@@ -3125,6 +3177,10 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "GET /SASjsApi/session/{sessionId}",
+    "GET /SASjsApi/session/{sessionId}/log",
+    "GET /SASjsApi/session/{sessionId}/output",
+    "GET /SASjsApi/session/{sessionId}/state",
     "POST /SASjsApi/code/lint",
     "POST /SASjsApi/code/format",
     "GET /SASjsApi/info/authorizedRoutes",
@@ -3662,13 +3718,50 @@ var SASjsApi = (() => {
         ]
       }
     },
-    // Two refusals are deliberately not pinned here yet: a `code` that is not a
-    // string, and one that is empty. The package answers 400 `"code" must be a
-    // string` / `"code" is not allowed to be empty` - the messages the server's
-    // schema produces - but sasjs/server's code controller carries no
-    // `@Response(400)` for these routes, so the document states 200 alone and the
-    // parity gate refuses a case answering anything else. The cases land when the
-    // decorators do.
+    {
+      id: "code-lint-unauthenticated",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses a caller with no token",
+      request: { body: { code: "data _null_; run;" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "code-lint-non-string",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses a code value that is not a string, rather than coercing it",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: 123 }
+      },
+      expect: { status: 400, error: '"code" must be a string' }
+    },
+    {
+      id: "code-lint-empty",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses an empty buffer, which is not the same as a missing one",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "" }
+      },
+      expect: { status: 400, error: '"code" is not allowed to be empty' }
+    },
+    {
+      id: "code-format-unauthenticated",
+      route: "POST /SASjsApi/code/format",
+      description: "refuses a caller with no token",
+      request: { body: { code: "data _null_; run;" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "code-format-non-string",
+      route: "POST /SASjsApi/code/format",
+      description: "refuses a code value that is not a string",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: 123 }
+      },
+      expect: { status: 400, error: '"code" must be a string' }
+    },
     {
       id: "code-format-adds-the-header",
       route: "POST /SASjsApi/code/format",
@@ -4805,6 +4898,78 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/corpus/session.ts
+  var ADMIN = { userId: "user-admin", clientId: "web_app" };
+  var RESTRICTED = { userId: "user-restricted", clientId: "web_app" };
+  var SESSION_CORPUS = [
+    {
+      id: "session-summary-own",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers the owner the summary of their own session",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: {
+        status: 200,
+        body: {
+          sessionId: "sess-admin",
+          state: "completed",
+          pid: 4242,
+          creationTimeStamp: "2026-11-07T09:00:00.000Z",
+          deathTimeStamp: "2026-11-07T09:00:04.000Z",
+          expiresAfterMins: 60
+        }
+      }
+    },
+    {
+      id: "session-summary-as-admin",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers an administrator another account's session",
+      request: { subject: ADMIN, params: { sessionId: "sess-restricted" } },
+      expect: {
+        status: 200,
+        body: {
+          sessionId: "sess-restricted",
+          state: "running",
+          pid: 4243,
+          creationTimeStamp: "2026-11-07T09:05:00.000Z"
+        }
+      }
+    },
+    {
+      id: "session-log-own",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "answers the log this session wrote",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: {
+        status: 200,
+        contents: "NOTE: session started\nNOTE: session completed\n"
+      }
+    },
+    {
+      id: "session-log-nothing-written",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "answers an empty body for a session that has written nothing",
+      request: { subject: ADMIN, params: { sessionId: "sess-silent" } },
+      expect: { status: 200, contents: "" }
+    },
+    {
+      id: "session-output-own",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "answers the webout this session produced",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: { status: 200, contents: "<html><body>42</body></html>" }
+    },
+    {
+      id: "session-state-own",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "answers the run time's state for this session",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-restricted" } },
+      expect: {
+        status: 200,
+        body: { state: "running", pid: 4243, lineCount: 3 }
+      }
+    }
+  ];
+
   // src/corpus/records.ts
   var SIGNED_IN_TOKENS = [
     {
@@ -4867,8 +5032,8 @@ var SASjsApi = (() => {
       }
     ]
   };
-  var ADMIN = "admin-access";
-  var RESTRICTED = "user-access";
+  var ADMIN2 = "admin-access";
+  var RESTRICTED2 = "user-access";
   var RESTRICTED_UID = "user-restricted";
   var ADMIN_UID = "user-admin";
   var RECORD_CORPUS = [
@@ -4878,7 +5043,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user",
       description: "lists the accounts any signed-in caller may see",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -4902,7 +5067,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/{uid}",
       description: "returns the caller their own details, with the auto-exec code",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: RESTRICTED_UID } },
+      request: { token: RESTRICTED2, params: { uid: RESTRICTED_UID } },
       expect: {
         status: 200,
         partial: {
@@ -4927,7 +5092,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/{uid}",
       description: "answers 404 for an identifier no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "user-none" } },
+      request: { token: ADMIN2, params: { uid: "user-none" } },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -4935,7 +5100,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/by/username/{username}",
       description: "finds an account by username",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "user2" } },
+      request: { token: ADMIN2, params: { username: "user2" } },
       expect: {
         status: 200,
         partial: { uid: RESTRICTED_UID, username: "user2", isAdmin: false }
@@ -4954,7 +5119,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/by/username/{username}",
       description: "answers 404 for a username no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "nobody" } },
+      request: { token: ADMIN2, params: { username: "nobody" } },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -4963,7 +5128,7 @@ var SASjsApi = (() => {
       description: "creates an account, sanitised, and reports it",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           username: "newuser",
           displayName: "  New
 User  ",
@@ -4988,7 +5153,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           username: "newuser",
           displayName: "New User",
@@ -5011,7 +5176,7 @@ var SASjsApi = (() => {
       description: "refuses a username that is taken",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { username: "user2", displayName: "Another", password: "newpass" }
       },
       expect: { status: 409, error: "Username already exists." }
@@ -5022,7 +5187,7 @@ var SASjsApi = (() => {
       description: "changes an account's display name",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: RESTRICTED_UID },
         body: {
           displayName: "Renamed User",
@@ -5041,7 +5206,7 @@ var SASjsApi = (() => {
       description: "refuses a change to somebody else's account",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { uid: ADMIN_UID },
         body: { displayName: "Hijacked", username: "admin", password: "admin123" }
       },
@@ -5053,7 +5218,7 @@ var SASjsApi = (() => {
       description: "answers 404 with the identifier it looked up",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "user-none" },
         body: { displayName: "Nobody", username: "nobody", password: "none123" }
       },
@@ -5065,7 +5230,7 @@ var SASjsApi = (() => {
       description: "refuses a username change on a provider-managed account",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "user-directory" },
         body: {
           username: "renamed",
@@ -5084,7 +5249,7 @@ var SASjsApi = (() => {
       description: "refuses a username another account already has",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: RESTRICTED_UID },
         body: { username: "admin", displayName: "Demo User", password: "user123" }
       },
@@ -5096,7 +5261,7 @@ var SASjsApi = (() => {
       description: "changes an account looked up by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: {
           isActive: false,
@@ -5113,7 +5278,7 @@ var SASjsApi = (() => {
       description: "refuses a change to another account by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { username: "admin" },
         body: { displayName: "Hijacked", username: "admin", password: "admin123" }
       },
@@ -5125,7 +5290,7 @@ var SASjsApi = (() => {
       description: "answers 404 with the username it looked up",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "nobody" },
         body: { displayName: "Nobody", username: "nobody", password: "none123" }
       },
@@ -5137,7 +5302,7 @@ var SASjsApi = (() => {
       description: "refuses a display-name change on a provider-managed account",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "diruser" },
         body: { displayName: "Renamed", username: "diruser", password: "dir123" }
       },
@@ -5152,7 +5317,7 @@ var SASjsApi = (() => {
       description: "refuses a username another account already has",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: { username: "admin", displayName: "Demo User", password: "user123" }
       },
@@ -5163,7 +5328,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "deletes an account as an administrator, without a password",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: RESTRICTED_UID }, body: {} },
+      request: { token: ADMIN2, params: { uid: RESTRICTED_UID }, body: {} },
       expect: { status: 200, body: "Account Deleted!" }
     },
     {
@@ -5171,7 +5336,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "refuses a deletion of somebody else's account",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: ADMIN_UID }, body: {} },
+      request: { token: RESTRICTED2, params: { uid: ADMIN_UID }, body: {} },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5179,7 +5344,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "answers 404 for an identifier no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "user-none" }, body: {} },
+      request: { token: ADMIN2, params: { uid: "user-none" }, body: {} },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -5188,7 +5353,7 @@ var SASjsApi = (() => {
       description: "deletes an account looked up by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: {}
       },
@@ -5200,7 +5365,7 @@ var SASjsApi = (() => {
       description: "refuses a self-deletion whose password is wrong",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { username: "user2" },
         body: { password: "wrong123" }
       },
@@ -5211,7 +5376,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/by/username/{username}",
       description: "answers 404 for a username no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "nobody" }, body: {} },
+      request: { token: ADMIN2, params: { username: "nobody" }, body: {} },
       expect: { status: 404, error: "User is not found." }
     },
     // ----------------------------------------------------------------- groups
@@ -5220,7 +5385,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group",
       description: "lists the groups",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: [
@@ -5242,7 +5407,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/{uid}",
       description: "returns a group and its members",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      request: { token: RESTRICTED2, params: { uid: "group-admins" } },
       expect: {
         status: 200,
         partial: {
@@ -5265,7 +5430,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/{uid}",
       description: "answers 404 for an identifier no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-none" } },
+      request: { token: ADMIN2, params: { uid: "group-none" } },
       expect: { status: 404, error: "Group not found." }
     },
     {
@@ -5273,7 +5438,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/by/groupname/{name}",
       description: "finds a group by name",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { name: "DCGroup" } },
+      request: { token: ADMIN2, params: { name: "DCGroup" } },
       expect: {
         status: 200,
         partial: { uid: "group-data-controller", name: "DCGroup" }
@@ -5284,7 +5449,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/by/groupname/{name}",
       description: "answers 404 for a name no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { name: "nope" } },
+      request: { token: ADMIN2, params: { name: "nope" } },
       expect: { status: 404, error: "Group not found." }
     },
     {
@@ -5293,7 +5458,7 @@ var SASjsApi = (() => {
       description: "creates a group with no members",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { name: "NewGroup", description: "A new group", isActive: true }
       },
       expect: {
@@ -5312,7 +5477,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { name: "NewGroup", description: "x" }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5322,7 +5487,7 @@ var SASjsApi = (() => {
       route: "POST /SASjsApi/group",
       description: "refuses a name that is taken",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, body: { name: "DCGroup", description: "again" } },
+      request: { token: ADMIN2, body: { name: "DCGroup", description: "again" } },
       expect: { status: 409, error: "Group name already exists." }
     },
     {
@@ -5331,7 +5496,7 @@ var SASjsApi = (() => {
       description: "adds a member and returns the group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5345,7 +5510,7 @@ var SASjsApi = (() => {
       description: "refuses a change to the reserved public group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-public", userUid: RESTRICTED_UID }
       },
       expect: { status: 400, error: "Can't add/remove user to 'public' group." }
@@ -5356,7 +5521,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5367,7 +5532,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a group that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-none", userUid: RESTRICTED_UID }
       },
       expect: { status: 404, error: "Group not found." }
@@ -5378,7 +5543,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change on a provider-managed group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5392,7 +5557,7 @@ var SASjsApi = (() => {
       description: "removes a member and returns the group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5406,7 +5571,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change for a provider-managed user",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-directory" }
       },
       expect: {
@@ -5420,7 +5585,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change for a provider-managed user",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-directory" }
       },
       expect: {
@@ -5434,7 +5599,7 @@ var SASjsApi = (() => {
       description: "refuses a change to the reserved public group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-public", userUid: RESTRICTED_UID }
       },
       expect: { status: 400, error: "Can't add/remove user to 'public' group." }
@@ -5445,7 +5610,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5456,7 +5621,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a member that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-none" }
       },
       expect: { status: 404, error: "User not found." }
@@ -5467,7 +5632,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change on a provider-managed group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5480,7 +5645,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "deletes a group",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-data-controller" } },
+      request: { token: ADMIN2, params: { uid: "group-data-controller" } },
       expect: { status: 200 }
     },
     {
@@ -5488,7 +5653,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "refuses a deletion by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      request: { token: RESTRICTED2, params: { uid: "group-admins" } },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5496,7 +5661,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "answers 404 for an identifier no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-none" } },
+      request: { token: ADMIN2, params: { uid: "group-none" } },
       expect: { status: 404, error: "Group not found." }
     },
     // ------------------------------------------------------------ permissions
@@ -5505,7 +5670,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/authorizedRoutes",
       description: "answers the routes that accept a rule, to any caller",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: {
@@ -5529,7 +5694,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/myAuthorizedRoutes",
       description: "answers every route to an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: {
@@ -5553,7 +5718,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/myAuthorizedRoutes",
       description: "answers a caller only the routes its rules grant",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         // /AppStream is visible whatever the rules say; the two grants come from
@@ -5569,7 +5734,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/permission",
       description: "returns every rule to an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -5602,7 +5767,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/permission",
       description: "returns a caller only their own rules and their groups'",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: [
@@ -5644,7 +5809,7 @@ var SASjsApi = (() => {
       description: "creates a rule for a user",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5664,7 +5829,7 @@ var SASjsApi = (() => {
       description: "creates a rule for a group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/rename",
           type: "Route",
@@ -5688,7 +5853,7 @@ var SASjsApi = (() => {
       description: "refuses a principal type that is neither a user nor a group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/deploy",
           type: "Route",
@@ -5708,7 +5873,7 @@ var SASjsApi = (() => {
       description: "refuses a rule assigned to an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5728,7 +5893,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5745,7 +5910,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a principal that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/rename",
           type: "Route",
@@ -5762,7 +5927,7 @@ var SASjsApi = (() => {
       description: "refuses a group rule that already exists",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/file",
           type: "Route",
@@ -5782,7 +5947,7 @@ var SASjsApi = (() => {
       description: "refuses a rule that already exists",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/code/execute",
           type: "Route",
@@ -5802,7 +5967,7 @@ var SASjsApi = (() => {
       description: "flips a rule from Deny to Grant",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "rule-code" },
         body: { setting: "Grant" }
       },
@@ -5814,7 +5979,7 @@ var SASjsApi = (() => {
       description: "refuses a change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { uid: "rule-code" },
         body: { setting: "Grant" }
       },
@@ -5826,7 +5991,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a rule that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "rule-none" },
         body: { setting: "Grant" }
       },
@@ -5837,7 +6002,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "deletes a rule",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "rule-code" } },
+      request: { token: ADMIN2, params: { uid: "rule-code" } },
       expect: { status: 200, body: "Permission Deleted!" }
     },
     {
@@ -5845,7 +6010,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "refuses a deletion by a non-administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "rule-code" } },
+      request: { token: RESTRICTED2, params: { uid: "rule-code" } },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5853,7 +6018,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "answers 404 for a rule that does not exist",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "rule-none" } },
+      request: { token: ADMIN2, params: { uid: "rule-none" } },
       expect: { status: 404, error: "Permission not found." }
     },
     // --------------------------------------------------------------- clients
@@ -5862,7 +6027,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/client",
       description: "lists the registered clients",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -5886,7 +6051,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/client",
       description: "refuses the list to a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5895,7 +6060,7 @@ var SASjsApi = (() => {
       description: "registers a client",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           clientId: "new_app",
           clientSecret: "new_secret",
@@ -5919,7 +6084,7 @@ var SASjsApi = (() => {
       description: "applies the schema defaults when the lifetimes are omitted",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { clientId: "default_app", clientSecret: "default_secret" }
       },
       expect: {
@@ -5938,7 +6103,7 @@ var SASjsApi = (() => {
       description: "refuses a registration by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           clientId: "new_app",
           clientSecret: "new_secret",
@@ -5954,7 +6119,7 @@ var SASjsApi = (() => {
       description: "refuses a client id that is registered, with the 403 the server sends",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           clientId: "web_app",
           clientSecret: "other",
@@ -5971,7 +6136,7 @@ var SASjsApi = (() => {
       description: "changes the caller’s own password",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { currentPassword: "user123", newPassword: "changed123" }
       },
       expect: { status: 204 }
@@ -5981,7 +6146,7 @@ var SASjsApi = (() => {
       route: "PATCH /SASjsApi/auth/updatePassword",
       description: "refuses a body without the current password",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, body: { newPassword: "changed123" } },
+      request: { token: RESTRICTED2, body: { newPassword: "changed123" } },
       expect: { status: 400, error: '"currentPassword" is required' }
     },
     {
@@ -6000,7 +6165,7 @@ var SASjsApi = (() => {
       description: "refuses a change whose current password is wrong",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { currentPassword: "wrong", newPassword: "changed123" }
       },
       expect: { status: 403, error: "Invalid current password!" }
@@ -6021,6 +6186,112 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/session/service.ts
+  var createSessionService = (store, host) => {
+    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    const visible = async (caller, id) => {
+      if (!caller) throw new ApiError(401, "Unauthorized");
+      const reader = await store.userById(
+        caller.userId
+      );
+      if (!reader || !reader.isActive) throw new ApiError(401, "Unauthorized");
+      const session = await host.session(id);
+      if (!session) throw new ApiError(404, notFound(id));
+      const owner = session.owner;
+      if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
+        throw new ApiError(404, notFound(id));
+      return session;
+    };
+    return {
+      async summary(caller, id) {
+        const session = await visible(caller, id);
+        return session.summary;
+      },
+      async state(caller, id) {
+        await visible(caller, id);
+        const state = await host.state(id);
+        if (!state) throw new ApiError(404, notFound(id));
+        return state;
+      },
+      async log(caller, id) {
+        await visible(caller, id);
+        const log = await host.log(id);
+        if (log === void 0) throw new ApiError(404, notFound(id));
+        return log;
+      },
+      async output(caller, id) {
+        await visible(caller, id);
+        const output = await host.output(id);
+        if (output === void 0) throw new ApiError(404, notFound(id));
+        return output;
+      }
+    };
+  };
+
+  // src/session/memory-host.ts
+  var DEFAULT_SESSIONS = {
+    "sess-admin": {
+      owner: "user-admin",
+      summary: {
+        sessionId: "sess-admin",
+        state: "completed",
+        pid: 4242,
+        creationTimeStamp: "2026-11-07T09:00:00.000Z",
+        deathTimeStamp: "2026-11-07T09:00:04.000Z",
+        expiresAfterMins: 60
+      }
+    },
+    "sess-restricted": {
+      owner: "user-restricted",
+      summary: {
+        sessionId: "sess-restricted",
+        state: "running",
+        pid: 4243,
+        creationTimeStamp: "2026-11-07T09:05:00.000Z"
+      }
+    },
+    "sess-silent": {
+      owner: "user-admin",
+      summary: {
+        sessionId: "sess-silent",
+        state: "running",
+        pid: 4244,
+        creationTimeStamp: "2026-11-07T09:10:00.000Z"
+      }
+    }
+  };
+  var STATES = {
+    "sess-admin": { state: "completed", pid: 4242, lineCount: 12 },
+    "sess-restricted": { state: "running", pid: 4243, lineCount: 3 }
+  };
+  var LOGS = {
+    "sess-admin": "NOTE: session started\nNOTE: session completed\n",
+    "sess-restricted": "NOTE: session started\n",
+    "sess-silent": ""
+  };
+  var OUTPUTS = {
+    "sess-admin": "<html><body>42</body></html>",
+    "sess-restricted": "",
+    "sess-silent": ""
+  };
+  var MemorySessionHost = class {
+    constructor(sessions = DEFAULT_SESSIONS) {
+      this.sessions = sessions;
+    }
+    async session(id) {
+      return this.sessions[id];
+    }
+    async state(id) {
+      return STATES[id];
+    }
+    async log(id) {
+      return LOGS[id];
+    }
+    async output(id) {
+      return OUTPUTS[id];
+    }
+  };
+
   // src/corpus/runner.ts
   var servicesFor = (testCase) => {
     const identity = new MemoryIdentityStore(
@@ -6031,7 +6302,8 @@ var SASjsApi = (() => {
         testCase.unwritable ? new RefusingDriveStore(testCase.seed || {}) : new MemoryDriveStore(testCase.seed || {})
       ),
       identity: createIdentityService(identity),
-      records: createRecordService(identity)
+      records: createRecordService(identity),
+      session: createSessionService(identity, new MemorySessionHost())
     };
   };
   var RefusingDriveStore = class extends MemoryDriveStore {