@sasjs/api 0.9.0 → 0.11.0

package/build/browser.js

@@ -1,4 +1,4 @@
-/* @sasjs/api 0.9.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
+/* @sasjs/api 0.11.0 - the SASjs Server API, for a service worker. https://github.com/sasjs/api */
 "use strict";
 var SASjsApi = (() => {
   var __defProp = Object.defineProperty;
@@ -25,6 +25,7 @@ var SASjsApi = (() => {
     ADMIN_SIGNED_IN: () => ADMIN_SIGNED_IN,
     ALWAYS_VISIBLE_ROUTES: () => ALWAYS_VISIBLE_ROUTES,
     ApiError: () => ApiError,
+    CODE_CORPUS: () => CODE_CORPUS,
     DEFAULT_GRANTABLE_ROUTES: () => DEFAULT_GRANTABLE_ROUTES,
     DEFAULT_IDENTITY: () => DEFAULT_IDENTITY,
     DEPLOY_LIMITS: () => DEPLOY_LIMITS,
@@ -40,6 +41,7 @@ var SASjsApi = (() => {
     PROVIDER_MANAGED: () => PROVIDER_MANAGED,
     RECORD_CORPUS: () => RECORD_CORPUS,
     ROUTES: () => ROUTES,
+    SESSION_CORPUS: () => SESSION_CORPUS,
     STATIC_AUTHORIZED_ROUTES: () => STATIC_AUTHORIZED_ROUTES,
     TAG_CAPABILITIES: () => TAG_CAPABILITIES,
     TOP_LEVEL_ROUTES: () => TOP_LEVEL_ROUTES,
@@ -891,6 +893,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
         }
       ]
     },
@@ -919,6 +929,14 @@ var SASjsApi = (() => {
         {
           status: 200,
           description: "Ok"
+        },
+        {
+          status: 400,
+          description: '"code" is required / "code" must be a string / "code" is not allowed to be empty'
+        },
+        {
+          status: 401,
+          description: "Unauthorized"
         }
       ]
     },
@@ -2459,9 +2477,7 @@ var SASjsApi = (() => {
     Web: ["identity"]
   };
   var DIRECTORY = "Synchronising with an external auth provider needs a directory port, which this package does not have: a host decides which directory it holds accounts in, and answers this itself.";
-  var EDITOR = "Linting and formatting come from @sasjs/lint, which this package does not depend on. They land with the code routes so an editor has one wiring.";
   var RUNTIME = "Starting a program needs a runtime port, which this package does not have: a host decides which languages it holds, and answers this itself until then.";
-  var SESSION_RECORD = "A triggered session's record, log, output and state belong to the runtime that ran the program, and this package has no runtime port.";
   var HOST_CONFIG = "The body is the host's own configuration - ports, run times and providers - which a mock states for itself and this package cannot know.";
   var HOST_OWNED = "The host owns this report: it describes the host's own process and files, which a browser build has no equivalent of.";
   var WEB_BUNDLE = "The host serves its own web bundle; there is no API decision here for this package to answer.";
@@ -2529,8 +2545,14 @@ var SASjsApi = (() => {
     // Code - the editor's three calls, and the runtime one
     "POST /SASjsApi/code/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/code/trigger": { implemented: false, reason: RUNTIME },
-    "POST /SASjsApi/code/lint": { implemented: false, reason: EDITOR },
-    "POST /SASjsApi/code/format": { implemented: false, reason: EDITOR },
+    "POST /SASjsApi/code/lint": {
+      implemented: true,
+      capabilities: ["identity"]
+    },
+    "POST /SASjsApi/code/format": {
+      implemented: true,
+      capabilities: ["identity"]
+    },
     // Drive - the file and folder rules, and the three deploy routes
     // The body is the file itself, so there is nothing to annotate
     "GET /SASjsApi/drive/file": { implemented: true },
@@ -2633,22 +2655,13 @@ var SASjsApi = (() => {
       implemented: true,
       responses: { 200: user }
     },
-    "GET /SASjsApi/session/{sessionId}": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/log": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/output": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
-    "GET /SASjsApi/session/{sessionId}/state": {
-      implemented: false,
-      reason: SESSION_RECORD
-    },
+    // The port takes the owner as a uid and falls back to a username, which is
+    // what sasjs/server records today - a host hands its sessions through as they
+    // are, and the comparison tries the identifier first.
+    "GET /SASjsApi/session/{sessionId}": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/log": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/output": { implemented: true },
+    "GET /SASjsApi/session/{sessionId}/state": { implemented: true },
     // STP - a stored program, on the runtime port
     "GET /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
     "POST /SASjsApi/stp/execute": { implemented: false, reason: RUNTIME },
@@ -2772,8 +2785,10 @@ var SASjsApi = (() => {
         continue;
       if (param.in === "path") continue;
       const given = param.in === "query" ? request.query?.[param.name] : request.body?.[param.name];
-      if (given === void 0 || given === "")
+      if (given === void 0)
         throw new ApiError(400, `"${param.name}" is required`);
+      if (given === "")
+        throw new ApiError(400, `"${param.name}" is not allowed to be empty`);
     }
   };
   var targetPath = (request) => {
@@ -2786,7 +2801,7 @@ var SASjsApi = (() => {
   var dispatch = async (services, routeId, request = {}) => {
     const route = routeById(routeId);
     if (!route) throw new ApiError(404, `No such operation: ${routeId}`);
-    const { drive, identity, records } = services;
+    const { drive, identity, records, code } = services;
     const identityScoped = ["User", "Group", "Permission", "Client"].includes(route.tag) || routeId === "PATCH /SASjsApi/auth/updatePassword";
     if (identityScoped && records) {
       const subject = request.subject ?? (identity ? await identity.authenticate(request.token) : void 0);
@@ -2803,6 +2818,14 @@ var SASjsApi = (() => {
     const query = request.query || {};
     const body = request.body || {};
     const params = request.params || {};
+    const sessionRequired = () => {
+      if (!services.session)
+        throw new ApiError(
+          501,
+          `This host has no session service, so it cannot answer ${routeId}.`
+        );
+      return services.session;
+    };
     const required = () => {
       if (!records)
         throw new ApiError(
@@ -2827,7 +2850,7 @@ var SASjsApi = (() => {
             status: 200,
             body: await identity.token({
               clientId: String(body.clientId ?? ""),
-              code: String(body.code ?? "")
+              code: body.code
             })
           };
         case "POST /SASjsApi/auth/refresh":
@@ -2902,6 +2925,43 @@ var SASjsApi = (() => {
       }
       case "GET /SASjsApi/drive/filetree":
         return { status: 200, body: await drive.tree(query._folderPath) };
+      // ------------------------------------------------------------- sessions
+      case "GET /SASjsApi/session/{sessionId}": {
+        return {
+          status: 200,
+          body: await sessionRequired().summary(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/log": {
+        return {
+          status: 200,
+          contents: await sessionRequired().log(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/output": {
+        return {
+          status: 200,
+          contents: await sessionRequired().output(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
+      case "GET /SASjsApi/session/{sessionId}/state": {
+        return {
+          status: 200,
+          body: await sessionRequired().state(
+            await caller(),
+            String(params.sessionId ?? "")
+          )
+        };
+      }
       // ------------------------------------------------------------- records
       //
       // The administration routes: users, groups, permission rules, clients and the
@@ -2971,6 +3031,32 @@ var SASjsApi = (() => {
             { password: body.password }
           )
         };
+      case "POST /SASjsApi/code/lint":
+        if (!code)
+          throw new ApiError(
+            501,
+            `This host has no code service, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await code.lint(await caller(), {
+            code: body.code,
+            filePath: body.filePath
+          })
+        };
+      case "POST /SASjsApi/code/format":
+        if (!code)
+          throw new ApiError(
+            501,
+            `This host has no code service, so it cannot answer ${routeId}.`
+          );
+        return {
+          status: 200,
+          body: await code.format(await caller(), {
+            code: body.code,
+            filePath: body.filePath
+          })
+        };
       case "GET /SASjsApi/info/authorizedRoutes":
         return {
           status: 200,
@@ -3091,6 +3177,12 @@ var SASjsApi = (() => {
     }
   };
   var HANDLED_ROUTES = [
+    "GET /SASjsApi/session/{sessionId}",
+    "GET /SASjsApi/session/{sessionId}/log",
+    "GET /SASjsApi/session/{sessionId}/output",
+    "GET /SASjsApi/session/{sessionId}/state",
+    "POST /SASjsApi/code/lint",
+    "POST /SASjsApi/code/format",
     "GET /SASjsApi/info/authorizedRoutes",
     "GET /SASjsApi/info/myAuthorizedRoutes",
     "GET /SASjsApi/drive/file",
@@ -3602,6 +3694,90 @@ var SASjsApi = (() => {
     };
   };
 
+  // src/corpus/code.ts
+  var CODE_CORPUS = [
+    {
+      id: "code-lint-missing-header",
+      route: "POST /SASjsApi/code/lint",
+      description: "answers the diagnostics for a buffer, without touching a file",
+      request: {
+        // the routes are permissioned; the runner resolves the fixture's admin
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "data _null_;\n  x = 1;\nrun;\n" }
+      },
+      expect: {
+        status: 200,
+        body: [
+          {
+            message: "File missing Doxygen header",
+            lineNumber: 1,
+            startColumnNumber: 1,
+            endColumnNumber: 1,
+            severity: 1
+          }
+        ]
+      }
+    },
+    {
+      id: "code-lint-unauthenticated",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses a caller with no token",
+      request: { body: { code: "data _null_; run;" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "code-lint-non-string",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses a code value that is not a string, rather than coercing it",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: 123 }
+      },
+      expect: { status: 400, error: '"code" must be a string' }
+    },
+    {
+      id: "code-lint-empty",
+      route: "POST /SASjsApi/code/lint",
+      description: "refuses an empty buffer, which is not the same as a missing one",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "" }
+      },
+      expect: { status: 400, error: '"code" is not allowed to be empty' }
+    },
+    {
+      id: "code-format-unauthenticated",
+      route: "POST /SASjsApi/code/format",
+      description: "refuses a caller with no token",
+      request: { body: { code: "data _null_; run;" } },
+      expect: { status: 401, error: "Unauthorized" }
+    },
+    {
+      id: "code-format-non-string",
+      route: "POST /SASjsApi/code/format",
+      description: "refuses a code value that is not a string",
+      request: {
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: 123 }
+      },
+      expect: { status: 400, error: '"code" must be a string' }
+    },
+    {
+      id: "code-format-adds-the-header",
+      route: "POST /SASjsApi/code/format",
+      description: "answers the formatted buffer, header block included",
+      request: {
+        // the routes are permissioned; the runner resolves the fixture's admin
+        subject: { userId: "user-admin", clientId: "web_app" },
+        body: { code: "data _null_;\n  x = 1;\nrun;\n" }
+      },
+      expect: {
+        status: 200,
+        body: "/**\n  @file\n  @brief <Your brief here>\n\n  <h4> SAS Macros </h4>\n\n**/\ndata _null_;\n  x = 1;\nrun;\n"
+      }
+    }
+  ];
+
   // src/identity/fixture.ts
   var IDENTITY_FORMAT = 1;
   var SECONDS_IN_A_DAY2 = 86400;
@@ -4722,6 +4898,78 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/corpus/session.ts
+  var ADMIN = { userId: "user-admin", clientId: "web_app" };
+  var RESTRICTED = { userId: "user-restricted", clientId: "web_app" };
+  var SESSION_CORPUS = [
+    {
+      id: "session-summary-own",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers the owner the summary of their own session",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: {
+        status: 200,
+        body: {
+          sessionId: "sess-admin",
+          state: "completed",
+          pid: 4242,
+          creationTimeStamp: "2026-11-07T09:00:00.000Z",
+          deathTimeStamp: "2026-11-07T09:00:04.000Z",
+          expiresAfterMins: 60
+        }
+      }
+    },
+    {
+      id: "session-summary-as-admin",
+      route: "GET /SASjsApi/session/{sessionId}",
+      description: "answers an administrator another account's session",
+      request: { subject: ADMIN, params: { sessionId: "sess-restricted" } },
+      expect: {
+        status: 200,
+        body: {
+          sessionId: "sess-restricted",
+          state: "running",
+          pid: 4243,
+          creationTimeStamp: "2026-11-07T09:05:00.000Z"
+        }
+      }
+    },
+    {
+      id: "session-log-own",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "answers the log this session wrote",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: {
+        status: 200,
+        contents: "NOTE: session started\nNOTE: session completed\n"
+      }
+    },
+    {
+      id: "session-log-nothing-written",
+      route: "GET /SASjsApi/session/{sessionId}/log",
+      description: "answers an empty body for a session that has written nothing",
+      request: { subject: ADMIN, params: { sessionId: "sess-silent" } },
+      expect: { status: 200, contents: "" }
+    },
+    {
+      id: "session-output-own",
+      route: "GET /SASjsApi/session/{sessionId}/output",
+      description: "answers the webout this session produced",
+      request: { subject: ADMIN, params: { sessionId: "sess-admin" } },
+      expect: { status: 200, contents: "<html><body>42</body></html>" }
+    },
+    {
+      id: "session-state-own",
+      route: "GET /SASjsApi/session/{sessionId}/state",
+      description: "answers the run time's state for this session",
+      request: { subject: RESTRICTED, params: { sessionId: "sess-restricted" } },
+      expect: {
+        status: 200,
+        body: { state: "running", pid: 4243, lineCount: 3 }
+      }
+    }
+  ];
+
   // src/corpus/records.ts
   var SIGNED_IN_TOKENS = [
     {
@@ -4784,8 +5032,8 @@ var SASjsApi = (() => {
       }
     ]
   };
-  var ADMIN = "admin-access";
-  var RESTRICTED = "user-access";
+  var ADMIN2 = "admin-access";
+  var RESTRICTED2 = "user-access";
   var RESTRICTED_UID = "user-restricted";
   var ADMIN_UID = "user-admin";
   var RECORD_CORPUS = [
@@ -4795,7 +5043,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user",
       description: "lists the accounts any signed-in caller may see",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -4819,7 +5067,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/{uid}",
       description: "returns the caller their own details, with the auto-exec code",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: RESTRICTED_UID } },
+      request: { token: RESTRICTED2, params: { uid: RESTRICTED_UID } },
       expect: {
         status: 200,
         partial: {
@@ -4844,7 +5092,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/{uid}",
       description: "answers 404 for an identifier no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "user-none" } },
+      request: { token: ADMIN2, params: { uid: "user-none" } },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -4852,7 +5100,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/by/username/{username}",
       description: "finds an account by username",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "user2" } },
+      request: { token: ADMIN2, params: { username: "user2" } },
       expect: {
         status: 200,
         partial: { uid: RESTRICTED_UID, username: "user2", isAdmin: false }
@@ -4871,7 +5119,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/user/by/username/{username}",
       description: "answers 404 for a username no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "nobody" } },
+      request: { token: ADMIN2, params: { username: "nobody" } },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -4880,7 +5128,7 @@ var SASjsApi = (() => {
       description: "creates an account, sanitised, and reports it",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           username: "newuser",
           displayName: "  New
 User  ",
@@ -4905,7 +5153,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           username: "newuser",
           displayName: "New User",
@@ -4928,7 +5176,7 @@ var SASjsApi = (() => {
       description: "refuses a username that is taken",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { username: "user2", displayName: "Another", password: "newpass" }
       },
       expect: { status: 409, error: "Username already exists." }
@@ -4939,7 +5187,7 @@ var SASjsApi = (() => {
       description: "changes an account's display name",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: RESTRICTED_UID },
         body: {
           displayName: "Renamed User",
@@ -4958,7 +5206,7 @@ var SASjsApi = (() => {
       description: "refuses a change to somebody else's account",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { uid: ADMIN_UID },
         body: { displayName: "Hijacked", username: "admin", password: "admin123" }
       },
@@ -4970,7 +5218,7 @@ var SASjsApi = (() => {
       description: "answers 404 with the identifier it looked up",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "user-none" },
         body: { displayName: "Nobody", username: "nobody", password: "none123" }
       },
@@ -4982,7 +5230,7 @@ var SASjsApi = (() => {
       description: "refuses a username change on a provider-managed account",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "user-directory" },
         body: {
           username: "renamed",
@@ -5001,7 +5249,7 @@ var SASjsApi = (() => {
       description: "refuses a username another account already has",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: RESTRICTED_UID },
         body: { username: "admin", displayName: "Demo User", password: "user123" }
       },
@@ -5013,7 +5261,7 @@ var SASjsApi = (() => {
       description: "changes an account looked up by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: {
           isActive: false,
@@ -5030,7 +5278,7 @@ var SASjsApi = (() => {
       description: "refuses a change to another account by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { username: "admin" },
         body: { displayName: "Hijacked", username: "admin", password: "admin123" }
       },
@@ -5042,7 +5290,7 @@ var SASjsApi = (() => {
       description: "answers 404 with the username it looked up",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "nobody" },
         body: { displayName: "Nobody", username: "nobody", password: "none123" }
       },
@@ -5054,7 +5302,7 @@ var SASjsApi = (() => {
       description: "refuses a display-name change on a provider-managed account",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "diruser" },
         body: { displayName: "Renamed", username: "diruser", password: "dir123" }
       },
@@ -5069,7 +5317,7 @@ var SASjsApi = (() => {
       description: "refuses a username another account already has",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: { username: "admin", displayName: "Demo User", password: "user123" }
       },
@@ -5080,7 +5328,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "deletes an account as an administrator, without a password",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: RESTRICTED_UID }, body: {} },
+      request: { token: ADMIN2, params: { uid: RESTRICTED_UID }, body: {} },
       expect: { status: 200, body: "Account Deleted!" }
     },
     {
@@ -5088,7 +5336,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "refuses a deletion of somebody else's account",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: ADMIN_UID }, body: {} },
+      request: { token: RESTRICTED2, params: { uid: ADMIN_UID }, body: {} },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5096,7 +5344,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/{uid}",
       description: "answers 404 for an identifier no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "user-none" }, body: {} },
+      request: { token: ADMIN2, params: { uid: "user-none" }, body: {} },
       expect: { status: 404, error: "User is not found." }
     },
     {
@@ -5105,7 +5353,7 @@ var SASjsApi = (() => {
       description: "deletes an account looked up by username",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { username: "user2" },
         body: {}
       },
@@ -5117,7 +5365,7 @@ var SASjsApi = (() => {
       description: "refuses a self-deletion whose password is wrong",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { username: "user2" },
         body: { password: "wrong123" }
       },
@@ -5128,7 +5376,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/user/by/username/{username}",
       description: "answers 404 for a username no account has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { username: "nobody" }, body: {} },
+      request: { token: ADMIN2, params: { username: "nobody" }, body: {} },
       expect: { status: 404, error: "User is not found." }
     },
     // ----------------------------------------------------------------- groups
@@ -5137,7 +5385,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group",
       description: "lists the groups",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: [
@@ -5159,7 +5407,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/{uid}",
       description: "returns a group and its members",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      request: { token: RESTRICTED2, params: { uid: "group-admins" } },
       expect: {
         status: 200,
         partial: {
@@ -5182,7 +5430,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/{uid}",
       description: "answers 404 for an identifier no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-none" } },
+      request: { token: ADMIN2, params: { uid: "group-none" } },
       expect: { status: 404, error: "Group not found." }
     },
     {
@@ -5190,7 +5438,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/by/groupname/{name}",
       description: "finds a group by name",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { name: "DCGroup" } },
+      request: { token: ADMIN2, params: { name: "DCGroup" } },
       expect: {
         status: 200,
         partial: { uid: "group-data-controller", name: "DCGroup" }
@@ -5201,7 +5449,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/group/by/groupname/{name}",
       description: "answers 404 for a name no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { name: "nope" } },
+      request: { token: ADMIN2, params: { name: "nope" } },
       expect: { status: 404, error: "Group not found." }
     },
     {
@@ -5210,7 +5458,7 @@ var SASjsApi = (() => {
       description: "creates a group with no members",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { name: "NewGroup", description: "A new group", isActive: true }
       },
       expect: {
@@ -5229,7 +5477,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { name: "NewGroup", description: "x" }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5239,7 +5487,7 @@ var SASjsApi = (() => {
       route: "POST /SASjsApi/group",
       description: "refuses a name that is taken",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, body: { name: "DCGroup", description: "again" } },
+      request: { token: ADMIN2, body: { name: "DCGroup", description: "again" } },
       expect: { status: 409, error: "Group name already exists." }
     },
     {
@@ -5248,7 +5496,7 @@ var SASjsApi = (() => {
       description: "adds a member and returns the group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5262,7 +5510,7 @@ var SASjsApi = (() => {
       description: "refuses a change to the reserved public group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-public", userUid: RESTRICTED_UID }
       },
       expect: { status: 400, error: "Can't add/remove user to 'public' group." }
@@ -5273,7 +5521,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { groupUid: "group-admins", userUid: RESTRICTED_UID }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5284,7 +5532,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a group that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-none", userUid: RESTRICTED_UID }
       },
       expect: { status: 404, error: "Group not found." }
@@ -5295,7 +5543,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change on a provider-managed group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5309,7 +5557,7 @@ var SASjsApi = (() => {
       description: "removes a member and returns the group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5323,7 +5571,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change for a provider-managed user",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-directory" }
       },
       expect: {
@@ -5337,7 +5585,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change for a provider-managed user",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-directory" }
       },
       expect: {
@@ -5351,7 +5599,7 @@ var SASjsApi = (() => {
       description: "refuses a change to the reserved public group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-public", userUid: RESTRICTED_UID }
       },
       expect: { status: 400, error: "Can't add/remove user to 'public' group." }
@@ -5362,7 +5610,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { groupUid: "group-data-controller", userUid: RESTRICTED_UID }
       },
       expect: { status: 401, error: "Admin account required" }
@@ -5373,7 +5621,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a member that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-admins", userUid: "user-none" }
       },
       expect: { status: 404, error: "User not found." }
@@ -5384,7 +5632,7 @@ var SASjsApi = (() => {
       description: "refuses a membership change on a provider-managed group",
       identity: PROVIDER_MANAGED,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { groupUid: "group-directory", userUid: RESTRICTED_UID }
       },
       expect: {
@@ -5397,7 +5645,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "deletes a group",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-data-controller" } },
+      request: { token: ADMIN2, params: { uid: "group-data-controller" } },
       expect: { status: 200 }
     },
     {
@@ -5405,7 +5653,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "refuses a deletion by a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "group-admins" } },
+      request: { token: RESTRICTED2, params: { uid: "group-admins" } },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5413,7 +5661,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/group/{uid}",
       description: "answers 404 for an identifier no group has",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "group-none" } },
+      request: { token: ADMIN2, params: { uid: "group-none" } },
       expect: { status: 404, error: "Group not found." }
     },
     // ------------------------------------------------------------ permissions
@@ -5422,7 +5670,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/authorizedRoutes",
       description: "answers the routes that accept a rule, to any caller",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: {
@@ -5446,7 +5694,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/myAuthorizedRoutes",
       description: "answers every route to an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: {
@@ -5470,7 +5718,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/info/myAuthorizedRoutes",
       description: "answers a caller only the routes its rules grant",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         // /AppStream is visible whatever the rules say; the two grants come from
@@ -5486,7 +5734,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/permission",
       description: "returns every rule to an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -5519,7 +5767,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/permission",
       description: "returns a caller only their own rules and their groups'",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: {
         status: 200,
         body: [
@@ -5561,7 +5809,7 @@ var SASjsApi = (() => {
       description: "creates a rule for a user",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5581,7 +5829,7 @@ var SASjsApi = (() => {
       description: "creates a rule for a group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/rename",
           type: "Route",
@@ -5605,7 +5853,7 @@ var SASjsApi = (() => {
       description: "refuses a principal type that is neither a user nor a group",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/deploy",
           type: "Route",
@@ -5625,7 +5873,7 @@ var SASjsApi = (() => {
       description: "refuses a rule assigned to an administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5645,7 +5893,7 @@ var SASjsApi = (() => {
       description: "refuses a creation by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           path: "/SASjsApi/drive/folder",
           type: "Route",
@@ -5662,7 +5910,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a principal that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/rename",
           type: "Route",
@@ -5679,7 +5927,7 @@ var SASjsApi = (() => {
       description: "refuses a group rule that already exists",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/drive/file",
           type: "Route",
@@ -5699,7 +5947,7 @@ var SASjsApi = (() => {
       description: "refuses a rule that already exists",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           path: "/SASjsApi/code/execute",
           type: "Route",
@@ -5719,7 +5967,7 @@ var SASjsApi = (() => {
       description: "flips a rule from Deny to Grant",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "rule-code" },
         body: { setting: "Grant" }
       },
@@ -5731,7 +5979,7 @@ var SASjsApi = (() => {
       description: "refuses a change by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         params: { uid: "rule-code" },
         body: { setting: "Grant" }
       },
@@ -5743,7 +5991,7 @@ var SASjsApi = (() => {
       description: "answers 404 for a rule that does not exist",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         params: { uid: "rule-none" },
         body: { setting: "Grant" }
       },
@@ -5754,7 +6002,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "deletes a rule",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "rule-code" } },
+      request: { token: ADMIN2, params: { uid: "rule-code" } },
       expect: { status: 200, body: "Permission Deleted!" }
     },
     {
@@ -5762,7 +6010,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "refuses a deletion by a non-administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, params: { uid: "rule-code" } },
+      request: { token: RESTRICTED2, params: { uid: "rule-code" } },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5770,7 +6018,7 @@ var SASjsApi = (() => {
       route: "DELETE /SASjsApi/permission/{uid}",
       description: "answers 404 for a rule that does not exist",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN, params: { uid: "rule-none" } },
+      request: { token: ADMIN2, params: { uid: "rule-none" } },
       expect: { status: 404, error: "Permission not found." }
     },
     // --------------------------------------------------------------- clients
@@ -5779,7 +6027,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/client",
       description: "lists the registered clients",
       identity: ADMIN_SIGNED_IN,
-      request: { token: ADMIN },
+      request: { token: ADMIN2 },
       expect: {
         status: 200,
         body: [
@@ -5803,7 +6051,7 @@ var SASjsApi = (() => {
       route: "GET /SASjsApi/client",
       description: "refuses the list to a caller who is not an administrator",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED },
+      request: { token: RESTRICTED2 },
       expect: { status: 401, error: "Admin account required" }
     },
     {
@@ -5812,7 +6060,7 @@ var SASjsApi = (() => {
       description: "registers a client",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           clientId: "new_app",
           clientSecret: "new_secret",
@@ -5836,7 +6084,7 @@ var SASjsApi = (() => {
       description: "applies the schema defaults when the lifetimes are omitted",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: { clientId: "default_app", clientSecret: "default_secret" }
       },
       expect: {
@@ -5855,7 +6103,7 @@ var SASjsApi = (() => {
       description: "refuses a registration by a non-administrator",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: {
           clientId: "new_app",
           clientSecret: "new_secret",
@@ -5871,7 +6119,7 @@ var SASjsApi = (() => {
       description: "refuses a client id that is registered, with the 403 the server sends",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: ADMIN,
+        token: ADMIN2,
         body: {
           clientId: "web_app",
           clientSecret: "other",
@@ -5888,7 +6136,7 @@ var SASjsApi = (() => {
       description: "changes the caller’s own password",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { currentPassword: "user123", newPassword: "changed123" }
       },
       expect: { status: 204 }
@@ -5898,7 +6146,7 @@ var SASjsApi = (() => {
       route: "PATCH /SASjsApi/auth/updatePassword",
       description: "refuses a body without the current password",
       identity: ADMIN_SIGNED_IN,
-      request: { token: RESTRICTED, body: { newPassword: "changed123" } },
+      request: { token: RESTRICTED2, body: { newPassword: "changed123" } },
       expect: { status: 400, error: '"currentPassword" is required' }
     },
     {
@@ -5917,7 +6165,7 @@ var SASjsApi = (() => {
       description: "refuses a change whose current password is wrong",
       identity: ADMIN_SIGNED_IN,
       request: {
-        token: RESTRICTED,
+        token: RESTRICTED2,
         body: { currentPassword: "wrong", newPassword: "changed123" }
       },
       expect: { status: 403, error: "Invalid current password!" }
@@ -5938,6 +6186,112 @@ var SASjsApi = (() => {
     }
   ];
 
+  // src/session/service.ts
+  var createSessionService = (store, host) => {
+    const notFound = (id) => `Session with ID '${id}' was not found.`;
+    const visible = async (caller, id) => {
+      if (!caller) throw new ApiError(401, "Unauthorized");
+      const reader = await store.userById(
+        caller.userId
+      );
+      if (!reader || !reader.isActive) throw new ApiError(401, "Unauthorized");
+      const session = await host.session(id);
+      if (!session) throw new ApiError(404, notFound(id));
+      const owner = session.owner;
+      if (owner !== reader.uid && owner !== reader.username && !reader.isAdmin)
+        throw new ApiError(404, notFound(id));
+      return session;
+    };
+    return {
+      async summary(caller, id) {
+        const session = await visible(caller, id);
+        return session.summary;
+      },
+      async state(caller, id) {
+        await visible(caller, id);
+        const state = await host.state(id);
+        if (!state) throw new ApiError(404, notFound(id));
+        return state;
+      },
+      async log(caller, id) {
+        await visible(caller, id);
+        const log = await host.log(id);
+        if (log === void 0) throw new ApiError(404, notFound(id));
+        return log;
+      },
+      async output(caller, id) {
+        await visible(caller, id);
+        const output = await host.output(id);
+        if (output === void 0) throw new ApiError(404, notFound(id));
+        return output;
+      }
+    };
+  };
+
+  // src/session/memory-host.ts
+  var DEFAULT_SESSIONS = {
+    "sess-admin": {
+      owner: "user-admin",
+      summary: {
+        sessionId: "sess-admin",
+        state: "completed",
+        pid: 4242,
+        creationTimeStamp: "2026-11-07T09:00:00.000Z",
+        deathTimeStamp: "2026-11-07T09:00:04.000Z",
+        expiresAfterMins: 60
+      }
+    },
+    "sess-restricted": {
+      owner: "user-restricted",
+      summary: {
+        sessionId: "sess-restricted",
+        state: "running",
+        pid: 4243,
+        creationTimeStamp: "2026-11-07T09:05:00.000Z"
+      }
+    },
+    "sess-silent": {
+      owner: "user-admin",
+      summary: {
+        sessionId: "sess-silent",
+        state: "running",
+        pid: 4244,
+        creationTimeStamp: "2026-11-07T09:10:00.000Z"
+      }
+    }
+  };
+  var STATES = {
+    "sess-admin": { state: "completed", pid: 4242, lineCount: 12 },
+    "sess-restricted": { state: "running", pid: 4243, lineCount: 3 }
+  };
+  var LOGS = {
+    "sess-admin": "NOTE: session started\nNOTE: session completed\n",
+    "sess-restricted": "NOTE: session started\n",
+    "sess-silent": ""
+  };
+  var OUTPUTS = {
+    "sess-admin": "<html><body>42</body></html>",
+    "sess-restricted": "",
+    "sess-silent": ""
+  };
+  var MemorySessionHost = class {
+    constructor(sessions = DEFAULT_SESSIONS) {
+      this.sessions = sessions;
+    }
+    async session(id) {
+      return this.sessions[id];
+    }
+    async state(id) {
+      return STATES[id];
+    }
+    async log(id) {
+      return LOGS[id];
+    }
+    async output(id) {
+      return OUTPUTS[id];
+    }
+  };
+
   // src/corpus/runner.ts
   var servicesFor = (testCase) => {
     const identity = new MemoryIdentityStore(
@@ -5948,7 +6302,8 @@ var SASjsApi = (() => {
         testCase.unwritable ? new RefusingDriveStore(testCase.seed || {}) : new MemoryDriveStore(testCase.seed || {})
       ),
       identity: createIdentityService(identity),
-      records: createRecordService(identity)
+      records: createRecordService(identity),
+      session: createSessionService(identity, new MemorySessionHost())
     };
   };
   var RefusingDriveStore = class extends MemoryDriveStore {