@sasjs/api 0.6.0 → 0.7.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.6.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.7.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -22,6 +22,7 @@ var SASjsApi = (() => {
   // src/index.ts
   var index_exports = {};
   __export(index_exports, {
+    ADMIN_SIGNED_IN: () => ADMIN_SIGNED_IN,
     ApiError: () => ApiError,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
@@ -34,12 +35,15 @@ var SASjsApi = (() => {
     MemoryDriveStore: () => MemoryDriveStore,
     MemoryIdentityStore: () => MemoryIdentityStore,
     OVERLAY: () => OVERLAY,
+    PROVIDER_MANAGED: () => PROVIDER_MANAGED,
+    RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
     basename: () => basename,
     checkDeployTree: () => checkDeployTree,
     createDriveService: () => createDriveService,
     createIdentityService: () => createIdentityService,
+    createRecordService: () => createRecordService,
     decodeBase64: () => decodeBase64,
     deployTree: () => deployTree,
     dirname: () => dirname,
@@ -54,6 +58,7 @@ var SASjsApi = (() => {
     parseIdentity: () => parseIdentity,
     routeById: () => routeById,
     runCase: () => runCase,
+    sanitiseDisplayName: () => sanitiseDisplayName,
     servicesFor: () => servicesFor
   });
 
@@ -111,6 +116,7 @@ var SASjsApi = (() => {
     status: "success",
     message: "Files deployed successfully to @sasjs/server."
   };
+  var MAX_DEPTH = 32;
   var BASE64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
   var base64Body = (value) => value.replace(/[^A-Za-z0-9+/]/g, "");
   var base64Length = (value) => Math.floor(base64Body(value).length * 3 / 4);
@@ -145,7 +151,9 @@ var SASjsApi = (() => {
   };
   var memberName = (member) => member.type === "service" ? `${member.name}.sas` : member.name;
   var memberBytes = (member) => member.type === "file" ? base64Length(member.code) : utf8Length(member.code);
-  var describeSize = (bytes2) => bytes2 < 1024 * 1024 ? `${bytes2} bytes` : `${Math.round(bytes2 / (1024 * 1024) * 10) / 10} MB`;
+  var MEGABYTE = 1024 * 1024;
+  var describeSize = (bytes2) => bytes2 < MEGABYTE ? `${bytes2} bytes` : `${Math.ceil(bytes2 / MEGABYTE * 10) / 10} MB`;
+  var describeLimit = (bytes2) => bytes2 < MEGABYTE ? `${bytes2} bytes` : `${Math.round(bytes2 / MEGABYTE * 10) / 10} MB`;
   var emptyWalk = () => ({
     entries: 0,
     totalBytes: 0,
@@ -153,7 +161,7 @@ var SASjsApi = (() => {
   });
   var isSafeSegment = (name) => name !== "" && name !== "." && name !== ".." && !/[/\\]/.test(name) && // a Windows drive or a NUL byte is never a segment either
   !/[\0]/.test(name);
-  var walk = (members, parentPath, acc) => {
+  var walk = (members, parentPath, acc, depth = 1) => {
     for (const member of members) {
       const name = memberName(member);
       const memberPath = parentPath ? `${parentPath}/${name}` : name;
@@ -165,7 +173,11 @@ var SASjsApi = (() => {
         };
       acc.entries++;
       if (member.type === "folder") {
-        walk(member.members, memberPath, acc);
+        if (depth + 1 > MAX_DEPTH) {
+          if (!acc.tooDeep) acc.tooDeep = depth + 1;
+          continue;
+        }
+        walk(member.members, memberPath, acc, depth + 1);
         continue;
       }
       const bytes2 = memberBytes(member);
@@ -186,6 +198,12 @@ var SASjsApi = (() => {
     const measured = emptyWalk();
     walk(members, "", measured);
     if (measured.nameRefusal) return measured.nameRefusal;
+    if (measured.tooDeep)
+      return {
+        code: 413,
+        status: "failure",
+        message: `The file tree is nested too deeply: ${measured.tooDeep} levels (maximum ${MAX_DEPTH}).`
+      };
     if (measured.entries > limits.entries)
       return {
         code: 413,
@@ -196,13 +214,13 @@ var SASjsApi = (() => {
       return {
         code: 413,
         status: "failure",
-        message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeSize(limits.totalBytes)}).`
+        message: `The file tree exceeds the deploy limit: ${describeSize(measured.totalBytes)} (maximum ${describeLimit(limits.totalBytes)}).`
       };
     if (measured.largest.bytes > limits.fileBytes)
       return {
         code: 413,
         status: "failure",
-        message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeSize(limits.fileBytes)} per file).`
+        message: `A file in the tree exceeds the deploy limit: ${measured.largest.path} is ${describeSize(measured.largest.bytes)} (maximum ${describeLimit(limits.fileBytes)} per file).`
       };
     return null;
   };
@@ -665,7 +683,7 @@ var SASjsApi = (() => {
         },
         {
           status: 401,
-          description: "The authorization code is invalid, expired, already used, or was issued for another client, or the client id is unknown"
+          description: "The authorization code is invalid, expired, already used, or was issued for another client, or the client id is unknown. This route is unauthenticated, so an unknown client id is a `401` here where `POST /SASLogon/authorize` (which requires a session) answers `403`"
         }
       ]
     },
@@ -759,6 +777,10 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
         }
       ]
     },
@@ -799,6 +821,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 403,
+          description: "Client ID already exists."
         }
       ]
     },
@@ -1288,7 +1318,7 @@ var SASjsApi = (() => {
         },
         {
           status: 409,
-          description: "Folder already exists"
+          description: "Folder already exists. The body is that message as plain text."
         }
       ]
     },
@@ -1328,7 +1358,7 @@ var SASjsApi = (() => {
         },
         {
           status: 409,
-          description: "Something already exists at the new path"
+          description: "Something already exists at the new path. The body is that message as plain text."
         }
       ]
     },
@@ -1378,6 +1408,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 409,
+          description: "Group name already exists."
         }
       ]
     },
@@ -1406,6 +1444,22 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: "Can't add/remove user to 'public' group."
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Group not found. / User not found."
+        },
+        {
+          status: 405,
+          description: "Can't add/remove user to group created by external auth provider."
         }
       ]
     },
@@ -1434,6 +1488,22 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: "Can't add/remove user to 'public' group."
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Group not found. / User not found."
+        },
+        {
+          status: 405,
+          description: "Can't add/remove user to group created by external auth provider."
         }
       ]
     },
@@ -1456,6 +1526,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Group not found."
         }
       ]
     },
@@ -1478,6 +1556,10 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 404,
+          description: "Group not found."
         }
       ]
     },
@@ -1500,6 +1582,10 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 404,
+          description: "Group not found."
         }
       ]
     },
@@ -1560,6 +1646,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required, or no grant on the route"
+        },
+        {
+          status: 404,
+          description: "User not found."
         }
       ]
     },
@@ -1606,6 +1700,22 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: "Can not add permission for admin user. / Invalid principal type. Valid types are user or group."
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "User not found. / Group not found."
+        },
+        {
+          status: 409,
+          description: "Permission already exists with provided Path, Type and User. / Permission already exists with provided Path, Type and Group."
         }
       ]
     },
@@ -1628,6 +1738,14 @@ var SASjsApi = (() => {
         {
           status: 204,
           description: "No content"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Permission not found."
         }
       ]
     },
@@ -1656,6 +1774,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Permission not found."
         }
       ]
     },
@@ -1920,6 +2046,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 409,
+          description: "Username already exists."
         }
       ]
     },
@@ -1948,6 +2082,14 @@ var SASjsApi = (() => {
         {
           status: 204,
           description: "No content"
+        },
+        {
+          status: 401,
+          description: "Admin account required, or invalid password"
+        },
+        {
+          status: 404,
+          description: "User is not found."
         }
       ]
     },
@@ -1970,6 +2112,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
+        },
+        {
+          status: 404,
+          description: "User is not found."
         }
       ]
     },
@@ -2028,6 +2178,22 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Unable to find user with <id>"
+        },
+        {
+          status: 405,
+          description: "Can not update username of user that is created by an external auth provider. / Can not update display name of user that is created by an external auth provider."
+        },
+        {
+          status: 409,
+          description: "Username already exists."
         }
       ]
     },
@@ -2056,6 +2222,14 @@ var SASjsApi = (() => {
         {
           status: 204,
           description: "No content"
+        },
+        {
+          status: 401,
+          description: "Admin account required, or invalid password"
+        },
+        {
+          status: 404,
+          description: "User is not found."
         }
       ]
     },
@@ -2078,6 +2252,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
+        },
+        {
+          status: 404,
+          description: "User is not found."
         }
       ]
     },
@@ -2136,6 +2318,22 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 401,
+          description: "Admin account required"
+        },
+        {
+          status: 404,
+          description: "Unable to find user with <username>"
+        },
+        {
+          status: 405,
+          description: "Can not update username of user that is created by an external auth provider. / Can not update display name of user that is created by an external auth provider."
+        },
+        {
+          status: 409,
+          description: "Username already exists."
         }
       ]
     },
@@ -2169,7 +2367,7 @@ var SASjsApi = (() => {
         },
         {
           status: 403,
-          description: "The client id is unknown"
+          description: "The client id is unknown. This route runs under a signed-in session, so the caller is authenticated and an unknown client is refused as forbidden; the unauthenticated `POST /SASjsApi/auth/token` answers `401` for the same condition"
         }
       ]
     },
@@ -2254,7 +2452,7 @@ var SASjsApi = (() => {
     Client: ["identity"],
     Web: ["identity"]
   };
-  var IDENTITY_RECORDS = "The identity service answers the sign-in flow. User, group, permission rule, client and provider records need read and write methods on the same store, which this package does not have yet.";
+  var DIRECTORY = "Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.";
   var EDITOR = "Linting and formatting come from @sasjs/lint, which this package does not depend on. They land with the code routes so an editor has one wiring.";
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
   var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
@@ -2309,18 +2507,20 @@ var SASjsApi = (() => {
     },
     "POST /SASjsApi/auth/logout": { implemented: true },
     "PATCH /SASjsApi/auth/updatePassword": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
+      implemented: true,
+      // As with the permission list: the document's 404 is a caller whose record
+      // has gone, which a host's store can see and this package cannot.
+      hostResponses: [404]
     },
     // Auth Config - the providers a host was started with, and an LDAP import
     "GET /SASjsApi/authConfig": { implemented: false, reason: HOST_CONFIG },
     "POST /SASjsApi/authConfig/synchroniseWithLDAP": {
       implemented: false,
-      reason: IDENTITY_RECORDS
+      reason: DIRECTORY
     },
     // Client - the OAuth clients the identity store already holds for sign-in
-    "GET /SASjsApi/client": { implemented: false, reason: IDENTITY_RECORDS },
-    "POST /SASjsApi/client": { implemented: false, reason: IDENTITY_RECORDS },
+    "GET /SASjsApi/client": { implemented: true },
+    "POST /SASjsApi/client": { implemented: true },
     // Code - the editor's three calls, and the runtime one
     "POST /SASjsApi/code/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/code/trigger": { implemented: false, reason: RUNTIME },
@@ -2394,25 +2594,13 @@ var SASjsApi = (() => {
       reason: UNPUBLISH
     },
     // Group - members and the groups themselves
-    "GET /SASjsApi/group": { implemented: false, reason: IDENTITY_RECORDS },
-    "GET /SASjsApi/group/{uid}": { implemented: false, reason: IDENTITY_RECORDS },
-    "GET /SASjsApi/group/by/groupname/{name}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "POST /SASjsApi/group": { implemented: false, reason: IDENTITY_RECORDS },
-    "POST /SASjsApi/group/{groupUid}/{userUid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "DELETE /SASjsApi/group/{groupUid}/{userUid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "DELETE /SASjsApi/group/{uid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
+    "GET /SASjsApi/group": { implemented: true },
+    "GET /SASjsApi/group/{uid}": { implemented: true },
+    "GET /SASjsApi/group/by/groupname/{name}": { implemented: true },
+    "POST /SASjsApi/group": { implemented: true },
+    "POST /SASjsApi/group/{groupUid}/{userUid}": { implemented: true },
+    "DELETE /SASjsApi/group/{groupUid}/{userUid}": { implemented: true },
+    "DELETE /SASjsApi/group/{uid}": { implemented: true },
     // Info - what the host is, and what this caller may use
     "GET /SASjsApi/info": { implemented: false, reason: HOST_CONFIG },
     "GET /SASjsApi/info/authorizedRoutes": {
@@ -2428,16 +2616,24 @@ var SASjsApi = (() => {
       reason: PERMISSIONS
     },
     // Permission - the rules the inventory above is derived from
-    "GET /SASjsApi/permission": { implemented: false, reason: IDENTITY_RECORDS },
-    "POST /SASjsApi/permission": { implemented: false, reason: IDENTITY_RECORDS },
-    "PATCH /SASjsApi/permission/{uid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "DELETE /SASjsApi/permission/{uid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
+    "GET /SASjsApi/permission": {
+      implemented: true,
+      // The document states 404 for a caller whose record has gone - a token that
+      // outlived its account. Here a token stops resolving when the account does,
+      // so this package answers 401 before it gets that far; the host's own store
+      // is what can still see the difference.
+      hostResponses: [404]
+    },
+    "POST /SASjsApi/permission": { implemented: true },
+    "PATCH /SASjsApi/permission/{uid}": { implemented: true },
+    // The three deletes answer 204 here and 200 on the wire: the server's route
+    // handlers send `res.status(200).send('Account Deleted!')` and
+    // `'Permission Deleted!'`, while tsoa emitted 204 for a void handler, so the
+    // document understates the status. Correcting it is a decorator in
+    // sasjs/server (`@SuccessResponse('200', ...)`), and this package follows the
+    // document until that release lands - a local 200 would fail the schema check
+    // that keeps this table honest.
+    "DELETE /SASjsApi/permission/{uid}": { implemented: true },
     // Session - the caller's own session, then the record behind a triggered one
     "GET /SASjsApi/session": {
       implemented: true,
@@ -2464,29 +2660,26 @@ var SASjsApi = (() => {
     "POST /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/stp/trigger": { implemented: false, reason: RUNTIME },
     // User - the accounts the identity store already holds for sign-in
-    "GET /SASjsApi/user": { implemented: false, reason: IDENTITY_RECORDS },
-    "GET /SASjsApi/user/{uid}": { implemented: false, reason: IDENTITY_RECORDS },
-    "GET /SASjsApi/user/by/username/{username}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "POST /SASjsApi/user": { implemented: false, reason: IDENTITY_RECORDS },
-    "PATCH /SASjsApi/user/{uid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "PATCH /SASjsApi/user/by/username/{username}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "DELETE /SASjsApi/user/{uid}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    },
-    "DELETE /SASjsApi/user/by/username/{username}": {
-      implemented: false,
-      reason: IDENTITY_RECORDS
-    }
+    // Reading accounts is open to any authenticated caller, which is what
+    // sasjs/server's routes do (`authenticateAccessToken` only): the document once
+    // said `Admin account required` here, and sasjs/server#551 corrected it to
+    // `Unauthorized` because that is the refusal a caller actually receives. The
+    // breadth is the server's behaviour, copied deliberately - the auto-exec code
+    // is the one field withheld from anyone but an administrator or the account
+    // itself.
+    "GET /SASjsApi/user": { implemented: true },
+    "GET /SASjsApi/user/{uid}": { implemented: true },
+    "GET /SASjsApi/user/by/username/{username}": { implemented: true },
+    "POST /SASjsApi/user": { implemented: true },
+    "PATCH /SASjsApi/user/{uid}": { implemented: true },
+    "PATCH /SASjsApi/user/by/username/{username}": { implemented: true },
+    // The document also marks `password` optional on these deletes, while the
+    // server's schema requires it for anyone who is not an administrator, and for
+    // an account deleting itself. A host should treat a passwordless delete from a
+    // non-admin as the refusal it is; this package answers 401 `Invalid password.`
+    // where the server's schema answers 400 `"password" is required`.
+    "DELETE /SASjsApi/user/{uid}": { implemented: true },
+    "DELETE /SASjsApi/user/by/username/{username}": { implemented: true }
   };
 
   // src/routes/index.ts
@@ -2578,6 +2771,7 @@ var SASjsApi = (() => {
   };
 
   // src/host/dispatch.ts
+  var SECONDS_IN_A_DAY = 86400;
   var validate = (route, request) => {
     for (const param of route.params) {
       if (!param.required || param.in === "formData" || param.in === "header")
@@ -2598,10 +2792,31 @@ var SASjsApi = (() => {
   var dispatch = async (services, routeId, request = {}) => {
     const route = routeById(routeId);
     if (!route) throw new ApiError(404, `No such operation: ${routeId}`);
+    const { drive, identity, records } = services;
+    const identityScoped = ["User", "Group", "Permission", "Client"].includes(route.tag) || routeId === "PATCH /SASjsApi/auth/updatePassword";
+    if (identityScoped && records) {
+      const subject = request.subject ?? (identity ? await identity.authenticate(request.token) : void 0);
+      if (!subject) {
+        if (!identity)
+          throw new ApiError(
+            501,
+            `This host has no identity service, so it cannot answer ${routeId}.`
+          );
+        throw new ApiError(401, "Unauthorized");
+      }
+    }
     validate(route, request);
-    const { drive, identity } = services;
     const query = request.query || {};
     const body = request.body || {};
+    const params = request.params || {};
+    const required = () => {
+      if (!records)
+        throw new ApiError(
+          501,
+          `This host has no record service, so it cannot answer ${routeId}.`
+        );
+      return records;
+    };
     const caller = async () => {
       if (request.subject) return request.subject;
       return identity?.authenticate(request.token);
@@ -2693,6 +2908,169 @@ var SASjsApi = (() => {
       }
       case "GET /SASjsApi/drive/filetree":
         return { status: 200, body: await drive.tree(query._folderPath) };
+      // ------------------------------------------------------------- records
+      //
+      // The administration routes: users, groups, permission rules, clients and the
+      // caller's own password. Each handler resolves the caller and passes it on;
+      // the admin gate and the wording live in the service.
+      case "GET /SASjsApi/user":
+        return { status: 200, body: await required().listUsers(await caller()) };
+      case "GET /SASjsApi/user/{uid}":
+        return {
+          status: 200,
+          body: await required().getUser(await caller(), {
+            uid: String(params.uid ?? "")
+          })
+        };
+      case "GET /SASjsApi/user/by/username/{username}":
+        return {
+          status: 200,
+          body: await required().getUser(await caller(), {
+            username: String(params.username ?? "")
+          })
+        };
+      case "POST /SASjsApi/user":
+        return {
+          status: 200,
+          body: await required().createUser(await caller(), {
+            username: String(body.username ?? ""),
+            displayName: String(body.displayName ?? ""),
+            password: String(body.password ?? ""),
+            isAdmin: body.isAdmin,
+            isActive: body.isActive,
+            autoExec: body.autoExec
+          })
+        };
+      case "PATCH /SASjsApi/user/{uid}":
+        return {
+          status: 200,
+          body: await required().updateUser(
+            await caller(),
+            { uid: String(params.uid ?? "") },
+            body
+          )
+        };
+      case "PATCH /SASjsApi/user/by/username/{username}":
+        return {
+          status: 200,
+          body: await required().updateUser(
+            await caller(),
+            { username: String(params.username ?? "") },
+            body
+          )
+        };
+      case "DELETE /SASjsApi/user/{uid}":
+        await required().deleteUser(
+          await caller(),
+          { uid: String(params.uid ?? "") },
+          { password: body.password }
+        );
+        return { status: 204 };
+      case "DELETE /SASjsApi/user/by/username/{username}":
+        await required().deleteUser(
+          await caller(),
+          { username: String(params.username ?? "") },
+          { password: body.password }
+        );
+        return { status: 204 };
+      case "GET /SASjsApi/group":
+        return { status: 200, body: await required().listGroups(await caller()) };
+      case "GET /SASjsApi/group/{uid}":
+        return {
+          status: 200,
+          body: await required().getGroup(await caller(), {
+            uid: String(params.uid ?? "")
+          })
+        };
+      case "GET /SASjsApi/group/by/groupname/{name}":
+        return {
+          status: 200,
+          body: await required().getGroup(await caller(), {
+            name: String(params.name ?? "")
+          })
+        };
+      case "POST /SASjsApi/group":
+        return {
+          status: 200,
+          body: await required().createGroup(await caller(), {
+            name: String(body.name ?? ""),
+            description: String(body.description ?? ""),
+            isActive: body.isActive
+          })
+        };
+      case "POST /SASjsApi/group/{groupUid}/{userUid}":
+        return {
+          status: 200,
+          body: await required().addUserToGroup(
+            await caller(),
+            String(params.groupUid ?? ""),
+            String(params.userUid ?? "")
+          )
+        };
+      case "DELETE /SASjsApi/group/{groupUid}/{userUid}":
+        return {
+          status: 200,
+          body: await required().removeUserFromGroup(
+            await caller(),
+            String(params.groupUid ?? ""),
+            String(params.userUid ?? "")
+          )
+        };
+      case "DELETE /SASjsApi/group/{uid}":
+        await required().deleteGroup(await caller(), String(params.uid ?? ""));
+        return { status: 200 };
+      case "GET /SASjsApi/permission":
+        return {
+          status: 200,
+          body: await required().listPermissions(await caller())
+        };
+      case "POST /SASjsApi/permission":
+        return {
+          status: 200,
+          body: await required().createPermission(await caller(), {
+            path: String(body.path ?? ""),
+            type: String(body.type ?? ""),
+            setting: String(body.setting ?? ""),
+            principalType: String(body.principalType ?? ""),
+            principalId: String(body.principalId ?? "")
+          })
+        };
+      case "PATCH /SASjsApi/permission/{uid}":
+        return {
+          status: 200,
+          body: await required().updatePermission(
+            await caller(),
+            String(params.uid ?? ""),
+            { setting: String(body.setting ?? "") }
+          )
+        };
+      case "DELETE /SASjsApi/permission/{uid}":
+        await required().deletePermission(
+          await caller(),
+          String(params.uid ?? "")
+        );
+        return { status: 204 };
+      case "GET /SASjsApi/client":
+        return { status: 200, body: await required().listClients(await caller()) };
+      case "POST /SASjsApi/client":
+        return {
+          status: 200,
+          // An omitted lifetime is the schema's default, not NaN: the server's
+          // Client model declares 86400 and 2592000, and a NaN lifetime would make
+          // every token the client buys expire on arrival.
+          body: await required().createClient(await caller(), {
+            clientId: String(body.clientId ?? ""),
+            clientSecret: String(body.clientSecret ?? ""),
+            accessTokenExpiration: body.accessTokenExpiration === void 0 ? SECONDS_IN_A_DAY : Number(body.accessTokenExpiration),
+            refreshTokenExpiration: body.refreshTokenExpiration === void 0 ? SECONDS_IN_A_DAY * 30 : Number(body.refreshTokenExpiration)
+          })
+        };
+      case "PATCH /SASjsApi/auth/updatePassword":
+        await required().updatePassword(await caller(), {
+          currentPassword: String(body.currentPassword ?? ""),
+          newPassword: String(body.newPassword ?? "")
+        });
+        return { status: 204 };
       default: {
         const reason = routeById(routeId)?.reason;
         throw new ApiError(
@@ -2719,7 +3097,29 @@ var SASjsApi = (() => {
     "POST /SASLogon/login",
     "POST /SASLogon/authorize",
     "GET /SASLogon/logout",
-    "GET /SASjsApi/session"
+    "GET /SASjsApi/session",
+    "GET /SASjsApi/user",
+    "GET /SASjsApi/user/{uid}",
+    "GET /SASjsApi/user/by/username/{username}",
+    "POST /SASjsApi/user",
+    "PATCH /SASjsApi/user/{uid}",
+    "PATCH /SASjsApi/user/by/username/{username}",
+    "DELETE /SASjsApi/user/{uid}",
+    "DELETE /SASjsApi/user/by/username/{username}",
+    "GET /SASjsApi/group",
+    "GET /SASjsApi/group/{uid}",
+    "GET /SASjsApi/group/by/groupname/{name}",
+    "POST /SASjsApi/group",
+    "POST /SASjsApi/group/{groupUid}/{userUid}",
+    "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+    "DELETE /SASjsApi/group/{uid}",
+    "GET /SASjsApi/permission",
+    "POST /SASjsApi/permission",
+    "PATCH /SASjsApi/permission/{uid}",
+    "DELETE /SASjsApi/permission/{uid}",
+    "GET /SASjsApi/client",
+    "POST /SASjsApi/client",
+    "PATCH /SASjsApi/auth/updatePassword"
   ];
 
   // src/identity/service.ts
@@ -2808,31 +3208,359 @@ var SASjsApi = (() => {
     needsToUpdatePassword: user3.needsToUpdatePassword
   });
 
-  // src/identity/fixture.ts
-  var IDENTITY_FORMAT = 1;
-  var SECONDS_IN_A_DAY = 86400;
-  var DEFAULT_IDENTITY = {
-    format: IDENTITY_FORMAT,
-    users: [
-      {
-        uid: "user-admin",
-        username: "admin",
-        displayName: "Demo Admin",
-        // long enough to pass the API's own password rule (six characters), so a
-        // demo can sign in against a real server as well as a mock
-        password: "admin123",
-        isAdmin: true,
-        isActive: true,
-        needsToUpdatePassword: false
-      },
-      {
-        uid: "user-restricted",
-        username: "user2",
-        displayName: "Demo User",
-        password: "user123",
-        isAdmin: false,
-        isActive: true,
-        needsToUpdatePassword: false
+  // src/identity/records.ts
+  var ALL_USERS_GROUP = "all-users";
+  var PUBLIC_GROUP = "public";
+  var unauthorized2 = () => new ApiError(401, "Unauthorized");
+  var requireCaller = async (store, caller) => {
+    if (!caller) throw unauthorized2();
+    const user3 = await store.userById(caller.userId);
+    if (!user3 || !user3.isActive) throw unauthorized2();
+    return user3;
+  };
+  var requireAdmin = async (store, caller) => {
+    const user3 = await requireCaller(store, caller);
+    if (!user3.isAdmin) throw new ApiError(401, "Admin account required");
+    return user3;
+  };
+  var requireSelfOrAdmin = async (store, caller, target) => {
+    const user3 = await requireCaller(store, caller);
+    if (!user3.isAdmin && user3.uid !== target?.uid)
+      throw new ApiError(401, "Admin account required");
+    return user3;
+  };
+  var MAX_DISPLAY_NAME_LENGTH = 100;
+  var sanitiseDisplayName = (value) => String(value ?? "").replace(/[\u0000-\u001F\u007F]/g, "").trim().slice(0, MAX_DISPLAY_NAME_LENGTH);
+  var asUser = (user3) => ({
+    uid: user3.uid,
+    username: user3.username,
+    displayName: user3.displayName,
+    isAdmin: user3.isAdmin
+  });
+  var asGroup = (group) => ({
+    uid: group.uid,
+    name: group.name,
+    description: group.description
+  });
+  var createRecordService = (store) => {
+    const groupDetails = async (group) => {
+      const members = [];
+      for (const uid of group.users) {
+        const user3 = await store.userById(uid);
+        if (user3) members.push(asUser(user3));
+      }
+      return { ...asGroup(group), isActive: group.isActive, users: members };
+    };
+    const userDetails = async (user3, withAutoExec) => {
+      const groups = [];
+      for (const uid of user3.groups) {
+        const group = await store.groupById(uid);
+        if (group) groups.push(asGroup(group));
+      }
+      const details = {
+        ...asUser(user3),
+        isActive: user3.isActive,
+        needsToUpdatePassword: user3.needsToUpdatePassword,
+        groups
+      };
+      if (withAutoExec) details.autoExec = user3.autoExec ?? "";
+      return details;
+    };
+    const findBy = async (by) => by.uid !== void 0 ? store.userById(by.uid) : store.userByName(by.username ?? "");
+    const permissionDetails = async (permission) => {
+      const response = {
+        uid: permission.uid,
+        path: permission.path,
+        type: permission.type,
+        setting: permission.setting
+      };
+      if (permission.user) {
+        const user3 = await store.userById(permission.user);
+        if (user3) response.user = asUser(user3);
+      }
+      if (permission.group) {
+        const group = await store.groupById(permission.group);
+        if (group) response.group = await groupDetails(group);
+      }
+      return response;
+    };
+    return {
+      async listUsers(caller) {
+        await requireCaller(store, caller);
+        const users = await store.users();
+        return users.map(asUser);
+      },
+      async getUser(caller, by) {
+        const reader = await requireCaller(store, caller);
+        const user3 = await findBy(by);
+        if (!user3) throw new ApiError(404, "User is not found.");
+        const withAutoExec = reader.isAdmin || reader.uid === user3.uid;
+        return userDetails(user3, withAutoExec);
+      },
+      async createUser(caller, body) {
+        await requireAdmin(store, caller);
+        if (await store.userByName(body.username))
+          throw new ApiError(409, "Username already exists.");
+        const created = await store.createUser({
+          username: body.username,
+          displayName: sanitiseDisplayName(body.displayName),
+          isAdmin: body.isAdmin === true,
+          isActive: body.isActive !== false,
+          autoExec: body.autoExec
+        });
+        await store.setPassword(created.uid, body.password);
+        const allUsers = await store.groupByName(ALL_USERS_GROUP);
+        if (allUsers) await store.addToGroup(allUsers.uid, created.uid);
+        const stored = await store.userById(created.uid);
+        return userDetails(stored ?? created, true);
+      },
+      async updateUser(caller, by, body) {
+        const current = await findBy(by);
+        await requireSelfOrAdmin(store, caller, current);
+        const change = {};
+        const displayName = sanitiseDisplayName(body.displayName);
+        if (body.username && body.username !== current?.username && current?.authProvider)
+          throw new ApiError(
+            405,
+            "Can not update username of user that is created by an external auth provider."
+          );
+        if (displayName && displayName !== current?.displayName && current?.authProvider)
+          throw new ApiError(
+            405,
+            "Can not update display name of user that is created by an external auth provider."
+          );
+        if (body.username) {
+          const holder = await store.userByName(body.username);
+          if (holder && holder.uid !== current?.uid)
+            throw new ApiError(409, "Username already exists.");
+          change.username = body.username;
+        }
+        if (displayName) change.displayName = displayName;
+        if (body.isAdmin !== void 0) change.isAdmin = body.isAdmin;
+        if (body.isActive !== void 0) change.isActive = body.isActive;
+        if (body.autoExec !== void 0) change.autoExec = body.autoExec;
+        const updated = current ? await store.updateUser(current.uid, change) : void 0;
+        if (!updated)
+          throw new ApiError(
+            404,
+            `Unable to find user with ${by.uid || by.username}`
+          );
+        if (body.password) await store.setPassword(updated.uid, body.password);
+        const stored = await store.userById(updated.uid);
+        return userDetails(stored ?? updated, true);
+      },
+      async deleteUser(caller, by, body) {
+        const current = await findBy(by);
+        const actor = await requireSelfOrAdmin(store, caller, current);
+        if (!current) throw new ApiError(404, "User is not found.");
+        if (!actor.isAdmin) {
+          if (!await store.passwordMatches(current, body.password ?? ""))
+            throw new ApiError(401, "Invalid password.");
+        }
+        await store.deleteUser(current.uid);
+      },
+      async listGroups(caller) {
+        await requireCaller(store, caller);
+        const groups = await store.groups();
+        return groups.map(asGroup);
+      },
+      async getGroup(caller, by) {
+        await requireCaller(store, caller);
+        const group = by.uid !== void 0 ? await store.groupById(by.uid) : await store.groupByName(by.name ?? "");
+        if (!group) throw new ApiError(404, "Group not found.");
+        return groupDetails(group);
+      },
+      async createGroup(caller, body) {
+        await requireAdmin(store, caller);
+        if (await store.groupByName(body.name))
+          throw new ApiError(409, "Group name already exists.");
+        const created = await store.createGroup({
+          name: body.name,
+          description: body.description,
+          isActive: body.isActive !== false
+        });
+        return groupDetails(created);
+      },
+      async deleteGroup(caller, uid) {
+        await requireAdmin(store, caller);
+        if (!await store.groupById(uid))
+          throw new ApiError(404, "Group not found.");
+        await store.deleteGroup(uid);
+      },
+      async addUserToGroup(caller, groupUid, userUid) {
+        await requireAdmin(store, caller);
+        const group = await store.groupById(groupUid);
+        if (!group) throw new ApiError(404, "Group not found.");
+        if (group.name === PUBLIC_GROUP)
+          throw new ApiError(
+            400,
+            `Can't add/remove user to '${PUBLIC_GROUP}' group.`
+          );
+        if (group.authProvider)
+          throw new ApiError(
+            405,
+            "Can't add/remove user to group created by external auth provider."
+          );
+        const user3 = await store.userById(userUid);
+        if (!user3) throw new ApiError(404, "User not found.");
+        if (user3.authProvider)
+          throw new ApiError(
+            405,
+            "Can't add/remove user to group created by external auth provider."
+          );
+        const updated = await store.addToGroup(groupUid, userUid);
+        if (!updated) throw new ApiError(400, "Unable to update group.");
+        return groupDetails(updated);
+      },
+      async removeUserFromGroup(caller, groupUid, userUid) {
+        await requireAdmin(store, caller);
+        const group = await store.groupById(groupUid);
+        if (!group) throw new ApiError(404, "Group not found.");
+        if (group.name === PUBLIC_GROUP)
+          throw new ApiError(
+            400,
+            `Can't add/remove user to '${PUBLIC_GROUP}' group.`
+          );
+        if (group.authProvider)
+          throw new ApiError(
+            405,
+            "Can't add/remove user to group created by external auth provider."
+          );
+        const user3 = await store.userById(userUid);
+        if (!user3) throw new ApiError(404, "User not found.");
+        if (user3.authProvider)
+          throw new ApiError(
+            405,
+            "Can't add/remove user to group created by external auth provider."
+          );
+        const updated = await store.removeFromGroup(groupUid, userUid);
+        if (!updated) throw new ApiError(400, "Unable to update group.");
+        return groupDetails(updated);
+      },
+      async listPermissions(caller) {
+        const reader = await requireCaller(store, caller);
+        const rules = await store.permissions();
+        const visible = reader.isAdmin ? rules : rules.filter(
+          (rule) => rule.user === reader.uid || rule.group !== void 0 && reader.groups.includes(rule.group)
+        );
+        const out = [];
+        for (const rule of visible) out.push(await permissionDetails(rule));
+        return out;
+      },
+      async createPermission(caller, body) {
+        await requireAdmin(store, caller);
+        if (body.principalType === "user") {
+          const user3 = await store.userById(body.principalId);
+          if (!user3) throw new ApiError(404, "User not found.");
+          if (user3.isAdmin)
+            throw new ApiError(400, "Can not add permission for admin user.");
+          const exists = (await store.permissions()).some(
+            (rule) => rule.path === body.path && rule.type === body.type && rule.user === body.principalId
+          );
+          if (exists)
+            throw new ApiError(
+              409,
+              "Permission already exists with provided Path, Type and User."
+            );
+          const created = await store.createPermission({
+            path: body.path,
+            type: body.type,
+            setting: body.setting,
+            user: body.principalId
+          });
+          return permissionDetails(created);
+        }
+        if (body.principalType === "group") {
+          const group = await store.groupById(body.principalId);
+          if (!group) throw new ApiError(404, "Group not found.");
+          const exists = (await store.permissions()).some(
+            (rule) => rule.path === body.path && rule.type === body.type && rule.group === body.principalId
+          );
+          if (exists)
+            throw new ApiError(
+              409,
+              "Permission already exists with provided Path, Type and Group."
+            );
+          const created = await store.createPermission({
+            path: body.path,
+            type: body.type,
+            setting: body.setting,
+            group: body.principalId
+          });
+          return permissionDetails(created);
+        }
+        throw new ApiError(
+          400,
+          "Invalid principal type. Valid types are user or group."
+        );
+      },
+      async updatePermission(caller, uid, body) {
+        await requireAdmin(store, caller);
+        const updated = await store.setPermissionSetting(uid, body.setting);
+        if (!updated) throw new ApiError(404, "Permission not found.");
+        return permissionDetails(updated);
+      },
+      async deletePermission(caller, uid) {
+        await requireAdmin(store, caller);
+        if (!await store.permissionById(uid))
+          throw new ApiError(404, "Permission not found.");
+        await store.deletePermission(uid);
+      },
+      async listClients(caller) {
+        await requireAdmin(store, caller);
+        return store.clients();
+      },
+      async createClient(caller, body) {
+        await requireAdmin(store, caller);
+        if (await store.client(body.clientId))
+          throw new ApiError(403, "Error: Client ID already exists.");
+        return store.createClient({
+          clientId: body.clientId,
+          clientSecret: body.clientSecret,
+          accessTokenExpiration: body.accessTokenExpiration,
+          refreshTokenExpiration: body.refreshTokenExpiration
+        });
+      },
+      async updatePassword(caller, body) {
+        const reader = await requireCaller(store, caller);
+        if (reader.authProvider)
+          throw new ApiError(
+            405,
+            "Can not update password of user that is created by an external auth provider."
+          );
+        if (!await store.passwordMatches(reader, body.currentPassword))
+          throw new ApiError(403, "Invalid current password!");
+        await store.setPassword(reader.uid, body.newPassword);
+        await store.updateUser(reader.uid, { needsToUpdatePassword: false });
+      }
+    };
+  };
+
+  // src/identity/fixture.ts
+  var IDENTITY_FORMAT = 1;
+  var SECONDS_IN_A_DAY2 = 86400;
+  var DEFAULT_IDENTITY = {
+    format: IDENTITY_FORMAT,
+    users: [
+      {
+        uid: "user-admin",
+        username: "admin",
+        displayName: "Demo Admin",
+        // long enough to pass the API's own password rule (six characters), so a
+        // demo can sign in against a real server as well as a mock
+        password: "admin123",
+        isAdmin: true,
+        isActive: true,
+        needsToUpdatePassword: false
+      },
+      {
+        uid: "user-restricted",
+        username: "user2",
+        displayName: "Demo User",
+        password: "user123",
+        isAdmin: false,
+        isActive: true,
+        needsToUpdatePassword: false
       }
     ],
     groups: [
@@ -2878,14 +3606,14 @@ var SASjsApi = (() => {
       {
         clientId: "web_app",
         clientSecret: "web_app",
-        accessTokenExpiration: SECONDS_IN_A_DAY,
-        refreshTokenExpiration: SECONDS_IN_A_DAY * 30
+        accessTokenExpiration: SECONDS_IN_A_DAY2,
+        refreshTokenExpiration: SECONDS_IN_A_DAY2 * 30
       },
       {
         clientId: "sasjs",
         clientSecret: "sasjs",
         accessTokenExpiration: 3600,
-        refreshTokenExpiration: SECONDS_IN_A_DAY
+        refreshTokenExpiration: SECONDS_IN_A_DAY2
       }
     ]
   };
@@ -2931,9 +3659,12 @@ var SASjsApi = (() => {
   var live = (issued, now) => issued && (issued.expiresAt === void 0 || issued.expiresAt > now) ? issued.subject : void 0;
   var MemoryIdentityStore = class {
     constructor(fixture = DEFAULT_IDENTITY) {
-      this.users = [];
+      this.userList = [];
       this.passwords = /* @__PURE__ */ new Map();
-      this.clients = /* @__PURE__ */ new Map();
+      this.groupList = /* @__PURE__ */ new Map();
+      this.permissionList = /* @__PURE__ */ new Map();
+      this.clientRecords = /* @__PURE__ */ new Map();
+      this.clientMap = /* @__PURE__ */ new Map();
       this.pairs = /* @__PURE__ */ new Map();
       this.access = /* @__PURE__ */ new Map();
       this.refresh = /* @__PURE__ */ new Map();
@@ -2945,24 +3676,56 @@ var SASjsApi = (() => {
           `The identity fixture states format ${String(fixture.format)}; this store reads ${IDENTITY_FORMAT}.`
         );
       for (const user3 of fixture.users) {
-        this.users.push({
+        this.userList.push({
           uid: user3.uid,
           username: user3.username,
           displayName: user3.displayName,
           isAdmin: user3.isAdmin,
           isActive: user3.isActive,
-          needsToUpdatePassword: user3.needsToUpdatePassword
+          needsToUpdatePassword: user3.needsToUpdatePassword,
+          authProvider: user3.authProvider,
+          autoExec: user3.autoExec
         });
         this.passwords.set(user3.uid, user3.password);
       }
-      for (const client of fixture.clients)
-        this.clients.set(client.clientId, {
+      for (const client of fixture.clients) {
+        this.clientMap.set(client.clientId, {
+          clientId: client.clientId,
+          accessTokenExpiration: client.accessTokenExpiration,
+          refreshTokenExpiration: client.refreshTokenExpiration
+        });
+        this.clientRecords.set(client.clientId, {
           clientId: client.clientId,
+          clientSecret: client.clientSecret,
           accessTokenExpiration: client.accessTokenExpiration,
           refreshTokenExpiration: client.refreshTokenExpiration
         });
+      }
+      for (const group of fixture.groups) {
+        const uid = group.uid;
+        this.groupList.set(uid, {
+          uid,
+          name: group.name,
+          description: group.description,
+          isActive: group.isActive,
+          authProvider: group.authProvider,
+          users: group.users.map(
+            (username) => this.userList.find((user3) => user3.username === username)?.uid
+          ).filter((member) => member !== void 0)
+        });
+      }
+      for (const permission of fixture.permissions) {
+        this.permissionList.set(permission.uid, {
+          uid: permission.uid,
+          path: permission.path,
+          type: permission.type,
+          setting: permission.setting,
+          user: permission.user ? this.userList.find((user3) => user3.uid === permission.user)?.uid : void 0,
+          group: permission.group ? this.groupList.get(permission.group)?.uid : void 0
+        });
+      }
       for (const token of fixture.tokens || []) {
-        const user3 = this.users.find(
+        const user3 = this.userList.find(
           (candidate) => candidate.username === token.username
         );
         if (!user3) continue;
@@ -2976,7 +3739,7 @@ var SASjsApi = (() => {
           });
       }
       for (const code of fixture.codes || []) {
-        const user3 = this.users.find(
+        const user3 = this.userList.find(
           (candidate) => candidate.username === code.username
         );
         if (!user3) continue;
@@ -2986,17 +3749,21 @@ var SASjsApi = (() => {
       }
     }
     async userByName(username) {
-      return this.users.find((user3) => user3.username === username);
+      const user3 = this.userList.find(
+        (candidate) => candidate.username === username
+      );
+      return user3 ? this.recordOf(user3) : void 0;
     }
     async userById(uid) {
-      return this.users.find((user3) => user3.uid === uid);
+      const user3 = this.userList.find((candidate) => candidate.uid === uid);
+      return user3 ? this.recordOf(user3) : void 0;
     }
     /** A fixture holds the password in clear, so the check is an equality. */
     async passwordMatches(user3, password) {
       return this.passwords.get(user3.uid) === password;
     }
     async client(clientId) {
-      return this.clients.get(clientId);
+      return this.clientMap.get(clientId);
     }
     async issue(subject, client) {
       const issuedAt = Date.now();
@@ -3074,6 +3841,134 @@ var SASjsApi = (() => {
       this.claimed.add(code);
       return true;
     }
+    // ---------------------------------------------------------------- records
+    async users() {
+      return this.userList.map((user3) => this.recordOf(user3));
+    }
+    /** A user as the administration routes report one: groups derived, not stored. */
+    recordOf(user3) {
+      return {
+        ...user3,
+        groups: [...this.groupList.values()].filter((group) => group.users.includes(user3.uid)).map((group) => group.uid)
+      };
+    }
+    async createUser(input) {
+      const user3 = {
+        uid: `user-${randomHex(6)}`,
+        username: input.username,
+        displayName: input.displayName,
+        isAdmin: input.isAdmin,
+        isActive: input.isActive,
+        needsToUpdatePassword: false,
+        autoExec: input.autoExec,
+        authProvider: input.authProvider
+      };
+      this.userList.push(user3);
+      return this.recordOf(user3);
+    }
+    async updateUser(uid, change) {
+      const user3 = this.userList.find((candidate) => candidate.uid === uid);
+      if (!user3) return void 0;
+      if (change.username !== void 0) user3.username = change.username;
+      if (change.displayName !== void 0) user3.displayName = change.displayName;
+      if (change.isAdmin !== void 0) user3.isAdmin = change.isAdmin;
+      if (change.isActive !== void 0) user3.isActive = change.isActive;
+      if (change.needsToUpdatePassword !== void 0)
+        user3.needsToUpdatePassword = change.needsToUpdatePassword;
+      if (change.autoExec !== void 0) user3.autoExec = change.autoExec;
+      return this.recordOf(user3);
+    }
+    async deleteUser(uid) {
+      const index = this.userList.findIndex((user3) => user3.uid === uid);
+      if (index === -1) return;
+      this.userList.splice(index, 1);
+      this.passwords.delete(uid);
+      for (const group of this.groupList.values())
+        group.users = group.users.filter((member) => member !== uid);
+      for (const [key, permission] of this.permissionList)
+        if (permission.user === uid) this.permissionList.delete(key);
+      for (const key of this.pairs.keys())
+        if (key.startsWith(`${uid}|`)) this.pairs.delete(key);
+    }
+    async setPassword(uid, password) {
+      this.passwords.set(uid, password);
+    }
+    async groups() {
+      return [...this.groupList.values()];
+    }
+    async groupById(uid) {
+      return this.groupList.get(uid);
+    }
+    async groupByName(name) {
+      return [...this.groupList.values()].find((group) => group.name === name);
+    }
+    async createGroup(input) {
+      const group = {
+        uid: `group-${randomHex(6)}`,
+        name: input.name,
+        description: input.description,
+        isActive: input.isActive,
+        users: []
+      };
+      this.groupList.set(group.uid, group);
+      return group;
+    }
+    async deleteGroup(uid) {
+      this.groupList.delete(uid);
+      for (const [key, permission] of this.permissionList)
+        if (permission.group === uid) this.permissionList.delete(key);
+    }
+    async addToGroup(groupUid, userUid) {
+      const group = this.groupList.get(groupUid);
+      if (!group) return void 0;
+      if (!group.users.includes(userUid)) group.users.push(userUid);
+      return group;
+    }
+    async removeFromGroup(groupUid, userUid) {
+      const group = this.groupList.get(groupUid);
+      if (!group) return void 0;
+      group.users = group.users.filter((member) => member !== userUid);
+      return group;
+    }
+    async permissions() {
+      return [...this.permissionList.values()];
+    }
+    async permissionById(uid) {
+      return this.permissionList.get(uid);
+    }
+    async createPermission(input) {
+      const permission = {
+        uid: `rule-${randomHex(6)}`,
+        path: input.path,
+        type: input.type,
+        setting: input.setting,
+        user: input.user,
+        group: input.group
+      };
+      this.permissionList.set(permission.uid, permission);
+      return permission;
+    }
+    async setPermissionSetting(uid, setting) {
+      const permission = this.permissionList.get(uid);
+      if (!permission) return void 0;
+      permission.setting = setting;
+      return permission;
+    }
+    async deletePermission(uid) {
+      this.permissionList.delete(uid);
+    }
+    async clients() {
+      return [...this.clientRecords.values()];
+    }
+    async createClient(input) {
+      this.clientRecords.set(input.clientId, input);
+      this.clientMap.set(input.clientId, {
+        clientId: input.clientId,
+        accessTokenExpiration: input.accessTokenExpiration,
+        refreshTokenExpiration: input.refreshTokenExpiration
+      });
+      return input;
+    }
   };
 
   // src/corpus/drive.ts
@@ -3761,15 +4656,1233 @@ var SASjsApi = (() => {
     }
   ];
 
-  // src/corpus/runner.ts
-  var servicesFor = (testCase) => ({
-    drive: createDriveService(
-      testCase.unwritable ? new RefusingDriveStore(testCase.seed || {}) : new MemoryDriveStore(testCase.seed || {})
-    ),
-    identity: createIdentityService(
-      new MemoryIdentityStore(testCase.identity || DEFAULT_IDENTITY)
-    )
-  });
+  // src/corpus/records.ts
+  var SIGNED_IN_TOKENS = [
+    {
+      username: "admin",
+      clientId: "web_app",
+      accessToken: "admin-access",
+      refreshToken: "admin-refresh"
+    },
+    {
+      username: "user2",
+      clientId: "web_app",
+      accessToken: "user-access",
+      refreshToken: "user-refresh"
+    }
+  ];
+  var ADMIN_SIGNED_IN = {
+    ...DEFAULT_IDENTITY,
+    tokens: SIGNED_IN_TOKENS
+  };
+  var PROVIDER_MANAGED = {
+    ...ADMIN_SIGNED_IN,
+    tokens: [
+      ...SIGNED_IN_TOKENS,
+      {
+        username: "diruser",
+        clientId: "web_app",
+        accessToken: "dir-access",
+        refreshToken: "dir-refresh"
+      }
+    ],
+    users: [
+      ...ADMIN_SIGNED_IN.users,
+      {
+        uid: "user-directory",
+        username: "diruser",
+        displayName: "Directory User",
+        password: "dir123",
+        isAdmin: false,
+        isActive: true,
+        needsToUpdatePassword: false,
+        authProvider: "oidc"
+      }
+    ],
+    groups: [
+      ...ADMIN_SIGNED_IN.groups,
+      {
+        uid: "group-directory",
+        name: "Directory",
+        description: "Managed by the directory",
+        isActive: true,
+        users: [],
+        authProvider: "oidc"
+      },
+      {
+        uid: "group-public",
+        name: "public",
+        description: "Everyone",
+        isActive: true,
+        users: []
+      }
+    ]
+  };
+  var ADMIN = "admin-access";
+  var RESTRICTED = "user-access";
+  var RESTRICTED_UID = "user-restricted";
+  var ADMIN_UID = "user-admin";
+  var RECORD_CORPUS = [
+    // ------------------------------------------------------------------ users
+    {
+      id: "list-users",
+      route: "GET /SASjsApi/user",
+      description: "lists the accounts any signed-in caller may see",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN },
+      expect: {
+        status: 200,
+        body: [
+          {
+            uid: ADMIN_UID,
+            username: "admin",
+            displayName: "Demo Admin",
+            isAdmin: true
+          },
+          {
+            uid: RESTRICTED_UID,
+            username: "user2",
+            displayName: "Demo User",
+            isAdmin: false
+          }
+        ]
+      }
+    },
+    {
+      id: "get-user-self",
+      route: "GET /SASjsApi/user/{uid}",
+      description: "returns the caller their own details, with the auto-exec code",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED, params: { uid: RESTRICTED_UID } },
+      expect: {
+        status: 200,
+        partial: {
+          uid: RESTRICTED_UID,
+          username: "user2",
+          isActive: true,
+          isAdmin: false,
+          autoExec: ""
+        }
+      }
+    },
+    {
+      id: "get-user-unauthenticated",
+      route: "GET /SASjsApi/user/{uid}",
+      description: "refuses a read with no caller at all",
+      identity: ADMIN_SIGNED_IN,
+      request: { params: { uid: RESTRICTED_UID } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "get-user-missing",
+      route: "GET /SASjsApi/user/{uid}",
+      description: "answers 404 for an identifier no account has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "user-none" } },
+      expect: { status: 404, error: "User is not found." }
+    },
+    {
+      id: "get-user-by-username",
+      route: "GET /SASjsApi/user/by/username/{username}",
+      description: "finds an account by username",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { username: "user2" } },
+      expect: {
+        status: 200,
+        partial: { uid: RESTRICTED_UID, username: "user2", isAdmin: false }
+      }
+    },
+    {
+      id: "get-user-by-username-unauthenticated",
+      route: "GET /SASjsApi/user/by/username/{username}",
+      description: "refuses the by-username read with no caller",
+      identity: ADMIN_SIGNED_IN,
+      request: { params: { username: "user2" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "get-user-by-username-missing",
+      route: "GET /SASjsApi/user/by/username/{username}",
+      description: "answers 404 for a username no account has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { username: "nobody" } },
+      expect: { status: 404, error: "User is not found." }
+    },
+    {
+      id: "create-user",
+      route: "POST /SASjsApi/user",
+      description: "creates an account, sanitised, and reports it",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          username: "newuser",
+          displayName: "  New
 User  ",
+          password: "newpass",
+          isAdmin: false,
+          isActive: true
+        }
+      },
+      expect: {
+        status: 200,
+        partial: {
+          username: "newuser",
+          displayName: "New User",
+          isAdmin: false,
+          isActive: true
+        }
+      }
+    },
+    {
+      id: "create-user-not-admin",
+      route: "POST /SASjsApi/user",
+      description: "refuses a creation by a caller who is not an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        body: {
+          username: "newuser",
+          displayName: "New User",
+          password: "newpass"
+        }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "create-user-anonymous-incomplete",
+      route: "POST /SASjsApi/user",
+      description: "answers 401 before the payload schema, anonymously and empty",
+      identity: ADMIN_SIGNED_IN,
+      request: { body: {} },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "create-user-duplicate",
+      route: "POST /SASjsApi/user",
+      description: "refuses a username that is taken",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: { username: "user2", displayName: "Another", password: "newpass" }
+      },
+      expect: { status: 409, error: "Username already exists." }
+    },
+    {
+      id: "update-user",
+      route: "PATCH /SASjsApi/user/{uid}",
+      description: "changes an account's display name",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { uid: RESTRICTED_UID },
+        body: {
+          displayName: "Renamed User",
+          username: "user2",
+          password: "user123"
+        }
+      },
+      expect: {
+        status: 200,
+        partial: { uid: RESTRICTED_UID, displayName: "Renamed User" }
+      }
+    },
+    {
+      id: "update-user-not-admin",
+      route: "PATCH /SASjsApi/user/{uid}",
+      description: "refuses a change to somebody else's account",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        params: { uid: ADMIN_UID },
+        body: { displayName: "Hijacked", username: "admin", password: "admin123" }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "update-user-missing",
+      route: "PATCH /SASjsApi/user/{uid}",
+      description: "answers 404 with the identifier it looked up",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { uid: "user-none" },
+        body: { displayName: "Nobody", username: "nobody", password: "none123" }
+      },
+      expect: { status: 404, error: "Unable to find user with user-none" }
+    },
+    {
+      id: "update-user-provider",
+      route: "PATCH /SASjsApi/user/{uid}",
+      description: "refuses a username change on a provider-managed account",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { uid: "user-directory" },
+        body: {
+          username: "renamed",
+          displayName: "Directory User",
+          password: "dir123"
+        }
+      },
+      expect: {
+        status: 405,
+        error: "Can not update username of user that is created by an external auth provider."
+      }
+    },
+    {
+      id: "update-user-username-taken",
+      route: "PATCH /SASjsApi/user/{uid}",
+      description: "refuses a username another account already has",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { uid: RESTRICTED_UID },
+        body: { username: "admin", displayName: "Demo User", password: "user123" }
+      },
+      expect: { status: 409, error: "Username already exists." }
+    },
+    {
+      id: "update-user-by-username",
+      route: "PATCH /SASjsApi/user/by/username/{username}",
+      description: "changes an account looked up by username",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { username: "user2" },
+        body: {
+          isActive: false,
+          username: "user2",
+          displayName: "Demo User",
+          password: "user123"
+        }
+      },
+      expect: { status: 200, partial: { username: "user2", isActive: false } }
+    },
+    {
+      id: "update-user-by-username-not-admin",
+      route: "PATCH /SASjsApi/user/by/username/{username}",
+      description: "refuses a change to another account by username",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        params: { username: "admin" },
+        body: { displayName: "Hijacked", username: "admin", password: "admin123" }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "update-user-by-username-missing",
+      route: "PATCH /SASjsApi/user/by/username/{username}",
+      description: "answers 404 with the username it looked up",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { username: "nobody" },
+        body: { displayName: "Nobody", username: "nobody", password: "none123" }
+      },
+      expect: { status: 404, error: "Unable to find user with nobody" }
+    },
+    {
+      id: "update-user-by-username-provider",
+      route: "PATCH /SASjsApi/user/by/username/{username}",
+      description: "refuses a display-name change on a provider-managed account",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { username: "diruser" },
+        body: { displayName: "Renamed", username: "diruser", password: "dir123" }
+      },
+      expect: {
+        status: 405,
+        error: "Can not update display name of user that is created by an external auth provider."
+      }
+    },
+    {
+      id: "update-user-by-username-taken",
+      route: "PATCH /SASjsApi/user/by/username/{username}",
+      description: "refuses a username another account already has",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { username: "user2" },
+        body: { username: "admin", displayName: "Demo User", password: "user123" }
+      },
+      expect: { status: 409, error: "Username already exists." }
+    },
+    {
+      id: "delete-user",
+      route: "DELETE /SASjsApi/user/{uid}",
+      description: "deletes an account as an administrator, without a password",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: RESTRICTED_UID }, body: {} },
+      expect: { status: 204 }
+    },
+    {
+      id: "delete-user-not-admin",
+      route: "DELETE /SASjsApi/user/{uid}",
+      description: "refuses a deletion of somebody else's account",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED, params: { uid: ADMIN_UID }, body: {} },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "delete-user-missing",
+      route: "DELETE /SASjsApi/user/{uid}",
+      description: "answers 404 for an identifier no account has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "user-none" }, body: {} },
+      expect: { status: 404, error: "User is not found." }
+    },
+    {
+      id: "delete-user-by-username",
+      route: "DELETE /SASjsApi/user/by/username/{username}",
+      description: "deletes an account looked up by username",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { username: "user2" },
+        body: {}
+      },
+      expect: { status: 204 }
+    },
+    {
+      id: "delete-user-by-username-wrong-password",
+      route: "DELETE /SASjsApi/user/by/username/{username}",
+      description: "refuses a self-deletion whose password is wrong",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        params: { username: "user2" },
+        body: { password: "wrong" }
+      },
+      expect: { status: 401, error: "Invalid password." }
+    },
+    {
+      id: "delete-user-by-username-missing",
+      route: "DELETE /SASjsApi/user/by/username/{username}",
+      description: "answers 404 for a username no account has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { username: "nobody" }, body: {} },
+      expect: { status: 404, error: "User is not found." }
+    },
+    // ----------------------------------------------------------------- groups
+    {
+      id: "list-groups",
+      route: "GET /SASjsApi/group",
+      description: "lists the groups",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        body: [
+          {
+            uid: "group-data-controller",
+            name: "DCGroup",
+            description: "Data Controller users"
+          },
+          {
+            uid: "group-admins",
+            name: "Admins",
+            description: "Everything the API offers"
+          }
+        ]
+      }
+    },
+    {
+      id: "get-group",
+      route: "GET /SASjsApi/group/{uid}",
+      description: "returns a group and its members",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      expect: {
+        status: 200,
+        partial: {
+          uid: "group-admins",
+          name: "Admins",
+          isActive: true,
+          users: [
+            {
+              uid: ADMIN_UID,
+              username: "admin",
+              displayName: "Demo Admin",
+              isAdmin: true
+            }
+          ]
+        }
+      }
+    },
+    {
+      id: "get-group-missing",
+      route: "GET /SASjsApi/group/{uid}",
+      description: "answers 404 for an identifier no group has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "group-none" } },
+      expect: { status: 404, error: "Group not found." }
+    },
+    {
+      id: "get-group-by-name",
+      route: "GET /SASjsApi/group/by/groupname/{name}",
+      description: "finds a group by name",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { name: "DCGroup" } },
+      expect: {
+        status: 200,
+        partial: { uid: "group-data-controller", name: "DCGroup" }
+      }
+    },
+    {
+      id: "get-group-by-name-missing",
+      route: "GET /SASjsApi/group/by/groupname/{name}",
+      description: "answers 404 for a name no group has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { name: "nope" } },
+      expect: { status: 404, error: "Group not found." }
+    },
+    {
+      id: "create-group",
+      route: "POST /SASjsApi/group",
+      description: "creates a group with no members",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: { name: "NewGroup", description: "A new group", isActive: true }
+      },
+      expect: {
+        status: 200,
+        partial: {
+          name: "NewGroup",
+          description: "A new group",
+          isActive: true,
+          users: []
+        }
+      }
+    },
+    {
+      id: "create-group-not-admin",
+      route: "POST /SASjsApi/group",
+      description: "refuses a creation by a caller who is not an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        body: { name: "NewGroup", description: "x" }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "create-group-duplicate",
+      route: "POST /SASjsApi/group",
+      description: "refuses a name that is taken",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, body: { name: "DCGroup", description: "again" } },
+      expect: { status: 409, error: "Group name already exists." }
+    },
+    {
+      id: "add-user-to-group",
+      route: "POST /SASjsApi/group/{groupUid}/{userUid}",
+      description: "adds a member and returns the group",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
+      },
+      expect: {
+        status: 200,
+        partial: { uid: "group-admins", name: "Admins" }
+      }
+    },
+    {
+      id: "add-user-to-public-group",
+      route: "POST /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a change to the reserved public group",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-public", userUid: RESTRICTED_UID }
+      },
+      expect: { status: 400, error: "Can't add/remove user to 'public' group." }
+    },
+    {
+      id: "add-user-to-group-not-admin",
+      route: "POST /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a membership change by a non-administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "add-user-to-group-missing-group",
+      route: "POST /SASjsApi/group/{groupUid}/{userUid}",
+      description: "answers 404 for a group that does not exist",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-none", userUid: RESTRICTED_UID }
+      },
+      expect: { status: 404, error: "Group not found." }
+    },
+    {
+      id: "add-user-to-group-provider",
+      route: "POST /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a membership change on a provider-managed group",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
+      },
+      expect: {
+        status: 405,
+        error: "Can't add/remove user to group created by external auth provider."
+      }
+    },
+    {
+      id: "remove-user-from-group",
+      route: "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+      description: "removes a member and returns the group",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
+      },
+      expect: {
+        status: 200,
+        partial: { uid: "group-data-controller", name: "DCGroup", users: [] }
+      }
+    },
+    {
+      id: "add-provider-user-to-group",
+      route: "POST /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a membership change for a provider-managed user",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-admins", userUid: "user-directory" }
+      },
+      expect: {
+        status: 405,
+        error: "Can't add/remove user to group created by external auth provider."
+      }
+    },
+    {
+      id: "remove-provider-user-from-group",
+      route: "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a membership change for a provider-managed user",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-admins", userUid: "user-directory" }
+      },
+      expect: {
+        status: 405,
+        error: "Can't add/remove user to group created by external auth provider."
+      }
+    },
+    {
+      id: "remove-user-from-public-group",
+      route: "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a change to the reserved public group",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-public", userUid: RESTRICTED_UID }
+      },
+      expect: { status: 400, error: "Can't add/remove user to 'public' group." }
+    },
+    {
+      id: "remove-user-from-group-not-admin",
+      route: "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a membership change by a non-administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "remove-user-from-group-missing-user",
+      route: "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+      description: "answers 404 for a member that does not exist",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-admins", userUid: "user-none" }
+      },
+      expect: { status: 404, error: "User not found." }
+    },
+    {
+      id: "remove-user-from-group-provider",
+      route: "DELETE /SASjsApi/group/{groupUid}/{userUid}",
+      description: "refuses a membership change on a provider-managed group",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: ADMIN,
+        params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
+      },
+      expect: {
+        status: 405,
+        error: "Can't add/remove user to group created by external auth provider."
+      }
+    },
+    {
+      id: "delete-group",
+      route: "DELETE /SASjsApi/group/{uid}",
+      description: "deletes a group",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "group-data-controller" } },
+      expect: { status: 200 }
+    },
+    {
+      id: "delete-group-not-admin",
+      route: "DELETE /SASjsApi/group/{uid}",
+      description: "refuses a deletion by a caller who is not an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "delete-group-missing",
+      route: "DELETE /SASjsApi/group/{uid}",
+      description: "answers 404 for an identifier no group has",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "group-none" } },
+      expect: { status: 404, error: "Group not found." }
+    },
+    // ------------------------------------------------------------ permissions
+    {
+      id: "list-permissions-as-admin",
+      route: "GET /SASjsApi/permission",
+      description: "returns every rule to an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN },
+      expect: {
+        status: 200,
+        body: [
+          {
+            uid: "rule-routes",
+            path: "/SASjsApi/info",
+            type: "Route",
+            setting: "Grant",
+            group: {
+              uid: "group-data-controller",
+              name: "DCGroup",
+              description: "Data Controller users",
+              isActive: true,
+              users: [
+                {
+                  uid: RESTRICTED_UID,
+                  username: "user2",
+                  displayName: "Demo User",
+                  isAdmin: false
+                }
+              ]
+            }
+          },
+          {
+            uid: "rule-execute",
+            path: "/SASjsApi/stp/execute",
+            type: "Route",
+            setting: "Grant",
+            group: {
+              uid: "group-data-controller",
+              name: "DCGroup",
+              description: "Data Controller users",
+              isActive: true,
+              users: [
+                {
+                  uid: RESTRICTED_UID,
+                  username: "user2",
+                  displayName: "Demo User",
+                  isAdmin: false
+                }
+              ]
+            }
+          },
+          {
+            uid: "rule-code",
+            path: "/SASjsApi/code/execute",
+            type: "Route",
+            setting: "Deny",
+            user: {
+              uid: RESTRICTED_UID,
+              username: "user2",
+              displayName: "Demo User",
+              isAdmin: false
+            }
+          }
+        ]
+      }
+    },
+    {
+      id: "list-permissions-as-user",
+      route: "GET /SASjsApi/permission",
+      description: "returns a caller only their own rules and their groups'",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        body: [
+          {
+            uid: "rule-routes",
+            path: "/SASjsApi/info",
+            type: "Route",
+            setting: "Grant",
+            group: {
+              uid: "group-data-controller",
+              name: "DCGroup",
+              description: "Data Controller users",
+              isActive: true,
+              users: [
+                {
+                  uid: RESTRICTED_UID,
+                  username: "user2",
+                  displayName: "Demo User",
+                  isAdmin: false
+                }
+              ]
+            }
+          },
+          {
+            uid: "rule-execute",
+            path: "/SASjsApi/stp/execute",
+            type: "Route",
+            setting: "Grant",
+            group: {
+              uid: "group-data-controller",
+              name: "DCGroup",
+              description: "Data Controller users",
+              isActive: true,
+              users: [
+                {
+                  uid: RESTRICTED_UID,
+                  username: "user2",
+                  displayName: "Demo User",
+                  isAdmin: false
+                }
+              ]
+            }
+          },
+          {
+            uid: "rule-code",
+            path: "/SASjsApi/code/execute",
+            type: "Route",
+            setting: "Deny",
+            user: {
+              uid: RESTRICTED_UID,
+              username: "user2",
+              displayName: "Demo User",
+              isAdmin: false
+            }
+          }
+        ]
+      }
+    },
+    {
+      id: "list-permissions-unauthenticated",
+      route: "GET /SASjsApi/permission",
+      description: "refuses the list with no caller",
+      identity: ADMIN_SIGNED_IN,
+      request: {},
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "create-permission-user",
+      route: "POST /SASjsApi/permission",
+      description: "creates a rule for a user",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/code/lint",
+          type: "Route",
+          setting: "Grant",
+          principalType: "user",
+          principalId: RESTRICTED_UID
+        }
+      },
+      expect: {
+        status: 200,
+        partial: { path: "/SASjsApi/code/lint", setting: "Grant" }
+      }
+    },
+    {
+      id: "create-permission-group",
+      route: "POST /SASjsApi/permission",
+      description: "creates a rule for a group",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/code/lint",
+          type: "Route",
+          setting: "Grant",
+          principalType: "group",
+          principalId: "group-data-controller"
+        }
+      },
+      expect: {
+        status: 200,
+        partial: {
+          path: "/SASjsApi/code/lint",
+          setting: "Grant",
+          group: { uid: "group-data-controller", name: "DCGroup" }
+        }
+      }
+    },
+    {
+      id: "create-permission-invalid-principal-type",
+      route: "POST /SASjsApi/permission",
+      description: "refuses a principal type that is neither a user nor a group",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/code/lint",
+          type: "Route",
+          setting: "Grant",
+          principalType: "role",
+          principalId: "anything"
+        }
+      },
+      expect: {
+        status: 400,
+        error: "Invalid principal type. Valid types are user or group."
+      }
+    },
+    {
+      id: "create-permission-admin-principal",
+      route: "POST /SASjsApi/permission",
+      description: "refuses a rule assigned to an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/code/lint",
+          type: "Route",
+          setting: "Grant",
+          principalType: "user",
+          principalId: ADMIN_UID
+        }
+      },
+      expect: {
+        status: 400,
+        error: "Can not add permission for admin user."
+      }
+    },
+    {
+      id: "create-permission-not-admin",
+      route: "POST /SASjsApi/permission",
+      description: "refuses a creation by a non-administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        body: {
+          path: "/SASjsApi/code/lint",
+          type: "Route",
+          setting: "Grant",
+          principalType: "user",
+          principalId: RESTRICTED_UID
+        }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "create-permission-missing-principal",
+      route: "POST /SASjsApi/permission",
+      description: "answers 404 for a principal that does not exist",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/code/lint",
+          type: "Route",
+          setting: "Grant",
+          principalType: "group",
+          principalId: "group-none"
+        }
+      },
+      expect: { status: 404, error: "Group not found." }
+    },
+    {
+      id: "create-permission-duplicate-group",
+      route: "POST /SASjsApi/permission",
+      description: "refuses a group rule that already exists",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/info",
+          type: "Route",
+          setting: "Grant",
+          principalType: "group",
+          principalId: "group-data-controller"
+        }
+      },
+      expect: {
+        status: 409,
+        error: "Permission already exists with provided Path, Type and Group."
+      }
+    },
+    {
+      id: "create-permission-duplicate",
+      route: "POST /SASjsApi/permission",
+      description: "refuses a rule that already exists",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          path: "/SASjsApi/code/execute",
+          type: "Route",
+          setting: "Deny",
+          principalType: "user",
+          principalId: RESTRICTED_UID
+        }
+      },
+      expect: {
+        status: 409,
+        error: "Permission already exists with provided Path, Type and User."
+      }
+    },
+    {
+      id: "update-permission",
+      route: "PATCH /SASjsApi/permission/{uid}",
+      description: "flips a rule from Deny to Grant",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { uid: "rule-code" },
+        body: { setting: "Grant" }
+      },
+      expect: { status: 200, partial: { uid: "rule-code", setting: "Grant" } }
+    },
+    {
+      id: "update-permission-not-admin",
+      route: "PATCH /SASjsApi/permission/{uid}",
+      description: "refuses a change by a non-administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        params: { uid: "rule-code" },
+        body: { setting: "Grant" }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "update-permission-missing",
+      route: "PATCH /SASjsApi/permission/{uid}",
+      description: "answers 404 for a rule that does not exist",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        params: { uid: "rule-none" },
+        body: { setting: "Grant" }
+      },
+      expect: { status: 404, error: "Permission not found." }
+    },
+    {
+      id: "delete-permission",
+      route: "DELETE /SASjsApi/permission/{uid}",
+      description: "deletes a rule",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "rule-code" } },
+      expect: { status: 204 }
+    },
+    {
+      id: "delete-permission-not-admin",
+      route: "DELETE /SASjsApi/permission/{uid}",
+      description: "refuses a deletion by a non-administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED, params: { uid: "rule-code" } },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "delete-permission-missing",
+      route: "DELETE /SASjsApi/permission/{uid}",
+      description: "answers 404 for a rule that does not exist",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN, params: { uid: "rule-none" } },
+      expect: { status: 404, error: "Permission not found." }
+    },
+    // --------------------------------------------------------------- clients
+    {
+      id: "list-clients",
+      route: "GET /SASjsApi/client",
+      description: "lists the registered clients",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN },
+      expect: {
+        status: 200,
+        body: [
+          {
+            clientId: "web_app",
+            clientSecret: "web_app",
+            accessTokenExpiration: 86400,
+            refreshTokenExpiration: 2592e3
+          },
+          {
+            clientId: "sasjs",
+            clientSecret: "sasjs",
+            accessTokenExpiration: 3600,
+            refreshTokenExpiration: 86400
+          }
+        ]
+      }
+    },
+    {
+      id: "list-clients-not-admin",
+      route: "GET /SASjsApi/client",
+      description: "refuses the list to a caller who is not an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "create-client",
+      route: "POST /SASjsApi/client",
+      description: "registers a client",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          clientId: "new_app",
+          clientSecret: "new_secret",
+          accessTokenExpiration: 3600,
+          refreshTokenExpiration: 86400
+        }
+      },
+      expect: {
+        status: 200,
+        body: {
+          clientId: "new_app",
+          clientSecret: "new_secret",
+          accessTokenExpiration: 3600,
+          refreshTokenExpiration: 86400
+        }
+      }
+    },
+    {
+      id: "create-client-defaults",
+      route: "POST /SASjsApi/client",
+      description: "applies the schema defaults when the lifetimes are omitted",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: { clientId: "default_app", clientSecret: "default_secret" }
+      },
+      expect: {
+        status: 200,
+        body: {
+          clientId: "default_app",
+          clientSecret: "default_secret",
+          accessTokenExpiration: 86400,
+          refreshTokenExpiration: 2592e3
+        }
+      }
+    },
+    {
+      id: "create-client-not-admin",
+      route: "POST /SASjsApi/client",
+      description: "refuses a registration by a non-administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        body: {
+          clientId: "new_app",
+          clientSecret: "new_secret",
+          accessTokenExpiration: 3600,
+          refreshTokenExpiration: 86400
+        }
+      },
+      expect: { status: 401, error: "Admin account required" }
+    },
+    {
+      id: "create-client-duplicate",
+      route: "POST /SASjsApi/client",
+      description: "refuses a client id that is registered, with the 403 the server sends",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: ADMIN,
+        body: {
+          clientId: "web_app",
+          clientSecret: "other",
+          accessTokenExpiration: 3600,
+          refreshTokenExpiration: 86400
+        }
+      },
+      expect: { status: 403, error: "Error: Client ID already exists." }
+    },
+    // -------------------------------------------------------------- passwords
+    {
+      id: "update-password",
+      route: "PATCH /SASjsApi/auth/updatePassword",
+      description: "changes the caller’s own password",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        body: { currentPassword: "user123", newPassword: "changed123" }
+      },
+      expect: { status: 204 }
+    },
+    {
+      id: "update-password-missing-field",
+      route: "PATCH /SASjsApi/auth/updatePassword",
+      description: "refuses a body without the current password",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED, body: { newPassword: "changed123" } },
+      expect: { status: 400, error: '"currentPassword" is required' }
+    },
+    {
+      id: "update-password-unauthenticated",
+      route: "PATCH /SASjsApi/auth/updatePassword",
+      description: "refuses the change with no caller",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        body: { currentPassword: "user123", newPassword: "changed123" }
+      },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "update-password-wrong-current",
+      route: "PATCH /SASjsApi/auth/updatePassword",
+      description: "refuses a change whose current password is wrong",
+      identity: ADMIN_SIGNED_IN,
+      request: {
+        token: RESTRICTED,
+        body: { currentPassword: "wrong", newPassword: "changed123" }
+      },
+      expect: { status: 403, error: "Invalid current password!" }
+    },
+    {
+      id: "update-password-provider",
+      route: "PATCH /SASjsApi/auth/updatePassword",
+      description: "refuses a password change on a provider-managed account",
+      identity: PROVIDER_MANAGED,
+      request: {
+        token: "dir-access",
+        body: { currentPassword: "dir123", newPassword: "changed123" }
+      },
+      expect: {
+        status: 405,
+        error: "Can not update password of user that is created by an external auth provider."
+      }
+    }
+  ];
+
+  // src/corpus/runner.ts
+  var servicesFor = (testCase) => {
+    const identity = new MemoryIdentityStore(
+      testCase.identity || DEFAULT_IDENTITY
+    );
+    return {
+      drive: createDriveService(
+        testCase.unwritable ? new RefusingDriveStore(testCase.seed || {}) : new MemoryDriveStore(testCase.seed || {})
+      ),
+      identity: createIdentityService(identity),
+      records: createRecordService(identity)
+    };
+  };
   var RefusingDriveStore = class extends MemoryDriveStore {
     async write() {
       throw new Error("the store refused the write");