@sasjs/cli 4.18.6 → 4.20.0

package/build/commands/auth/spec/login.spec.js

@@ -0,0 +1,665 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var prompts_1 = __importDefault(require("prompts"));
+var utils_1 = require("@sasjs/utils");
+var utilsModule = __importStar(require("../../../utils"));
+var authLoginModule = __importStar(require("../login"));
+// Mock prompts so the password prompt returns immediately without blocking.
+jest.mock('prompts', function () { return ({
+    __esModule: true,
+    default: jest.fn(function () { return Promise.resolve({ pass: 'test-pass' }); })
+}); });
+// Mock getString from @sasjs/utils so the username prompt doesn't block.
+// We keep the rest of @sasjs/utils real (ServerType, Target, Logger, etc.).
+jest.mock('@sasjs/utils', function () {
+    var actual = jest.requireActual('@sasjs/utils');
+    return __assign(__assign({}, actual), { getString: jest.fn(function () { return Promise.resolve('test-user'); }) });
+});
+// Re-import after mock so login.ts picks up the mocked getString.
+var utils_2 = require("@sasjs/utils");
+// Mock the three orchestration dependencies that authLogin delegates to.
+// We spy on the utils barrel (../../utils) which re-exports from auth.ts and
+// config.ts, so the spies are the same references login.ts resolves at runtime.
+jest.mock('../../../utils', function () { return (__assign(__assign({}, jest.requireActual('../../../utils')), { getTokensWithPasswordGrant: jest.fn(), fetchLoggedInUser: jest.fn(), saveTokens: jest.fn() })); });
+var viyaTarget = new utils_1.Target({
+    name: 'viya-test',
+    serverType: utils_1.ServerType.SasViya,
+    serverUrl: 'https://viya.example.com',
+    appLoc: '/Public/test',
+    contextName: 'test context'
+});
+var sas9Target = new utils_1.Target({
+    name: 'sas9-test',
+    serverType: utils_1.ServerType.Sas9,
+    serverUrl: 'https://sas9.example.com',
+    appLoc: '/Public/test',
+    contextName: 'test context'
+});
+describe('authLogin', function () {
+    beforeEach(function () {
+        process.logger = new utils_1.Logger(utils_1.LogLevel.Off);
+        jest.clearAllMocks();
+        utils_2.getString.mockResolvedValue('test-user');
+        prompts_1.default.mockResolvedValue({
+            pass: 'test-pass'
+        });
+        utilsModule.getTokensWithPasswordGrant.mockResolvedValue({
+            access_token: 'access-123',
+            refresh_token: 'refresh-456'
+        });
+        utilsModule.fetchLoggedInUser.mockResolvedValue({
+            id: 'sastest',
+            name: 'SAS Test User'
+        });
+        utilsModule.saveTokens.mockResolvedValue(undefined);
+        // Reset env vars and TTY between tests.
+        delete process.env.SAS_USERNAME;
+        delete process.env.SAS_PASSWORD;
+        // Default to TTY=true so interactive prompts are allowed unless a test
+        // explicitly overrides.
+        Object.defineProperty(process.stdin, 'isTTY', {
+            value: true,
+            configurable: true
+        });
+    });
+    afterAll(function () {
+        jest.restoreAllMocks();
+        delete process.env.SAS_USERNAME;
+        delete process.env.SAS_PASSWORD;
+        Object.defineProperty(process.stdin, 'isTTY', {
+            value: true,
+            configurable: true
+        });
+    });
+    // ---------------------------------------------------------------------------
+    // Guard 1: Non-Viya rejection
+    // ---------------------------------------------------------------------------
+    it('should reject when target.serverType is not SASVIYA', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, expect(authLoginModule.authLogin(sas9Target)).rejects.toThrow("'sasjs auth login' is only supported for SASVIYA targets.")];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 2: Missing serverUrl
+    // ---------------------------------------------------------------------------
+    it('should reject when target.serverUrl is missing/empty', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var noUrlTarget;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    noUrlTarget = new utils_1.Target({
+                        name: 'no-url',
+                        serverType: utils_1.ServerType.SasViya,
+                        serverUrl: '',
+                        appLoc: '/Public/test',
+                        contextName: 'test context'
+                    });
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(noUrlTarget)).rejects.toThrow("Target 'no-url' does not have a serverUrl configured.")];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 3: --insecure httpsAgentOptions mutation
+    // ---------------------------------------------------------------------------
+    it('should set rejectUnauthorized: false on target.httpsAgentOptions when insecure is true', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var callTarget;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, true)];
+                case 1:
+                    _a.sent();
+                    callTarget = utilsModule.getTokensWithPasswordGrant
+                        .mock.calls[0][0];
+                    expect(callTarget.httpsAgentOptions).toMatchObject({
+                        rejectUnauthorized: false,
+                        allowInsecureRequests: true
+                    });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 3b: insecure=false should NOT mutate httpsAgentOptions
+    // ---------------------------------------------------------------------------
+    it('should not mutate httpsAgentOptions when insecure is false', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var callTarget;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _b.sent();
+                    callTarget = utilsModule.getTokensWithPasswordGrant
+                        .mock.calls[0][0];
+                    // The original target has no rejectUnauthorized set at all.
+                    expect((_a = callTarget.httpsAgentOptions) === null || _a === void 0 ? void 0 : _a.rejectUnauthorized).not.toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 4: saveTokens called with correct args on successful login
+    // ---------------------------------------------------------------------------
+    it('should call saveTokens with the target name, access token, and refresh token after successful login', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    expect(utilsModule.saveTokens).toHaveBeenCalledTimes(1);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 4b: saveTokens should default refresh_token to '' when omitted
+    // ---------------------------------------------------------------------------
+    it('should call saveTokens with empty string refresh_token when the server omits it', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.getTokensWithPasswordGrant.mockResolvedValue({
+                        access_token: 'access-789',
+                        refresh_token: ''
+                    });
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-789', '');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 5: fetchLoggedInUser failure — tokens not saved, error propagated
+    // ---------------------------------------------------------------------------
+    it('should not save tokens and should propagate the error when fetchLoggedInUser fails', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.fetchLoggedInUser.mockRejectedValue(new Error('Unable to verify the access token'));
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow('Unable to verify the access token')];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Guard 6: getTokensWithPasswordGrant failure — tokens not saved, error propagated
+    // ---------------------------------------------------------------------------
+    it('should not save tokens and should propagate the error when getTokensWithPasswordGrant fails', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.getTokensWithPasswordGrant.mockRejectedValue(new Error('Login failed for user'));
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow('Login failed for user')];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    expect(utilsModule.fetchLoggedInUser).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Callback coverage: username validator rejects empty input
+    // ---------------------------------------------------------------------------
+    it('should pass a validator to getString that rejects empty usernames', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var validator;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    validator = utils_2.getString.mock.calls[0][1];
+                    expect(validator('')).toBe('Username is required.');
+                    expect(validator('someuser')).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Callback coverage: password prompt onCancel throws 'Input cancelled.'
+    // ---------------------------------------------------------------------------
+    it('should throw Input cancelled when the password prompt is cancelled', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    // Capture the onCancel handler from the prompts() call and invoke it
+                    // directly, simulating a user pressing Ctrl+C.
+                    ;
+                    prompts_1.default.mockImplementation(function (_config, opts) {
+                        opts.onCancel();
+                        return Promise.resolve({ pass: '' });
+                    });
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow('Input cancelled.')];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Branch coverage: id fallback in success log (id || 'unknown user')
+    // ---------------------------------------------------------------------------
+    it('should log "unknown user" when fetchLoggedInUser returns no id', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.fetchLoggedInUser.mockResolvedValue({
+                        id: '',
+                        name: 'Some Name'
+                    });
+                    // The function should still complete — the fallback is in the log message,
+                    // not a throw. We just verify saveTokens is still called.
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    // The function should still complete — the fallback is in the log message,
+                    // not a throw. We just verify saveTokens is still called.
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Branch coverage: name fallback in success log (name ? ` (${name})` : '')
+    // ---------------------------------------------------------------------------
+    it('should succeed when fetchLoggedInUser returns no name', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    utilsModule.fetchLoggedInUser.mockResolvedValue({
+                        id: 'sastest',
+                        name: undefined
+                    });
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ===========================================================================
+    // Non-interactive credential input paths (env vars, stdin, no-TTY fallback)
+    // ===========================================================================
+    // ---------------------------------------------------------------------------
+    // Env vars: SAS_USERNAME + SAS_PASSWORD skip both prompts
+    // ---------------------------------------------------------------------------
+    it('should use SAS_USERNAME and SAS_PASSWORD env vars without prompting', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'env-user';
+                    process.env.SAS_PASSWORD = 'env-pass';
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utils_2.getString).not.toHaveBeenCalled();
+                    expect(prompts_1.default).not.toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'env-user', 'env-pass');
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Env var username only — password still prompted interactively
+    // ---------------------------------------------------------------------------
+    it('should use SAS_USERNAME but prompt for password when only username env var is set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'env-user';
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utils_2.getString).not.toHaveBeenCalled();
+                    expect(prompts_1.default).toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'env-user', 'test-pass');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Env var password only — username still prompted interactively
+    // ---------------------------------------------------------------------------
+    it('should use SAS_PASSWORD but prompt for username when only password env var is set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    process.env.SAS_PASSWORD = 'env-pass';
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false)];
+                case 1:
+                    _a.sent();
+                    expect(utils_2.getString).toHaveBeenCalled();
+                    expect(prompts_1.default).not.toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'test-user', 'env-pass');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // --password-stdin reads password from stdin, username from env
+    // ---------------------------------------------------------------------------
+    it('should read password from stdin and username from SAS_USERNAME when --password-stdin is set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var stdinData, originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'stdin-user';
+                    stdinData = 'stdin-pa55\n';
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            var done = false;
+                            return {
+                                next: function () {
+                                    if (done)
+                                        return Promise.resolve({ done: true, value: undefined });
+                                    done = true;
+                                    return Promise.resolve({
+                                        done: false,
+                                        value: Buffer.from(stdinData)
+                                    });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false, true)];
+                case 2:
+                    _b.sent();
+                    expect(utils_2.getString).not.toHaveBeenCalled();
+                    expect(prompts_1.default).not.toHaveBeenCalled();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'stdin-user', 'stdin-pa55');
+                    expect(utilsModule.saveTokens).toHaveBeenCalledWith(viyaTarget.name, 'access-123', 'refresh-456');
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // --password-stdin with empty stdin throws a clear error
+    // ---------------------------------------------------------------------------
+    it('should throw when --password-stdin is set but stdin is empty', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'stdin-user';
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            return {
+                                next: function () {
+                                    return Promise.resolve({ done: true, value: undefined });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false, true)).rejects.toThrow(/no password was read from stdin/)];
+                case 2:
+                    _b.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    expect(utilsModule.saveTokens).not.toHaveBeenCalled();
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // --password-stdin without SAS_USERNAME throws (can't prompt interactively)
+    // ---------------------------------------------------------------------------
+    it('should throw when --password-stdin is set but SAS_USERNAME is not set', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            return {
+                                next: function () {
+                                    return Promise.resolve({ done: true, value: undefined });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false, true)).rejects.toThrow(/SAS_USERNAME/)];
+                case 2:
+                    _b.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // No TTY, no env vars, no --password-stdin → clear error for username
+    // ---------------------------------------------------------------------------
+    it('should throw a clear error when no TTY and no env vars are available (username)', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    Object.defineProperty(process.stdin, 'isTTY', {
+                        value: false,
+                        configurable: true
+                    });
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow(/A SAS username is required/)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // No TTY + SAS_USERNAME set but no password → clear error for password
+    // ---------------------------------------------------------------------------
+    it('should throw a clear error when SAS_USERNAME is set but no password source is available', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    Object.defineProperty(process.stdin, 'isTTY', {
+                        value: false,
+                        configurable: true
+                    });
+                    process.env.SAS_USERNAME = 'env-user';
+                    return [4 /*yield*/, expect(authLoginModule.authLogin(viyaTarget, false)).rejects.toThrow(/A SAS password is required/)];
+                case 1:
+                    _a.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    // ---------------------------------------------------------------------------
+    // Precedence: --password-stdin takes precedence over SAS_PASSWORD
+    // ---------------------------------------------------------------------------
+    it('should prefer --password-stdin over SAS_PASSWORD env var', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var stdinData, originalStdin, mockStdin;
+        var _a;
+        return __generator(this, function (_b) {
+            switch (_b.label) {
+                case 0:
+                    process.env.SAS_USERNAME = 'env-user';
+                    process.env.SAS_PASSWORD = 'env-pass';
+                    stdinData = 'stdin-pa55\n';
+                    originalStdin = process.stdin;
+                    mockStdin = (_a = {},
+                        _a[Symbol.asyncIterator] = function () {
+                            var done = false;
+                            return {
+                                next: function () {
+                                    if (done)
+                                        return Promise.resolve({ done: true, value: undefined });
+                                    done = true;
+                                    return Promise.resolve({
+                                        done: false,
+                                        value: Buffer.from(stdinData)
+                                    });
+                                }
+                            };
+                        },
+                        _a);
+                    Object.defineProperty(process, 'stdin', {
+                        value: mockStdin,
+                        configurable: true
+                    });
+                    _b.label = 1;
+                case 1:
+                    _b.trys.push([1, , 3, 4]);
+                    return [4 /*yield*/, authLoginModule.authLogin(viyaTarget, false, true)];
+                case 2:
+                    _b.sent();
+                    expect(utilsModule.getTokensWithPasswordGrant).toHaveBeenCalledWith(viyaTarget, 'env-user', 'stdin-pa55');
+                    return [3 /*break*/, 4];
+                case 3:
+                    Object.defineProperty(process, 'stdin', {
+                        value: originalStdin,
+                        configurable: true
+                    });
+                    return [7 /*endfinally*/];
+                case 4: return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/build/commands/deploy/internal/executeDeployScriptSasViya.js

@@ -73,7 +73,8 @@ function executeDeployScriptSasViya(deployScriptName, target, linesToExecute, lo
                             fileName: deployScriptName,
                             linesOfCode: linesToExecute,
                             contextName: contextName,
-                            authConfig: authConfig
+                            authConfig: authConfig,
+                            onTokensRefreshed: (0, config_1.persistTokensRefreshedByAdapter)(target)
                         })
                             .catch(function (err) {
                             process.logger.error('executeScriptSASViya Error', err);