@sasjs/api 0.2.1 → 0.3.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.2.1 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.3.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -23,14 +23,19 @@ var SASjsApi = (() => {
   var index_exports = {};
   __export(index_exports, {
     ApiError: () => ApiError,
+    DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
     DRIVE_CORPUS: () => DRIVE_CORPUS,
     HANDLED_ROUTES: () => HANDLED_ROUTES,
+    IDENTITY_CORPUS: () => IDENTITY_CORPUS,
+    IDENTITY_FORMAT: () => IDENTITY_FORMAT,
     MemoryDriveStore: () => MemoryDriveStore,
+    MemoryIdentityStore: () => MemoryIdentityStore,
     OVERLAY: () => OVERLAY,
     ROUTES: () => ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
     basename: () => basename,
     createDriveService: () => createDriveService,
+    createIdentityService: () => createIdentityService,
     dirname: () => dirname,
     dispatch: () => dispatch,
     findRoute: () => findRoute,
@@ -38,6 +43,7 @@ var SASjsApi = (() => {
     isApiError: () => isApiError,
     isRoot: () => isRoot,
     normaliseDrivePath: () => normaliseDrivePath,
+    parseIdentity: () => parseIdentity,
     routeById: () => routeById,
     runCase: () => runCase,
     servicesFor: () => servicesFor
@@ -425,6 +431,10 @@ var SASjsApi = (() => {
         {
           status: 204,
           description: "No content"
+        },
+        {
+          status: 401,
+          description: "No valid access token was supplied"
         }
       ]
     },
@@ -440,6 +450,10 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "The refresh token is missing, invalid or expired, or the client id is unknown"
         }
       ]
     },
@@ -468,6 +482,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: "The request body is missing `clientId` or `code`"
+        },
+        {
+          status: 401,
+          description: "The authorization code is invalid, expired, already used, or was issued for another client, or the client id is unknown"
         }
       ]
     },
@@ -496,6 +518,26 @@ var SASjsApi = (() => {
         {
           status: 204,
           description: "No content"
+        },
+        {
+          status: 400,
+          description: "The request body is missing `currentPassword` or `newPassword`"
+        },
+        {
+          status: 401,
+          description: "No valid access token was supplied"
+        },
+        {
+          status: 403,
+          description: "The current password is incorrect"
+        },
+        {
+          status: 404,
+          description: "The authenticated user no longer exists"
+        },
+        {
+          status: 405,
+          description: "The account authenticates through an external provider, which holds its password"
         }
       ]
     },
@@ -1409,6 +1451,10 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "No valid access token or session was supplied"
         }
       ]
     },
@@ -1892,6 +1938,18 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: "The request body is missing `clientId`, or the CSRF token is missing or invalid"
+        },
+        {
+          status: 401,
+          description: "No signed-in session"
+        },
+        {
+          status: 403,
+          description: "The client id is unknown"
         }
       ]
     },
@@ -1920,6 +1978,22 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: "The request body is missing `username` or `password`"
+        },
+        {
+          status: 401,
+          description: "The credentials are not valid, or password sign-in is disabled for local accounts"
+        },
+        {
+          status: 429,
+          description: "Too many failed attempts for this account"
+        },
+        {
+          status: 500,
+          description: "An unexpected error occurred while signing in"
         }
       ]
     },
@@ -1935,6 +2009,10 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 500,
+          description: "The session store failed to replace the session"
         }
       ]
     }
@@ -1957,6 +2035,13 @@ var SASjsApi = (() => {
     Web: ["identity"]
   };
   var success = { status: "success" };
+  var user = {
+    uid: "",
+    username: "",
+    displayName: "",
+    isAdmin: false,
+    needsToUpdatePassword: false
+  };
   var OVERLAY = {
     // the route inventory reports what the CALLER may use, so it needs an identity
     // even though the rest of the Info tag needs nothing
@@ -2008,6 +2093,37 @@ var SASjsApi = (() => {
     },
     "POST /SASjsApi/drive/deploy/upload": {
       implemented: false
+    },
+    // The lockout and the provider failure are answered before the package is
+    // consulted (routes/web/web.ts in sasjs/server).
+    "POST /SASLogon/login": {
+      implemented: true,
+      hostResponses: [429, 500],
+      responses: { 200: { loggedIn: true, user } }
+    },
+    // The sign-in flow. The statuses are the document's; these entries state the
+    // body a client keys on, and that this package answers the operation.
+    "POST /SASjsApi/auth/token": {
+      implemented: true,
+      responses: { 200: { accessToken: "", refreshToken: "" } }
+    },
+    "POST /SASjsApi/auth/refresh": {
+      implemented: true,
+      responses: { 200: { accessToken: "", refreshToken: "" } }
+    },
+    "POST /SASjsApi/auth/logout": { implemented: true },
+    "POST /SASLogon/authorize": {
+      implemented: true,
+      responses: { 200: { code: "" } }
+    },
+    "GET /SASLogon/logout": {
+      implemented: true,
+      hostResponses: [500],
+      responses: { 200: "OK!" }
+    },
+    "GET /SASjsApi/session": {
+      implemented: true,
+      responses: { 200: user }
     }
   };
 
@@ -2032,9 +2148,15 @@ var SASjsApi = (() => {
         ...body === void 0 ? {} : { body }
       };
     });
+    for (const status of overlay.hostResponses || [])
+      if (!documented.has(status))
+        throw new Error(
+          `src/routes/overlay.ts marks status ${status} of ${generated.id} as host-only, and the OpenAPI document does not state it. Correct the document in sasjs/server and re-vendor spec/swagger.yaml, or drop the annotation.`
+        );
     return {
       ...generated,
       responses,
+      hostResponses: overlay.hostResponses || [],
       capabilities: overlay.capabilities || TAG_CAPABILITIES[generated.tag] || [],
       implemented: overlay.implemented === true
     };
@@ -2110,8 +2232,57 @@ var SASjsApi = (() => {
     const route = routeById(routeId);
     if (!route) throw new ApiError(404, `No such operation: ${routeId}`);
     validate(route, request);
-    const { drive } = services;
+    const { drive, identity } = services;
     const query = request.query || {};
+    const body = request.body || {};
+    const caller = async () => {
+      if (request.subject) return request.subject;
+      return identity?.authenticate(request.token);
+    };
+    if (routeId.startsWith("POST /SASjsApi/auth/") || routeId.startsWith("POST /SASLogon/") || routeId === "GET /SASLogon/logout" || routeId === "GET /SASjsApi/session") {
+      if (!identity)
+        throw new ApiError(
+          501,
+          `This host has no identity service, so it cannot answer ${routeId}.`
+        );
+      switch (routeId) {
+        case "POST /SASjsApi/auth/token":
+          return {
+            status: 200,
+            body: await identity.token({
+              clientId: String(body.clientId ?? ""),
+              code: String(body.code ?? "")
+            })
+          };
+        case "POST /SASjsApi/auth/refresh":
+          return { status: 200, body: await identity.refresh(request.token) };
+        case "POST /SASjsApi/auth/logout":
+          await identity.logout(await caller());
+          return { status: 204 };
+        case "POST /SASLogon/login":
+          return {
+            status: 200,
+            body: await identity.login({
+              username: String(body.username ?? ""),
+              password: String(body.password ?? "")
+            })
+          };
+        case "POST /SASLogon/authorize":
+          return {
+            status: 200,
+            body: {
+              code: await identity.authorize(
+                await caller(),
+                String(body.clientId ?? "")
+              )
+            }
+          };
+        case "GET /SASLogon/logout":
+          return { status: 200, contents: await identity.logoutSession() };
+        case "GET /SASjsApi/session":
+          return { status: 200, body: await identity.session(await caller()) };
+      }
+    }
     switch (routeId) {
       case "GET /SASjsApi/drive/file": {
         const file = await drive.read(String(query._filePath || ""));
@@ -2164,9 +2335,354 @@ var SASjsApi = (() => {
     "POST /SASjsApi/drive/folder",
     "DELETE /SASjsApi/drive/folder",
     "POST /SASjsApi/drive/rename",
-    "GET /SASjsApi/drive/filetree"
+    "GET /SASjsApi/drive/filetree",
+    "POST /SASjsApi/auth/token",
+    "POST /SASjsApi/auth/refresh",
+    "POST /SASjsApi/auth/logout",
+    "POST /SASLogon/login",
+    "POST /SASLogon/authorize",
+    "GET /SASLogon/logout",
+    "GET /SASjsApi/session"
   ];
 
+  // src/identity/service.ts
+  var unauthorized = () => new ApiError(401, "Unauthorized");
+  var liveSubject = async (store, subject) => {
+    const user3 = await store.userById(subject.userId);
+    if (!user3 || !user3.isActive) throw unauthorized();
+    return subject;
+  };
+  var createIdentityService = (store) => ({
+    async authenticate(token) {
+      if (token === void 0) return void 0;
+      const subject = await store.readAccess(token);
+      if (!subject) return void 0;
+      const user3 = await store.userById(subject.userId);
+      return user3 && user3.isActive ? subject : void 0;
+    },
+    async login({ username, password }) {
+      const user3 = await store.userByName(username);
+      if (!user3) throw new ApiError(401, "Username is not found.");
+      if (!await store.passwordMatches(user3, password))
+        throw new ApiError(401, "Invalid Password.");
+      if (!user3.isActive) throw new ApiError(401, "This account is not active.");
+      return {
+        loggedIn: true,
+        user: {
+          uid: user3.uid,
+          username: user3.username,
+          displayName: user3.displayName,
+          isAdmin: user3.isAdmin,
+          needsToUpdatePassword: user3.needsToUpdatePassword
+        }
+      };
+    },
+    async authorize(subject, clientId) {
+      if (!subject) throw unauthorized();
+      if (!await store.client(clientId))
+        throw new ApiError(403, "Invalid clientId.");
+      return store.issueCode({ userId: subject.userId, clientId });
+    },
+    async token({ clientId, code }) {
+      const subject = await store.readCode(code);
+      if (!subject || subject.clientId !== clientId)
+        throw new ApiError(401, "Invalid Auth Code");
+      const client = await store.client(clientId);
+      if (!client) throw new ApiError(401, "Invalid clientId.");
+      const named = await liveSubject(store, subject);
+      if (!await store.claimCode(code))
+        throw new ApiError(401, "Invalid Auth Code");
+      const existing = await store.pairFor(named);
+      if (existing) return existing;
+      const pair = await store.issue(named, client);
+      await store.savePair(named, pair);
+      return pair;
+    },
+    async refresh(token) {
+      const subject = token === void 0 ? void 0 : await store.readRefresh(token);
+      if (!subject) throw unauthorized();
+      const client = await store.client(subject.clientId);
+      if (!client) throw new ApiError(401, "Invalid clientId.");
+      const named = await liveSubject(store, subject);
+      const pair = await store.issue(named, client);
+      await store.savePair(named, pair);
+      return pair;
+    },
+    async logout(subject) {
+      if (!subject) throw unauthorized();
+      await store.deletePair(subject);
+    },
+    async logoutSession() {
+      return "OK!";
+    },
+    async session(subject) {
+      if (!subject) throw unauthorized();
+      const user3 = await store.userById(subject.userId);
+      if (!user3) throw unauthorized();
+      return asSession(user3);
+    }
+  });
+  var asSession = (user3) => ({
+    uid: user3.uid,
+    username: user3.username,
+    displayName: user3.displayName,
+    isAdmin: user3.isAdmin,
+    needsToUpdatePassword: user3.needsToUpdatePassword
+  });
+
+  // src/identity/fixture.ts
+  var IDENTITY_FORMAT = 1;
+  var SECONDS_IN_A_DAY = 86400;
+  var DEFAULT_IDENTITY = {
+    format: IDENTITY_FORMAT,
+    users: [
+      {
+        uid: "user-admin",
+        username: "admin",
+        displayName: "Demo Admin",
+        // long enough to pass the API's own password rule (six characters), so a
+        // demo can sign in against a real server as well as a mock
+        password: "admin123",
+        isAdmin: true,
+        isActive: true,
+        needsToUpdatePassword: false
+      },
+      {
+        uid: "user-restricted",
+        username: "user2",
+        displayName: "Demo User",
+        password: "user123",
+        isAdmin: false,
+        isActive: true,
+        needsToUpdatePassword: false
+      }
+    ],
+    groups: [
+      {
+        uid: "group-data-controller",
+        name: "DCGroup",
+        description: "Data Controller users",
+        isActive: true,
+        users: ["user2"]
+      },
+      {
+        uid: "group-admins",
+        name: "Admins",
+        description: "Everything the API offers",
+        isActive: true,
+        users: ["admin"]
+      }
+    ],
+    permissions: [
+      {
+        uid: "rule-routes",
+        path: "/SASjsApi/info",
+        type: "Route",
+        setting: "Grant",
+        group: "group-data-controller"
+      },
+      {
+        uid: "rule-execute",
+        path: "/SASjsApi/stp/execute",
+        type: "Route",
+        setting: "Grant",
+        group: "group-data-controller"
+      },
+      {
+        uid: "rule-code",
+        path: "/SASjsApi/code/execute",
+        type: "Route",
+        setting: "Deny",
+        user: "user-restricted"
+      }
+    ],
+    clients: [
+      {
+        clientId: "web_app",
+        clientSecret: "web_app",
+        accessTokenExpiration: SECONDS_IN_A_DAY,
+        refreshTokenExpiration: SECONDS_IN_A_DAY * 30
+      },
+      {
+        clientId: "sasjs",
+        clientSecret: "sasjs",
+        accessTokenExpiration: 3600,
+        refreshTokenExpiration: SECONDS_IN_A_DAY
+      }
+    ]
+  };
+  var parseIdentity = (raw) => {
+    const fixture = raw;
+    if (!fixture || typeof fixture !== "object")
+      throw new Error("The identity fixture is not an object.");
+    if (fixture.format !== IDENTITY_FORMAT)
+      throw new Error(
+        `The identity fixture states format ${String(fixture.format)}, and this build reads format ${IDENTITY_FORMAT}. Rebuild the site, or replace mock-identity.json with one this version wrote.`
+      );
+    for (const key of ["users", "groups", "permissions", "clients"])
+      if (!Array.isArray(fixture[key]))
+        throw new Error(`The identity fixture has no \`${key}\` array.`);
+    for (const token of fixture.tokens || [])
+      if (!token.accessToken || !token.refreshToken)
+        throw new Error(
+          `The identity fixture declares a half pair for ${token.username}/${token.clientId}: a seeded token needs both an accessToken and a refreshToken, because a token only authenticates while the subject's pair holds it.`
+        );
+    if (!fixture.users.some((user3) => user3.isAdmin))
+      throw new Error(
+        "The identity fixture declares no administrator: a demo with nobody able to administer it cannot exercise the admin routes."
+      );
+    return fixture;
+  };
+
+  // src/identity/memory-store.ts
+  var keyOf = (subject) => `${subject.userId}|${subject.clientId}`;
+  var randomHex = (bytes2) => {
+    const source = globalThis.crypto;
+    if (!source)
+      throw new ApiError(
+        500,
+        "This host has no Web Crypto (`globalThis.crypto`), so it cannot mint an unguessable identity string."
+      );
+    const buffer = new Uint8Array(bytes2);
+    source.getRandomValues(buffer);
+    return Array.from(buffer, (byte) => byte.toString(16).padStart(2, "0")).join(
+      ""
+    );
+  };
+  var CODE_LIFETIME_SECONDS = 30;
+  var live = (issued, now) => issued && (issued.expiresAt === void 0 || issued.expiresAt > now) ? issued.subject : void 0;
+  var MemoryIdentityStore = class {
+    constructor(fixture = DEFAULT_IDENTITY) {
+      this.users = [];
+      this.passwords = /* @__PURE__ */ new Map();
+      this.clients = /* @__PURE__ */ new Map();
+      this.pairs = /* @__PURE__ */ new Map();
+      this.access = /* @__PURE__ */ new Map();
+      this.refresh = /* @__PURE__ */ new Map();
+      this.codes = /* @__PURE__ */ new Map();
+      this.claimed = /* @__PURE__ */ new Set();
+      if (fixture.format !== IDENTITY_FORMAT)
+        throw new ApiError(
+          500,
+          `The identity fixture states format ${String(fixture.format)}; this store reads ${IDENTITY_FORMAT}.`
+        );
+      for (const user3 of fixture.users) {
+        this.users.push({
+          uid: user3.uid,
+          username: user3.username,
+          displayName: user3.displayName,
+          isAdmin: user3.isAdmin,
+          isActive: user3.isActive,
+          needsToUpdatePassword: user3.needsToUpdatePassword
+        });
+        this.passwords.set(user3.uid, user3.password);
+      }
+      for (const client of fixture.clients)
+        this.clients.set(client.clientId, {
+          clientId: client.clientId,
+          accessTokenExpiration: client.accessTokenExpiration,
+          refreshTokenExpiration: client.refreshTokenExpiration
+        });
+      for (const token of fixture.tokens || []) {
+        const user3 = this.users.find(
+          (candidate) => candidate.username === token.username
+        );
+        if (!user3) continue;
+        const subject = { userId: user3.uid, clientId: token.clientId };
+        if (token.accessToken) this.access.set(token.accessToken, { subject });
+        if (token.refreshToken) this.refresh.set(token.refreshToken, { subject });
+        if (token.accessToken && token.refreshToken)
+          this.pairs.set(keyOf(subject), {
+            accessToken: token.accessToken,
+            refreshToken: token.refreshToken
+          });
+      }
+      for (const code of fixture.codes || []) {
+        const user3 = this.users.find(
+          (candidate) => candidate.username === code.username
+        );
+        if (!user3) continue;
+        this.codes.set(code.code, {
+          subject: { userId: user3.uid, clientId: code.clientId }
+        });
+      }
+    }
+    async userByName(username) {
+      return this.users.find((user3) => user3.username === username);
+    }
+    async userById(uid) {
+      return this.users.find((user3) => user3.uid === uid);
+    }
+    /** A fixture holds the password in clear, so the check is an equality. */
+    async passwordMatches(user3, password) {
+      return this.passwords.get(user3.uid) === password;
+    }
+    async client(clientId) {
+      return this.clients.get(clientId);
+    }
+    async issue(subject, client) {
+      const issuedAt = Date.now();
+      const pair = {
+        accessToken: `access-${randomHex(16)}`,
+        refreshToken: `refresh-${randomHex(16)}`
+      };
+      this.access.set(pair.accessToken, {
+        subject,
+        expiresAt: issuedAt + client.accessTokenExpiration * 1e3
+      });
+      this.refresh.set(pair.refreshToken, {
+        subject,
+        expiresAt: issuedAt + client.refreshTokenExpiration * 1e3
+      });
+      return pair;
+    }
+    /**
+     * A token names its subject only while that subject's CURRENT pair holds it.
+     * The server verifies a token against the pair saved for the user and client,
+     * so a logged-out or rotated token stops working there too; without the same
+     * check here, the browser host would honour a token the server had revoked.
+     */
+    async readAccess(token) {
+      return this.current(token, this.access, "accessToken");
+    }
+    async readRefresh(token) {
+      return this.current(token, this.refresh, "refreshToken");
+    }
+    current(token, issued, kind) {
+      const entry = issued.get(token);
+      if (!entry) return void 0;
+      const subject = live(entry, Date.now());
+      if (!subject) return void 0;
+      const pair = this.pairs.get(keyOf(subject));
+      return pair && pair[kind] === token ? subject : void 0;
+    }
+    async pairFor(subject) {
+      return this.pairs.get(keyOf(subject));
+    }
+    async savePair(subject, pair) {
+      this.pairs.set(keyOf(subject), pair);
+    }
+    async deletePair(subject) {
+      this.pairs.delete(keyOf(subject));
+    }
+    async issueCode(subject) {
+      const code = `code-${randomHex(16)}`;
+      this.codes.set(code, {
+        subject,
+        expiresAt: Date.now() + CODE_LIFETIME_SECONDS * 1e3
+      });
+      return code;
+    }
+    async readCode(code) {
+      return live(this.codes.get(code), Date.now());
+    }
+    async claimCode(code) {
+      if (this.claimed.has(code) || !this.codes.has(code)) return false;
+      this.claimed.add(code);
+      return true;
+    }
+  };
+
   // src/corpus/drive.ts
   var success2 = { status: "success" };
   var bytes = (...values) => Uint8Array.from(values);
@@ -2469,9 +2985,277 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/corpus/identity.ts
+  var SIGNED_IN = {
+    ...DEFAULT_IDENTITY,
+    tokens: [
+      {
+        username: "user2",
+        clientId: "web_app",
+        accessToken: "seed-access",
+        refreshToken: "seed-refresh"
+      },
+      {
+        username: "admin",
+        clientId: "removed_client",
+        accessToken: "seed-access-orphan",
+        refreshToken: "seed-refresh-orphan"
+      }
+    ],
+    codes: [
+      { code: "seed-code", username: "user2", clientId: "web_app" },
+      { code: "seed-orphan-code", username: "user2", clientId: "removed_client" },
+      // the same shape with a pair already issued: the exchange must still refuse,
+      // rather than handing back tokens that belong to a client that is gone
+      {
+        code: "seed-orphan-pair-code",
+        username: "admin",
+        clientId: "removed_client"
+      }
+    ]
+  };
+  var DEACTIVATED = {
+    ...SIGNED_IN,
+    users: SIGNED_IN.users.map(
+      (user3) => user3.username === "user2" ? { ...user3, isActive: false } : user3
+    )
+  };
+  var user2 = {
+    username: "user2",
+    displayName: "Demo User",
+    isAdmin: false,
+    needsToUpdatePassword: false
+  };
+  var IDENTITY_CORPUS = [
+    {
+      id: "login",
+      route: "POST /SASLogon/login",
+      description: "signs a seeded user in",
+      request: { body: { username: "admin", password: "admin123" } },
+      expect: {
+        status: 200,
+        partial: {
+          loggedIn: true,
+          user: {
+            username: "admin",
+            displayName: "Demo Admin",
+            isAdmin: true,
+            needsToUpdatePassword: false
+          }
+        }
+      }
+    },
+    {
+      id: "login-missing-username",
+      route: "POST /SASLogon/login",
+      description: "refuses a sign-in with no username as 400, naming the field",
+      request: { body: { password: "admin123" } },
+      expect: { status: 400, error: '"username" is required' }
+    },
+    {
+      id: "login-deactivated",
+      route: "POST /SASLogon/login",
+      description: "refuses a deactivated account, naming it",
+      identity: DEACTIVATED,
+      request: { body: { username: "user2", password: "user123" } },
+      expect: { status: 401, error: "This account is not active." }
+    },
+    {
+      id: "login-wrong-password",
+      route: "POST /SASLogon/login",
+      description: "refuses a wrong password as 401, naming it",
+      request: { body: { username: "admin", password: "wrong123" } },
+      expect: { status: 401, error: "Invalid Password." }
+    },
+    {
+      id: "login-unknown-user",
+      route: "POST /SASLogon/login",
+      description: "refuses an unknown username as 401, naming it",
+      request: { body: { username: "nobody", password: "admin123" } },
+      expect: { status: 401, error: "Username is not found." }
+    },
+    {
+      id: "authorize",
+      route: "POST /SASLogon/authorize",
+      description: "issues a code to a signed-in caller",
+      identity: SIGNED_IN,
+      request: {
+        token: "seed-access",
+        body: { clientId: "web_app" }
+      },
+      expect: { status: 200, keys: ["code"] }
+    },
+    {
+      id: "authorize-missing-client",
+      route: "POST /SASLogon/authorize",
+      description: "refuses an authorize with no clientId as 400, naming the field",
+      identity: SIGNED_IN,
+      request: { token: "seed-access", body: {} },
+      expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+      id: "authorize-without-session",
+      route: "POST /SASLogon/authorize",
+      description: "refuses with 401 when no caller is signed in",
+      request: { body: { clientId: "web_app" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "authorize-unknown-client",
+      route: "POST /SASLogon/authorize",
+      description: "refuses an unknown client with 403",
+      identity: SIGNED_IN,
+      request: { token: "seed-access", body: { clientId: "nope" } },
+      expect: { status: 403, error: "Invalid clientId." }
+    },
+    {
+      id: "exchange-code",
+      route: "POST /SASjsApi/auth/token",
+      description: "exchanges a code for a token pair",
+      identity: SIGNED_IN,
+      request: { body: { clientId: "web_app", code: "seed-code" } },
+      expect: { status: 200, keys: ["accessToken", "refreshToken"] }
+    },
+    {
+      id: "exchange-missing-client",
+      route: "POST /SASjsApi/auth/token",
+      description: "refuses an exchange with no clientId as 400, naming the field",
+      identity: SIGNED_IN,
+      request: { body: { code: "seed-code" } },
+      expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+      id: "exchange-code-unknown",
+      route: "POST /SASjsApi/auth/token",
+      description: "refuses a code the host never issued",
+      request: { body: { clientId: "web_app", code: "not-a-code" } },
+      expect: { status: 401, error: "Invalid Auth Code" }
+    },
+    {
+      id: "exchange-code-other-client",
+      route: "POST /SASjsApi/auth/token",
+      description: "refuses a code presented for another client, as a bad code",
+      identity: SIGNED_IN,
+      request: { body: { clientId: "sasjs", code: "seed-code" } },
+      expect: { status: 401, error: "Invalid Auth Code" }
+    },
+    {
+      id: "exchange-code-client-gone",
+      route: "POST /SASjsApi/auth/token",
+      description: "refuses a valid code whose client no longer exists",
+      identity: SIGNED_IN,
+      request: { body: { clientId: "removed_client", code: "seed-orphan-code" } },
+      expect: { status: 401, error: "Invalid clientId." }
+    },
+    {
+      id: "exchange-code-client-gone-with-pair",
+      route: "POST /SASjsApi/auth/token",
+      description: "refuses an exchange whose client is gone even when a pair was issued before it was deleted",
+      identity: SIGNED_IN,
+      request: {
+        body: { clientId: "removed_client", code: "seed-orphan-pair-code" }
+      },
+      expect: { status: 401, error: "Invalid clientId." }
+    },
+    {
+      id: "exchange-code-deactivated",
+      route: "POST /SASjsApi/auth/token",
+      description: "refuses an exchange for an account that has been deactivated",
+      identity: DEACTIVATED,
+      request: { body: { clientId: "web_app", code: "seed-code" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "refresh",
+      route: "POST /SASjsApi/auth/refresh",
+      description: "mints a new pair from a refresh token",
+      identity: SIGNED_IN,
+      request: { token: "seed-refresh" },
+      expect: { status: 200, keys: ["accessToken", "refreshToken"] }
+    },
+    {
+      id: "refresh-invalid",
+      route: "POST /SASjsApi/auth/refresh",
+      description: "refuses a refresh token it did not issue",
+      request: { token: "not-a-token" },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "refresh-without-token",
+      route: "POST /SASjsApi/auth/refresh",
+      description: "refuses a refresh with no token at all",
+      request: {},
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "refresh-client-gone",
+      route: "POST /SASjsApi/auth/refresh",
+      description: "refuses a refresh whose client no longer exists",
+      identity: SIGNED_IN,
+      request: { token: "seed-refresh-orphan" },
+      expect: { status: 401, error: "Invalid clientId." }
+    },
+    {
+      id: "refresh-deactivated",
+      route: "POST /SASjsApi/auth/refresh",
+      description: "refuses a refresh for an account that has been deactivated, as the server does on every request",
+      identity: DEACTIVATED,
+      request: { token: "seed-refresh" },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "logout",
+      route: "POST /SASjsApi/auth/logout",
+      description: "revokes the caller pair and answers 204",
+      identity: SIGNED_IN,
+      request: { token: "seed-access" },
+      expect: { status: 204 }
+    },
+    {
+      id: "logout-without-token",
+      route: "POST /SASjsApi/auth/logout",
+      description: "refuses a logout with no valid token",
+      request: {},
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "session",
+      route: "GET /SASjsApi/session",
+      description: "reports the caller the token names",
+      identity: SIGNED_IN,
+      request: { token: "seed-access" },
+      expect: { status: 200, partial: user2 }
+    },
+    {
+      id: "session-deactivated",
+      route: "GET /SASjsApi/session",
+      description: "stops resolving a token whose account has been deactivated",
+      identity: DEACTIVATED,
+      request: { token: "seed-access" },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "session-without-token",
+      route: "GET /SASjsApi/session",
+      description: "refuses the session read with no caller",
+      request: {},
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "sign-out",
+      route: "GET /SASLogon/logout",
+      description: "answers the body the browser sign-out returns",
+      request: {},
+      expect: { status: 200, contents: "OK!" }
+    }
+  ];
+
   // src/corpus/runner.ts
   var servicesFor = (testCase) => ({
-    drive: createDriveService(new MemoryDriveStore(testCase.seed || {}))
+    drive: createDriveService(new MemoryDriveStore(testCase.seed || {})),
+    identity: createIdentityService(
+      new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY)
+    )
   });
   var runCase = async (testCase, services = servicesFor(testCase)) => {
     try {