@sasjs/api 0.2.1 → 0.3.0

package/build/esm/corpus/identity.js

@@ -0,0 +1,265 @@
+import { DEFAULT_IDENTITY } from '../identity/fixture.js';
+/** The default fixture, plus a caller that is already signed in. */
+export const SIGNED_IN = {
+    ...DEFAULT_IDENTITY,
+    tokens: [
+        {
+            username: 'user2',
+            clientId: 'web_app',
+            accessToken: 'seed-access',
+            refreshToken: 'seed-refresh'
+        },
+        {
+            username: 'admin',
+            clientId: 'removed_client',
+            accessToken: 'seed-access-orphan',
+            refreshToken: 'seed-refresh-orphan'
+        }
+    ],
+    codes: [
+        { code: 'seed-code', username: 'user2', clientId: 'web_app' },
+        { code: 'seed-orphan-code', username: 'user2', clientId: 'removed_client' },
+        // the same shape with a pair already issued: the exchange must still refuse,
+        // rather than handing back tokens that belong to a client that is gone
+        {
+            code: 'seed-orphan-pair-code',
+            username: 'admin',
+            clientId: 'removed_client'
+        }
+    ]
+};
+/** The same identity, with the restricted user switched off. */
+export const DEACTIVATED = {
+    ...SIGNED_IN,
+    users: SIGNED_IN.users.map((user) => user.username === 'user2' ? { ...user, isActive: false } : user)
+};
+/** The user the seeded session belongs to, without the host's own identifier. */
+const user2 = {
+    username: 'user2',
+    displayName: 'Demo User',
+    isAdmin: false,
+    needsToUpdatePassword: false
+};
+export const IDENTITY_CORPUS = [
+    {
+        id: 'login',
+        route: 'POST /SASLogon/login',
+        description: 'signs a seeded user in',
+        request: { body: { username: 'admin', password: 'admin123' } },
+        expect: {
+            status: 200,
+            partial: {
+                loggedIn: true,
+                user: {
+                    username: 'admin',
+                    displayName: 'Demo Admin',
+                    isAdmin: true,
+                    needsToUpdatePassword: false
+                }
+            }
+        }
+    },
+    {
+        id: 'login-missing-username',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a sign-in with no username as 400, naming the field',
+        request: { body: { password: 'admin123' } },
+        expect: { status: 400, error: '"username" is required' }
+    },
+    {
+        id: 'login-deactivated',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a deactivated account, naming it',
+        identity: DEACTIVATED,
+        request: { body: { username: 'user2', password: 'user123' } },
+        expect: { status: 401, error: 'This account is not active.' }
+    },
+    {
+        id: 'login-wrong-password',
+        route: 'POST /SASLogon/login',
+        description: 'refuses a wrong password as 401, naming it',
+        request: { body: { username: 'admin', password: 'wrong123' } },
+        expect: { status: 401, error: 'Invalid Password.' }
+    },
+    {
+        id: 'login-unknown-user',
+        route: 'POST /SASLogon/login',
+        description: 'refuses an unknown username as 401, naming it',
+        request: { body: { username: 'nobody', password: 'admin123' } },
+        expect: { status: 401, error: 'Username is not found.' }
+    },
+    {
+        id: 'authorize',
+        route: 'POST /SASLogon/authorize',
+        description: 'issues a code to a signed-in caller',
+        identity: SIGNED_IN,
+        request: {
+            token: 'seed-access',
+            body: { clientId: 'web_app' }
+        },
+        expect: { status: 200, keys: ['code'] }
+    },
+    {
+        id: 'authorize-missing-client',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses an authorize with no clientId as 400, naming the field',
+        identity: SIGNED_IN,
+        request: { token: 'seed-access', body: {} },
+        expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+        id: 'authorize-without-session',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses with 401 when no caller is signed in',
+        request: { body: { clientId: 'web_app' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'authorize-unknown-client',
+        route: 'POST /SASLogon/authorize',
+        description: 'refuses an unknown client with 403',
+        identity: SIGNED_IN,
+        request: { token: 'seed-access', body: { clientId: 'nope' } },
+        expect: { status: 403, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'exchanges a code for a token pair',
+        identity: SIGNED_IN,
+        request: { body: { clientId: 'web_app', code: 'seed-code' } },
+        expect: { status: 200, keys: ['accessToken', 'refreshToken'] }
+    },
+    {
+        id: 'exchange-missing-client',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange with no clientId as 400, naming the field',
+        identity: SIGNED_IN,
+        request: { body: { code: 'seed-code' } },
+        expect: { status: 400, error: '"clientId" is required' }
+    },
+    {
+        id: 'exchange-code-unknown',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a code the host never issued',
+        request: { body: { clientId: 'web_app', code: 'not-a-code' } },
+        expect: { status: 401, error: 'Invalid Auth Code' }
+    },
+    {
+        id: 'exchange-code-other-client',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a code presented for another client, as a bad code',
+        identity: SIGNED_IN,
+        request: { body: { clientId: 'sasjs', code: 'seed-code' } },
+        expect: { status: 401, error: 'Invalid Auth Code' }
+    },
+    {
+        id: 'exchange-code-client-gone',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses a valid code whose client no longer exists',
+        identity: SIGNED_IN,
+        request: { body: { clientId: 'removed_client', code: 'seed-orphan-code' } },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code-client-gone-with-pair',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange whose client is gone even when a pair was issued before it was deleted',
+        identity: SIGNED_IN,
+        request: {
+            body: { clientId: 'removed_client', code: 'seed-orphan-pair-code' }
+        },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'exchange-code-deactivated',
+        route: 'POST /SASjsApi/auth/token',
+        description: 'refuses an exchange for an account that has been deactivated',
+        identity: DEACTIVATED,
+        request: { body: { clientId: 'web_app', code: 'seed-code' } },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'mints a new pair from a refresh token',
+        identity: SIGNED_IN,
+        request: { token: 'seed-refresh' },
+        expect: { status: 200, keys: ['accessToken', 'refreshToken'] }
+    },
+    {
+        id: 'refresh-invalid',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh token it did not issue',
+        request: { token: 'not-a-token' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh-without-token',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh with no token at all',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'refresh-client-gone',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh whose client no longer exists',
+        identity: SIGNED_IN,
+        request: { token: 'seed-refresh-orphan' },
+        expect: { status: 401, error: 'Invalid clientId.' }
+    },
+    {
+        id: 'refresh-deactivated',
+        route: 'POST /SASjsApi/auth/refresh',
+        description: 'refuses a refresh for an account that has been deactivated, as the server does on every request',
+        identity: DEACTIVATED,
+        request: { token: 'seed-refresh' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'logout',
+        route: 'POST /SASjsApi/auth/logout',
+        description: 'revokes the caller pair and answers 204',
+        identity: SIGNED_IN,
+        request: { token: 'seed-access' },
+        expect: { status: 204 }
+    },
+    {
+        id: 'logout-without-token',
+        route: 'POST /SASjsApi/auth/logout',
+        description: 'refuses a logout with no valid token',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'session',
+        route: 'GET /SASjsApi/session',
+        description: 'reports the caller the token names',
+        identity: SIGNED_IN,
+        request: { token: 'seed-access' },
+        expect: { status: 200, partial: user2 }
+    },
+    {
+        id: 'session-deactivated',
+        route: 'GET /SASjsApi/session',
+        description: 'stops resolving a token whose account has been deactivated',
+        identity: DEACTIVATED,
+        request: { token: 'seed-access' },
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'session-without-token',
+        route: 'GET /SASjsApi/session',
+        description: 'refuses the session read with no caller',
+        request: {},
+        expect: { status: 401, error: 'Unauthorized' }
+    },
+    {
+        id: 'sign-out',
+        route: 'GET /SASLogon/logout',
+        description: 'answers the body the browser sign-out returns',
+        request: {},
+        expect: { status: 200, contents: 'OK!' }
+    }
+];

package/build/esm/corpus/runner.d.ts

@@ -16,7 +16,12 @@ export interface CaseResult {
     /** The refusal's message, when the case was refused. */
     error?: string;
 }
-/** Services over a fresh store, seeded with the case's files. */
+/**
+ * Services over fresh stores, seeded with the case's files and identity.
+ *
+ * The identity store is built for every case, drive or not, so a case that starts
+ * mid-flow can declare the tokens and codes it begins with.
+ */
 export declare const servicesFor: (testCase: CorpusCase) => Services;
 /**
  * Runs a corpus case against the drive the case seeds itself, or against

package/build/esm/corpus/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAKnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,iEAAiE;AACjE,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAEjD,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAcpB,CAAA"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/corpus/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAQnD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;IAC9B,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,UAAU,UAAU,KAAG,QAKjD,CAAA;AAEF;;;;GAIG;AACH,eAAO,MAAM,OAAO,GAClB,UAAU,UAAU,EACpB,WAAU,QAAgC,KACzC,OAAO,CAAC,UAAU,CAcpB,CAAA"}

package/build/esm/corpus/runner.js

@@ -1,10 +1,19 @@
 import { dispatch } from '../host/dispatch.js';
 import { createDriveService } from '../drive/service.js';
 import { MemoryDriveStore } from '../drive/memory-store.js';
+import { createIdentityService } from '../identity/service.js';
+import { MemoryIdentityStore } from '../identity/memory-store.js';
+import { DEFAULT_IDENTITY } from '../identity/fixture.js';
 import { isApiError } from '../types.js';
-/** Services over a fresh store, seeded with the case's files. */
+/**
+ * Services over fresh stores, seeded with the case's files and identity.
+ *
+ * The identity store is built for every case, drive or not, so a case that starts
+ * mid-flow can declare the tokens and codes it begins with.
+ */
 export const servicesFor = (testCase) => ({
-    drive: createDriveService(new MemoryDriveStore(testCase.seed || {}))
+    drive: createDriveService(new MemoryDriveStore(testCase.seed || {})),
+    identity: createIdentityService(new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY))
 });
 /**
  * Runs a corpus case against the drive the case seeds itself, or against

package/build/esm/host/dispatch.d.ts

@@ -1,4 +1,6 @@
 import type { DriveService } from '../drive/service.js';
+import type { IdentityService } from '../identity/service.js';
+import type { Subject } from '../identity/types.js';
 export interface ApiRequest {
     query?: Record<string, string | undefined>;
     body?: Record<string, unknown>;
@@ -7,6 +9,14 @@ export interface ApiRequest {
         name: string;
         contents: string | Uint8Array;
     };
+    /**
+     * The bearer token the request carried, for the routes that name their caller
+     * in a header rather than a body. A host that already resolved the caller - a
+     * session cookie - passes `subject` instead.
+     */
+    token?: string;
+    /** The caller, when the host resolved one before dispatching. */
+    subject?: Subject;
 }
 export interface ApiResponse {
     status: number;
@@ -17,6 +27,12 @@ export interface ApiResponse {
 }
 export interface Services {
     drive: DriveService;
+    /**
+     * Users, clients and tokens. A host without one answers 501 for the identity
+     * routes, which is the same answer as an operation this package does not
+     * implement - the difference is the message, and it names the capability.
+     */
+    identity?: IdentityService;
 }
 export declare const dispatch: (services: Services, routeId: string, request?: ApiRequest) => Promise<ApiResponse>;
 /** Whether a route is one `dispatch` can answer today. */

package/build/esm/host/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAGvD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;CACvD;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;CACpB;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CA2DrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAUlC,CAAA"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/host/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAGnD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,oFAAoF;IACpF,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;KAAE,CAAA;IACtD;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,mBAAmB;IACnB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,YAAY,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;CAC3B;AAsCD,eAAO,MAAM,QAAQ,GACnB,UAAU,QAAQ,EAClB,SAAS,MAAM,EACf,UAAS,UAAe,KACvB,OAAO,CAAC,WAAW,CAqHrB,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,EAAE,MAAM,EAiBlC,CAAA"}

package/build/esm/host/dispatch.js

@@ -39,8 +39,56 @@ export const dispatch = async (services, routeId, request = {}) => {
     if (!route)
         throw new ApiError(404, `No such operation: ${routeId}`);
     validate(route, request);
-    const { drive } = services;
+    const { drive, identity } = services;
     const query = request.query || {};
+    const body = request.body || {};
+    /** The caller, from the request's own subject or the token it carried. */
+    const caller = async () => {
+        if (request.subject)
+            return request.subject;
+        return identity?.authenticate(request.token);
+    };
+    if (routeId.startsWith('POST /SASjsApi/auth/') ||
+        routeId.startsWith('POST /SASLogon/') ||
+        routeId === 'GET /SASLogon/logout' ||
+        routeId === 'GET /SASjsApi/session') {
+        if (!identity)
+            throw new ApiError(501, `This host has no identity service, so it cannot answer ${routeId}.`);
+        switch (routeId) {
+            case 'POST /SASjsApi/auth/token':
+                return {
+                    status: 200,
+                    body: await identity.token({
+                        clientId: String(body.clientId ?? ''),
+                        code: String(body.code ?? '')
+                    })
+                };
+            case 'POST /SASjsApi/auth/refresh':
+                return { status: 200, body: await identity.refresh(request.token) };
+            case 'POST /SASjsApi/auth/logout':
+                await identity.logout(await caller());
+                return { status: 204 };
+            case 'POST /SASLogon/login':
+                return {
+                    status: 200,
+                    body: await identity.login({
+                        username: String(body.username ?? ''),
+                        password: String(body.password ?? '')
+                    })
+                };
+            case 'POST /SASLogon/authorize':
+                return {
+                    status: 200,
+                    body: {
+                        code: await identity.authorize(await caller(), String(body.clientId ?? ''))
+                    }
+                };
+            case 'GET /SASLogon/logout':
+                return { status: 200, contents: await identity.logoutSession() };
+            case 'GET /SASjsApi/session':
+                return { status: 200, body: await identity.session(await caller()) };
+        }
+    }
     switch (routeId) {
         case 'GET /SASjsApi/drive/file': {
             const file = await drive.read(String(query._filePath || ''));
@@ -94,5 +142,12 @@ export const HANDLED_ROUTES = [
     'POST /SASjsApi/drive/folder',
     'DELETE /SASjsApi/drive/folder',
     'POST /SASjsApi/drive/rename',
-    'GET /SASjsApi/drive/filetree'
+    'GET /SASjsApi/drive/filetree',
+    'POST /SASjsApi/auth/token',
+    'POST /SASjsApi/auth/refresh',
+    'POST /SASjsApi/auth/logout',
+    'POST /SASLogon/login',
+    'POST /SASLogon/authorize',
+    'GET /SASLogon/logout',
+    'GET /SASjsApi/session'
 ];

package/build/esm/identity/fixture.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The identity a browser build starts from, and the format it travels in.
+ *
+ * A shipped fixture is what makes a mock build work with no configuration: it
+ * is small, legible, and declared to be fake. Passwords are plain text because
+ * nothing verifies them beyond an equality check - there is no boundary here,
+ * and pretending otherwise by shipping a hash would suggest one.
+ *
+ * `format` is stamped the way the drive's snapshot is: a store written by an
+ * older build is refused with a named reason rather than misread.
+ */
+export declare const IDENTITY_FORMAT = 1;
+export interface IdentityFixtureUser {
+    uid: string;
+    username: string;
+    displayName: string;
+    /** Plain text on purpose: a fixture, not a credential store. */
+    password: string;
+    isAdmin: boolean;
+    isActive: boolean;
+    needsToUpdatePassword: boolean;
+}
+export interface IdentityFixtureGroup {
+    uid: string;
+    name: string;
+    description: string;
+    isActive: boolean;
+    /** Usernames of the members. */
+    users: string[];
+}
+export interface IdentityFixturePermission {
+    uid: string;
+    path: string;
+    /** `Route` is the only kind the API defines. */
+    type: string;
+    /** `Grant` or `Deny`. */
+    setting: string;
+    /** The username the rule is assigned to, when it is not a group's. */
+    user?: string;
+    /** The group the rule is assigned to, when it is not a user's. */
+    group?: string;
+}
+export interface IdentityFixtureClient {
+    clientId: string;
+    clientSecret: string;
+    /** Seconds an access token lives. */
+    accessTokenExpiration: number;
+    /** Seconds a refresh token lives. */
+    refreshTokenExpiration: number;
+}
+/** An authorization code a host should already accept, so a case can start mid-flow. */
+export interface IdentityFixtureCode {
+    code: string;
+    username: string;
+    clientId: string;
+}
+/** A token a host should already accept, so a case can start signed in. */
+export interface IdentityFixtureToken {
+    username: string;
+    clientId: string;
+    accessToken?: string;
+    refreshToken?: string;
+}
+export interface IdentityFixture {
+    format: number;
+    users: IdentityFixtureUser[];
+    groups: IdentityFixtureGroup[];
+    permissions: IdentityFixturePermission[];
+    clients: IdentityFixtureClient[];
+    /** Tokens a host accepts before it has issued any. */
+    tokens?: IdentityFixtureToken[];
+    /** Authorization codes a host accepts before it has issued any. */
+    codes?: IdentityFixtureCode[];
+}
+export declare const DEFAULT_IDENTITY: IdentityFixture;
+/**
+ * Parses a fixture a build wrote, refusing one this package cannot read.
+ *
+ * The checks name what is wrong and what to do about it: a fixture is hand-
+ * editable, so "invalid identity" would send the reader to the type rather than
+ * to the line.
+ */
+export declare const parseIdentity: (raw: unknown) => IdentityFixture;
+//# sourceMappingURL=fixture.d.ts.map

package/build/esm/identity/fixture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixture.d.ts","sourceRoot":"","sources":["../../../src/identity/fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,eAAe,IAAI,CAAA;AAEhC,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,qBAAqB,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,sBAAsB,EAAE,MAAM,CAAA;CAC/B;AAED,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5B,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC9B,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,sDAAsD;IACtD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC/B,mEAAmE;IACnE,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAA;CAC9B;AAID,eAAO,MAAM,gBAAgB,EAAE,eA6E9B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,eA2B5C,CAAA"}

package/build/esm/identity/fixture.js

@@ -0,0 +1,114 @@
+/**
+ * The identity a browser build starts from, and the format it travels in.
+ *
+ * A shipped fixture is what makes a mock build work with no configuration: it
+ * is small, legible, and declared to be fake. Passwords are plain text because
+ * nothing verifies them beyond an equality check - there is no boundary here,
+ * and pretending otherwise by shipping a hash would suggest one.
+ *
+ * `format` is stamped the way the drive's snapshot is: a store written by an
+ * older build is refused with a named reason rather than misread.
+ */
+export const IDENTITY_FORMAT = 1;
+const SECONDS_IN_A_DAY = 86400;
+export const DEFAULT_IDENTITY = {
+    format: IDENTITY_FORMAT,
+    users: [
+        {
+            uid: 'user-admin',
+            username: 'admin',
+            displayName: 'Demo Admin',
+            // long enough to pass the API's own password rule (six characters), so a
+            // demo can sign in against a real server as well as a mock
+            password: 'admin123',
+            isAdmin: true,
+            isActive: true,
+            needsToUpdatePassword: false
+        },
+        {
+            uid: 'user-restricted',
+            username: 'user2',
+            displayName: 'Demo User',
+            password: 'user123',
+            isAdmin: false,
+            isActive: true,
+            needsToUpdatePassword: false
+        }
+    ],
+    groups: [
+        {
+            uid: 'group-data-controller',
+            name: 'DCGroup',
+            description: 'Data Controller users',
+            isActive: true,
+            users: ['user2']
+        },
+        {
+            uid: 'group-admins',
+            name: 'Admins',
+            description: 'Everything the API offers',
+            isActive: true,
+            users: ['admin']
+        }
+    ],
+    permissions: [
+        {
+            uid: 'rule-routes',
+            path: '/SASjsApi/info',
+            type: 'Route',
+            setting: 'Grant',
+            group: 'group-data-controller'
+        },
+        {
+            uid: 'rule-execute',
+            path: '/SASjsApi/stp/execute',
+            type: 'Route',
+            setting: 'Grant',
+            group: 'group-data-controller'
+        },
+        {
+            uid: 'rule-code',
+            path: '/SASjsApi/code/execute',
+            type: 'Route',
+            setting: 'Deny',
+            user: 'user-restricted'
+        }
+    ],
+    clients: [
+        {
+            clientId: 'web_app',
+            clientSecret: 'web_app',
+            accessTokenExpiration: SECONDS_IN_A_DAY,
+            refreshTokenExpiration: SECONDS_IN_A_DAY * 30
+        },
+        {
+            clientId: 'sasjs',
+            clientSecret: 'sasjs',
+            accessTokenExpiration: 3600,
+            refreshTokenExpiration: SECONDS_IN_A_DAY
+        }
+    ]
+};
+/**
+ * Parses a fixture a build wrote, refusing one this package cannot read.
+ *
+ * The checks name what is wrong and what to do about it: a fixture is hand-
+ * editable, so "invalid identity" would send the reader to the type rather than
+ * to the line.
+ */
+export const parseIdentity = (raw) => {
+    const fixture = raw;
+    if (!fixture || typeof fixture !== 'object')
+        throw new Error('The identity fixture is not an object.');
+    if (fixture.format !== IDENTITY_FORMAT)
+        throw new Error(`The identity fixture states format ${String(fixture.format)}, and this build reads format ${IDENTITY_FORMAT}. Rebuild the site, or replace mock-identity.json with one this version wrote.`);
+    for (const key of ['users', 'groups', 'permissions', 'clients'])
+        if (!Array.isArray(fixture[key]))
+            throw new Error(`The identity fixture has no \`${key}\` array.`);
+    for (const token of fixture.tokens || [])
+        if (!token.accessToken || !token.refreshToken)
+            throw new Error(`The identity fixture declares a half pair for ${token.username}/${token.clientId}: a seeded token needs both an accessToken and a refreshToken, because a token only authenticates while the subject's pair holds it.`);
+    if (!fixture.users.some((user) => user.isAdmin))
+        throw new Error('The identity fixture declares no administrator: a demo with nobody able to administer it cannot exercise the admin routes.');
+    return fixture;
+};