@sasjs/cli 4.18.6 → 4.19.0

package/build/utils/spec/auth.spec.js

@@ -0,0 +1,255 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var utils_1 = require("@sasjs/utils");
+var node_1 = require("@sasjs/adapter/node");
+var auth_1 = require("../auth");
+// SasjsRequestClient is imported inside auth.ts from '@sasjs/adapter/node'.
+// We mock the module so we can control the .get() and .post() responses.
+jest.mock('@sasjs/adapter/node', function () {
+    var actual = jest.requireActual('@sasjs/adapter/node');
+    return __assign(__assign({}, actual), { SasjsRequestClient: jest.fn().mockImplementation(function () { return ({
+            get: jest.fn(),
+            post: jest.fn()
+        }); }) });
+});
+// Re-import after mock setup so the module under test picks up the mock.
+// (Re-declared with the same name; TS allows this in spec files via the
+//  `esModuleInterop` + `allowJs` combination the CLI's tsconfig enables.)
+var node_2 = require("@sasjs/adapter/node");
+var target = new utils_1.Target({
+    name: 'test',
+    serverType: utils_1.ServerType.SasViya,
+    serverUrl: 'https://viya.example.com',
+    appLoc: '/Public/test',
+    contextName: 'test context'
+});
+describe('fetchLoggedInUser', function () {
+    afterEach(function () {
+        jest.clearAllMocks();
+    });
+    it('should return the user id and name when the identity endpoint responds', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockGet, result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockGet = jest.fn().mockResolvedValue({
+                        result: { id: 'sastest', name: 'SAS Test User' }
+                    });
+                    node_2.SasjsRequestClient.mockImplementation(function () { return ({
+                        get: mockGet
+                    }); });
+                    return [4 /*yield*/, (0, auth_1.fetchLoggedInUser)(target, 'valid-token')];
+                case 1:
+                    result = _a.sent();
+                    expect(result).toEqual({ id: 'sastest', name: 'SAS Test User' });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should throw a friendly error when the identity endpoint returns an error', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockGet;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockGet = jest
+                        .fn()
+                        .mockRejectedValue(new Error('Request failed with status 401'));
+                    node_2.SasjsRequestClient.mockImplementation(function () { return ({
+                        get: mockGet
+                    }); });
+                    return [4 /*yield*/, expect((0, auth_1.fetchLoggedInUser)(target, 'bad-token')).rejects.toThrow("Unable to verify the access token against ".concat(target.serverUrl))];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should throw an error when the identity endpoint returns no user id', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockGet;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockGet = jest.fn().mockResolvedValue({ result: {} });
+                    node_2.SasjsRequestClient.mockImplementation(function () { return ({
+                        get: mockGet
+                    }); });
+                    return [4 /*yield*/, expect((0, auth_1.fetchLoggedInUser)(target, 'token')).rejects.toThrow('Login succeeded but the identity endpoint returned no user id.')];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});
+describe('getTokensWithPasswordGrant', function () {
+    var user = 'myuser';
+    var pass = 'mypass';
+    afterEach(function () {
+        jest.clearAllMocks();
+    });
+    var mockPostSuccess = function (tokens) {
+        var mockPost = jest.fn().mockResolvedValue({ result: tokens });
+        node_2.SasjsRequestClient.mockImplementation(function () { return ({
+            post: mockPost
+        }); });
+        return mockPost;
+    };
+    var mockPostFailure = function (err) {
+        var mockPost = jest.fn().mockRejectedValue(err);
+        node_2.SasjsRequestClient.mockImplementation(function () { return ({
+            post: mockPost
+        }); });
+        return mockPost;
+    };
+    it('should send a password-grant request with the correct Basic auth header and grant_type', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var mockPost, result, _a, endpoint, body, contentType, headers, expectedBasic;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    mockPost = mockPostSuccess({
+                        access_token: 'access-123',
+                        refresh_token: 'refresh-456'
+                    });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithPasswordGrant)(target, user, pass)];
+                case 1:
+                    result = _b.sent();
+                    expect(result).toEqual({
+                        access_token: 'access-123',
+                        refresh_token: 'refresh-456'
+                    });
+                    // Verify the post() call: endpoint, body, and headers.
+                    expect(mockPost).toHaveBeenCalledTimes(1);
+                    _a = __read(mockPost.mock.calls[0], 5), endpoint = _a[0], body = _a[1], contentType = _a[3], headers = _a[4];
+                    expect(endpoint).toBe('/SASLogon/oauth/token');
+                    expect(contentType).toBe('application/x-www-form-urlencoded');
+                    expectedBasic = Buffer.from("".concat(auth_1.SAS_CLI_CLIENT_ID, ":")).toString('base64');
+                    expect(headers.Authorization).toBe("Basic ".concat(expectedBasic));
+                    // Body must carry grant_type=password plus the user credentials.
+                    expect(body).toBeInstanceOf(URLSearchParams);
+                    expect(body.get('grant_type')).toBe('password');
+                    expect(body.get('username')).toBe(user);
+                    expect(body.get('password')).toBe(pass);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should throw a friendly error when the token endpoint returns a non-200 response', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockPostFailure(new Error('Request failed with status 401'));
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithPasswordGrant)(target, user, pass)).rejects.toThrow("Login failed for user '".concat(user, "' on ").concat(target.serverUrl))];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should pass through CertificateError without wrapping it', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var certErr;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    certErr = new node_1.CertificateError('https://viya.example.com');
+                    mockPostFailure(certErr);
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithPasswordGrant)(target, user, pass)).rejects.toBe(certErr)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should throw when the token endpoint response has no access_token', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockPostSuccess({ refresh_token: 'refresh-only' });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithPasswordGrant)(target, user, pass)).rejects.toThrow('Login failed: the token endpoint did not return an access token.')];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should default refresh_token to empty string when the server omits it', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    mockPostSuccess({ access_token: 'access-only' });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithPasswordGrant)(target, user, pass)];
+                case 1:
+                    result = _a.sent();
+                    expect(result.access_token).toBe('access-only');
+                    // Some Viya deployments omit refresh_token for the password grant; we
+                    // normalize to '' so downstream code (saveTokens, config) can treat it
+                    // as a plain string.
+                    expect(result.refresh_token).toBe('');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});