@sasjs/cli 4.18.0 → 4.18.1

package/build/commands/deploy/spec/cbd.spec.server.viya.js

@@ -255,13 +255,13 @@ describe('sasjs cbd with Viya', function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        jest.spyOn(configUtils, 'getAccessToken').mockImplementation(function () {
+                        jest.spyOn(configUtils, 'getAuthConfig').mockImplementation(function () {
                             return Promise.reject('Token error');
                         });
                         return [4 /*yield*/, (0, build_1.build)(target)];
                     case 1:
                         _a.sent();
-                        return [4 /*yield*/, expect((0, deploy_1.deploy)(target, true)).rejects.toThrow(new Error("Deployment failed. Request is not authenticated.\nPlease add the following variables to your .env.".concat(target.name, " file:\nCLIENT, SECRET, ACCESS_TOKEN, REFRESH_TOKEN")))];
+                        return [4 /*yield*/, expect((0, deploy_1.deploy)(target, true)).rejects.toThrow(new Error("Deployment failed. Request is not authenticated.\nToken error"))];
                     case 2:
                         _a.sent();
                         jest.restoreAllMocks();

package/build/commands/shared/deployToSasViyaWithServicePack.js

@@ -55,12 +55,11 @@ function deployToSasViyaWithServicePack(jsonFilePath, target, isLocal, isForced)
                         throw new Error('Provided data file must be valid json.');
                     }
                     populateCodeInServicePack(jsonObject);
-                    return [4 /*yield*/, (0, utils_2.getAccessToken)(target).catch(function (e) { return ''; })];
+                    return [4 /*yield*/, (0, utils_2.getAuthConfig)(target).catch(function (err) {
+                            throw new Error("Deployment failed. Request is not authenticated.\n".concat((err === null || err === void 0 ? void 0 : err.message) || err));
+                        })];
                 case 2:
-                    access_token = _a.sent();
-                    if (!access_token) {
-                        throw new Error("Deployment failed. Request is not authenticated.\nPlease add the following variables to your .env".concat(isLocal ? ".".concat(target.name) : '', " file:\nCLIENT, SECRET, ACCESS_TOKEN, REFRESH_TOKEN"));
-                    }
+                    access_token = (_a.sent()).access_token;
                     sasjs = (0, utils_2.getSASjs)(target);
                     return [4 /*yield*/, sasjs
                             .deployServicePack(jsonObject, undefined, undefined, access_token, isForced)

package/build/commands/shared/spec/deployToSasViyaWithServicePack.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/build/commands/shared/spec/deployToSasViyaWithServicePack.spec.js

@@ -0,0 +1,146 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var path_1 = __importDefault(require("path"));
+var os_1 = __importDefault(require("os"));
+var utils_1 = require("@sasjs/utils");
+var configUtils = __importStar(require("../../../utils/config"));
+var deployToSasViyaWithServicePack_1 = require("../deployToSasViyaWithServicePack");
+var target = new utils_1.Target({
+    name: 'test',
+    appLoc: '/Public/test/',
+    serverType: utils_1.ServerType.SasViya,
+    serverUrl: 'https://server.com',
+    contextName: 'test context'
+});
+var mockAuthConfig = {
+    client: 'cl13nt',
+    secret: '53cr3t',
+    access_token: 'acc355',
+    refresh_token: 'r3fr35h'
+};
+describe('deployToSasViyaWithServicePack', function () {
+    var jsonFilePath;
+    var deployServicePack;
+    beforeEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    jsonFilePath = path_1.default.join(os_1.default.tmpdir(), "servicepack-".concat(Date.now(), ".json"));
+                    return [4 /*yield*/, (0, utils_1.createFile)(jsonFilePath, JSON.stringify({ members: [] }))];
+                case 1:
+                    _a.sent();
+                    deployServicePack = jest.fn().mockResolvedValue({});
+                    jest
+                        .spyOn(configUtils, 'getSASjs')
+                        .mockImplementation(function () { return ({ deployServicePack: deployServicePack }); });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterEach(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, utils_1.deleteFile)(jsonFilePath)];
+                case 1:
+                    _a.sent();
+                    jest.restoreAllMocks();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('refreshes and persists the access token via getAuthConfig instead of the non-persisting getAccessToken', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var getAuthConfigSpy;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    getAuthConfigSpy = jest
+                        .spyOn(configUtils, 'getAuthConfig')
+                        .mockImplementation(function () { return Promise.resolve(mockAuthConfig); });
+                    return [4 /*yield*/, expect((0, deployToSasViyaWithServicePack_1.deployToSasViyaWithServicePack)(jsonFilePath, target, true, false)).toResolve()];
+                case 1:
+                    _a.sent();
+                    expect(getAuthConfigSpy).toHaveBeenCalledWith(target);
+                    expect(deployServicePack).toHaveBeenCalledWith({ members: [] }, undefined, undefined, mockAuthConfig.access_token, false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('surfaces the real auth/refresh error instead of a generic "add these variables" message when credentials already exist', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var realError;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    realError = new Error('invalid_grant: refresh token has already been used');
+                    jest.spyOn(configUtils, 'getAuthConfig').mockImplementation(function () {
+                        return Promise.reject(realError);
+                    });
+                    return [4 /*yield*/, expect((0, deployToSasViyaWithServicePack_1.deployToSasViyaWithServicePack)(jsonFilePath, target, true, false)).rejects.toThrow(/invalid_grant: refresh token has already been used/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/build/utils/auth.d.ts

@@ -18,6 +18,14 @@ export declare function isAccessTokenExpiring(token: string): boolean;
  * @param {string} token- token string that will be evaluated
  */
 export declare function isRefreshTokenExpiring(token?: string): boolean;
+/**
+ * Exchanges a refresh token for a new access/refresh token pair.
+ * SAS Viya's refresh tokens are single-use and rotate on every call: the
+ * `refresh_token` returned here supersedes the one passed in, which becomes
+ * invalid immediately. Callers must persist the returned pair (see
+ * `saveTokens` in config.ts) or a later refresh attempt with the old token
+ * will be rejected by the server.
+ */
 export declare function refreshTokens(sasjsInstance: SASjs, clientId: string, clientSecret: string, refreshToken: string): Promise<{
     access_token: string;
     refresh_token: string;

package/build/utils/auth.js

@@ -101,6 +101,14 @@ function isRefreshTokenExpiring(token) {
     return timeToLive <= 30; // 30 seconds
 }
 exports.isRefreshTokenExpiring = isRefreshTokenExpiring;
+/**
+ * Exchanges a refresh token for a new access/refresh token pair.
+ * SAS Viya's refresh tokens are single-use and rotate on every call: the
+ * `refresh_token` returned here supersedes the one passed in, which becomes
+ * invalid immediately. Callers must persist the returned pair (see
+ * `saveTokens` in config.ts) or a later refresh attempt with the old token
+ * will be rejected by the server.
+ */
 function refreshTokens(sasjsInstance, clientId, clientSecret, refreshToken) {
     return __awaiter(this, void 0, void 0, function () {
         var _a, access_token, refresh_token;

package/build/utils/config.d.ts

@@ -61,11 +61,29 @@ export declare function getStreamConfig(target?: Target): Promise<StreamConfig>;
 export declare function sanitizeAppLoc(appLoc: string): string;
 export declare function getProjectRoot(): Promise<string>;
 /**
- * Gets the auth config for the specified target.
+ * Gets the auth config for the specified target, refreshing the access token
+ * (via the refresh token) if it is expiring.
+ *
+ * Unlike {@link getAccessToken}, this persists any newly issued access/refresh
+ * token pair via {@link saveTokens}. That persistence is not optional: SAS Viya
+ * issues rotating, single-use refresh tokens, so once a refresh token has been
+ * used to mint a new pair, the old one is void. If the new pair isn't written
+ * back to `.env.{target}` / the global config, the *next* CLI invocation reads
+ * the now-stale refresh token from disk and fails to authenticate - which is
+ * indistinguishable, from the user's point of view, from never having
+ * refreshed at all. This is why every command that needs an authenticated
+ * request should call `getAuthConfig`, not `getAccessToken`.
  * @param {Target} target - the target to get an access token for.
  * @returns {AuthConfig} - an object containing an access token, refresh token, client ID and secret.
  */
 export declare function getAuthConfig(target: Target): Promise<AuthConfig>;
+/**
+ * Persists an access/refresh token pair to wherever the target's credentials
+ * live: `.env.{targetName}` for a local target, or `authConfig` in the global
+ * `~/.sasjsrc` otherwise. Called by {@link getAuthConfig} after every refresh
+ * so that a rotated (single-use) refresh token from SAS Viya is never reused -
+ * reusing it on a subsequent CLI invocation would be rejected by the server.
+ */
 export declare const saveTokens: (targetName: string, client: string, secret: string, access_token: string, refresh_token: string) => Promise<void>;
 /**
  * Gets the auth config for the specified SAS9 target.
@@ -84,6 +102,16 @@ export declare function getAuthConfigSAS9(target: Target): AuthConfigSas9;
  * If a refresh token is unavailable, we will use the client ID and secret
  * to obtain a new access token. Manual intervention is required in this case
  * to navigate to the URL shown and type in an authorization code.
+ *
+ * IMPORTANT: unlike {@link getAuthConfig}, this does NOT persist a refreshed
+ * access/refresh token pair back to disk - the new tokens only live for the
+ * lifetime of this process. Since SAS Viya refresh tokens are single-use and
+ * rotate on every refresh, calling this from a command whose CLI invocation
+ * ends shortly after (leaving the stale refresh token on disk) will cause the
+ * *next* invocation to fail to authenticate. Only use this where that's
+ * acceptable - e.g. one-shot, same-process cleanup calls such as
+ * `removeTestServerFolder` in test support code. Any user-facing command
+ * should use `getAuthConfig` instead.
  * @param {object} target - the target to get an access token for.
  * @param {string} checkIfExpiring - flag that indicates whether to do an expiry check.
  */

package/build/utils/config.js

@@ -790,7 +790,18 @@ function getProjectRoot() {
 }
 exports.getProjectRoot = getProjectRoot;
 /**
- * Gets the auth config for the specified target.
+ * Gets the auth config for the specified target, refreshing the access token
+ * (via the refresh token) if it is expiring.
+ *
+ * Unlike {@link getAccessToken}, this persists any newly issued access/refresh
+ * token pair via {@link saveTokens}. That persistence is not optional: SAS Viya
+ * issues rotating, single-use refresh tokens, so once a refresh token has been
+ * used to mint a new pair, the old one is void. If the new pair isn't written
+ * back to `.env.{target}` / the global config, the *next* CLI invocation reads
+ * the now-stale refresh token from disk and fails to authenticate - which is
+ * indistinguishable, from the user's point of view, from never having
+ * refreshed at all. This is why every command that needs an authenticated
+ * request should call `getAuthConfig`, not `getAccessToken`.
  * @param {Target} target - the target to get an access token for.
  * @returns {AuthConfig} - an object containing an access token, refresh token, client ID and secret.
  */
@@ -874,6 +885,13 @@ function getAuthConfig(target) {
     });
 }
 exports.getAuthConfig = getAuthConfig;
+/**
+ * Persists an access/refresh token pair to wherever the target's credentials
+ * live: `.env.{targetName}` for a local target, or `authConfig` in the global
+ * `~/.sasjsrc` otherwise. Called by {@link getAuthConfig} after every refresh
+ * so that a rotated (single-use) refresh token from SAS Viya is never reused -
+ * reusing it on a subsequent CLI invocation would be rejected by the server.
+ */
 var saveTokens = function (targetName, client, secret, access_token, refresh_token) { return __awaiter(void 0, void 0, void 0, function () {
     var isLocalTarget, VERBOSE, envFileContent, envFilePath, globalConfig, target, targetJson;
     var _a, _b, _c;
@@ -952,6 +970,16 @@ exports.getAuthConfigSAS9 = getAuthConfigSAS9;
  * If a refresh token is unavailable, we will use the client ID and secret
  * to obtain a new access token. Manual intervention is required in this case
  * to navigate to the URL shown and type in an authorization code.
+ *
+ * IMPORTANT: unlike {@link getAuthConfig}, this does NOT persist a refreshed
+ * access/refresh token pair back to disk - the new tokens only live for the
+ * lifetime of this process. Since SAS Viya refresh tokens are single-use and
+ * rotate on every refresh, calling this from a command whose CLI invocation
+ * ends shortly after (leaving the stale refresh token on disk) will cause the
+ * *next* invocation to fail to authenticate. Only use this where that's
+ * acceptable - e.g. one-shot, same-process cleanup calls such as
+ * `removeTestServerFolder` in test support code. Any user-facing command
+ * should use `getAuthConfig` instead.
  * @param {object} target - the target to get an access token for.
  * @param {string} checkIfExpiring - flag that indicates whether to do an expiry check.
  */

package/package.json

@@ -122,5 +122,5 @@
   "overrides": {
     "ws": "8.21.0"
   },
-  "version": "4.18.0"
+  "version": "4.18.1"
 }