@sasjs/api 0.8.0 → 0.10.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.8.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.10.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -23,7 +23,10 @@ var SASjsApi = (() => {
   var index_exports = {};
   __export(index_exports, {
     ADMIN_SIGNED_IN: () => ADMIN_SIGNED_IN,
+    ALWAYS_VISIBLE_ROUTES: () => ALWAYS_VISIBLE_ROUTES,
     ApiError: () => ApiError,
+    CODE_CORPUS: () => CODE_CORPUS,
+    DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
     DEPLOY_PAYLOAD_BYTES: () => DEPLOY_PAYLOAD_BYTES,
@@ -38,7 +41,9 @@ var SASjsApi = (() => {
     PROVIDER_MANAGED: () => PROVIDER_MANAGED,
     RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
+    STATIC_AUTHORIZED_ROUTES: () => STATIC_AUTHORIZED_ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
+    TOP_LEVEL_ROUTES: () => TOP_LEVEL_ROUTES,
     basename: () => basename,
     checkDeployTree: () => checkDeployTree,
     createDriveService: () => createDriveService,
@@ -53,13 +58,15 @@ var SASjsApi = (() => {
     isApiError: () => isApiError,
     isDeployTree: () => isDeployTree,
     isRoot: () => isRoot,
+    isRouteGranted: () => isRouteGranted,
     measureDeployTree: () => measureDeployTree,
     normaliseDrivePath: () => normaliseDrivePath,
     parseIdentity: () => parseIdentity,
     routeById: () => routeById,
     runCase: () => runCase,
     sanitiseDisplayName: () => sanitiseDisplayName,
-    servicesFor: () => servicesFor
+    servicesFor: () => servicesFor,
+    topLevelRouteFor: () => topLevelRouteFor
   });
 
   // src/types.ts
@@ -2453,11 +2460,9 @@ var SASjsApi = (() => {
     Web: ["identity"]
   };
   var DIRECTORY = "Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.";
-  var EDITOR = "Linting and formatting come from @sasjs/lint, which this package does not depend on. They land with the code routes so an editor has one wiring.";
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
   var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
-  var PERMISSIONS = "The route inventory is the host's permission model, which this package does not hold.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
   var ARCHIVE = "Expanding the uploaded archive is the host's transport work - multer and a zip library on the server, `DecompressionStream` in a worker - and the host hands this package the tree it produces, which is the same tree `POST /SASjsApi/drive/deploy` takes.";
@@ -2524,8 +2529,14 @@ var SASjsApi = (() => {
     // Code - the editor's three calls, and the runtime one
     "POST /SASjsApi/code/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/code/trigger": { implemented: false, reason: RUNTIME },
-    "POST /SASjsApi/code/lint": { implemented: false, reason: EDITOR },
-    "POST /SASjsApi/code/format": { implemented: false, reason: EDITOR },
+    "POST /SASjsApi/code/lint": {
+      implemented: true,
+      capabilities: ["identity"]
+    },
+    "POST /SASjsApi/code/format": {
+      implemented: true,
+      capabilities: ["identity"]
+    },
     // Drive - the file and folder rules, and the three deploy routes
     // The body is the file itself, so there is nothing to annotate
     "GET /SASjsApi/drive/file": { implemented: true },
@@ -2604,16 +2615,12 @@ var SASjsApi = (() => {
     // Info - what the host is, and what this caller may use
     "GET /SASjsApi/info": { implemented: false, reason: HOST_CONFIG },
     "GET /SASjsApi/info/authorizedRoutes": {
-      implemented: false,
-      // the route inventory reports what the CALLER may use, so it needs an
-      // identity even though the rest of the Info tag needs nothing
-      capabilities: ["identity"],
-      reason: PERMISSIONS
+      implemented: true,
+      capabilities: ["identity"]
     },
     "GET /SASjsApi/info/myAuthorizedRoutes": {
-      implemented: false,
-      capabilities: ["identity"],
-      reason: PERMISSIONS
+      implemented: true,
+      capabilities: ["identity"]
     },
     // Permission - the rules the inventory above is derived from
     "GET /SASjsApi/permission": {
@@ -2771,8 +2778,10 @@ var SASjsApi = (() => {
         continue;
       if (param.in === "path") continue;
       const given = param.in === "query" ? request.query?.[param.name] : request.body?.[param.name];
-      if (given === void 0 || given === "")
+      if (given === void 0)
         throw new ApiError(400, `"${param.name}" is required`);
+      if (given === "")
+        throw new ApiError(400, `"${param.name}" is not allowed to be empty`);
     }
   };
   var targetPath = (request) => {
@@ -2785,7 +2794,7 @@ var SASjsApi = (() => {
   var dispatch = async (services, routeId, request = {}) => {
     const route = routeById(routeId);
     if (!route) throw new ApiError(404, `No such operation: ${routeId}`);
-    const { drive, identity, records } = services;
+    const { drive, identity, records, code } = services;
     const identityScoped = ["User", "Group", "Permission", "Client"].includes(route.tag) || routeId === "PATCH /SASjsApi/auth/updatePassword";
     if (identityScoped && records) {
       const subject = request.subject ?? (identity ? await identity.authenticate(request.token) : void 0);
@@ -2826,7 +2835,7 @@ var SASjsApi = (() => {
             status: 200,
             body: await identity.token({
               clientId: String(body.clientId ?? ""),
-              code: String(body.code ?? "")
+              code: body.code
             })
           };
         case "POST /SASjsApi/auth/refresh":
@@ -2970,6 +2979,42 @@ var SASjsApi = (() => {
             { password: body.password }
           )
         };
+      case "POST /SASjsApi/code/lint":
+        if (!code)
+          throw new ApiError(
+            501,
+            `This host has no code service, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await code.lint(await caller(), {
+            code: body.code,
+            filePath: body.filePath
+          })
+        };
+      case "POST /SASjsApi/code/format":
+        if (!code)
+          throw new ApiError(
+            501,
+            `This host has no code service, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await code.format(await caller(), {
+            code: body.code,
+            filePath: body.filePath
+          })
+        };
+      case "GET /SASjsApi/info/authorizedRoutes":
+        return {
+          status: 200,
+          body: await required().listAuthorizedRoutes(await caller())
+        };
+      case "GET /SASjsApi/info/myAuthorizedRoutes":
+        return {
+          status: 200,
+          body: await required().myAuthorizedRoutes(await caller())
+        };
       case "GET /SASjsApi/group":
         return { status: 200, body: await required().listGroups(await caller()) };
       case "GET /SASjsApi/group/{uid}":
@@ -3080,6 +3125,10 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "POST /SASjsApi/code/lint",
+    "POST /SASjsApi/code/format",
+    "GET /SASjsApi/info/authorizedRoutes",
+    "GET /SASjsApi/info/myAuthorizedRoutes",
     "GET /SASjsApi/drive/file",
     "POST /SASjsApi/drive/file",
     "PATCH /SASjsApi/drive/file",
@@ -3121,6 +3170,40 @@ var SASjsApi = (() => {
     "PATCH /SASjsApi/auth/updatePassword"
   ];
 
+  // src/identity/routeAccess.ts
+  var TOP_LEVEL_ROUTES = ["/AppStream", "/SASjsApi"];
+  var ALWAYS_VISIBLE_ROUTES = ["/AppStream"];
+  var STATIC_AUTHORIZED_ROUTES = [
+    "/SASjsApi/code/execute",
+    "/SASjsApi/stp/execute",
+    "/SASjsApi/drive/deploy",
+    "/SASjsApi/drive/deploy/upload",
+    "/SASjsApi/drive/file",
+    "/SASjsApi/drive/folder",
+    "/SASjsApi/drive/fileTree",
+    "/SASjsApi/drive/rename"
+  ];
+  var DEFAULT_GRANTABLE_ROUTES = [
+    ...TOP_LEVEL_ROUTES,
+    ...STATIC_AUTHORIZED_ROUTES
+  ];
+  var topLevelRouteFor = (routePath) => TOP_LEVEL_ROUTES.find(
+    (route) => routePath.toLowerCase().startsWith(route.toLowerCase())
+  ) ?? routePath;
+  var settingOn = (rules, path) => rules.find((rule) => rule.path === path)?.setting;
+  var GRANT = "Grant";
+  var DENY = "Deny";
+  var isRouteGranted = (rules, path, topLevelRoute = topLevelRouteFor(path)) => {
+    const userSetting = settingOn(rules.user, path) ?? settingOn(rules.user, topLevelRoute);
+    if (userSetting) return userSetting === GRANT;
+    const onPath = rules.group.filter((rule) => rule.path === path);
+    if (onPath.some((rule) => rule.setting === GRANT)) return true;
+    if (onPath.some((rule) => rule.setting === DENY)) return false;
+    return rules.group.some(
+      (rule) => rule.path === topLevelRoute && rule.setting === GRANT
+    );
+  };
+
   // src/identity/service.ts
   var unauthorized = () => new ApiError(401, "Unauthorized");
   var liveSubject = async (store, subject) => {
@@ -3241,7 +3324,8 @@ var SASjsApi = (() => {
     name: group.name,
     description: group.description
   });
-  var createRecordService = (store) => {
+  var createRecordService = (store, options = {}) => {
+    const grantableRoutes = options.grantableRoutes || DEFAULT_GRANTABLE_ROUTES;
     const groupDetails = async (group) => {
       const members = [];
       for (const uid of group.users) {
@@ -3428,6 +3512,32 @@ var SASjsApi = (() => {
         if (!updated) throw new ApiError(400, "Unable to update group.");
         return groupDetails(updated);
       },
+      async listAuthorizedRoutes(caller) {
+        await requireCaller(store, caller);
+        return { paths: [...grantableRoutes] };
+      },
+      async myAuthorizedRoutes(caller) {
+        const reader = await requireCaller(store, caller);
+        if (reader.isAdmin) return { paths: [...grantableRoutes] };
+        const rules = await store.permissions();
+        const mine = {
+          user: rules.filter((rule) => rule.user === reader.uid).map((rule) => ({ path: rule.path, setting: rule.setting })),
+          group: rules.filter(
+            (rule) => rule.group !== void 0 && reader.groups.includes(rule.group)
+          ).map((rule) => ({ path: rule.path, setting: rule.setting }))
+        };
+        const publicGroup = (await store.groups()).find(
+          (group) => group.name === "public"
+        );
+        const publicGrants = publicGroup ? rules.filter(
+          (rule) => rule.group === publicGroup.uid && rule.setting === "Grant"
+        ).map((rule) => rule.path) : [];
+        return {
+          paths: grantableRoutes.filter(
+            (path) => ALWAYS_VISIBLE_ROUTES.includes(path) || publicGrants.includes(path) || isRouteGranted(mine, path, topLevelRouteFor(path))
+          )
+        };
+      },
       async listPermissions(caller) {
         const reader = await requireCaller(store, caller);
         const rules = await store.permissions();
@@ -3528,6 +3638,53 @@ var SASjsApi = (() => {
     };
   };
 
+  // src/corpus/code.ts
+  var CODE_CORPUS = [
+    {
+      id: "code-lint-missing-header",
+      route: "POST /SASjsApi/code/lint",
+      description: "answers the diagnostics for a buffer, without touching a file",
+      request: {
+        // the routes are permissioned; the runner resolves the fixture's admin
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "data _null_;\n  x = 1;\nrun;\n" }
+      },
+      expect: {
+        status: 200,
+        body: [
+          {
+            message: "File missing Doxygen header",
+            lineNumber: 1,
+            startColumnNumber: 1,
+            endColumnNumber: 1,
+            severity: 1
+          }
+        ]
+      }
+    },
+    // Two refusals are deliberately not pinned here yet: a `code` that is not a
+    // string, and one that is empty. The package answers 400 `"code" must be a
+    // string` / `"code" is not allowed to be empty` - the messages the server's
+    // schema produces - but sasjs/server's code controller carries no
+    // `@Response(400)` for these routes, so the document states 200 alone and the
+    // parity gate refuses a case answering anything else. The cases land when the
+    // decorators do.
+    {
+      id: "code-format-adds-the-header",
+      route: "POST /SASjsApi/code/format",
+      description: "answers the formatted buffer, header block included",
+      request: {
+        // the routes are permissioned; the runner resolves the fixture's admin
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "data _null_;\n  x = 1;\nrun;\n" }
+      },
+      expect: {
+        status: 200,
+        body: "/**\n  @file\n  @brief <Your brief here>\n\n  <h4> SAS Macros </h4>\n\n**/\ndata _null_;\n  x = 1;\nrun;\n"
+      }
+    }
+  ];
+
   // src/identity/fixture.ts
   var IDENTITY_FORMAT = 1;
   var SECONDS_IN_A_DAY2 = 86400;
@@ -5343,6 +5500,70 @@ var SASjsApi = (() => {
       expect: { status: 404, error: "Group not found." }
     },
     // ------------------------------------------------------------ permissions
+    {
+      id: "authorized-routes",
+      route: "GET /SASjsApi/info/authorizedRoutes",
+      description: "answers the routes that accept a rule, to any caller",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        body: {
+          paths: [
+            "/AppStream",
+            "/SASjsApi",
+            "/SASjsApi/code/execute",
+            "/SASjsApi/stp/execute",
+            "/SASjsApi/drive/deploy",
+            "/SASjsApi/drive/deploy/upload",
+            "/SASjsApi/drive/file",
+            "/SASjsApi/drive/folder",
+            "/SASjsApi/drive/fileTree",
+            "/SASjsApi/drive/rename"
+          ]
+        }
+      }
+    },
+    {
+      id: "my-authorized-routes-as-admin",
+      route: "GET /SASjsApi/info/myAuthorizedRoutes",
+      description: "answers every route to an administrator",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: ADMIN },
+      expect: {
+        status: 200,
+        body: {
+          paths: [
+            "/AppStream",
+            "/SASjsApi",
+            "/SASjsApi/code/execute",
+            "/SASjsApi/stp/execute",
+            "/SASjsApi/drive/deploy",
+            "/SASjsApi/drive/deploy/upload",
+            "/SASjsApi/drive/file",
+            "/SASjsApi/drive/folder",
+            "/SASjsApi/drive/fileTree",
+            "/SASjsApi/drive/rename"
+          ]
+        }
+      }
+    },
+    {
+      id: "my-authorized-routes-as-user",
+      route: "GET /SASjsApi/info/myAuthorizedRoutes",
+      description: "answers a caller only the routes its rules grant",
+      identity: ADMIN_SIGNED_IN,
+      request: { token: RESTRICTED },
+      expect: {
+        status: 200,
+        // /AppStream is visible whatever the rules say; the two grants come from
+        // DCGroup; /SASjsApi/code/execute is denied to this user by a user rule,
+        // and nothing grants the rest
+        body: {
+          paths: ["/AppStream", "/SASjsApi/stp/execute", "/SASjsApi/drive/file"]
+        }
+      }
+    },
     {
       id: "list-permissions-as-admin",
       route: "GET /SASjsApi/permission",

package/build/cjs/code/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCodeService = void 0;
+/**
+ * The code service, on its own entry point.
+ *
+ * `@sasjs/lint` reads the filesystem (its config resolution walks up for a
+ * `.sasjslint`), so it cannot be bundled for a service worker: the package root
+ * stays free of it and a host that wants these routes imports `@sasjs/api/code`.
+ */
+var service_js_1 = require("./service.js");
+Object.defineProperty(exports, "createCodeService", { enumerable: true, get: function () { return service_js_1.createCodeService; } });

package/build/cjs/code/service.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCodeService = void 0;
+const lint_1 = require("@sasjs/lint");
+const types_js_1 = require("../types.js");
+/**
+ * `code`, refused the way the server's schema refuses it.
+ *
+ * Coercing with `String(...)` defeated the refusal: `{"code": 123}` was linted as
+ * the text "123" and `{"code": ""}` answered "required" where the server says it
+ * is empty. The three messages are Joi's, because they are the ones a client
+ * written against the document already handles.
+ */
+const codeOf = (body) => {
+    const value = body.code;
+    if (value === undefined)
+        throw new types_js_1.ApiError(400, '"code" is required');
+    if (typeof value !== 'string')
+        throw new types_js_1.ApiError(400, '"code" must be a string');
+    if (value === '')
+        throw new types_js_1.ApiError(400, '"code" is not allowed to be empty');
+    return value;
+};
+/**
+ * The two editor routes, over `@sasjs/lint`.
+ *
+ * The linter is a dependency because it is the same everywhere, and it is
+ * deliberately NOT reachable from the package root: `@sasjs/lint` resolves its
+ * configuration by walking the filesystem, so it cannot be bundled into the
+ * service worker the browser entry produces. A host that wants these routes
+ * imports `@sasjs/api/code`, which is Node-only, exactly like the linter.
+ *
+ * The *rules* are the host's: which `.sasjslint` applies to a path is a fact
+ * about a drive, so `lintConfig` is asked for it.
+ * Neither route touches the drive or runs anything; they answer about the text
+ * in the request, which is what lets an editor check unsaved changes.
+ */
+const createCodeService = (options = {}) => {
+    const requireCaller = (caller) => {
+        // both routes are permissioned at the gate, so a caller that reached the
+        // service without one is a host that skipped it rather than a public route
+        if (!caller)
+            throw new types_js_1.ApiError(401, 'Unauthorized');
+    };
+    const configFor = (filePath) => options.lintConfig ? options.lintConfig(filePath) : undefined;
+    return {
+        async lint(caller, body) {
+            requireCaller(caller);
+            return (0, lint_1.lintText)(codeOf(body), configFor(body.filePath));
+        },
+        async format(caller, body) {
+            requireCaller(caller);
+            return (0, lint_1.formatText)(codeOf(body), configFor(body.filePath));
+        }
+    };
+};
+exports.createCodeService = createCodeService;

package/build/cjs/corpus/code.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODE_CORPUS = void 0;
+/**
+ * The editor's corpus: the two routes that answer about a buffer rather than a
+ * file.
+ *
+ * Both expectations are the linter's own output for the same input, measured
+ * against `@sasjs/lint` with no configuration - the defaults an untitled buffer
+ * lints against. A host that supplies a `.sasjslint` changes the rules for its
+ * own drive, which is why the case names no `filePath`.
+ *
+ *     lintText('data _null_;\n  x = 1;\nrun;\n')
+ *       -> [{ message: 'File missing Doxygen header', lineNumber: 1, ... }]
+ *     formatText(...)
+ *       -> the header block, then the program with its spacing normalised
+ */
+exports.CODE_CORPUS = [
+    {
+        id: 'code-lint-missing-header',
+        route: 'POST /SASjsApi/code/lint',
+        description: 'answers the diagnostics for a buffer, without touching a file',
+        request: {
+            // the routes are permissioned; the runner resolves the fixture's admin
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: 'data _null_;\n  x = 1;\nrun;\n' }
+        },
+        expect: {
+            status: 200,
+            body: [
+                {
+                    message: 'File missing Doxygen header',
+                    lineNumber: 1,
+                    startColumnNumber: 1,
+                    endColumnNumber: 1,
+                    severity: 1
+                }
+            ]
+        }
+    },
+    // Two refusals are deliberately not pinned here yet: a `code` that is not a
+    // string, and one that is empty. The package answers 400 `"code" must be a
+    // string` / `"code" is not allowed to be empty` - the messages the server's
+    // schema produces - but sasjs/server's code controller carries no
+    // `@Response(400)` for these routes, so the document states 200 alone and the
+    // parity gate refuses a case answering anything else. The cases land when the
+    // decorators do.
+    {
+        id: 'code-format-adds-the-header',
+        route: 'POST /SASjsApi/code/format',
+        description: 'answers the formatted buffer, header block included',
+        request: {
+            // the routes are permissioned; the runner resolves the fixture's admin
+            subject: { userId: 'user-admin', clientId: 'web_app' },
+            body: { code: 'data _null_;\n  x = 1;\nrun;\n' }
+        },
+        expect: {
+            status: 200,
+            body: '/**\n  @file\n  @brief <Your brief here>\n\n  <h4> SAS Macros </h4>\n\n**/\ndata _null_;\n  x = 1;\nrun;\n'
+        }
+    }
+];

package/build/cjs/corpus/records.js

@@ -702,6 +702,70 @@ exports.RECORD_CORPUS = [
         expect: { status: 404, error: 'Group not found.' }
     },
     // ------------------------------------------------------------ permissions
+    {
+        id: 'authorized-routes',
+        route: 'GET /SASjsApi/info/authorizedRoutes',
+        description: 'answers the routes that accept a rule, to any caller',
+        identity: exports.ADMIN_SIGNED_IN,
+        request: { token: RESTRICTED },
+        expect: {
+            status: 200,
+            body: {
+                paths: [
+                    '/AppStream',
+                    '/SASjsApi',
+                    '/SASjsApi/code/execute',
+                    '/SASjsApi/stp/execute',
+                    '/SASjsApi/drive/deploy',
+                    '/SASjsApi/drive/deploy/upload',
+                    '/SASjsApi/drive/file',
+                    '/SASjsApi/drive/folder',
+                    '/SASjsApi/drive/fileTree',
+                    '/SASjsApi/drive/rename'
+                ]
+            }
+        }
+    },
+    {
+        id: 'my-authorized-routes-as-admin',
+        route: 'GET /SASjsApi/info/myAuthorizedRoutes',
+        description: 'answers every route to an administrator',
+        identity: exports.ADMIN_SIGNED_IN,
+        request: { token: ADMIN },
+        expect: {
+            status: 200,
+            body: {
+                paths: [
+                    '/AppStream',
+                    '/SASjsApi',
+                    '/SASjsApi/code/execute',
+                    '/SASjsApi/stp/execute',
+                    '/SASjsApi/drive/deploy',
+                    '/SASjsApi/drive/deploy/upload',
+                    '/SASjsApi/drive/file',
+                    '/SASjsApi/drive/folder',
+                    '/SASjsApi/drive/fileTree',
+                    '/SASjsApi/drive/rename'
+                ]
+            }
+        }
+    },
+    {
+        id: 'my-authorized-routes-as-user',
+        route: 'GET /SASjsApi/info/myAuthorizedRoutes',
+        description: 'answers a caller only the routes its rules grant',
+        identity: exports.ADMIN_SIGNED_IN,
+        request: { token: RESTRICTED },
+        expect: {
+            status: 200,
+            // /AppStream is visible whatever the rules say; the two grants come from
+            // DCGroup; /SASjsApi/code/execute is denied to this user by a user rule,
+            // and nothing grants the rest
+            body: {
+                paths: ['/AppStream', '/SASjsApi/stp/execute', '/SASjsApi/drive/file']
+            }
+        }
+    },
     {
         id: 'list-permissions-as-admin',
         route: 'GET /SASjsApi/permission',

package/build/cjs/host/dispatch.js

@@ -24,8 +24,13 @@ const validate = (route, request) => {
         const given = param.in === 'query'
             ? request.query?.[param.name]
             : request.body?.[param.name];
-        if (given === undefined || given === '')
+        // missing and empty are two refusals, the way the schema has them: a
+        // client that sent the field an empty value has a different bug from one
+        // that omitted it
+        if (given === undefined)
             throw new types_js_1.ApiError(400, `"${param.name}" is required`);
+        if (given === '')
+            throw new types_js_1.ApiError(400, `"${param.name}" is not allowed to be empty`);
     }
 };
 /** The drive path a write names: the query parameter wins over the form field. */
@@ -44,7 +49,7 @@ const dispatch = async (services, routeId, request = {}) => {
     const route = (0, index_js_1.routeById)(routeId);
     if (!route)
         throw new types_js_1.ApiError(404, `No such operation: ${routeId}`);
-    const { drive, identity, records } = services;
+    const { drive, identity, records, code } = services;
     // The server authenticates before its payload schema runs, so an anonymous
     // request with an incomplete body is a 401 there rather than a 400. The order
     // is only observable on the route groups that gate on a caller: the sign-in
@@ -92,7 +97,7 @@ const dispatch = async (services, routeId, request = {}) => {
                     status: 200,
                     body: await identity.token({
                         clientId: String(body.clientId ?? ''),
-                        code: String(body.code ?? '')
+                        code: body.code
                     })
                 };
             case 'POST /SASjsApi/auth/refresh':
@@ -219,6 +224,36 @@ const dispatch = async (services, routeId, request = {}) => {
                 status: 200,
                 body: await required().deleteUser(await caller(), { username: String(params.username ?? '') }, { password: body.password })
             };
+        case 'POST /SASjsApi/code/lint':
+            if (!code)
+                throw new types_js_1.ApiError(501, `This host has no code service, so it cannot answer ${routeId}.`);
+            return {
+                status: 200,
+                body: await code.lint(await caller(), {
+                    code: body.code,
+                    filePath: body.filePath
+                })
+            };
+        case 'POST /SASjsApi/code/format':
+            if (!code)
+                throw new types_js_1.ApiError(501, `This host has no code service, so it cannot answer ${routeId}.`);
+            return {
+                status: 200,
+                body: await code.format(await caller(), {
+                    code: body.code,
+                    filePath: body.filePath
+                })
+            };
+        case 'GET /SASjsApi/info/authorizedRoutes':
+            return {
+                status: 200,
+                body: await required().listAuthorizedRoutes(await caller())
+            };
+        case 'GET /SASjsApi/info/myAuthorizedRoutes':
+            return {
+                status: 200,
+                body: await required().myAuthorizedRoutes(await caller())
+            };
         case 'GET /SASjsApi/group':
             return { status: 200, body: await required().listGroups(await caller()) };
         case 'GET /SASjsApi/group/{uid}':
@@ -322,6 +357,10 @@ const dispatch = async (services, routeId, request = {}) => {
 exports.dispatch = dispatch;
 /** Whether a route is one `dispatch` can answer today. */
 exports.HANDLED_ROUTES = [
+    'POST /SASjsApi/code/lint',
+    'POST /SASjsApi/code/format',
+    'GET /SASjsApi/info/authorizedRoutes',
+    'GET /SASjsApi/info/myAuthorizedRoutes',
     'GET /SASjsApi/drive/file',
     'POST /SASjsApi/drive/file',
     'PATCH /SASjsApi/drive/file',