@sasjs/api 0.2.0 → 0.3.0

package/build/cjs/corpus/drive.js

@@ -238,6 +238,26 @@ exports.DRIVE_CORPUS = [
         request: { body: { oldPath: '/data/nope.csv', newPath: '/data/x.csv' } },
         expect: { status: 404, error: 'No file/folder found for provided path.' }
     },
+    {
+        id: 'rename-file-to-blocked-extension',
+        route: 'POST /SASjsApi/drive/rename',
+        description: 'refuses a rename that would produce a name the file routes refuse',
+        seed: { '/data/report.csv': 'a,b' },
+        request: {
+            body: { oldPath: '/data/report.csv', newPath: '/data/report.sh' }
+        },
+        expect: { status: 400, error: 'Invalid file extension' }
+    },
+    {
+        id: 'rename-folder-to-dotted-name',
+        route: 'POST /SASjsApi/drive/rename',
+        description: 'renames a folder whose new name carries a blocked suffix',
+        seed: { '/data/reports/a.csv': 'a' },
+        request: {
+            body: { oldPath: '/data/reports', newPath: '/data/reports.sh' }
+        },
+        expect: { status: 200, body: { status: 'success' } }
+    },
     {
         id: 'rename-folder-into-itself',
         route: 'POST /SASjsApi/drive/rename',

package/build/cjs/corpus/identity.js

@@ -0,0 +1,268 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_CORPUS = exports.DEACTIVATED = exports.SIGNED_IN = void 0;
+const fixture_js_1 = require("../identity/fixture.js");
+/** The default fixture, plus a caller that is already signed in. */
+exports.SIGNED_IN = {
+    ...fixture_js_1.DEFAULT_IDENTITY,
+    tokens: [
+        {
+            username: 'user2',
+            clientId: 'web_app',
+            accessToken: 'seed-access',
+            refreshToken: 'seed-refresh'
+        },
+        {
+            username: 'admin',
+            clientId: 'removed_client',
+            accessToken: 'seed-access-orphan',
+            refreshToken: 'seed-refresh-orphan'
+        }
+    ],
+    codes: [
+        { code: 'seed-code', username: 'user2', clientId: 'web_app' },
+        { code: 'seed-orphan-code', username: 'user2', clientId: 'removed_client' },
+        // the same shape with a pair already issued: the exchange must still refuse,
+        // rather than handing back tokens that belong to a client that is gone
+        {
+            code: 'seed-orphan-pair-code',
+            username: 'admin',
+            clientId: 'removed_client'
+        }
+    ]
+};
+/** The same identity, with the restricted user switched off. */
+exports.DEACTIVATED = {
+    ...exports.SIGNED_IN,
+    users: exports.SIGNED_IN.users.map((user) => user.username === 'user2' ? { ...user, isActive: false } : user)
+};
+/** The user the seeded session belongs to, without the host's own identifier. */
+const user2 = {
+    username: 'user2',
+    displayName: 'Demo User',
+    isAdmin: false,
+    needsToUpdatePassword: false
+};
+exports.IDENTITY_CORPUS = [
+    {
+        id: 'login',
+        route: 'POST /SASLogon/login',
+        description: 'signs a seeded user in',
+        request: { body: { username: 'admin', password: 'admin123' } },
+        expect: {
+            status: 200,
+            partial: {
+                loggedIn: true,
+                user: {
+                    username: 'admin',
+                    displayName: 'Demo Admin',
+                    isAdmin: true,
+                    needsToUpdatePassword: false
+                }
+            }
+        }
+    },
+    {
+        id: 'login-missing-username',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a sign-in with no username as 400, naming the field',
+        request: { body: { password: 'admin123' } },
+        expect: { status: 400, error: '"username" is required' }
+    },
+    {
+        id: 'login-deactivated',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a deactivated account, naming it',
+        identity: exports.DEACTIVATED,
+        request: { body: { username: 'user2', password: 'user123' } },
+        expect: { status: 401, error: 'This account is not active.' }
+    },
+    {
+        id: 'login-wrong-password',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a wrong password as 401, naming it',
+        request: { body: { username: 'admin', password: 'wrong123' } },
+        expect: { status: 401, error: 'Invalid Password.' }
+    },
+    {
+        id: 'login-unknown-user',
+        route: 'POST /SASLogon/login',
+        description: 'refuses an unknown username as 401, naming it',
+        request: { body: { username: 'nobody', password: 'admin123' } },
+        expect: { status: 401, error: 'Username is not found.' }
+    },
+    {
+        id: 'authorize',
+        route: 'POST /SASLogon/authorize',
+        description: 'issues a code to a signed-in caller',
+        identity: exports.SIGNED_IN,
+        request: {
+            token: 'seed-access',
+            body: { clientId: 'web_app' }
+        },
+        expect: { status: 200, keys: ['code'] }
+    },
+    {
+        id: 'authorize-missing-client',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses an authorize with no clientId as 400, naming the field',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access', body: {} },
+        expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+        id: 'authorize-without-session',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses with 401 when no caller is signed in',
+        request: { body: { clientId: 'web_app' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'authorize-unknown-client',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses an unknown client with 403',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access', body: { clientId: 'nope' } },
+        expect: { status: 403, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'exchanges a code for a token pair',
+        identity: exports.SIGNED_IN,
+        request: { body: { clientId: 'web_app', code: 'seed-code' } },
+        expect: { status: 200, keys: ['accessToken', 'refreshToken'] }
+    },
+    {
+        id: 'exchange-missing-client',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange with no clientId as 400, naming the field',
+        identity: exports.SIGNED_IN,
+        request: { body: { code: 'seed-code' } },
+        expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+        id: 'exchange-code-unknown',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a code the host never issued',
+        request: { body: { clientId: 'web_app', code: 'not-a-code' } },
+        expect: { status: 401, error: 'Invalid Auth Code' }
+    },
+    {
+        id: 'exchange-code-other-client',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a code presented for another client, as a bad code',
+        identity: exports.SIGNED_IN,
+        request: { body: { clientId: 'sasjs', code: 'seed-code' } },
+        expect: { status: 401, error: 'Invalid Auth Code' }
+    },
+    {
+        id: 'exchange-code-client-gone',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a valid code whose client no longer exists',
+        identity: exports.SIGNED_IN,
+        request: { body: { clientId: 'removed_client', code: 'seed-orphan-code' } },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code-client-gone-with-pair',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange whose client is gone even when a pair was issued before it was deleted',
+        identity: exports.SIGNED_IN,
+        request: {
+            body: { clientId: 'removed_client', code: 'seed-orphan-pair-code' }
+        },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code-deactivated',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange for an account that has been deactivated',
+        identity: exports.DEACTIVATED,
+        request: { body: { clientId: 'web_app', code: 'seed-code' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'mints a new pair from a refresh token',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-refresh' },
+        expect: { status: 200, keys: ['accessToken', 'refreshToken'] }
+    },
+    {
+        id: 'refresh-invalid',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh token it did not issue',
+        request: { token: 'not-a-token' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh-without-token',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh with no token at all',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh-client-gone',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh whose client no longer exists',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-refresh-orphan' },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'refresh-deactivated',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh for an account that has been deactivated, as the server does on every request',
+        identity: exports.DEACTIVATED,
+        request: { token: 'seed-refresh' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'logout',
+        route: 'POST /SASjsApi/auth/logout',
+        description: 'revokes the caller pair and answers 204',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access' },
+        expect: { status: 204 }
+    },
+    {
+        id: 'logout-without-token',
+        route: 'POST /SASjsApi/auth/logout',
+        description: 'refuses a logout with no valid token',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'session',
+        route: 'GET /SASjsApi/session',
+        description: 'reports the caller the token names',
+        identity: exports.SIGNED_IN,
+        request: { token: 'seed-access' },
+        expect: { status: 200, partial: user2 }
+    },
+    {
+        id: 'session-deactivated',
+        route: 'GET /SASjsApi/session',
+        description: 'stops resolving a token whose account has been deactivated',
+        identity: exports.DEACTIVATED,
+        request: { token: 'seed-access' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'session-without-token',
+        route: 'GET /SASjsApi/session',
+        description: 'refuses the session read with no caller',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'sign-out',
+        route: 'GET /SASLogon/logout',
+        description: 'answers the body the browser sign-out returns',
+        request: {},
+        expect: { status: 200, contents: 'OK!' }
+    }
+];

package/build/cjs/corpus/runner.js

@@ -4,10 +4,19 @@ exports.runCase = exports.servicesFor = void 0;
 const dispatch_js_1 = require("../host/dispatch.js");
 const service_js_1 = require("../drive/service.js");
 const memory_store_js_1 = require("../drive/memory-store.js");
+const service_js_2 = require("../identity/service.js");
+const memory_store_js_2 = require("../identity/memory-store.js");
+const fixture_js_1 = require("../identity/fixture.js");
 const types_js_1 = require("../types.js");
-/** Services over a fresh store, seeded with the case's files. */
+/**
+ * Services over fresh stores, seeded with the case's files and identity.
+ *
+ * The identity store is built for every case, drive or not, so a case that starts
+ * mid-flow can declare the tokens and codes it begins with.
+ */
 const servicesFor = (testCase) => ({
-    drive: (0, service_js_1.createDriveService)(new memory_store_js_1.MemoryDriveStore(testCase.seed || {}))
+    drive: (0, service_js_1.createDriveService)(new memory_store_js_1.MemoryDriveStore(testCase.seed || {})),
+    identity: (0, service_js_2.createIdentityService)(new memory_store_js_2.MemoryIdentityStore(testCase.identity || fixture_js_1.DEFAULT_IDENTITY))
 });
 exports.servicesFor = servicesFor;
 /**

package/build/cjs/drive/service.js

@@ -124,6 +124,14 @@ const createDriveService = (store) => {
                     throw new types_js_1.ApiError(409, stat.directory
                         ? 'Folder with new name already exists.'
                         : 'File with new name already exists.');
+                // the extension rule is the drive's file-path rule, so a rename may not
+                // be the way around it: without this a file could be renamed into a name
+                // that GET, PATCH and DELETE then refuse, leaving an entry the API that
+                // created it can no longer read or remove. A folder is not subject to it
+                // (nothing puts a folder through the file-path schema), so only a file
+                // move is checked.
+                if (!stat.directory && (0, paths_js_1.hasBlockedExtension)(to))
+                    throw new types_js_1.ApiError(400, 'Invalid file extension');
                 await store.move(from, to);
                 return { status: 'success' };
             }

package/build/cjs/host/dispatch.js

@@ -42,8 +42,56 @@ const dispatch = async (services, routeId, request = {}) => {
     if (!route)
         throw new types_js_1.ApiError(404, `No such operation: ${routeId}`);
     validate(route, request);
-    const { drive } = services;
+    const { drive, identity } = services;
     const query = request.query || {};
+    const body = request.body || {};
+    /** The caller, from the request's own subject or the token it carried. */
+    const caller = async () => {
+        if (request.subject)
+            return request.subject;
+        return identity?.authenticate(request.token);
+    };
+    if (routeId.startsWith('POST /SASjsApi/auth/') ||
+        routeId.startsWith('POST /SASLogon/') ||
+        routeId === 'GET /SASLogon/logout' ||
+        routeId === 'GET /SASjsApi/session') {
+        if (!identity)
+            throw new types_js_1.ApiError(501, `This host has no identity service, so it cannot answer ${routeId}.`);
+        switch (routeId) {
+            case 'POST /SASjsApi/auth/token':
+                return {
+                    status: 200,
+                    body: await identity.token({
+                        clientId: String(body.clientId ?? ''),
+                        code: String(body.code ?? '')
+                    })
+                };
+            case 'POST /SASjsApi/auth/refresh':
+                return { status: 200, body: await identity.refresh(request.token) };
+            case 'POST /SASjsApi/auth/logout':
+                await identity.logout(await caller());
+                return { status: 204 };
+            case 'POST /SASLogon/login':
+                return {
+                    status: 200,
+                    body: await identity.login({
+                        username: String(body.username ?? ''),
+                        password: String(body.password ?? '')
+                    })
+                };
+            case 'POST /SASLogon/authorize':
+                return {
+                    status: 200,
+                    body: {
+                        code: await identity.authorize(await caller(), String(body.clientId ?? ''))
+                    }
+                };
+            case 'GET /SASLogon/logout':
+                return { status: 200, contents: await identity.logoutSession() };
+            case 'GET /SASjsApi/session':
+                return { status: 200, body: await identity.session(await caller()) };
+        }
+    }
     switch (routeId) {
         case 'GET /SASjsApi/drive/file': {
             const file = await drive.read(String(query._filePath || ''));
@@ -98,5 +146,12 @@ exports.HANDLED_ROUTES = [
     'POST /SASjsApi/drive/folder',
     'DELETE /SASjsApi/drive/folder',
     'POST /SASjsApi/drive/rename',
-    'GET /SASjsApi/drive/filetree'
+    'GET /SASjsApi/drive/filetree',
+    'POST /SASjsApi/auth/token',
+    'POST /SASjsApi/auth/refresh',
+    'POST /SASjsApi/auth/logout',
+    'POST /SASLogon/login',
+    'POST /SASLogon/authorize',
+    'GET /SASLogon/logout',
+    'GET /SASjsApi/session'
 ];

package/build/cjs/identity/fixture.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * The identity a browser build starts from, and the format it travels in.
+ *
+ * A shipped fixture is what makes a mock build work with no configuration: it
+ * is small, legible, and declared to be fake. Passwords are plain text because
+ * nothing verifies them beyond an equality check - there is no boundary here,
+ * and pretending otherwise by shipping a hash would suggest one.
+ *
+ * `format` is stamped the way the drive's snapshot is: a store written by an
+ * older build is refused with a named reason rather than misread.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseIdentity = exports.DEFAULT_IDENTITY = exports.IDENTITY_FORMAT = void 0;
+exports.IDENTITY_FORMAT = 1;
+const SECONDS_IN_A_DAY = 86400;
+exports.DEFAULT_IDENTITY = {
+    format: exports.IDENTITY_FORMAT,
+    users: [
+        {
+            uid: 'user-admin',
+            username: 'admin',
+            displayName: 'Demo Admin',
+            // long enough to pass the API's own password rule (six characters), so a
+            // demo can sign in against a real server as well as a mock
+            password: 'admin123',
+            isAdmin: true,
+            isActive: true,
+            needsToUpdatePassword: false
+        },
+        {
+            uid: 'user-restricted',
+            username: 'user2',
+            displayName: 'Demo User',
+            password: 'user123',
+            isAdmin: false,
+            isActive: true,
+            needsToUpdatePassword: false
+        }
+    ],
+    groups: [
+        {
+            uid: 'group-data-controller',
+            name: 'DCGroup',
+            description: 'Data Controller users',
+            isActive: true,
+            users: ['user2']
+        },
+        {
+            uid: 'group-admins',
+            name: 'Admins',
+            description: 'Everything the API offers',
+            isActive: true,
+            users: ['admin']
+        }
+    ],
+    permissions: [
+        {
+            uid: 'rule-routes',
+            path: '/SASjsApi/info',
+            type: 'Route',
+            setting: 'Grant',
+            group: 'group-data-controller'
+        },
+        {
+            uid: 'rule-execute',
+            path: '/SASjsApi/stp/execute',
+            type: 'Route',
+            setting: 'Grant',
+            group: 'group-data-controller'
+        },
+        {
+            uid: 'rule-code',
+            path: '/SASjsApi/code/execute',
+            type: 'Route',
+            setting: 'Deny',
+            user: 'user-restricted'
+        }
+    ],
+    clients: [
+        {
+            clientId: 'web_app',
+            clientSecret: 'web_app',
+            accessTokenExpiration: SECONDS_IN_A_DAY,
+            refreshTokenExpiration: SECONDS_IN_A_DAY * 30
+        },
+        {
+            clientId: 'sasjs',
+            clientSecret: 'sasjs',
+            accessTokenExpiration: 3600,
+            refreshTokenExpiration: SECONDS_IN_A_DAY
+        }
+    ]
+};
+/**
+ * Parses a fixture a build wrote, refusing one this package cannot read.
+ *
+ * The checks name what is wrong and what to do about it: a fixture is hand-
+ * editable, so "invalid identity" would send the reader to the type rather than
+ * to the line.
+ */
+const parseIdentity = (raw) => {
+    const fixture = raw;
+    if (!fixture || typeof fixture !== 'object')
+        throw new Error('The identity fixture is not an object.');
+    if (fixture.format !== exports.IDENTITY_FORMAT)
+        throw new Error(`The identity fixture states format ${String(fixture.format)}, and this build reads format ${exports.IDENTITY_FORMAT}. Rebuild the site, or replace mock-identity.json with one this version wrote.`);
+    for (const key of ['users', 'groups', 'permissions', 'clients'])
+        if (!Array.isArray(fixture[key]))
+            throw new Error(`The identity fixture has no \`${key}\` array.`);
+    for (const token of fixture.tokens || [])
+        if (!token.accessToken || !token.refreshToken)
+            throw new Error(`The identity fixture declares a half pair for ${token.username}/${token.clientId}: a seeded token needs both an accessToken and a refreshToken, because a token only authenticates while the subject's pair holds it.`);
+    if (!fixture.users.some((user) => user.isAdmin))
+        throw new Error('The identity fixture declares no administrator: a demo with nobody able to administer it cannot exercise the admin routes.');
+    return fixture;
+};
+exports.parseIdentity = parseIdentity;