@sasjs/api 0.10.0 → 0.12.0

package/build/esm/routes/generated.js

@@ -344,6 +344,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 400,
+                description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+            },
+            {
+                status: 401,
+                description: 'Unauthorized'
             }
         ]
     },
@@ -372,6 +380,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 400,
+                description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+            },
+            {
+                status: 401,
+                description: 'Unauthorized'
             }
         ]
     },
@@ -1282,6 +1298,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1304,6 +1328,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1326,6 +1358,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },
@@ -1348,6 +1388,14 @@ export const GENERATED_ROUTES = [
             {
                 status: 200,
                 description: 'Ok'
+            },
+            {
+                status: 401,
+                description: 'No valid access token or session was supplied'
+            },
+            {
+                status: 404,
+                description: 'Session with the given ID was not found.'
             }
         ]
     },

package/build/esm/routes/overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AA2CD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAyNhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}
+{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../../src/routes/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGzD,yDAAyD;AACzD,UAAU,aAAa;IACrB,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;IAC3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,CAAC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,WAAW,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAElE,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAczD,CAAA;AAqCD,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CA6MhD,CAAA;AAED,wEAAwE;AACxE,eAAO,MAAM,OAAO,EAAE,UAAU,EAA8C,CAAA"}

package/build/esm/routes/overlay.js

@@ -24,12 +24,10 @@ export const TAG_CAPABILITIES = {
  */
 const DIRECTORY = 'Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.';
 const RUNTIME = 'Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.';
-const SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
 const HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
 const HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
 const WEB_BUNDLE = 'The host serves its own web bundle; there is no API decision here for this package to answer.';
 const ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
-const UNPUBLISH = 'Unpublishing inverts the deploy route, so the two land together.';
 const success = { status: 'success' };
 const user = {
     uid: '',
@@ -163,10 +161,7 @@ export const OVERLAY = {
     },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.
-    'DELETE /SASjsApi/drive/deploy': {
-        implemented: false,
-        reason: UNPUBLISH
-    },
+    'DELETE /SASjsApi/drive/deploy': { implemented: true },
     // Group - members and the groups themselves
     'GET /SASjsApi/group': { implemented: true },
     'GET /SASjsApi/group/{uid}': { implemented: true },
@@ -202,22 +197,13 @@ export const OVERLAY = {
         implemented: true,
         responses: { 200: user }
     },
-    'GET /SASjsApi/session/{sessionId}': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/log': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/output': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
-    'GET /SASjsApi/session/{sessionId}/state': {
-        implemented: false,
-        reason: SESSION_RECORD
-    },
+    // The port takes the owner as a uid and falls back to a username, which is
+    // what sasjs/server records today - a host hands its sessions through as they
+    // are, and the comparison tries the identifier first.
+    'GET /SASjsApi/session/{sessionId}': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/log': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/output': { implemented: true },
+    'GET /SASjsApi/session/{sessionId}/state': { implemented: true },
     // STP - a stored program, on the runtime port
     'GET /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },
     'POST /SASjsApi/stp/execute': { implemented: false, reason: RUNTIME },

package/build/esm/session/memory-host.d.ts

@@ -0,0 +1,19 @@
+import type { HostSession, SessionHost, SessionStateResponse } from './service.js';
+/**
+ * The sessions the corpus and the package's own tests read.
+ *
+ * One session per account, so the interesting case is expressible: an
+ * administrator may read a session that is not theirs, and the other way round
+ * answers the 404 that hides it. `sess-silent` exists with nothing written yet,
+ * because an empty log is a 200 and not a 404.
+ */
+export declare const DEFAULT_SESSIONS: Record<string, HostSession>;
+export declare class MemorySessionHost implements SessionHost {
+    private readonly sessions;
+    constructor(sessions?: Record<string, HostSession>);
+    session(id: string): Promise<HostSession>;
+    state(id: string): Promise<SessionStateResponse | undefined>;
+    log(id: string): Promise<string | undefined>;
+    output(id: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=memory-host.d.ts.map

package/build/esm/session/memory-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-host.d.ts","sourceRoot":"","sources":["../../../src/session/memory-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,oBAAoB,EACrB,MAAM,cAAc,CAAA;AAErB;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CA8BxD,CAAA;AAmBD,qBAAa,iBAAkB,YAAW,WAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,8BAAmB;IAElD,OAAO,CAAC,EAAE,EAAE,MAAM;IAIlB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAI5D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAGtD"}

package/build/esm/session/memory-host.js

@@ -0,0 +1,70 @@
+/**
+ * The sessions the corpus and the package's own tests read.
+ *
+ * One session per account, so the interesting case is expressible: an
+ * administrator may read a session that is not theirs, and the other way round
+ * answers the 404 that hides it. `sess-silent` exists with nothing written yet,
+ * because an empty log is a 200 and not a 404.
+ */
+export const DEFAULT_SESSIONS = {
+    'sess-admin': {
+        owner: 'user-admin',
+        summary: {
+            sessionId: 'sess-admin',
+            state: 'completed',
+            pid: 4242,
+            creationTimeStamp: '2026-11-07T09:00:00.000Z',
+            deathTimeStamp: '2026-11-07T09:00:04.000Z',
+            expiresAfterMins: 60
+        }
+    },
+    'sess-restricted': {
+        owner: 'user-restricted',
+        summary: {
+            sessionId: 'sess-restricted',
+            state: 'running',
+            pid: 4243,
+            creationTimeStamp: '2026-11-07T09:05:00.000Z'
+        }
+    },
+    'sess-silent': {
+        owner: 'user-admin',
+        summary: {
+            sessionId: 'sess-silent',
+            state: 'running',
+            pid: 4244,
+            creationTimeStamp: '2026-11-07T09:10:00.000Z'
+        }
+    }
+};
+const STATES = {
+    'sess-admin': { state: 'completed', pid: 4242, lineCount: 12 },
+    'sess-restricted': { state: 'running', pid: 4243, lineCount: 3 }
+};
+const LOGS = {
+    'sess-admin': 'NOTE: session started\nNOTE: session completed\n',
+    'sess-restricted': 'NOTE: session started\n',
+    'sess-silent': ''
+};
+const OUTPUTS = {
+    'sess-admin': '<html><body>42</body></html>',
+    'sess-restricted': '',
+    'sess-silent': ''
+};
+export class MemorySessionHost {
+    constructor(sessions = DEFAULT_SESSIONS) {
+        this.sessions = sessions;
+    }
+    async session(id) {
+        return this.sessions[id];
+    }
+    async state(id) {
+        return STATES[id];
+    }
+    async log(id) {
+        return LOGS[id];
+    }
+    async output(id) {
+        return OUTPUTS[id];
+    }
+}

package/build/esm/session/service.d.ts

@@ -0,0 +1,62 @@
+import type { Subject } from '../identity/types.js';
+import type { IdentityStore } from '../identity/types.js';
+/** A triggered session as the API reports one. */
+export interface SessionSummary {
+    sessionId: string;
+    state: string;
+    pid?: number;
+    creationTimeStamp?: string;
+    deathTimeStamp?: string;
+    failureReason?: string;
+    expiresAfterMins?: number;
+}
+/** What `/state` answers: whatever the host's run time reports for a session. */
+export type SessionStateResponse = Record<string, unknown>;
+/**
+ * A session as the host holds it.
+ *
+ * `owner` should be a **uid**: a username is mutable client data - an account
+ * can be renamed, and two accounts can swap names - so a name comparison can
+ * hand a session to whoever holds the name later. A username is accepted too,
+ * because sasjs/server's own session records carry the owner's username, and a
+ * host that hands those straight through the port must not 404 the owner of
+ * every session. The uid is tried first; the name is the fallback.
+ */
+export interface HostSession {
+    owner: string;
+    summary: SessionSummary;
+}
+/**
+ * The host's sessions: a run time's registry, and the files that session wrote.
+ *
+ * Every capability answers `undefined` for a session the host does not hold,
+ * which the service turns into a 404. `log` and `output` answer an empty string
+ * for one that exists but has written nothing yet, because that is not an error.
+ */
+export interface SessionHost {
+    session(id: string): Promise<HostSession | undefined>;
+    state(id: string): Promise<SessionStateResponse | undefined>;
+    log(id: string): Promise<string | undefined>;
+    output(id: string): Promise<string | undefined>;
+}
+export interface SessionService {
+    summary(caller: Subject | undefined, id: string): Promise<SessionSummary>;
+    state(caller: Subject | undefined, id: string): Promise<SessionStateResponse>;
+    log(caller: Subject | undefined, id: string): Promise<string>;
+    output(caller: Subject | undefined, id: string): Promise<string>;
+}
+/**
+ * The four session routes, over the host's own session store.
+ *
+ * The caller passes a `Subject` and nothing else: which account that is, whether
+ * it is an administrator, and whether the session is theirs are all resolved
+ * here, against the same store the records service reads. A host never states a
+ * role.
+ *
+ * `404` covers both "no such session" and "not yours", on purpose: a session id
+ * is handed to the caller that triggered the program and is built from a
+ * timestamp plus a small random number, so it is guessable within a window, and
+ * confirming the id exists would say it was right.
+ */
+export declare const createSessionService: (store: IdentityStore, host: SessionHost) => SessionService;
+//# sourceMappingURL=service.d.ts.map

package/build/esm/session/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/session/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,sBAAsB,CAAA;AAE7E,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,cAAc,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IACrD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC5D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;IACzE,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,GAAG,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjE;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,aAAa,EACpB,MAAM,WAAW,KAChB,cAsDF,CAAA"}

package/build/esm/session/service.js

@@ -0,0 +1,61 @@
+import { ApiError } from '../types.js';
+/**
+ * The four session routes, over the host's own session store.
+ *
+ * The caller passes a `Subject` and nothing else: which account that is, whether
+ * it is an administrator, and whether the session is theirs are all resolved
+ * here, against the same store the records service reads. A host never states a
+ * role.
+ *
+ * `404` covers both "no such session" and "not yours", on purpose: a session id
+ * is handed to the caller that triggered the program and is built from a
+ * timestamp plus a small random number, so it is guessable within a window, and
+ * confirming the id exists would say it was right.
+ */
+export const createSessionService = (store, host) => {
+    /** The server's wording, so adopting it here does not become a later change. */
+    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    /** The caller, and the session if they may see it - or the 404 that hides it. */
+    const visible = async (caller, id) => {
+        if (!caller)
+            throw new ApiError(401, 'Unauthorized');
+        const reader = await store.userById(caller.userId);
+        if (!reader || !reader.isActive)
+            throw new ApiError(401, 'Unauthorized');
+        const session = await host.session(id);
+        if (!session)
+            throw new ApiError(404, notFound(id));
+        // the uid is the key to compare; a name is the fallback a host may need
+        const owner = session.owner;
+        if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
+            throw new ApiError(404, notFound(id));
+        return session;
+    };
+    return {
+        async summary(caller, id) {
+            const session = await visible(caller, id);
+            return session.summary;
+        },
+        async state(caller, id) {
+            await visible(caller, id);
+            const state = await host.state(id);
+            if (!state)
+                throw new ApiError(404, notFound(id));
+            return state;
+        },
+        async log(caller, id) {
+            await visible(caller, id);
+            const log = await host.log(id);
+            if (log === undefined)
+                throw new ApiError(404, notFound(id));
+            return log;
+        },
+        async output(caller, id) {
+            await visible(caller, id);
+            const output = await host.output(id);
+            if (output === undefined)
+                throw new ApiError(404, notFound(id));
+            return output;
+        }
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/api",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "The SASjs Server API, described once - a generated route table, the services behind it, and the conformance corpus both hosts run",
   "license": "MIT",
   "author": "SASjs",