@sasjs/api 0.7.2 → 0.9.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.7.2 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.9.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -23,7 +23,9 @@ var SASjsApi = (() => {
   var index_exports = {};
   __export(index_exports, {
     ADMIN_SIGNED_IN: () => ADMIN_SIGNED_IN,
+    ALWAYS_VISIBLE_ROUTES: () => ALWAYS_VISIBLE_ROUTES,
     ApiError: () => ApiError,
+    DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
     DEPLOY_PAYLOAD_BYTES: () => DEPLOY_PAYLOAD_BYTES,
@@ -38,7 +40,9 @@ var SASjsApi = (() => {
     PROVIDER_MANAGED: () => PROVIDER_MANAGED,
     RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
+    STATIC_AUTHORIZED_ROUTES: () => STATIC_AUTHORIZED_ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
+    TOP_LEVEL_ROUTES: () => TOP_LEVEL_ROUTES,
     basename: () => basename,
     checkDeployTree: () => checkDeployTree,
     createDriveService: () => createDriveService,
@@ -53,13 +57,15 @@ var SASjsApi = (() => {
     isApiError: () => isApiError,
     isDeployTree: () => isDeployTree,
     isRoot: () => isRoot,
+    isRouteGranted: () => isRouteGranted,
     measureDeployTree: () => measureDeployTree,
     normaliseDrivePath: () => normaliseDrivePath,
     parseIdentity: () => parseIdentity,
     routeById: () => routeById,
     runCase: () => runCase,
     sanitiseDisplayName: () => sanitiseDisplayName,
-    servicesFor: () => servicesFor
+    servicesFor: () => servicesFor,
+    topLevelRouteFor: () => topLevelRouteFor
   });
 
   // src/types.ts
@@ -2457,7 +2463,6 @@ var SASjsApi = (() => {
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
   var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
-  var PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
   var ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
@@ -2604,16 +2609,12 @@ var SASjsApi = (() => {
     // Info - what the host is, and what this caller may use
     "GET /SASjsApi/info": { implemented: false, reason: HOST_CONFIG },
     "GET /SASjsApi/info/authorizedRoutes": {
-      implemented: false,
-      // the route inventory reports what the CALLER may use, so it needs an
-      // identity even though the rest of the Info tag needs nothing
-      capabilities: ["identity"],
-      reason: PERMISSIONS
+      implemented: true,
+      capabilities: ["identity"]
     },
     "GET /SASjsApi/info/myAuthorizedRoutes": {
-      implemented: false,
-      capabilities: ["identity"],
-      reason: PERMISSIONS
+      implemented: true,
+      capabilities: ["identity"]
     },
     // Permission - the rules the inventory above is derived from
     "GET /SASjsApi/permission": {
@@ -2970,6 +2971,16 @@ var SASjsApi = (() => {
             { password: body.password }
           )
         };
+      case "GET /SASjsApi/info/authorizedRoutes":
+        return {
+          status: 200,
+          body: await required().listAuthorizedRoutes(await caller())
+        };
+      case "GET /SASjsApi/info/myAuthorizedRoutes":
+        return {
+          status: 200,
+          body: await required().myAuthorizedRoutes(await caller())
+        };
       case "GET /SASjsApi/group":
         return { status: 200, body: await required().listGroups(await caller()) };
       case "GET /SASjsApi/group/{uid}":
@@ -3080,6 +3091,8 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "GET /SASjsApi/info/authorizedRoutes",
+    "GET /SASjsApi/info/myAuthorizedRoutes",
     "GET /SASjsApi/drive/file",
     "POST /SASjsApi/drive/file",
     "PATCH /SASjsApi/drive/file",
@@ -3121,6 +3134,40 @@ var SASjsApi = (() => {
     "PATCH /SASjsApi/auth/updatePassword"
   ];
 
+  // src/identity/routeAccess.ts
+  var TOP_LEVEL_ROUTES = ["/AppStream", "/SASjsApi"];
+  var ALWAYS_VISIBLE_ROUTES = ["/AppStream"];
+  var STATIC_AUTHORIZED_ROUTES = [
+    "/SASjsApi/code/execute",
+    "/SASjsApi/stp/execute",
+    "/SASjsApi/drive/deploy",
+    "/SASjsApi/drive/deploy/upload",
+    "/SASjsApi/drive/file",
+    "/SASjsApi/drive/folder",
+    "/SASjsApi/drive/fileTree",
+    "/SASjsApi/drive/rename"
+  ];
+  var DEFAULT_GRANTABLE_ROUTES = [
+    ...TOP_LEVEL_ROUTES,
+    ...STATIC_AUTHORIZED_ROUTES
+  ];
+  var topLevelRouteFor = (routePath) => TOP_LEVEL_ROUTES.find(
+    (route) => routePath.toLowerCase().startsWith(route.toLowerCase())
+  ) ?? routePath;
+  var settingOn = (rules, path) => rules.find((rule) => rule.path === path)?.setting;
+  var GRANT = "Grant";
+  var DENY = "Deny";
+  var isRouteGranted = (rules, path, topLevelRoute = topLevelRouteFor(path)) => {
+    const userSetting = settingOn(rules.user, path) ?? settingOn(rules.user, topLevelRoute);
+    if (userSetting) return userSetting === GRANT;
+    const onPath = rules.group.filter((rule) => rule.path === path);
+    if (onPath.some((rule) => rule.setting === GRANT)) return true;
+    if (onPath.some((rule) => rule.setting === DENY)) return false;
+    return rules.group.some(
+      (rule) => rule.path === topLevelRoute && rule.setting === GRANT
+    );
+  };
+
   // src/identity/service.ts
   var unauthorized = () => new ApiError(401, "Unauthorized");
   var liveSubject = async (store, subject) => {
@@ -3241,7 +3288,8 @@ var SASjsApi = (() => {
     name: group.name,
     description: group.description
   });
-  var createRecordService = (store) => {
+  var createRecordService = (store, options = {}) => {
+    const grantableRoutes = options.grantableRoutes || DEFAULT_GRANTABLE_ROUTES;
     const groupDetails = async (group) => {
       const members = [];
       for (const uid of group.users) {
@@ -3266,23 +3314,14 @@ var SASjsApi = (() => {
       return details;
     };
     const findBy = async (by) => by.uid !== void 0 ? store.userById(by.uid) : store.userByName(by.username ?? "");
-    const permissionDetails = async (permission) => {
-      const response = {
-        uid: permission.uid,
-        path: permission.path,
-        type: permission.type,
-        setting: permission.setting
-      };
-      if (permission.user) {
-        const user3 = await store.userById(permission.user);
-        if (user3) response.user = asUser(user3);
-      }
-      if (permission.group) {
-        const group = await store.groupById(permission.group);
-        if (group) response.group = await groupDetails(group);
-      }
-      return response;
-    };
+    const permissionDetails = async (permission) => ({
+      uid: permission.uid,
+      path: permission.path,
+      type: permission.type,
+      setting: permission.setting,
+      ...permission.user ? { user: permission.user } : {},
+      ...permission.group ? { group: permission.group } : {}
+    });
     return {
       async listUsers(caller) {
         await requireCaller(store, caller);
@@ -3437,6 +3476,32 @@ var SASjsApi = (() => {
         if (!updated) throw new ApiError(400, "Unable to update group.");
         return groupDetails(updated);
       },
+      async listAuthorizedRoutes(caller) {
+        await requireCaller(store, caller);
+        return { paths: [...grantableRoutes] };
+      },
+      async myAuthorizedRoutes(caller) {
+        const reader = await requireCaller(store, caller);
+        if (reader.isAdmin) return { paths: [...grantableRoutes] };
+        const rules = await store.permissions();
+        const mine = {
+          user: rules.filter((rule) => rule.user === reader.uid).map((rule) => ({ path: rule.path, setting: rule.setting })),
+          group: rules.filter(
+            (rule) => rule.group !== void 0 && reader.groups.includes(rule.group)
+          ).map((rule) => ({ path: rule.path, setting: rule.setting }))
+        };
+        const publicGroup = (await store.groups()).find(
+          (group) => group.name === "public"
+        );
+        const publicGrants = publicGroup ? rules.filter(
+          (rule) => rule.group === publicGroup.uid && rule.setting === "Grant"
+        ).map((rule) => rule.path) : [];
+        return {
+          paths: grantableRoutes.filter(
+            (path) => ALWAYS_VISIBLE_ROUTES.includes(path) || publicGrants.includes(path) || isRouteGranted(mine, path, topLevelRouteFor(path))
+          )
+        };
+      },
       async listPermissions(caller) {
         const reader = await requireCaller(store, caller);
         const rules = await store.permissions();
@@ -3583,7 +3648,7 @@ var SASjsApi = (() => {
     permissions: [
       {
         uid: "rule-routes",
-        path: "/SASjsApi/info",
+        path: "/SASjsApi/drive/file",
         type: "Route",
         setting: "Grant",
         group: "group-data-controller"
@@ -5054,7 +5119,7 @@ var SASjsApi = (() => {
       request: {
         token: RESTRICTED,
         params: { username: "user2" },
-        body: { password: "wrong" }
+        body: { password: "wrong123" }
       },
       expect: { status: 401, error: "Invalid password." }
     },
@@ -5352,6 +5417,70 @@ var SASjsApi = (() => {
       expect: { status: 404, error: "Group not found." }
     },
     // ------------------------------------------------------------ permissions
+    {
+      id: "authorized-routes",
+      route: "GET /SASjsApi/info/authorizedRoutes",
+      description: "answers the routes that accept a rule, to any caller",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        body: {
+          paths: [
+            "/AppStream",
+            "/SASjsApi",
+            "/SASjsApi/code/execute",
+            "/SASjsApi/stp/execute",
+            "/SASjsApi/drive/deploy",
+            "/SASjsApi/drive/deploy/upload",
+            "/SASjsApi/drive/file",
+            "/SASjsApi/drive/folder",
+            "/SASjsApi/drive/fileTree",
+            "/SASjsApi/drive/rename"
+          ]
+        }
+      }
+    },
+    {
+      id: "my-authorized-routes-as-admin",
+      route: "GET /SASjsApi/info/myAuthorizedRoutes",
+      description: "answers every route to an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN },
+      expect: {
+        status: 200,
+        body: {
+          paths: [
+            "/AppStream",
+            "/SASjsApi",
+            "/SASjsApi/code/execute",
+            "/SASjsApi/stp/execute",
+            "/SASjsApi/drive/deploy",
+            "/SASjsApi/drive/deploy/upload",
+            "/SASjsApi/drive/file",
+            "/SASjsApi/drive/folder",
+            "/SASjsApi/drive/fileTree",
+            "/SASjsApi/drive/rename"
+          ]
+        }
+      }
+    },
+    {
+      id: "my-authorized-routes-as-user",
+      route: "GET /SASjsApi/info/myAuthorizedRoutes",
+      description: "answers a caller only the routes its rules grant",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        // /AppStream is visible whatever the rules say; the two grants come from
+        // DCGroup; /SASjsApi/code/execute is denied to this user by a user rule,
+        // and nothing grants the rest
+        body: {
+          paths: ["/AppStream", "/SASjsApi/stp/execute", "/SASjsApi/drive/file"]
+        }
+      }
+    },
     {
       id: "list-permissions-as-admin",
       route: "GET /SASjsApi/permission",
@@ -5363,55 +5492,24 @@ var SASjsApi = (() => {
         body: [
           {
             uid: "rule-routes",
-            path: "/SASjsApi/info",
+            path: "/SASjsApi/drive/file",
             type: "Route",
             setting: "Grant",
-            group: {
-              uid: "group-data-controller",
-              name: "DCGroup",
-              description: "Data Controller users",
-              isActive: true,
-              users: [
-                {
-                  uid: RESTRICTED_UID,
-                  username: "user2",
-                  displayName: "Demo User",
-                  isAdmin: false
-                }
-              ]
-            }
+            group: "group-data-controller"
           },
           {
             uid: "rule-execute",
             path: "/SASjsApi/stp/execute",
             type: "Route",
             setting: "Grant",
-            group: {
-              uid: "group-data-controller",
-              name: "DCGroup",
-              description: "Data Controller users",
-              isActive: true,
-              users: [
-                {
-                  uid: RESTRICTED_UID,
-                  username: "user2",
-                  displayName: "Demo User",
-                  isAdmin: false
-                }
-              ]
-            }
+            group: "group-data-controller"
           },
           {
             uid: "rule-code",
             path: "/SASjsApi/code/execute",
             type: "Route",
             setting: "Deny",
-            user: {
-              uid: RESTRICTED_UID,
-              username: "user2",
-              displayName: "Demo User",
-              isAdmin: false
-            }
+            user: RESTRICTED_UID
           }
         ]
       }
@@ -5427,55 +5525,24 @@ var SASjsApi = (() => {
         body: [
           {
             uid: "rule-routes",
-            path: "/SASjsApi/info",
+            path: "/SASjsApi/drive/file",
             type: "Route",
             setting: "Grant",
-            group: {
-              uid: "group-data-controller",
-              name: "DCGroup",
-              description: "Data Controller users",
-              isActive: true,
-              users: [
-                {
-                  uid: RESTRICTED_UID,
-                  username: "user2",
-                  displayName: "Demo User",
-                  isAdmin: false
-                }
-              ]
-            }
+            group: "group-data-controller"
           },
           {
             uid: "rule-execute",
             path: "/SASjsApi/stp/execute",
             type: "Route",
             setting: "Grant",
-            group: {
-              uid: "group-data-controller",
-              name: "DCGroup",
-              description: "Data Controller users",
-              isActive: true,
-              users: [
-                {
-                  uid: RESTRICTED_UID,
-                  username: "user2",
-                  displayName: "Demo User",
-                  isAdmin: false
-                }
-              ]
-            }
+            group: "group-data-controller"
           },
           {
             uid: "rule-code",
             path: "/SASjsApi/code/execute",
             type: "Route",
             setting: "Deny",
-            user: {
-              uid: RESTRICTED_UID,
-              username: "user2",
-              displayName: "Demo User",
-              isAdmin: false
-            }
+            user: RESTRICTED_UID
           }
         ]
       }
@@ -5496,7 +5563,7 @@ var SASjsApi = (() => {
       request: {
         token: ADMIN,
         body: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/folder",
           type: "Route",
           setting: "Grant",
           principalType: "user",
@@ -5505,7 +5572,7 @@ var SASjsApi = (() => {
       },
       expect: {
         status: 200,
-        partial: { path: "/SASjsApi/code/lint", setting: "Grant" }
+        partial: { path: "/SASjsApi/drive/folder", setting: "Grant" }
       }
     },
     {
@@ -5516,7 +5583,7 @@ var SASjsApi = (() => {
       request: {
         token: ADMIN,
         body: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/rename",
           type: "Route",
           setting: "Grant",
           principalType: "group",
@@ -5526,9 +5593,9 @@ var SASjsApi = (() => {
       expect: {
         status: 200,
         partial: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/rename",
           setting: "Grant",
-          group: { uid: "group-data-controller", name: "DCGroup" }
+          group: "group-data-controller"
         }
       }
     },
@@ -5540,7 +5607,7 @@ var SASjsApi = (() => {
       request: {
         token: ADMIN,
         body: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/deploy",
           type: "Route",
           setting: "Grant",
           principalType: "role",
@@ -5560,7 +5627,7 @@ var SASjsApi = (() => {
       request: {
         token: ADMIN,
         body: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/folder",
           type: "Route",
           setting: "Grant",
           principalType: "user",
@@ -5580,7 +5647,7 @@ var SASjsApi = (() => {
       request: {
         token: RESTRICTED,
         body: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/folder",
           type: "Route",
           setting: "Grant",
           principalType: "user",
@@ -5597,7 +5664,7 @@ var SASjsApi = (() => {
       request: {
         token: ADMIN,
         body: {
-          path: "/SASjsApi/code/lint",
+          path: "/SASjsApi/drive/rename",
           type: "Route",
           setting: "Grant",
           principalType: "group",
@@ -5614,7 +5681,7 @@ var SASjsApi = (() => {
       request: {
         token: ADMIN,
         body: {
-          path: "/SASjsApi/info",
+          path: "/SASjsApi/drive/file",
           type: "Route",
           setting: "Grant",
           principalType: "group",