@sasjs/cli 4.18.6 → 4.19.0

package/build/utils/auth.js

@@ -35,13 +35,9 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNewAccessToken = exports.refreshTokens = exports.isRefreshTokenExpiring = exports.isAccessTokenExpiring = exports.getAuthCode = exports.getAuthUrl = void 0;
+exports.getNewAccessToken = exports.fetchLoggedInUser = exports.getTokensWithPasswordGrant = exports.SAS_CLI_CLIENT_ID = exports.refreshTokens = exports.getAuthCode = exports.getAuthUrl = void 0;
 var utils_1 = require("@sasjs/utils");
-var jwt_decode_1 = __importDefault(require("jwt-decode"));
 var node_1 = require("@sasjs/adapter/node");
 var getAuthUrl = function (serverType, serverUrl, clientId) {
     return serverType === utils_1.ServerType.Sasjs
@@ -69,38 +65,6 @@ function getAuthCode(authUrl) {
     });
 }
 exports.getAuthCode = getAuthCode;
-/**
- * Checks if the Access Token is expired or is expiring in 1 hour.  A default Access Token
- * lasts 12 hours. If the Access Token expires, the Refresh Token is used to fetch a new
- * Access Token. In the case that the Refresh Token is expired, 1 hour is enough to let
- * most jobs finish.
- * @param {string} token- token string that will be evaluated
- */
-function isAccessTokenExpiring(token) {
-    if (!token) {
-        return true;
-    }
-    var payload = (0, jwt_decode_1.default)(token);
-    var timeToLive = payload.exp - new Date().valueOf() / 1000;
-    return timeToLive <= 60 * 60; // 1 hour
-}
-exports.isAccessTokenExpiring = isAccessTokenExpiring;
-/**
- * Checks if the Refresh Token is expired or expiring in 30 secs. A default Refresh Token
- * lasts 30 days.  Once the Refresh Token expires, the user must re-authenticate (provide
- * credentials in a browser to obtain an authorisation code). 30 seconds is enough time
- * to make a request for a final Access Token.
- * @param {string} token- token string that will be evaluated
- */
-function isRefreshTokenExpiring(token) {
-    if (!token) {
-        return true;
-    }
-    var payload = (0, jwt_decode_1.default)(token);
-    var timeToLive = payload.exp - new Date().valueOf() / 1000;
-    return timeToLive <= 30; // 30 seconds
-}
-exports.isRefreshTokenExpiring = isRefreshTokenExpiring;
 /**
  * Exchanges a refresh token for a new access/refresh token pair.
  * SAS Viya's refresh tokens are single-use and rotate on every call: the
@@ -123,6 +87,102 @@ function refreshTokens(sasjsInstance, clientId, clientSecret, refreshToken) {
     });
 }
 exports.refreshTokens = refreshTokens;
+/**
+ * The pre-registered, secret-less OAuth client that ships with every SAS Viya
+ * deployment (used by the official SAS Viya CLI). Allows authenticating with a
+ * SAS username/password (OAuth2 resource owner password grant) when no
+ * administrator-registered client/secret is available.
+ */
+exports.SAS_CLI_CLIENT_ID = 'sas.cli';
+/**
+ * Fetches an access/refresh token pair from SAS Viya using the resource owner
+ * password grant against the built-in `sas.cli` public client. Unlike the
+ * client/secret flows, no OAuth client registration is required - the
+ * credentials are the user's regular SAS logon credentials.
+ *
+ * Note: this requires the password grant to be enabled for `sas.cli` (the
+ * default) and a local/LDAP account - it cannot work on SSO/SAML/MFA-only
+ * estates.
+ * @param {Target} target - the SASVIYA target to authenticate against.
+ * @param {string} user - the SAS username.
+ * @param {string} pass - the SAS password.
+ * @returns the access and refresh token pair.
+ */
+function getTokensWithPasswordGrant(target, user, pass) {
+    return __awaiter(this, void 0, void 0, function () {
+        var requestClient, basicAuth, data, authResponse;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    requestClient = new node_1.SasjsRequestClient(target.serverUrl, target.httpsAgentOptions);
+                    basicAuth = Buffer.from("".concat(exports.SAS_CLI_CLIENT_ID, ":")).toString('base64');
+                    data = new URLSearchParams({
+                        grant_type: 'password',
+                        username: user,
+                        password: pass
+                    });
+                    return [4 /*yield*/, requestClient
+                            .post('/SASLogon/oauth/token', data, undefined, 'application/x-www-form-urlencoded', {
+                            Authorization: "Basic ".concat(basicAuth),
+                            Accept: 'application/json'
+                        })
+                            .then(function (res) { return res.result; })
+                            .catch(function (err) {
+                            if (err instanceof node_1.CertificateError)
+                                throw err;
+                            throw new Error("Login failed for user '".concat(user, "' on ").concat(target.serverUrl, ".\n") +
+                                "Please check your username and password and try again. If they are correct, " +
+                                "the password grant may be disabled for the '".concat(exports.SAS_CLI_CLIENT_ID, "' client on this Viya deployment.\n") +
+                                "".concat((err === null || err === void 0 ? void 0 : err.message) || err));
+                        })];
+                case 1:
+                    authResponse = _a.sent();
+                    if (!(authResponse === null || authResponse === void 0 ? void 0 : authResponse.access_token)) {
+                        throw new Error("Login failed: the token endpoint did not return an access token.");
+                    }
+                    return [2 /*return*/, {
+                            access_token: authResponse.access_token,
+                            // Some Viya deployments omit refresh_token for the password grant; default
+                            // to '' so downstream code (saveTokens, config) can treat it as a plain
+                            // string rather than handling undefined.
+                            refresh_token: authResponse.refresh_token || ''
+                        }];
+            }
+        });
+    });
+}
+exports.getTokensWithPasswordGrant = getTokensWithPasswordGrant;
+/**
+ * Verifies an access token by fetching the identity it belongs to.
+ * @param {Target} target - the SASVIYA target the token was minted for.
+ * @param {string} accessToken - the access token to verify.
+ * @returns the id and display name of the authenticated user.
+ */
+function fetchLoggedInUser(target, accessToken) {
+    return __awaiter(this, void 0, void 0, function () {
+        var requestClient, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    requestClient = new node_1.SasjsRequestClient(target.serverUrl, target.httpsAgentOptions);
+                    return [4 /*yield*/, requestClient
+                            .get('/identities/users/@currentUser', accessToken)
+                            .catch(function (err) {
+                            if (err instanceof node_1.CertificateError)
+                                throw err;
+                            throw new Error("Unable to verify the access token against ".concat(target.serverUrl, ": ").concat((err === null || err === void 0 ? void 0 : err.message) || err));
+                        })];
+                case 1:
+                    result = (_a.sent()).result;
+                    if (!(result === null || result === void 0 ? void 0 : result.id)) {
+                        throw new Error('Login succeeded but the identity endpoint returned no user id.');
+                    }
+                    return [2 /*return*/, { id: result.id, name: result === null || result === void 0 ? void 0 : result.name }];
+            }
+        });
+    });
+}
+exports.fetchLoggedInUser = fetchLoggedInUser;
 function getNewAccessToken(sasjsInstance, clientId, clientSecret, target) {
     return __awaiter(this, void 0, void 0, function () {
         var authUrl, authCode, _a, access_token, refresh_token;

package/build/utils/config.d.ts

@@ -1,4 +1,4 @@
-import SASjs from '@sasjs/adapter/node';
+import SASjs, { OnTokensRefreshed } from '@sasjs/adapter/node';
 import { Configuration, Target, AuthConfig, StreamConfig, AuthConfigSas9, SyncDirectoryMap } from '@sasjs/utils';
 import { TargetScope } from '../types/targetScope';
 /**
@@ -84,7 +84,17 @@ export declare function getAuthConfig(target: Target): Promise<AuthConfig>;
  * so that a rotated (single-use) refresh token from SAS Viya is never reused -
  * reusing it on a subsequent CLI invocation would be rejected by the server.
  */
-export declare const saveTokens: (targetName: string, client: string, secret: string, access_token: string, refresh_token: string) => Promise<void>;
+export declare const saveTokens: (targetName: string, access_token: string, refresh_token: string, client?: string, secret?: string) => Promise<void>;
+/**
+ * Returns an `onTokensRefreshed` handler for adapter methods that refresh
+ * tokens internally (e.g. `executeScript` on long-running jobs). The adapter
+ * receives the rotated pair; this handler persists it via {@link saveTokens}
+ * exactly as {@link getAuthConfig} does for its own refreshes, so the stored
+ * single-use refresh token never goes stale between CLI invocations.
+ * Any client/secret already configured for the target is passed through so
+ * {@link saveTokens} does not drop it from `.env.{target}`.
+ */
+export declare const persistTokensRefreshedByAdapter: (target: Target) => OnTokensRefreshed;
 /**
  * Gets the auth config for the specified SAS9 target.
  * @param {Target} target - the target to get an access token for.
@@ -114,6 +124,7 @@ export declare function getAuthConfigSAS9(target: Target): AuthConfigSas9;
  * should use `getAuthConfig` instead.
  * @param {object} target - the target to get an access token for.
  * @param {string} checkIfExpiring - flag that indicates whether to do an expiry check.
+ * @internal One-shot/test-only. User-facing commands must use {@link getAuthConfig}.
  */
 export declare function getAccessToken(target: Target, checkIfExpiring?: boolean): Promise<string>;
 /**

package/build/utils/config.js

@@ -75,10 +75,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getSASjsAndAuthConfig = exports.getSASjs = exports.getTestTearDown = exports.getTestSetUp = exports.overrideEnvVariables = exports.getAccessToken = exports.getAuthConfigSAS9 = exports.saveTokens = exports.getAuthConfig = exports.getProjectRoot = exports.sanitizeAppLoc = exports.getStreamConfig = exports.getMacroFolders = exports.getBinaryFolders = exports.getProgramFolders = exports.getFolders = exports.saveToLocalConfig = exports.saveLocalConfigFile = exports.getSyncDirectories = exports.getLocalOrGlobalConfig = exports.getLocalConfig = exports.removeFromLocalConfig = exports.removeFromGlobalConfig = exports.saveToGlobalConfig = exports.saveGlobalRcFile = exports.getLocalRcFile = exports.getGlobalRcFile = exports.findTargetInConfiguration = exports.getConfiguration = void 0;
+exports.getSASjsAndAuthConfig = exports.getSASjs = exports.getTestTearDown = exports.getTestSetUp = exports.overrideEnvVariables = exports.getAccessToken = exports.getAuthConfigSAS9 = exports.persistTokensRefreshedByAdapter = exports.saveTokens = exports.getAuthConfig = exports.getProjectRoot = exports.sanitizeAppLoc = exports.getStreamConfig = exports.getMacroFolders = exports.getBinaryFolders = exports.getProgramFolders = exports.getFolders = exports.saveToLocalConfig = exports.saveLocalConfigFile = exports.getSyncDirectories = exports.getLocalOrGlobalConfig = exports.getLocalConfig = exports.removeFromLocalConfig = exports.removeFromGlobalConfig = exports.saveToGlobalConfig = exports.saveGlobalRcFile = exports.getLocalRcFile = exports.getGlobalRcFile = exports.findTargetInConfiguration = exports.getConfiguration = void 0;
 var node_1 = __importDefault(require("@sasjs/adapter/node"));
 var utils_1 = require("@sasjs/utils");
 var auth_1 = require("./auth");
+var auth_2 = require("@sasjs/utils/auth");
 var path_1 = __importDefault(require("path"));
 var dotenv_1 = __importDefault(require("dotenv"));
 var targetScope_1 = require("../types/targetScope");
@@ -90,6 +91,19 @@ var ERROR_MESSAGE = function (targetName) {
         NOT_FOUND_FALLBACK: "No target was found.\nPlease check the target name and try again, or use `sasjs add` to add a new target.\nMore info: https://cli.sasjs.io/faq/#what-is-the-difference-between-local-and-global-targets\n"
     };
 };
+/**
+ * Sanitizes a credential value that may have come from an .env file or
+ * `process.env`. Node persists `process.env.X = undefined` as the literal
+ * string "undefined", and .env files can contain "null" as a placeholder.
+ * Returns undefined for those sentinel strings so they don't leak into
+ * authConfig; otherwise returns the original value (including the empty
+ * string, which is a valid client secret).
+ */
+var sanitizeEnvValue = function (value) {
+    return value && (value.trim() === 'null' || value.trim() === 'undefined')
+        ? undefined
+        : value;
+};
 /**
  * Returns an object that represents the SASjs CLI configuration in a given file.
  * @param {string} pathToFile - the path to the file in question.
@@ -808,7 +822,7 @@ exports.getProjectRoot = getProjectRoot;
 function getAuthConfig(target) {
     var _a, _b, _c, _d;
     return __awaiter(this, void 0, void 0, function () {
-        var access_token, refresh_token, client, secret, sasjs, tokens;
+        var access_token, refresh_token, client, passwordGrantHint, secret, sasjs, tokens, sasjs, tokens;
         return __generator(this, function (_e) {
             switch (_e.label) {
                 case 0:
@@ -827,56 +841,83 @@ function getAuthConfig(target) {
                     refresh_token = ((_b = target === null || target === void 0 ? void 0 : target.authConfig) === null || _b === void 0 ? void 0 : _b.refresh_token)
                         ? target.authConfig.refresh_token
                         : process.env.REFRESH_TOKEN;
-                    refresh_token =
-                        refresh_token &&
-                            (refresh_token.trim() === 'null' || refresh_token.trim() === 'undefined')
-                            ? undefined
-                            : refresh_token;
+                    refresh_token = sanitizeEnvValue(refresh_token);
                     client = ((_c = target === null || target === void 0 ? void 0 : target.authConfig) === null || _c === void 0 ? void 0 : _c.client)
                         ? target.authConfig.client
                         : process.env.CLIENT;
-                    client =
-                        client && (client.trim() === 'null' || client.trim() === 'undefined')
-                            ? undefined
-                            : client;
-                    if (!client) {
-                        throw new Error("Client ID was not found.\n        Please make sure that the 'client' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file."));
-                    }
+                    client = sanitizeEnvValue(client);
+                    passwordGrantHint = "\nAlternatively, run 'sasjs auth login -t ".concat(target === null || target === void 0 ? void 0 : target.name, "' to authenticate with your SAS username and password (no client/secret required).");
                     secret = ((_d = target === null || target === void 0 ? void 0 : target.authConfig) === null || _d === void 0 ? void 0 : _d.secret)
                         ? target.authConfig.secret
                         : process.env.SECRET;
-                    secret =
-                        secret && (secret.trim() === 'null' || secret.trim() === 'undefined')
-                            ? undefined
-                            : secret;
+                    secret = sanitizeEnvValue(secret);
+                    // A fresh access token is sufficient on its own - return it before
+                    // requiring client/secret. This enables token-based authentication for
+                    // targets without a registered OAuth client (see `sasjs auth login`).
+                    // Use the same 300 s margin as the refresh path below for consistency —
+                    // see the comment at line 713 for why the default 3600 s is too large.
+                    if (access_token && !(0, auth_2.isAccessTokenExpiring)(access_token, 300)) {
+                        return [2 /*return*/, {
+                                access_token: access_token,
+                                refresh_token: refresh_token || '',
+                                client: client,
+                                secret: client ? secret || '' : undefined
+                            }];
+                    }
+                    if (!(!client && target.serverType === utils_1.ServerType.SasViya)) return [3 /*break*/, 5];
+                    // Some estates issue opaque (non-JWT) refresh tokens, which cannot be
+                    // expiry-checked client-side - isRefreshTokenExpiring treats those as
+                    // usable and lets the server reject them if they have actually expired.
+                    if (!refresh_token || (0, auth_2.isRefreshTokenExpiring)(refresh_token)) {
+                        throw new Error("The access token has expired and no refresh token is available.".concat(passwordGrantHint));
+                    }
+                    sasjs = getSASjs(target);
+                    return [4 /*yield*/, (0, auth_1.refreshTokens)(sasjs, auth_1.SAS_CLI_CLIENT_ID, '', refresh_token)];
+                case 3:
+                    tokens = _e.sent();
+                    access_token = (tokens === null || tokens === void 0 ? void 0 : tokens.access_token) || access_token;
+                    refresh_token = (tokens === null || tokens === void 0 ? void 0 : tokens.refresh_token) || refresh_token;
+                    return [4 /*yield*/, (0, exports.saveTokens)(target.name, access_token, refresh_token || '')];
+                case 4:
+                    _e.sent();
+                    return [2 /*return*/, {
+                            access_token: access_token,
+                            refresh_token: refresh_token || '',
+                            client: undefined,
+                            secret: undefined
+                        }];
+                case 5:
+                    if (!client) {
+                        throw new Error("Client ID was not found.\n        Please make sure that the 'client' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file.").concat(passwordGrantHint));
+                    }
                     if (!secret) {
                         if (target.serverType === utils_1.ServerType.Sasjs)
                             secret = '';
                         else
-                            throw new Error("Client secret was not found.\n        Please make sure that the 'secret' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file."));
+                            throw new Error("Client secret was not found.\n        Please make sure that the 'secret' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file.").concat(passwordGrantHint));
                     }
-                    if (!(0, auth_1.isAccessTokenExpiring)(access_token)) return [3 /*break*/, 8];
+                    if (!(0, auth_2.isAccessTokenExpiring)(access_token, 300)) return [3 /*break*/, 11];
                     sasjs = getSASjs(target);
                     tokens = void 0;
-                    if (!(0, auth_1.isRefreshTokenExpiring)(refresh_token)) return [3 /*break*/, 4];
+                    if (!(0, auth_2.isRefreshTokenExpiring)(refresh_token)) return [3 /*break*/, 7];
                     return [4 /*yield*/, (0, auth_1.getNewAccessToken)(sasjs, client, secret, target)];
-                case 3:
+                case 6:
                     tokens = _e.sent();
-                    return [3 /*break*/, 6];
-                case 4: return [4 /*yield*/, (0, auth_1.refreshTokens)(sasjs, client, secret, refresh_token)];
-                case 5:
+                    return [3 /*break*/, 9];
+                case 7: return [4 /*yield*/, (0, auth_1.refreshTokens)(sasjs, client, secret, refresh_token || '')];
+                case 8:
                     tokens = _e.sent();
-                    _e.label = 6;
-                case 6:
+                    _e.label = 9;
+                case 9:
                     access_token = (tokens === null || tokens === void 0 ? void 0 : tokens.access_token) || access_token;
                     refresh_token = (tokens === null || tokens === void 0 ? void 0 : tokens.refresh_token) || refresh_token;
-                    return [4 /*yield*/, (0, exports.saveTokens)(target.name, client, secret, access_token, refresh_token || '')];
-                case 7:
+                    return [4 /*yield*/, (0, exports.saveTokens)(target.name, access_token, refresh_token || '', client, secret)];
+                case 10:
                     _e.sent();
-                    _e.label = 8;
-                case 8: return [2 /*return*/, {
+                    _e.label = 11;
+                case 11: return [2 /*return*/, {
                         access_token: access_token,
-                        refresh_token: refresh_token,
+                        refresh_token: refresh_token || '',
                         client: client,
                         secret: secret
                     }];
@@ -892,8 +933,8 @@ exports.getAuthConfig = getAuthConfig;
  * so that a rotated (single-use) refresh token from SAS Viya is never reused -
  * reusing it on a subsequent CLI invocation would be rejected by the server.
  */
-var saveTokens = function (targetName, client, secret, access_token, refresh_token) { return __awaiter(void 0, void 0, void 0, function () {
-    var isLocalTarget, VERBOSE, envFileContent, envFilePath, globalConfig, target, targetJson;
+var saveTokens = function (targetName, access_token, refresh_token, client, secret) { return __awaiter(void 0, void 0, void 0, function () {
+    var isLocalTarget, VERBOSE, clientSecretContent, envFileContent, envFilePath, globalConfig, target, targetJson;
     var _a, _b, _c;
     return __generator(this, function (_d) {
         switch (_d.label) {
@@ -908,7 +949,10 @@ var saveTokens = function (targetName, client, secret, access_token, refresh_tok
                 isLocalTarget = _d.sent();
                 if (!isLocalTarget) return [3 /*break*/, 3];
                 VERBOSE = process.env.VERBOSE;
-                envFileContent = "CLIENT=".concat(client, "\nSECRET=").concat(secret, "\nACCESS_TOKEN=").concat(access_token, "\nREFRESH_TOKEN=").concat(refresh_token, "\n").concat(VERBOSE ? 'VERBOSE=' + VERBOSE + '\n' : '');
+                clientSecretContent = client
+                    ? "CLIENT=".concat(client, "\nSECRET=").concat(secret || '', "\n")
+                    : '';
+                envFileContent = "".concat(clientSecretContent, "ACCESS_TOKEN=").concat(access_token, "\nREFRESH_TOKEN=").concat(refresh_token, "\n").concat(VERBOSE ? 'VERBOSE=' + VERBOSE + '\n' : '');
                 envFilePath = path_1.default.join(process.projectDir, ".env.".concat(targetName));
                 return [4 /*yield*/, (0, utils_1.createFile)(envFilePath, envFileContent)];
             case 2:
@@ -922,8 +966,10 @@ var saveTokens = function (targetName, client, secret, access_token, refresh_tok
                 if (!target) {
                     throw new Error(ERROR_MESSAGE(targetName).NOT_FOUND_TARGET_NAME);
                 }
-                targetJson = target.toJson();
-                targetJson.authConfig = { client: client, secret: secret, access_token: access_token, refresh_token: refresh_token };
+                targetJson = __assign({}, target);
+                targetJson.authConfig = __assign(__assign(__assign({}, (targetJson.authConfig || {})), (client
+                    ? { client: client, secret: secret || '' }
+                    : { client: undefined, secret: undefined })), { access_token: access_token, refresh_token: refresh_token });
                 return [4 /*yield*/, saveToGlobalConfig(new utils_1.Target(targetJson), globalConfig.defaultTarget === targetName)];
             case 5:
                 _d.sent();
@@ -934,6 +980,38 @@ var saveTokens = function (targetName, client, secret, access_token, refresh_tok
     });
 }); };
 exports.saveTokens = saveTokens;
+/**
+ * Returns an `onTokensRefreshed` handler for adapter methods that refresh
+ * tokens internally (e.g. `executeScript` on long-running jobs). The adapter
+ * receives the rotated pair; this handler persists it via {@link saveTokens}
+ * exactly as {@link getAuthConfig} does for its own refreshes, so the stored
+ * single-use refresh token never goes stale between CLI invocations.
+ * Any client/secret already configured for the target is passed through so
+ * {@link saveTokens} does not drop it from `.env.{target}`.
+ */
+var persistTokensRefreshedByAdapter = function (target) {
+    return function (_a) {
+        var access_token = _a.access_token, refresh_token = _a.refresh_token;
+        return __awaiter(void 0, void 0, void 0, function () {
+            var rawClient, rawSecret, client, secret;
+            var _b, _c;
+            return __generator(this, function (_d) {
+                switch (_d.label) {
+                    case 0:
+                        rawClient = ((_b = target.authConfig) === null || _b === void 0 ? void 0 : _b.client) || process.env.CLIENT;
+                        rawSecret = ((_c = target.authConfig) === null || _c === void 0 ? void 0 : _c.secret) || process.env.SECRET;
+                        client = sanitizeEnvValue(rawClient);
+                        secret = sanitizeEnvValue(rawSecret);
+                        return [4 /*yield*/, (0, exports.saveTokens)(target.name, access_token, refresh_token, client, secret)];
+                    case 1:
+                        _d.sent();
+                        return [2 /*return*/];
+                }
+            });
+        });
+    };
+};
+exports.persistTokensRefreshedByAdapter = persistTokensRefreshedByAdapter;
 /**
  * Gets the auth config for the specified SAS9 target.
  * @param {Target} target - the target to get an access token for.
@@ -982,11 +1060,12 @@ exports.getAuthConfigSAS9 = getAuthConfigSAS9;
  * should use `getAuthConfig` instead.
  * @param {object} target - the target to get an access token for.
  * @param {string} checkIfExpiring - flag that indicates whether to do an expiry check.
+ * @internal One-shot/test-only. User-facing commands must use {@link getAuthConfig}.
  */
 function getAccessToken(target, checkIfExpiring) {
     if (checkIfExpiring === void 0) { checkIfExpiring = true; }
     return __awaiter(this, void 0, void 0, function () {
-        var accessToken, sasjs, client, secret, refreshToken, tokens;
+        var accessToken, sasjs, passwordGrantHint, client, secret, refreshToken, tokens;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
@@ -1007,38 +1086,29 @@ function getAccessToken(target, checkIfExpiring) {
                         accessToken.trim() === 'undefined') {
                         throw new Error("A valid access token was not found.\nPlease provide an access token in the access_token property in your .env file or as part of the authInfo in your target configuration (sasjsconfig.json).");
                     }
-                    if (!(checkIfExpiring && (0, auth_1.isAccessTokenExpiring)(accessToken))) return [3 /*break*/, 7];
+                    if (!(checkIfExpiring && (0, auth_2.isAccessTokenExpiring)(accessToken))) return [3 /*break*/, 7];
                     sasjs = getSASjs(target);
+                    passwordGrantHint = "\nAlternatively, run 'sasjs auth login -t ".concat(target === null || target === void 0 ? void 0 : target.name, "' to authenticate with your SAS username and password (no client/secret required).");
                     client = target.authConfig && target.authConfig.client
                         ? target.authConfig.client
                         : process.env.CLIENT;
-                    client =
-                        client && (client.trim() === 'null' || client.trim() === 'undefined')
-                            ? undefined
-                            : client;
+                    client = sanitizeEnvValue(client);
                     if (!client) {
-                        throw new Error("Client ID was not found.\n        Please make sure that the 'client' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file."));
+                        throw new Error("Client ID was not found.\n        Please make sure that the 'client' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file.").concat(passwordGrantHint));
                     }
                     secret = target.authConfig && target.authConfig.secret
                         ? target.authConfig.secret
                         : process.env.SECRET;
-                    secret =
-                        secret && (secret.trim() === 'null' || secret.trim() === 'undefined')
-                            ? undefined
-                            : secret;
+                    secret = sanitizeEnvValue(secret);
                     if (!secret) {
-                        throw new Error("Client secret was not found.\n        Please make sure that the 'secret' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file."));
+                        throw new Error("Client secret was not found.\n        Please make sure that the 'secret' property is set in your local .env file or in the correct target authConfig in your global ~".concat(path_1.default.sep, ".sasjsrc file.").concat(passwordGrantHint));
                     }
                     refreshToken = target.authConfig && target.authConfig.refresh_token
                         ? target.authConfig.refresh_token
                         : process.env.REFRESH_TOKEN;
-                    refreshToken =
-                        refreshToken &&
-                            (refreshToken.trim() === 'null' || refreshToken.trim() === 'undefined')
-                            ? undefined
-                            : refreshToken;
+                    refreshToken = sanitizeEnvValue(refreshToken);
                     tokens = void 0;
-                    if (!(0, auth_1.isRefreshTokenExpiring)(refreshToken)) return [3 /*break*/, 4];
+                    if (!(0, auth_2.isRefreshTokenExpiring)(refreshToken)) return [3 /*break*/, 4];
                     return [4 /*yield*/, (0, auth_1.getNewAccessToken)(sasjs, client, secret, target)];
                 case 3:
                     tokens = _a.sent();

package/build/utils/spec/auth.spec.d.ts

@@ -0,0 +1 @@
+export {};