@sasjs/cli 4.18.5 → 4.19.0

package/build/commands/auth/spec/login.spec.js

@@ -0,0 +1,364 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var prompts_1 = __importDefault(require("prompts"));
+var utils_1 = require("@sasjs/utils");
+var utilsModule = __importStar(require("../../../utils"));
+var authLoginModule = __importStar(require("../login"));
+// Mock prompts so the password prompt returns immediately without blocking.
+jest.mock('prompts', function () { return ({
+    __esModule: true,
+    default: jest.fn(function () { return Promise.resolve({ pass: 'test-pass' }); })
+}); });
+// Mock getString from @sasjs/utils so the username prompt doesn't block.
+// We keep the rest of @sasjs/utils real (ServerType, Target, Logger, etc.).
+jest.mock('@sasjs/utils', function () {
+    var actual = jest.requireActual('@sasjs/utils');
+    return __assign(__assign({}, actual), { getString: jest.fn(function () { return Promise.resolve('test-user'); }) });
+});
+// Re-import after mock so login.ts picks up the mocked getString.
+var utils_2 = require("@sasjs/utils");
+// Mock the three orchestration dependencies that authLogin delegates to.
+// We spy on the utils barrel (../../utils) which re-exports from auth.ts and
+// config.ts, so the spies are the same references login.ts resolves at runtime.
+jest.mock('../../../utils', function () { return (__assign(__assign({}, jest.requireActual('../../../utils')), { getTokensWithPasswordGrant: jest.fn(), fetchLoggedInUser: jest.fn(), saveTokens: jest.fn() })); });
+var viyaTarget = new utils_1.Target({
+    name: 'viya-test',
+    serverType: utils_1.ServerType.SasViya,
+    serverUrl: 'https://viya.example.com',
+    appLoc: '/Public/test',
+    contextName: 'test context'
+});
+var sas9Target = new utils_1.Target({
+    name: 'sas9-test',
+    serverType: utils_1.ServerType.Sas9,
+    serverUrl: 'https://sas9.example.com',
+    appLoc: '/Public/test',
+    contextName: 'test context'
+});
+describe('authLogin', function () {
+    beforeEach(function () {
+        process.logger = new utils_1.Logger(utils_1.LogLevel.Off);
+        jest.clearAllMocks();
+        utils_2.getString.mockResolvedValue('test-user');
+        prompts_1.default.mockResolvedValue({
+            pass: 'test-pass'
+        });
+        utilsModule.getTokensWithPasswordGrant.mockResolvedValue({
+            access_token: 'access-123',
+            refresh_token: 'refresh-456'
+        });
+        utilsModule.fetchLoggedInUser.mockResolvedValue({
+            id: 'sastest',
+            name: 'SAS Test User'
+        });
+        utilsModule.saveTokens.mockResolvedValue(undefined);
+    });
+    afterAll(function () {
+        jest.restoreAllMocks();
+    });
+    // ---------------------------------------------------------------------------
+    // Guard 1: Non-Viya rejection
+    // ---------------------------------------------------------------------------
+    it('should reject when target.serverType is not SASVIYA', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, expect(authLoginModule.authLogin(sas9Target)).rejects.toThrow("'sasjs auth login' is only supported for SASVIYA targets.")];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 2: Missing serverUrl
+    // ---------------------------------------------------------------------------
+    it('should reject when target.serverUrl is missing/empty', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var noUrlTarget;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    noUrlTarget = new utils_1.Target({
+                        name: 'no-url',
+                        serverType: utils_1.ServerType.SasViya,
+                        serverUrl: '',
+                        appLoc: '/Public/test',
+                        contextName: 'test context'
+                    });
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(noUrlTarget)).rejects.toThrow("Target 'no-url' does not have a serverUrl configured.")];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 3: --insecure httpsAgentOptions mutation
+    // ---------------------------------------------------------------------------
+    it('should set rejectUnauthorized: false on target.httpsAgentOptions when insecure is true', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var callTarget;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, true)];
+                case 1:
+                    _a.sent();
+                    callTarget = utilsModule.getTokensWithPasswordGrant
+                        .mock.calls[0][0];
+                    expect(callTarget.httpsAgentOptions).toMatchObject({
+                        rejectUnauthorized: false,
+                        allowInsecureRequests: true
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 3b: insecure=false should NOT mutate httpsAgentOptions
+    // ---------------------------------------------------------------------------
+    it('should not mutate httpsAgentOptions when insecure is false', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var callTarget;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _b.sent();
+                    callTarget = utilsModule.getTokensWithPasswordGrant
+                        .mock.calls[0][0];
+                    // The original target has no rejectUnauthorized set at all.
+                    expect((_a = callTarget.httpsAgentOptions) === null || _a === void 0 ? void 0 : _a.rejectUnauthorized).not.toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 4: saveTokens called with correct args on successful login
+    // ---------------------------------------------------------------------------
+    it('should call saveTokens with the target name, access token, and refresh token after successful login', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    expect(utilsModule.saveTokens).toHaveBeenCalledTimes(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 4b: saveTokens should default refresh_token to '' when omitted
+    // ---------------------------------------------------------------------------
+    it('should call saveTokens with empty string refresh_token when the server omits it', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.getTokensWithPasswordGrant.mockResolvedValue({
+                        access_token: 'access-789',
+                        refresh_token: ''
+                    });
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-789', '');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 5: fetchLoggedInUser failure — tokens not saved, error propagated
+    // ---------------------------------------------------------------------------
+    it('should not save tokens and should propagate the error when fetchLoggedInUser fails', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.fetchLoggedInUser.mockRejectedValue(new Error('Unable to verify the access token'));
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow('Unable to verify the access token')];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 6: getTokensWithPasswordGrant failure — tokens not saved, error propagated
+    // ---------------------------------------------------------------------------
+    it('should not save tokens and should propagate the error when getTokensWithPasswordGrant fails', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.getTokensWithPasswordGrant.mockRejectedValue(new Error('Login failed for user'));
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow('Login failed for user')];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    expect(utilsModule.fetchLoggedInUser).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Callback coverage: username validator rejects empty input
+    // ---------------------------------------------------------------------------
+    it('should pass a validator to getString that rejects empty usernames', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var validator;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    validator = utils_2.getString.mock.calls[0][1];
+                    expect(validator('')).toBe('Username is required.');
+                    expect(validator('someuser')).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Callback coverage: password prompt onCancel throws 'Input cancelled.'
+    // ---------------------------------------------------------------------------
+    it('should throw Input cancelled when the password prompt is cancelled', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    // Capture the onCancel handler from the prompts() call and invoke it
+                    // directly, simulating a user pressing Ctrl+C.
+                    ;
+                    prompts_1.default.mockImplementation(function (_config, opts) {
+                        opts.onCancel();
+                        return Promise.resolve({ pass: '' });
+                    });
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow('Input cancelled.')];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Branch coverage: id fallback in success log (id || 'unknown user')
+    // ---------------------------------------------------------------------------
+    it('should log "unknown user" when fetchLoggedInUser returns no id', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.fetchLoggedInUser.mockResolvedValue({
+                        id: '',
+                        name: 'Some Name'
+                    });
+                    // The function should still complete — the fallback is in the log message,
+                    // not a throw. We just verify saveTokens is still called.
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    // The function should still complete — the fallback is in the log message,
+                    // not a throw. We just verify saveTokens is still called.
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Branch coverage: name fallback in success log (name ? ` (${name})` : '')
+    // ---------------------------------------------------------------------------
+    it('should succeed when fetchLoggedInUser returns no name', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.fetchLoggedInUser.mockResolvedValue({
+                        id: 'sastest',
+                        name: undefined
+                    });
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/build/commands/build/build.js

@@ -251,10 +251,17 @@ function getBuildInfo(target, streamWeb) {
                 case 6: return [4 /*yield*/, getDepsContent(dependencyFilePaths, target, macroFolders)];
                 case 7:
                     dependenciesContent = _a.sent();
-                    return [4 /*yield*/, getBuildVars(target)];
+                    return [4 /*yield*/, getBuildVars(target)
+                        /* NOTE: keep %global as the first line - a leading /** comment block is
+                           stripped by removeHeader() when the final build file is assembled, so
+                           the guidance below must come AFTER code to survive into the output. */
+                    ];
                 case 8:
                     buildVars = _a.sent();
-                    return [2 /*return*/, "\n/**\n  * The appLoc represents the metadata or SAS Drive location of the app you\n  * are about to deploy\n  *\n  * To set an alternative appLoc, simply populate the appLoc variable prior\n  * to running this program, eg:\n  *\n  * %let apploc=/my/apploc;\n  * %inc thisfile;\n  *\n  */\n\n%global appLoc;\n%let compiled_apploc=".concat(appLoc, ";\n%let appLoc=%sysfunc(coalescec(&appLoc,&compiled_apploc));\n\n\n").concat(serverType === utils_1.ServerType.Sas9
+                    /* NOTE: keep %global as the first line - a leading /** comment block is
+                       stripped by removeHeader() when the final build file is assembled, so
+                       the guidance below must come AFTER code to survive into the output. */
+                    return [2 /*return*/, "\n%global appLoc;\n\n/**\n  * The appLoc represents the metadata or SAS Drive location of the app you\n  * are about to deploy\n  *\n  * To set an alternative appLoc, simply populate the appLoc variable prior\n  * to running this program, eg:\n  *\n  * %let apploc=/my/apploc;\n  * %inc thisfile;\n  *\n  * Do NOT change compiled_apploc - it is not the deploy location, it is the\n  * appLoc that was baked into the frontend files at build time.  It is used\n  * by the swap= parameter of %mv_createfile to rewrite that string to the\n  * runtime appLoc when streaming web (html/css/js) files are uploaded.\n  * Changing it breaks dynamic appLoc switching (no strings will match).\n  *\n  */\n\n%let compiled_apploc=".concat(appLoc, ";\n%let appLoc=%sysfunc(coalescec(&appLoc,&compiled_apploc));\n\n\n").concat(serverType === utils_1.ServerType.Sas9
                             ? "\n/**\n  * The serverName represents the SAS 9 logical server context\n  * There is no programmatic (SAS code) way to obtain this\n  * So it is taken from the sasjsconfig file OR supplied at runtime, eg:\n  *\n  * %let apploc=/my/apploc;\n  * %let serverName=SASAppDC;\n  * %inc thisfile;\n  *\n  */\n\n%global serverName;\n%let compiled_serverName=".concat(serverName, ";\n%let serverName=%sysfunc(coalescec(&serverName,&compiled_serverName));\n")
                             : '', "\n\n%let sasjs_clickmeservice=clickme;\n%let syscc=0;\noptions ps=max nonotes nosgen nomprint nomlogic nosource2 nosource noquotelenmax;\n/* user supplied build vars */\n").concat(buildVars, "\n/* user supplied build vars end */\n/* system macro dependencies for build process */\n").concat(dependenciesContent, "\n/* system macro dependencies for build process end*/\n/* system macros for build process */\n").concat((0, utils_1.removeHeader)(buildConfig), "\n/* system macros for build process end */\n")];
             }

package/build/commands/build/spec/build.spec.js

@@ -144,6 +144,9 @@ describe('sasjs build', function () {
                     expect(finalSasFile.includes(commentLine1.split("'").join("'".repeat(2)))).toBeTruthy();
                     expect(commentLine2.split("'").join("'".repeat(2))).toBeTruthy();
                     expect(finalSasFile.includes(afterComment)).toBeTruthy();
+                    // The guidance comment only survives removeHeader() because `%global appLoc;`
+                    // precedes it (regex ^\s*/(\*){1,2}... does not match) - lock that in.
+                    expect(finalSasFile.includes('Do NOT change compiled_apploc')).toBeTruthy();
                     return [2 /*return*/];
             }
         });

package/build/commands/deploy/internal/executeDeployScriptSasViya.js

@@ -73,7 +73,8 @@ function executeDeployScriptSasViya(deployScriptName, target, linesToExecute, lo
                             fileName: deployScriptName,
                             linesOfCode: linesToExecute,
                             contextName: contextName,
-                            authConfig: authConfig
+                            authConfig: authConfig,
+                            onTokensRefreshed: (0, config_1.persistTokensRefreshedByAdapter)(target)
                         })
                             .catch(function (err) {
                             process.logger.error('executeScriptSASViya Error', err);

package/build/commands/fs/internal/executeCode.js

@@ -69,7 +69,8 @@ var executeOnSasViya = function (target, code) { return __awaiter(void 0, void 0
                         fileName: 'program.sas',
                         linesOfCode: code.split('\n'),
                         contextName: contextName,
-                        authConfig: authConfig
+                        authConfig: authConfig,
+                        onTokensRefreshed: (0, utils_2.persistTokensRefreshedByAdapter)(target)
                     })];
             case 2:
                 log = (_c.sent()).log;

package/build/commands/help/help.js

@@ -202,7 +202,9 @@ function printHelpText() {
                     name: 'auth',
                     title: 'auth',
                     description: [
-                        "lets the user add credentials for target to either the local project configuration, or to the global .sasjsrc file.",
+                        "lets the user authenticate against a target.",
+                        "With the 'login' sub command (SASVIYA targets only), authentication is performed with a SAS username and password - no OAuth client/secret required - and the resulting tokens are saved.",
+                        "Without a sub command, behaves like 'sasjs add cred' (client/secret based authentication).",
                         "",
                         "NOTE: This command requires the user to input all the required parameters. More information available in the online documentation: ".concat(chalk_1.default.cyanBright('https://cli.sasjs.io/auth/'))
                     ]
@@ -336,7 +338,6 @@ function printHelpText() {
                 }
             ];
             aliases = [
-                { name: 'add', aliases: ['auth'] },
                 { name: 'build', aliases: ['b'] },
                 { name: 'compile', aliases: ['c'] },
                 { name: 'compilebuild', aliases: ['cb'] },

package/build/commands/run/run.js

@@ -169,7 +169,8 @@ function executeOnSasViya(filePath, target, linesToExecute, logFile) {
                             fileName: path_1.default.basename(filePath),
                             linesOfCode: linesToExecute,
                             contextName: contextName,
-                            authConfig: authConfig
+                            authConfig: authConfig,
+                            onTokensRefreshed: (0, config_1.persistTokensRefreshedByAdapter)(target)
                         })
                             .catch(function (err) { return __awaiter(_this, void 0, void 0, function () {
                             var log;

package/build/types/command/commandAliases.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAllSupportedAliases = exports.aliasMap = void 0;
 exports.aliasMap = new Map([
-    ['add', ['auth']],
     ['build', ['b']],
     ['compile', ['c']],
     ['compilebuild', ['cb']],

package/build/types/command/commandBase.js

@@ -85,6 +85,7 @@ var subCommandMap = new Map([
     ['doc', ['init', 'lineage']],
     ['servicepack', ['deploy']],
     ['add', ['cred']],
+    ['auth', ['login']],
     ['lint', ['init', 'fix', 'find']],
     ['flow', ['execute']]
 ]);

package/build/types/command/commandFactory.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAllSupportedCommands = exports.commandFactory = void 0;
 var addCommand_1 = require("../../commands/add/addCommand");
+var authCommand_1 = require("../../commands/auth/authCommand");
 var buildCommand_1 = require("../../commands/build/buildCommand");
 var compileBuildCommand_1 = require("../../commands/build/compileBuildCommand");
 var compileCommand_1 = require("../../commands/compile/compileCommand");
@@ -27,6 +28,7 @@ var fsCommand_1 = require("../../commands/fs/fsCommand");
 var snippetsCommand_1 = require("../../commands/snippets/snippetsCommand");
 exports.commandFactory = new Map([
     ['add', function (args) { return new addCommand_1.AddCommand(args); }],
+    ['auth', function (args) { return new authCommand_1.AuthCommand(args); }],
     ['build', function (args) { return new buildCommand_1.BuildCommand(args); }],
     ['compile', function (args) { return new compileCommand_1.CompileCommand(args); }],
     ['compilebuild', function (args) { return new compileBuildCommand_1.CompileBuildCommand(args); }],

package/build/utils/auth.d.ts

@@ -2,22 +2,6 @@ import { ServerType, Target } from '@sasjs/utils';
 import SASjs from '@sasjs/adapter/node';
 export declare const getAuthUrl: (serverType: ServerType, serverUrl: string, clientId: string) => string;
 export declare function getAuthCode(authUrl: string): Promise<string>;
-/**
- * Checks if the Access Token is expired or is expiring in 1 hour.  A default Access Token
- * lasts 12 hours. If the Access Token expires, the Refresh Token is used to fetch a new
- * Access Token. In the case that the Refresh Token is expired, 1 hour is enough to let
- * most jobs finish.
- * @param {string} token- token string that will be evaluated
- */
-export declare function isAccessTokenExpiring(token: string): boolean;
-/**
- * Checks if the Refresh Token is expired or expiring in 30 secs. A default Refresh Token
- * lasts 30 days.  Once the Refresh Token expires, the user must re-authenticate (provide
- * credentials in a browser to obtain an authorisation code). 30 seconds is enough time
- * to make a request for a final Access Token.
- * @param {string} token- token string that will be evaluated
- */
-export declare function isRefreshTokenExpiring(token?: string): boolean;
 /**
  * Exchanges a refresh token for a new access/refresh token pair.
  * SAS Viya's refresh tokens are single-use and rotate on every call: the
@@ -30,6 +14,41 @@ export declare function refreshTokens(sasjsInstance: SASjs, clientId: string, cl
     access_token: string;
     refresh_token: string;
 }>;
+/**
+ * The pre-registered, secret-less OAuth client that ships with every SAS Viya
+ * deployment (used by the official SAS Viya CLI). Allows authenticating with a
+ * SAS username/password (OAuth2 resource owner password grant) when no
+ * administrator-registered client/secret is available.
+ */
+export declare const SAS_CLI_CLIENT_ID = "sas.cli";
+/**
+ * Fetches an access/refresh token pair from SAS Viya using the resource owner
+ * password grant against the built-in `sas.cli` public client. Unlike the
+ * client/secret flows, no OAuth client registration is required - the
+ * credentials are the user's regular SAS logon credentials.
+ *
+ * Note: this requires the password grant to be enabled for `sas.cli` (the
+ * default) and a local/LDAP account - it cannot work on SSO/SAML/MFA-only
+ * estates.
+ * @param {Target} target - the SASVIYA target to authenticate against.
+ * @param {string} user - the SAS username.
+ * @param {string} pass - the SAS password.
+ * @returns the access and refresh token pair.
+ */
+export declare function getTokensWithPasswordGrant(target: Target, user: string, pass: string): Promise<{
+    access_token: string;
+    refresh_token: string;
+}>;
+/**
+ * Verifies an access token by fetching the identity it belongs to.
+ * @param {Target} target - the SASVIYA target the token was minted for.
+ * @param {string} accessToken - the access token to verify.
+ * @returns the id and display name of the authenticated user.
+ */
+export declare function fetchLoggedInUser(target: Target, accessToken: string): Promise<{
+    id: string;
+    name?: string;
+}>;
 export declare function getNewAccessToken(sasjsInstance: SASjs, clientId: string, clientSecret: string, target: Target): Promise<{
     access_token: string;
     refresh_token: string;