@sasjs/api 0.11.0 → 0.13.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.11.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.13.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -28,6 +28,7 @@ var SASjsApi = (() => {
     CODE_CORPUS: () => CODE_CORPUS,
     DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
+    DEPLOY_CORPUS: () => DEPLOY_CORPUS,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
     DEPLOY_PAYLOAD_BYTES: () => DEPLOY_PAYLOAD_BYTES,
     DEPLOY_SUCCESS: () => DEPLOY_SUCCESS,
@@ -1847,6 +1848,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1869,6 +1878,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1891,6 +1908,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -1913,6 +1938,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
+        },
+        {
+          status: 404,
+          description: "Session with the given ID was not found."
         }
       ]
     },
@@ -2481,8 +2514,6 @@ var SASjsApi = (() => {
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
-  var ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
-  var UNPUBLISH = "Unpublishing inverts the deploy route, so the two land together.";
   var success = { status: "success" };
   var user = {
     uid: "",
@@ -2610,16 +2641,10 @@ var SASjsApi = (() => {
         500: { status: "failure", message: "Deployment failed!" }
       }
     },
-    "POST /SASjsApi/drive/deploy/upload": {
-      implemented: false,
-      reason: ARCHIVE
-    },
+    "POST /SASjsApi/drive/deploy/upload": { implemented: true },
     // `404` is a pair - the registry name and the appLoc it was published from -
     // that matches no entry, and the drive's content is deliberately left alone.
-    "DELETE /SASjsApi/drive/deploy": {
-      implemented: false,
-      reason: UNPUBLISH
-    },
+    "DELETE /SASjsApi/drive/deploy": { implemented: true },
     // Group - members and the groups themselves
     "GET /SASjsApi/group": { implemented: true },
     "GET /SASjsApi/group/{uid}": { implemented: true },
@@ -2777,6 +2802,24 @@ var SASjsApi = (() => {
     return void 0;
   };
 
+  // src/drive/registry.ts
+  var unpublishAppStream = async (registry, body) => {
+    if (!body?.streamServiceName)
+      throw new ApiError(400, '"streamServiceName" is required');
+    if (!body.appLoc) throw new ApiError(400, '"appLoc" is required');
+    if (!await registry.unpublish(body.appLoc))
+      throw new ApiError(404, "No such app stream entry.");
+    return { status: "success" };
+  };
+  var MemoryAppStreamRegistry = class {
+    constructor(folders = ["/Public/myApp"]) {
+      this.folders = new Set(folders);
+    }
+    async unpublish(appLoc) {
+      return this.folders.delete(appLoc);
+    }
+  };
+
   // src/host/dispatch.ts
   var SECONDS_IN_A_DAY = 86400;
   var validate = (route, request) => {
@@ -2919,10 +2962,25 @@ var SASjsApi = (() => {
             String(request.body?.newPath || "")
           )
         };
+      // The archive is the host's transport - multer and a zip library on a
+      // server, `DecompressionStream` in a worker - and it hands this the same tree
+      // `POST /deploy` takes. The deploy cap is measured on that tree, after
+      // expansion, which is why the two share this path rather than reading bytes.
+      case "POST /SASjsApi/drive/deploy/upload":
       case "POST /SASjsApi/drive/deploy": {
         await drive.deploy(String(body.appLoc ?? ""), body.fileTree);
         return { status: 200, body: DEPLOY_SUCCESS };
       }
+      case "DELETE /SASjsApi/drive/deploy":
+        if (!services.registry)
+          throw new ApiError(
+            501,
+            `This host has no app stream registry, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await unpublishAppStream(services.registry, body)
+        };
       case "GET /SASjsApi/drive/filetree":
         return { status: 200, body: await drive.tree(query._folderPath) };
       // ------------------------------------------------------------- sessions
@@ -3177,6 +3235,8 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "POST /SASjsApi/drive/deploy/upload",
+    "DELETE /SASjsApi/drive/deploy",
     "GET /SASjsApi/session/{sessionId}",
     "GET /SASjsApi/session/{sessionId}/log",
     "GET /SASjsApi/session/{sessionId}/output",
@@ -4898,10 +4958,150 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/corpus/deploy.ts
+  var SUBJECT = { userId: "user-admin", clientId: "web_app" };
+  var manyMembers2 = (count) => Array.from({ length: count }, (_, at) => ({
+    name: `file-${at}.txt`,
+    type: "file",
+    code: ""
+  }));
+  var DEPLOY_CORPUS = [
+    {
+      id: "deploy-unpublish",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "removes a published app stream and answers the status",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "myApp", appLoc: "/Public/myApp" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
+    {
+      id: "deploy-unpublish-other-name",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "removes the app by its folder when the name has been renamed",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "renamed-app", appLoc: "/Public/myApp" }
+      },
+      expect: { status: 200, body: { status: "success" } }
+    },
+    {
+      id: "deploy-unpublish-no-stream-name",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "refuses a body that does not say which stream to remove",
+      request: { subject: SUBJECT, body: { appLoc: "/Public/myApp" } },
+      expect: { status: 400, error: '"streamServiceName" is required' }
+    },
+    {
+      id: "deploy-unpublish-no-app-loc",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "refuses a body that does not say which folder to remove",
+      request: { subject: SUBJECT, body: { streamServiceName: "myApp" } },
+      expect: { status: 400, error: '"appLoc" is required' }
+    },
+    {
+      id: "deploy-unpublish-unknown-folder",
+      route: "DELETE /SASjsApi/drive/deploy",
+      description: "answers 404 for a folder nothing is published at",
+      request: {
+        subject: SUBJECT,
+        body: { streamServiceName: "myApp", appLoc: "/Public/not-an-app" }
+      },
+      expect: { status: 404, error: "No such app stream entry." }
+    },
+    // ------------------------------------------- the uploaded-archive route
+    // The archive is expanded by the host, so what arrives here is the same tree
+    // `POST /deploy` takes - which is why every answer below matches its twin.
+    {
+      id: "upload-tree",
+      route: "POST /SASjsApi/drive/deploy/upload",
+      description: "writes the tree an uploaded archive expanded to",
+      request: {
+        subject: SUBJECT,
+        body: {
+          appLoc: "/Public/apps/uploaded",
+          fileTree: {
+            members: [
+              { name: "index.html", type: "file", code: "PGgxPkhlbGxvPC9oMT4=" }
+            ]
+          }
+        }
+      },
+      expect: {
+        status: 200,
+        body: {
+          status: "success",
+          message: "Files deployed successfully to @sasjs/server."
+        }
+      }
+    },
+    {
+      id: "upload-refused-by-shape",
+      route: "POST /SASjsApi/drive/deploy/upload",
+      description: "refuses an expansion that is not a tree",
+      request: {
+        subject: SUBJECT,
+        body: { appLoc: "/Public/apps/bad", fileTree: { members: 1 } }
+      },
+      expect: {
+        status: 400,
+        body: {
+          status: "failure",
+          message: "Provided not supported data format."
+        },
+        error: "Provided not supported data format."
+      }
+    },
+    {
+      id: "upload-refused-by-entry-count",
+      route: "POST /SASjsApi/drive/deploy/upload",
+      description: "applies the deploy cap to the expanded tree, not the bytes",
+      request: {
+        subject: SUBJECT,
+        body: {
+          appLoc: "/Public/apps/many",
+          fileTree: { members: manyMembers2(10001) }
+        }
+      },
+      expect: {
+        status: 413,
+        body: {
+          status: "failure",
+          message: "The file tree exceeds the deploy limit: 10001 entries (maximum 10000)."
+        },
+        error: "The file tree exceeds the deploy limit: 10001 entries (maximum 10000)."
+      }
+    },
+    {
+      id: "upload-refused-by-store",
+      route: "POST /SASjsApi/drive/deploy/upload",
+      description: "answers the routes 500 when the drive refuses the write",
+      unwritable: true,
+      request: {
+        subject: SUBJECT,
+        body: {
+          appLoc: "/Public/apps/demo",
+          fileTree: {
+            members: [{ name: "run", type: "service", code: "%put hi;" }]
+          }
+        }
+      },
+      expect: {
+        status: 500,
+        body: { status: "failure", message: "Deployment failed!" },
+        error: "Deployment failed!"
+      }
+    }
+  ];
+
   // src/corpus/session.ts
   var ADMIN = { userId: "user-admin", clientId: "web_app" };
   var RESTRICTED = { userId: "user-restricted", clientId: "web_app" };
+  var notFound = (id) => `Session with ID '${id}' was not found.`;
+  var UNAUTHORIZED = "Unauthorized";
   var SESSION_CORPUS = [
+    // ---------------------------------------------------------------- summary
     {
       id: "session-summary-own",
       route: "GET /SASjsApi/session/{sessionId}",
@@ -4934,6 +5134,28 @@ var SASjsApi = (() => {
         }
       }
     },
+    {
+      id: "session-summary-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-summary-foreign",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers 404 for another account's session, not 403",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    {
+      id: "session-summary-unknown",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers the same 404 for a session that does not exist",
+      request: { subject: ADMIN, params: { sessionId: "sess-nope" } },
+      expect: { status: 404, error: notFound("sess-nope") }
+    },
+    // -------------------------------------------------------------------- log
     {
       id: "session-log-own",
       route: "GET /SASjsApi/session/{sessionId}/log",
@@ -4951,6 +5173,21 @@ var SASjsApi = (() => {
       request: { subject: ADMIN, params: { sessionId: "sess-silent" } },
       expect: { status: 200, contents: "" }
     },
+    {
+      id: "session-log-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-log-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "will not read another account's log",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    // ----------------------------------------------------------------- output
     {
       id: "session-output-own",
       route: "GET /SASjsApi/session/{sessionId}/output",
@@ -4958,6 +5195,21 @@ var SASjsApi = (() => {
       request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
       expect: { status: 200, contents: "<html><body>42</body></html>" }
     },
+    {
+      id: "session-output-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-admin" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-output-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "will not read another account's webout",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
+    },
+    // ------------------------------------------------------------------ state
     {
       id: "session-state-own",
       route: "GET /SASjsApi/session/{sessionId}/state",
@@ -4967,6 +5219,20 @@ var SASjsApi = (() => {
         status: 200,
         body: { state: "running", pid: 4243, lineCount: 3 }
       }
+    },
+    {
+      id: "session-state-unauthenticated",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "refuses a caller with no token",
+      request: { params: { sessionId: "sess-restricted" } },
+      expect: { status: 401, error: UNAUTHORIZED }
+    },
+    {
+      id: "session-state-foreign",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "will not report another account's session state",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-admin" } },
+      expect: { status: 404, error: notFound("sess-admin") }
     }
   ];
 
@@ -6188,7 +6454,7 @@ var SASjsApi = (() => {
 
   // src/session/service.ts
   var createSessionService = (store, host) => {
-    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    const notFound2 = (id) => `Session with ID '${id}' was not found.`;
     const visible = async (caller, id) => {
       if (!caller) throw new ApiError(401, "Unauthorized");
       const reader = await store.userById(
@@ -6196,10 +6462,10 @@ var SASjsApi = (() => {
       );
       if (!reader || !reader.isActive) throw new ApiError(401, "Unauthorized");
       const session = await host.session(id);
-      if (!session) throw new ApiError(404, notFound(id));
+      if (!session) throw new ApiError(404, notFound2(id));
       const owner = session.owner;
       if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
-        throw new ApiError(404, notFound(id));
+        throw new ApiError(404, notFound2(id));
       return session;
     };
     return {
@@ -6210,19 +6476,19 @@ var SASjsApi = (() => {
       async state(caller, id) {
         await visible(caller, id);
         const state = await host.state(id);
-        if (!state) throw new ApiError(404, notFound(id));
+        if (!state) throw new ApiError(404, notFound2(id));
         return state;
       },
       async log(caller, id) {
         await visible(caller, id);
         const log = await host.log(id);
-        if (log === void 0) throw new ApiError(404, notFound(id));
+        if (log === void 0) throw new ApiError(404, notFound2(id));
         return log;
       },
       async output(caller, id) {
         await visible(caller, id);
         const output = await host.output(id);
-        if (output === void 0) throw new ApiError(404, notFound(id));
+        if (output === void 0) throw new ApiError(404, notFound2(id));
         return output;
       }
     };
@@ -6303,6 +6569,7 @@ var SASjsApi = (() => {
       ),
       identity: createIdentityService(identity),
       records: createRecordService(identity),
+      registry: new MemoryAppStreamRegistry(),
       session: createSessionService(identity, new MemorySessionHost())
     };
   };

package/build/cjs/corpus/deploy.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_CORPUS = void 0;
+const SUBJECT = { userId: 'user-admin', clientId: 'web_app' };
+/** A tree of `count` file members, for the deploy cap. */
+const manyMembers = (count) => Array.from({ length: count }, (_, at) => ({
+    name: `file-${at}.txt`,
+    type: 'file',
+    code: ''
+}));
+exports.DEPLOY_CORPUS = [
+    {
+        id: 'deploy-unpublish',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'removes a published app stream and answers the status',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'myApp', appLoc: '/Public/myApp' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
+    {
+        id: 'deploy-unpublish-other-name',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'removes the app by its folder when the name has been renamed',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'renamed-app', appLoc: '/Public/myApp' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
+    {
+        id: 'deploy-unpublish-no-stream-name',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'refuses a body that does not say which stream to remove',
+        request: { subject: SUBJECT, body: { appLoc: '/Public/myApp' } },
+        expect: { status: 400, error: '"streamServiceName" is required' }
+    },
+    {
+        id: 'deploy-unpublish-no-app-loc',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'refuses a body that does not say which folder to remove',
+        request: { subject: SUBJECT, body: { streamServiceName: 'myApp' } },
+        expect: { status: 400, error: '"appLoc" is required' }
+    },
+    {
+        id: 'deploy-unpublish-unknown-folder',
+        route: 'DELETE /SASjsApi/drive/deploy',
+        description: 'answers 404 for a folder nothing is published at',
+        request: {
+            subject: SUBJECT,
+            body: { streamServiceName: 'myApp', appLoc: '/Public/not-an-app' }
+        },
+        expect: { status: 404, error: 'No such app stream entry.' }
+    },
+    // ------------------------------------------- the uploaded-archive route
+    // The archive is expanded by the host, so what arrives here is the same tree
+    // `POST /deploy` takes - which is why every answer below matches its twin.
+    {
+        id: 'upload-tree',
+        route: 'POST /SASjsApi/drive/deploy/upload',
+        description: 'writes the tree an uploaded archive expanded to',
+        request: {
+            subject: SUBJECT,
+            body: {
+                appLoc: '/Public/apps/uploaded',
+                fileTree: {
+                    members: [
+                        { name: 'index.html', type: 'file', code: 'PGgxPkhlbGxvPC9oMT4=' }
+                    ]
+                }
+            }
+        },
+        expect: {
+            status: 200,
+            body: {
+                status: 'success',
+                message: 'Files deployed successfully to @sasjs/server.'
+            }
+        }
+    },
+    {
+        id: 'upload-refused-by-shape',
+        route: 'POST /SASjsApi/drive/deploy/upload',
+        description: 'refuses an expansion that is not a tree',
+        request: {
+            subject: SUBJECT,
+            body: { appLoc: '/Public/apps/bad', fileTree: { members: 1 } }
+        },
+        expect: {
+            status: 400,
+            body: {
+                status: 'failure',
+                message: 'Provided not supported data format.'
+            },
+            error: 'Provided not supported data format.'
+        }
+    },
+    {
+        id: 'upload-refused-by-entry-count',
+        route: 'POST /SASjsApi/drive/deploy/upload',
+        description: 'applies the deploy cap to the expanded tree, not the bytes',
+        request: {
+            subject: SUBJECT,
+            body: {
+                appLoc: '/Public/apps/many',
+                fileTree: { members: manyMembers(10001) }
+            }
+        },
+        expect: {
+            status: 413,
+            body: {
+                status: 'failure',
+                message: 'The file tree exceeds the deploy limit: 10001 entries (maximum 10000).'
+            },
+            error: 'The file tree exceeds the deploy limit: 10001 entries (maximum 10000).'
+        }
+    },
+    {
+        id: 'upload-refused-by-store',
+        route: 'POST /SASjsApi/drive/deploy/upload',
+        description: 'answers the routes 500 when the drive refuses the write',
+        unwritable: true,
+        request: {
+            subject: SUBJECT,
+            body: {
+                appLoc: '/Public/apps/demo',
+                fileTree: {
+                    members: [{ name: 'run', type: 'service', code: '%put hi;' }]
+                }
+            }
+        },
+        expect: {
+            status: 500,
+            body: { status: 'failure', message: 'Deployment failed!' },
+            error: 'Deployment failed!'
+        }
+    }
+];

package/build/cjs/corpus/runner.js

@@ -4,6 +4,7 @@ exports.runCase = exports.servicesFor = void 0;
 const dispatch_js_1 = require("../host/dispatch.js");
 const service_js_1 = require("../drive/service.js");
 const memory_store_js_1 = require("../drive/memory-store.js");
+const registry_js_1 = require("../drive/registry.js");
 const service_js_2 = require("../identity/service.js");
 const records_js_1 = require("../identity/records.js");
 const service_js_3 = require("../session/service.js");
@@ -29,6 +30,7 @@ const servicesFor = (testCase) => {
             : new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
         identity: (0, service_js_2.createIdentityService)(identity),
         records: (0, records_js_1.createRecordService)(identity),
+        registry: new registry_js_1.MemoryAppStreamRegistry(),
         session: (0, service_js_3.createSessionService)(identity, new memory_host_js_1.MemorySessionHost())
     };
 };