@sasjs/api 0.10.0 → 0.11.0

package/build/esm/host/dispatch.js

@@ -71,6 +71,12 @@ export const dispatch = async (services, routeId, request = {}) => {
     const body = request.body || {};
     const params = request.params || {};
     /** The record service, or the 501 a host without one answers. */
+    /** The host's sessions, or the 501 that names the missing capability. */
+    const sessionRequired = () => {
+        if (!services.session)
+            throw new ApiError(501, `This host has no session service, so it cannot answer ${routeId}.`);
+        return services.session;
+    };
     const required = () => {
         if (!records)
             throw new ApiError(501, `This host has no record service, so it cannot answer ${routeId}.`);
@@ -168,6 +174,31 @@ export const dispatch = async (services, routeId, request = {}) => {
         }
         case 'GET /SASjsApi/drive/filetree':
             return { status: 200, body: await drive.tree(query._folderPath) };
+        // ------------------------------------------------------------- sessions
+        case 'GET /SASjsApi/session/{sessionId}': {
+            return {
+                status: 200,
+                body: await sessionRequired().summary(await caller(), String(params.sessionId ?? ''))
+            };
+        }
+        case 'GET /SASjsApi/session/{sessionId}/log': {
+            return {
+                status: 200,
+                contents: await sessionRequired().log(await caller(), String(params.sessionId ?? ''))
+            };
+        }
+        case 'GET /SASjsApi/session/{sessionId}/output': {
+            return {
+                status: 200,
+                contents: await sessionRequired().output(await caller(), String(params.sessionId ?? ''))
+            };
+        }
+        case 'GET /SASjsApi/session/{sessionId}/state': {
+            return {
+                status: 200,
+                body: await sessionRequired().state(await caller(), String(params.sessionId ?? ''))
+            };
+        }
         // ------------------------------------------------------------- records
         //
         // The administration routes: users, groups, permission rules, clients and the
@@ -353,6 +384,10 @@ export const dispatch = async (services, routeId, request = {}) => {
 };
 /** Whether a route is one `dispatch` can answer today. */
 export const HANDLED_ROUTES = [
+    'GET /SASjsApi/session/{sessionId}',
+    'GET /SASjsApi/session/{sessionId}/log',
+    'GET /SASjsApi/session/{sessionId}/output',
+    'GET /SASjsApi/session/{sessionId}/state',
     'POST /SASjsApi/code/lint',
     'POST /SASjsApi/code/format',
     'GET /SASjsApi/info/authorizedRoutes',

package/build/esm/index.d.ts

@@ -38,6 +38,7 @@ export type { IdentityFixture, IdentityFixtureClient, IdentityFixtureCode, Ident
 export type { IdentityClient, IdentityClientRecord, IdentityGroupRecord, IdentityPermissionRecord, IdentityStore, IdentityUser, IdentityUserRecord, NewGroup, NewPermission, NewUser, Subject, TokenPair, UserChange } from './identity/types.js';
 export { DRIVE_CORPUS } from './corpus/drive.js';
 export { IDENTITY_CORPUS } from './corpus/identity.js';
+export { SESSION_CORPUS } from './corpus/session.js';
 export { RECORD_CORPUS, ADMIN_SIGNED_IN, PROVIDER_MANAGED } from './corpus/records.js';
 export type { CorpusCase } from './corpus/drive.js';
 export { runCase, servicesFor } from './corpus/runner.js';

package/build/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG7D,cAAc,2BAA2B,CAAA;AACzC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,cAAc,YAAY,CAAA;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,MAAM,EACP,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,UAAU,EACX,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,EACT,SAAS,EACV,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAG7D,cAAc,2BAA2B,CAAA;AACzC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,aAAa,EACb,OAAO,EACP,OAAO,EACP,SAAS,EACT,UAAU,EACX,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA"}

package/build/esm/index.js

@@ -30,5 +30,6 @@ export { MemoryIdentityStore } from './identity/memory-store.js';
 export { DEFAULT_IDENTITY, IDENTITY_FORMAT, parseIdentity } from './identity/fixture.js';
 export { DRIVE_CORPUS } from './corpus/drive.js';
 export { IDENTITY_CORPUS } from './corpus/identity.js';
+export { SESSION_CORPUS } from './corpus/session.js';
 export { RECORD_CORPUS, ADMIN_SIGNED_IN, PROVIDER_MANAGED } from './corpus/records.js';
 export { runCase, servicesFor } from './corpus/runner.js';

package/build/esm/routes/generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../../src/routes/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAs3D5C,CAAA"}
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../../src/routes/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAw4D5C,CAAA"}

package/build/esm/routes/generated.js

@@ -344,6 +344,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 400,
+                description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+            },
+            {
+                status: 401,
+                description: 'Unauthorized'
             }
         ]
     },
@@ -372,6 +380,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 400,
+                description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+            },
+            {
+                status: 401,
+                description: 'Unauthorized'
             }
         ]
     },

package/build/esm/routes/overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AA2CD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAyNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}
+{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAwCD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAgNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}

package/build/esm/routes/overlay.js

@@ -24,7 +24,6 @@ export const TAG_CAPABILITIES = {
  */
 const DIRECTORY = 'Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.';
 const RUNTIME = 'Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.';
-const SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
 const HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
@@ -202,22 +201,13 @@ export const OVERLAY = {
         implemented: true,
         responses: { 200: user }
     },
-    'GET /SASjsApi/session/{sessionId}': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/log': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/output': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/state': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
+    // The port takes the owner as a uid and falls back to a username, which is
+    // what sasjs/server records today - a host hands its sessions through as they
+    // are, and the comparison tries the identifier first.
+    'GET /SASjsApi/session/{sessionId}': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/log': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/output': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/state': { implemented: true },
     // STP - a stored program, on the runtime port
     'GET /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },
     'POST /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },

package/build/esm/session/memory-host.d.ts

@@ -0,0 +1,19 @@
+import type { HostSession, SessionHost, SessionStateResponse } from './service.js';
+/**
+ * The sessions the corpus and the package's own tests read.
+ *
+ * One session per account, so the interesting case is expressible: an
+ * administrator may read a session that is not theirs, and the other way round
+ * answers the 404 that hides it. `sess-silent` exists with nothing written yet,
+ * because an empty log is a 200 and not a 404.
+ */
+export declare const DEFAULT_SESSIONS: Record<string, HostSession>;
+export declare class MemorySessionHost implements SessionHost {
+    private readonly sessions;
+    constructor(sessions?: Record<string, HostSession>);
+    session(id: string): Promise<HostSession>;
+    state(id: string): Promise<SessionStateResponse | undefined>;
+    log(id: string): Promise<string | undefined>;
+    output(id: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=memory-host.d.ts.map

package/build/esm/session/memory-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-host.d.ts","sourceRoot":"","sources":["../../../src/session/memory-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,oBAAoB,EACrB,MAAM,cAAc,CAAA;AAErB;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CA8BxD,CAAA;AAmBD,qBAAa,iBAAkB,YAAW,WAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,8BAAmB;IAElD,OAAO,CAAC,EAAE,EAAE,MAAM;IAIlB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAI5D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAGtD"}

package/build/esm/session/memory-host.js

@@ -0,0 +1,70 @@
+/**
+ * The sessions the corpus and the package's own tests read.
+ *
+ * One session per account, so the interesting case is expressible: an
+ * administrator may read a session that is not theirs, and the other way round
+ * answers the 404 that hides it. `sess-silent` exists with nothing written yet,
+ * because an empty log is a 200 and not a 404.
+ */
+export const DEFAULT_SESSIONS = {
+    'sess-admin': {
+        owner: 'user-admin',
+        summary: {
+            sessionId: 'sess-admin',
+            state: 'completed',
+            pid: 4242,
+            creationTimeStamp: '2026-11-07T09:00:00.000Z',
+            deathTimeStamp: '2026-11-07T09:00:04.000Z',
+            expiresAfterMins: 60
+        }
+    },
+    'sess-restricted': {
+        owner: 'user-restricted',
+        summary: {
+            sessionId: 'sess-restricted',
+            state: 'running',
+            pid: 4243,
+            creationTimeStamp: '2026-11-07T09:05:00.000Z'
+        }
+    },
+    'sess-silent': {
+        owner: 'user-admin',
+        summary: {
+            sessionId: 'sess-silent',
+            state: 'running',
+            pid: 4244,
+            creationTimeStamp: '2026-11-07T09:10:00.000Z'
+        }
+    }
+};
+const STATES = {
+    'sess-admin': { state: 'completed', pid: 4242, lineCount: 12 },
+    'sess-restricted': { state: 'running', pid: 4243, lineCount: 3 }
+};
+const LOGS = {
+    'sess-admin': 'NOTE: session started\nNOTE: session completed\n',
+    'sess-restricted': 'NOTE: session started\n',
+    'sess-silent': ''
+};
+const OUTPUTS = {
+    'sess-admin': '<html><body>42</body></html>',
+    'sess-restricted': '',
+    'sess-silent': ''
+};
+export class MemorySessionHost {
+    constructor(sessions = DEFAULT_SESSIONS) {
+        this.sessions = sessions;
+    }
+    async session(id) {
+        return this.sessions[id];
+    }
+    async state(id) {
+        return STATES[id];
+    }
+    async log(id) {
+        return LOGS[id];
+    }
+    async output(id) {
+        return OUTPUTS[id];
+    }
+}

package/build/esm/session/service.d.ts

@@ -0,0 +1,62 @@
+import type { Subject } from '../identity/types.js';
+import type { IdentityStore } from '../identity/types.js';
+/** A triggered session as the API reports one. */
+export interface SessionSummary {
+    sessionId: string;
+    state: string;
+    pid?: number;
+    creationTimeStamp?: string;
+    deathTimeStamp?: string;
+    failureReason?: string;
+    expiresAfterMins?: number;
+}
+/** What `/state` answers: whatever the host's run time reports for a session. */
+export type SessionStateResponse = Record<string, unknown>;
+/**
+ * A session as the host holds it.
+ *
+ * `owner` should be a **uid**: a username is mutable client data - an account
+ * can be renamed, and two accounts can swap names - so a name comparison can
+ * hand a session to whoever holds the name later. A username is accepted too,
+ * because sasjs/server's own session records carry the owner's username, and a
+ * host that hands those straight through the port must not 404 the owner of
+ * every session. The uid is tried first; the name is the fallback.
+ */
+export interface HostSession {
+    owner: string;
+    summary: SessionSummary;
+}
+/**
+ * The host's sessions: a run time's registry, and the files that session wrote.
+ *
+ * Every capability answers `undefined` for a session the host does not hold,
+ * which the service turns into a 404. `log` and `output` answer an empty string
+ * for one that exists but has written nothing yet, because that is not an error.
+ */
+export interface SessionHost {
+    session(id: string): Promise<HostSession | undefined>;
+    state(id: string): Promise<SessionStateResponse | undefined>;
+    log(id: string): Promise<string | undefined>;
+    output(id: string): Promise<string | undefined>;
+}
+export interface SessionService {
+    summary(caller: Subject | undefined, id: string): Promise<SessionSummary>;
+    state(caller: Subject | undefined, id: string): Promise<SessionStateResponse>;
+    log(caller: Subject | undefined, id: string): Promise<string>;
+    output(caller: Subject | undefined, id: string): Promise<string>;
+}
+/**
+ * The four session routes, over the host's own session store.
+ *
+ * The caller passes a `Subject` and nothing else: which account that is, whether
+ * it is an administrator, and whether the session is theirs are all resolved
+ * here, against the same store the records service reads. A host never states a
+ * role.
+ *
+ * `404` covers both "no such session" and "not yours", on purpose: a session id
+ * is handed to the caller that triggered the program and is built from a
+ * timestamp plus a small random number, so it is guessable within a window, and
+ * confirming the id exists would say it was right.
+ */
+export declare const createSessionService: (store: IdentityStore, host: SessionHost) => SessionService;
+//# sourceMappingURL=service.d.ts.map

package/build/esm/session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/session/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAA;AAE7E,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,cAAc,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IACrD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC5D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACzE,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,aAAa,EACpB,MAAM,WAAW,KAChB,cAsDF,CAAA"}

package/build/esm/session/service.js

@@ -0,0 +1,61 @@
+import { ApiError } from '../types.js';
+/**
+ * The four session routes, over the host's own session store.
+ *
+ * The caller passes a `Subject` and nothing else: which account that is, whether
+ * it is an administrator, and whether the session is theirs are all resolved
+ * here, against the same store the records service reads. A host never states a
+ * role.
+ *
+ * `404` covers both "no such session" and "not yours", on purpose: a session id
+ * is handed to the caller that triggered the program and is built from a
+ * timestamp plus a small random number, so it is guessable within a window, and
+ * confirming the id exists would say it was right.
+ */
+export const createSessionService = (store, host) => {
+    /** The server's wording, so adopting it here does not become a later change. */
+    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    /** The caller, and the session if they may see it - or the 404 that hides it. */
+    const visible = async (caller, id) => {
+        if (!caller)
+            throw new ApiError(401, 'Unauthorized');
+        const reader = await store.userById(caller.userId);
+        if (!reader || !reader.isActive)
+            throw new ApiError(401, 'Unauthorized');
+        const session = await host.session(id);
+        if (!session)
+            throw new ApiError(404, notFound(id));
+        // the uid is the key to compare; a name is the fallback a host may need
+        const owner = session.owner;
+        if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
+            throw new ApiError(404, notFound(id));
+        return session;
+    };
+    return {
+        async summary(caller, id) {
+            const session = await visible(caller, id);
+            return session.summary;
+        },
+        async state(caller, id) {
+            await visible(caller, id);
+            const state = await host.state(id);
+            if (!state)
+                throw new ApiError(404, notFound(id));
+            return state;
+        },
+        async log(caller, id) {
+            await visible(caller, id);
+            const log = await host.log(id);
+            if (log === undefined)
+                throw new ApiError(404, notFound(id));
+            return log;
+        },
+        async output(caller, id) {
+            await visible(caller, id);
+            const output = await host.output(id);
+            if (output === undefined)
+                throw new ApiError(404, notFound(id));
+            return output;
+        }
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/api",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "The SASjs Server API, described once - a generated route table, the services behind it, and the conformance corpus both hosts run",
   "license": "MIT",
   "author": "SASjs",