@sasjs/cli 6.10.1 → 6.11.0

package/build/commands/build/internal/mockSite/assets/runtime-core.js

@@ -973,6 +973,16 @@ const resolveProgram = (program) => {
  */
 const SEEDED_HEADERS = 'content-type: text/html; charset=utf-8\n'
 
+/**
+ * The largest body a single upload may carry.
+ *
+ * A browser worker holds the whole payload in memory, so an oversized upload is
+ * an out-of-memory failure rather than a limit a client can act on. This is the
+ * same 10 MB a deploy allows for one file, and it is checked from the File's
+ * `size` before the body is read.
+ */
+const MAX_UPLOAD_BYTES = 10 * 1024 * 1024
+
 const runProgram = ({ program, code, params = {}, tables = [] }) => {
   const payloadCode = code
   const codePath = program ? resolveProgram(program) : null
@@ -1163,7 +1173,9 @@ const readDriveFile = (filePath) => {
     String(filePath).replace(/^\/+/, '')
   )
   if (!FILES.has(abs)) {
-    const err = new Error('File not found')
+    // the server's wording, because a client prints this: GET /drive/file
+    // answers `res.status(404).send(err.message)`
+    const err = new Error(`File doesn't exist.`)
     err.status = 404
     throw err
   }
@@ -1179,6 +1191,207 @@ const readDriveFile = (filePath) => {
 /** The stored base64 of a byte entry, once it is known to decode. */
 const validateEntry = (contents) => cleanedBase64(contents)
 
+// ------------------------------------------------------------- drive writes
+// The /drive endpoints answer the same contract sasjs/server serves, so a client
+// that uploads, renames or deletes needs no change for a mock build - only the
+// storage differs (a Map here, a folder on the server). Every mutation marks the
+// entry dirty, which is how the page learns to persist it: the worker can be
+// terminated between requests, so a write it did not hand back would live only
+// until the next reload.
+
+const DRIVE_FILES = () => `${DRIVE_ROOT}/files`
+
+const driveError = (status, message) => {
+  const error = new Error(message)
+  error.status = status
+  return error
+}
+
+/**
+ * A caller-supplied path as the absolute path under the drive root, or null when
+ * it lands outside - the rule sasjs/server applies in resolveWithinDrive. A
+ * leading slash means "under the drive root", never filesystem absolute, and the
+ * test is on the whole normalised path rather than a substring: `/drive/filesx`
+ * is not inside `/drive/files`.
+ */
+const drivePath = (unsafePath) => {
+  const root = DRIVE_FILES()
+  const normalised = String(
+    unsafePath === undefined || unsafePath === null ? '' : unsafePath
+  )
+    .replace(/\\/g, '/')
+    .replace(/^\/+/, '')
+  const resolved = P.resolve(root, normalised)
+  return resolved === root || resolved.startsWith(root + '/') ? resolved : null
+}
+
+/**
+ * Writes one entry: bytes stay bytes (behind the base64 marker the drive reads
+ * them back from), a string is text, and the entry is marked for persistence.
+ *
+ * An upload arrives as bytes and is stored as bytes, which is also what the
+ * server does: multer writes the request body to disk and `saveFile` moves that
+ * file, so an uploaded CSV is a byte file there too - a program reading it
+ * without an encoding gets a Buffer on both hosts, and with `'utf8'` a string.
+ * The difference a client actually sees is the content type a download is served
+ * with, and that is decided by the extension on the GET route, as `sendFile`
+ * does on the server.
+ */
+const storeEntry = (abs, data) => {
+  const bytes = asBytes(data)
+  FILES.set(
+    abs,
+    bytes
+      ? BINARY_PREFIX + bytesToBase64(bytes)
+      : encodeText(String(data === undefined || data === null ? '' : data))
+  )
+  SIZES.delete(abs)
+  markDirty(abs)
+}
+
+/**
+ * The ancestor of a path that is itself a file, if there is one. `mkdirp` would
+ * happily turn `/data/x.csv` into a folder to hold `/data/x.csv/child`, leaving a
+ * path that is a file and has children at the same time - a state the server
+ * never reaches, because the filesystem refuses it (ENOTDIR).
+ */
+const fileAncestorOf = (abs) => {
+  const parts = abs.split('/').filter(Boolean)
+  let acc = ''
+  for (const part of parts.slice(0, -1)) {
+    acc += '/' + part
+    if (FILES.has(acc)) return acc
+  }
+  return null
+}
+
+const saveDriveFile = (filePath, data) => {
+  const abs = drivePath(filePath)
+  if (!abs || abs === DRIVE_FILES())
+    throw driveError(400, `Can't put file outside drive.`)
+  // a folder at the same path would leave one path present as both, which the
+  // server fails at the filesystem (EISDIR) rather than reporting as a conflict
+  if (FILES.has(abs) || DIRS.has(abs))
+    throw driveError(409, 'File already exists.')
+  // the server fails this at the filesystem with ENOTDIR and answers a 500; a
+  // named refusal is more use to a client than reproducing that, so it is a 400
+  const ancestor = fileAncestorOf(abs)
+  if (ancestor)
+    // the drive-relative path, never the host's absolute one: a client has no
+    // business knowing where the drive lives
+    throw driveError(
+      400,
+      `An ancestor of the path is a file: ${ancestor.slice(DRIVE_FILES().length) || '/'}`
+    )
+  mkdirp(P.dirname(abs))
+  storeEntry(abs, data)
+  return { status: 'success' }
+}
+
+const updateDriveFile = (filePath, data) => {
+  const abs = drivePath(filePath)
+  if (!abs || abs === DRIVE_FILES())
+    throw driveError(400, `Can't modify file outside drive.`)
+  if (!FILES.has(abs)) throw driveError(404, `File doesn't exist.`)
+  storeEntry(abs, data)
+  return { status: 'success' }
+}
+
+const removeDriveFile = (filePath) => {
+  const abs = drivePath(filePath)
+  if (!abs || abs === DRIVE_FILES())
+    throw driveError(400, `Can't delete file outside drive.`)
+  if (!FILES.has(abs)) throw driveError(404, `File doesn't exist.`)
+  FILES.delete(abs)
+  SIZES.delete(abs)
+  markDirty(abs)
+  return { status: 'success' }
+}
+
+const addDriveFolder = (folderPath) => {
+  const abs = drivePath(folderPath)
+  if (!abs || abs === DRIVE_FILES())
+    throw driveError(400, `Can't put folder outside drive.`)
+  if (DIRS.has(abs) || FILES.has(abs))
+    throw driveError(409, 'Folder already exists.')
+  mkdirp(abs)
+  return { status: 'success' }
+}
+
+/**
+ * Deletes a folder and everything under it. The drive is a flat map of paths, so
+ * this is the entries' prefix rather than a directory walk - and each file it
+ * removes is marked dirty (as a deletion) so the page drops it from IndexedDB
+ * too. An empty folder is not represented in the persisted drive, which is a
+ * map of files; see the note on the docs page.
+ */
+const removeDriveFolder = (folderPath) => {
+  const abs = drivePath(folderPath)
+  if (!abs || abs === DRIVE_FILES())
+    throw driveError(400, `Can't delete folder outside drive.`)
+  if (!DIRS.has(abs)) throw driveError(404, `Folder doesn't exist.`)
+  const prefix = abs + '/'
+  for (const path of [...FILES.keys()]) {
+    if (!path.startsWith(prefix)) continue
+    FILES.delete(path)
+    SIZES.delete(path)
+    markDirty(path)
+  }
+  for (const dir of [...DIRS]) {
+    if (dir === abs || dir.startsWith(prefix)) DIRS.delete(dir)
+  }
+  return { status: 'success' }
+}
+
+/** Moves one stored file, leaving both paths for the page to persist. */
+const moveEntry = (from, to) => {
+  FILES.set(to, FILES.get(from))
+  FILES.delete(from)
+  SIZES.delete(from)
+  SIZES.delete(to)
+  markDirty(to)
+  markDirty(from)
+}
+
+const renameDriveEntry = (oldPath, newPath) => {
+  const from = drivePath(oldPath)
+  if (!from || from === DRIVE_FILES())
+    throw driveError(400, `Old path can't be outside of drive.`)
+  const to = drivePath(newPath)
+  if (!to || to === DRIVE_FILES())
+    throw driveError(400, `New path can't be outside of drive.`)
+
+  if (DIRS.has(from)) {
+    // the server fails this at the filesystem; naming it here says why
+    if (to.startsWith(from + '/'))
+      throw driveError(400, `New path can't be inside the folder being moved.`)
+    if (DIRS.has(to) || FILES.has(to))
+      throw driveError(409, 'Folder with new name already exists.')
+    const prefix = from + '/'
+    mkdirp(P.dirname(to))
+    for (const dir of [...DIRS]) {
+      if (dir === from || dir.startsWith(prefix)) {
+        DIRS.delete(dir)
+        mkdirp(to + dir.slice(from.length))
+      }
+    }
+    for (const path of [...FILES.keys()]) {
+      if (path.startsWith(prefix)) moveEntry(path, to + path.slice(from.length))
+    }
+    return { status: 'success' }
+  }
+
+  if (FILES.has(from)) {
+    if (FILES.has(to) || DIRS.has(to))
+      throw driveError(409, 'File with new name already exists.')
+    mkdirp(P.dirname(to))
+    moveEntry(from, to)
+    return { status: 'success' }
+  }
+
+  throw driveError(404, 'No file/folder found for provided path.')
+}
+
 const buildTree = () => {
   const walk = (dir) => {
     const node = {
@@ -1356,10 +1569,21 @@ const api = {
   run: (payload) => runProgram(payload),
   list: (folder) => listFolder(folder),
   read: (file) => readDriveFile(file),
+  // the write half of the drive API: each one answers the server's success body
+  // or throws an error carrying the server's status and message
+  save: (filePath, data) => saveDriveFile(filePath, data),
+  update: (filePath, data) => updateDriveFile(filePath, data),
+  remove: (filePath) => removeDriveFile(filePath),
+  mkdir: (folderPath) => addDriveFolder(folderPath),
+  rmdir: (folderPath) => removeDriveFolder(folderPath),
+  rename: (oldPath, newPath) => renameDriveEntry(oldPath, newPath),
   tree: () => buildTree(),
   // the content type a session's header file is seeded with, so the worker can
   // tell a default from a declaration rather than carrying a second literal
   HEADERS_SEED: SEEDED_HEADERS,
+  // the largest single upload the host accepts, so the worker can refuse a body
+  // before materialising it and the specs and docs read the same number
+  MAX_UPLOAD_BYTES: MAX_UPLOAD_BYTES,
   // the format the snapshot download stamps, so persist.js writes the number
   // this runtime reads rather than a second literal
   DRIVE_FORMAT

package/build/commands/build/internal/mockSite/assets/sw.js

@@ -11,12 +11,13 @@
  * receives the changed files back after every run.
  *
  * TRUST MODEL: this is a single-user, no-auth host. It answers every /SASjsApi/
- * path on the site's origin, runs whatever program the request names, and runs
- * the code a code/execute request carries - the same contract a SASjs server
- * offers, minus the server. Nothing here is a boundary: a page at this origin
- * can already do all of it, because a visitor's own browser is the client. So
- * a site holding anything private, or one served from a shared origin, belongs
- * behind a real server rather than a static host.
+ * path on the site's origin, writes to the drive when a drive request names a
+ * path, runs whatever program the request names, and runs the code a
+ * code/execute request carries - the same contract a SASjs server offers, minus
+ * the server. Nothing here is a boundary: a page at this origin can already do
+ * all of it, because a visitor's own browser is the client. So a site holding
+ * anything private, or one served from a shared origin, belongs behind a real
+ * server rather than a static host.
  */
 importScripts('/host/runtime-core.js')
 
@@ -173,6 +174,123 @@ const readPayload = async (request) => {
   return { params: body.params || {}, tables: body.tables || [], json: body }
 }
 
+// ---------------------------------------------------------------- requests
+/** A request body as JSON, and {} when it is not JSON - a client that posts a
+ * form where the route wants JSON gets the missing-field answer rather than a
+ * parse error. */
+const readJson = async (request) => {
+  try {
+    return (await request.json()) || {}
+  } catch (e) {
+    return {}
+  }
+}
+
+const badRequest = (message) => {
+  const error = new Error(message)
+  error.status = 400
+  return error
+}
+
+const payloadTooLarge = (limit) => {
+  const error = new Error(
+    `The upload is larger than the browser host allows (${Math.round(
+      limit / (1024 * 1024)
+    )} MB).`
+  )
+  error.status = 413
+  return error
+}
+
+/**
+ * The value a route needs, or the 400 the server answers with when it is absent.
+ * The message is Joi's, because that is what a client sees from the real API.
+ */
+const required = (value, name) => {
+  if (typeof value === 'string' && value.length) return value
+  throw badRequest(`"${name}" is required`)
+}
+
+/**
+ * sasjs/server refuses a file path with one of these extensions (filePathSchema
+ * in api/src/utils/validation.ts). Nothing is executable on a static host, but a
+ * client that would be refused on deploy should hear it here too.
+ */
+const BLOCKED_FILE = /\.(exe|sh|htaccess)$/i
+
+const fileTarget = (value, name) => {
+  const given = required(value, name)
+  if (BLOCKED_FILE.test(given)) throw badRequest('Invalid file extension')
+  return given
+}
+
+/** The bytes of an uploaded file, from the multipart field the API names. */
+const uploadBytes = async (request) => {
+  const form = await request.formData().catch(() => null)
+  const upload = form && form.get('file')
+  if (!upload || typeof upload === 'string')
+    throw badRequest('"file" is not present.')
+  // refused from the File's size, before the body is read: a worker holds the
+  // whole payload in memory, so an oversized upload there is an out-of-memory
+  // failure rather than an answer a client can act on
+  if (typeof upload.size === 'number' && upload.size > R.MAX_UPLOAD_BYTES)
+    throw payloadTooLarge(R.MAX_UPLOAD_BYTES)
+  const target = form.get('filePath')
+  return {
+    bytes: new Uint8Array(await upload.arrayBuffer()),
+    filePath: target === null ? undefined : target
+  }
+}
+
+/**
+ * The content type `sendFile` would answer with for this path - by extension,
+ * because that is what express does, and because a byte entry would otherwise be
+ * served as `application/octet-stream` however text-like it is.
+ */
+const CONTENT_TYPES = {
+  '.csv': 'text/csv',
+  '.json': 'application/json',
+  '.sas': 'text/plain',
+  '.txt': 'text/plain',
+  '.log': 'text/plain',
+  '.html': 'text/html',
+  '.htm': 'text/html',
+  '.js': 'text/javascript',
+  '.css': 'text/css',
+  '.zip': 'application/zip',
+  '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  '.xls': 'application/vnd.ms-excel',
+  '.pdf': 'application/pdf',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.svg': 'image/svg+xml'
+}
+
+const contentTypeFor = (filePath, binary) => {
+  const name = String(filePath || '').toLowerCase()
+  const dot = name.lastIndexOf('.')
+  const known = dot > 0 ? CONTENT_TYPES[name.slice(dot)] : undefined
+  if (known) return known
+  return binary ? 'application/octet-stream' : 'text/plain'
+}
+
+/**
+ * Runs one drive mutation and then hands the page the entries it changed. The
+ * worker can be terminated between requests, so a write is only durable once the
+ * page has put it in IndexedDB.
+ *
+ * Await it at the call site: a bare `return driveResponse(...)` hands the
+ * promise back through handle's try without running its catch, so a refused
+ * write would reach the page as an unhandled rejection instead of its status.
+ */
+const driveResponse = async (runner) => {
+  const result = runner()
+  await persistChanges()
+  return json(result)
+}
+
 const handle = async (request, url) => {
   const path = url.pathname.replace(/\/+$/, '')
   const query = {}
@@ -192,20 +310,77 @@ const handle = async (request, url) => {
     }
 
     if (path.endsWith('/SASjsApi/drive/folder')) {
-      return json(await R.list(query._folderPath || ''))
+      if (request.method === 'GET')
+        return json(await R.list(query._folderPath || ''))
+
+      if (request.method === 'POST') {
+        const body = await readJson(request)
+        return await driveResponse(() =>
+          R.mkdir(required(body.folderPath, 'folderPath'))
+        )
+      }
+
+      if (request.method === 'DELETE') {
+        // an empty path names the drive root, which the server refuses at
+        // validation rather than deleting everything
+        const folderPath = required(query._folderPath, '_folderPath')
+        return await driveResponse(() => R.rmdir(folderPath))
+      }
     }
 
     if (path.endsWith('/SASjsApi/drive/filetree')) {
       return json(R.tree())
     }
 
-    if (path.endsWith('/SASjsApi/drive/file') && request.method === 'GET') {
-      const file = R.read(query._filePath || '')
-      return file.binary
-        ? new Response(toBytes(file.contents), {
-            headers: { 'content-type': 'application/octet-stream' }
-          })
-        : text(file.contents)
+    if (path.endsWith('/SASjsApi/drive/rename')) {
+      if (request.method === 'POST') {
+        const body = await readJson(request)
+        // both ends go through the extension check: without it a file could be
+        // renamed into a blocked name and then be unreachable by DELETE and PATCH,
+        // which apply the same check to the path they are given
+        const oldPath = fileTarget(body.oldPath, 'oldPath')
+        const newPath = fileTarget(body.newPath, 'newPath')
+        return await driveResponse(() => R.rename(oldPath, newPath))
+      }
+    }
+
+    if (path.endsWith('/SASjsApi/drive/file')) {
+      if (request.method === 'GET') {
+        const file = R.read(query._filePath || '')
+        // the server answers this with `sendFile`, so the type comes from the
+        // extension: a .csv is text/csv whether it was uploaded as bytes or
+        // written by a service as text
+        return new Response(
+          file.binary ? toBytes(file.contents) : file.contents,
+          {
+            status: 200,
+            headers: {
+              'content-type': contentTypeFor(query._filePath, file.binary)
+            }
+          }
+        )
+      }
+
+      if (request.method === 'DELETE') {
+        const filePath = fileTarget(query._filePath, '_filePath')
+        return await driveResponse(() => R.remove(filePath))
+      }
+
+      // POST creates (409 when the path is taken) and PATCH replaces (404 when
+      // it is not there) - the split the server's routes make, so a client that
+      // keys on the status code behaves the same way
+      if (request.method === 'POST' || request.method === 'PATCH') {
+        const upload = await uploadBytes(request)
+        const filePath = fileTarget(
+          query._filePath || upload.filePath,
+          '_filePath'
+        )
+        return await driveResponse(() =>
+          request.method === 'PATCH'
+            ? R.update(filePath, upload.bytes)
+            : R.save(filePath, upload.bytes)
+        )
+      }
     }
 
     if (
@@ -252,6 +427,12 @@ const handle = async (request, url) => {
   } catch (e) {
     const message = (e && e.stack) || String(e)
     broadcast({ type: 'sasjs-host-error', path, message })
+    // A drive refusal is the message itself, in plain text: the server answers
+    // these with `res.status(code).send(err.message)`, and its own suite asserts
+    // `res.text`. The other routes answer JSON, because a program failure
+    // carries more than a message (`status`, `error`), so they keep the envelope.
+    if (path.includes('/SASjsApi/drive/') && e && e.status)
+      return text((e && e.message) || String(e), e.status)
     return json(
       { message: (e && e.message) || String(e) },
       (e && e.status) || 500

package/build/commands/build/internal/mockSite/spec/runtime-core.spec.js

@@ -949,4 +949,249 @@ describe('browser runtime', function () {
         var runtime = loadRuntime();
         expect(function () { return runtime.run({ program: 'services/public/missing' }); }).toThrow(/Program not found in drive/);
     });
+    describe('drive writes', function () {
+        // the write API speaks drive-relative paths, and the seed holds absolute
+        // ones, so both sides go through the same root here
+        var root = '/sasjs/drive/files';
+        var seededRuntime = function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        runtime = loadRuntime();
+                        return [4 /*yield*/, seedDrive(runtime, (_a = {},
+                                _a["".concat(root, "/data/keep.csv")] = 'a,b\n1,2\n',
+                                _a))
+                            // boot marks the whole drive dirty, so the page persists a complete
+                            // snapshot; clearing it here leaves each test with only its own writes
+                        ];
+                    case 1:
+                        _b.sent();
+                        // boot marks the whole drive dirty, so the page persists a complete
+                        // snapshot; clearing it here leaves each test with only its own writes
+                        runtime.takeDirty();
+                        return [2 /*return*/, runtime];
+                }
+            });
+        }); };
+        var status = function (fn) {
+            try {
+                fn();
+            }
+            catch (e) {
+                return e.status;
+            }
+            return 200;
+        };
+        it('creates a file, and the page is told to persist it', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _b.sent();
+                        expect(runtime.save('/data/new/deep/up.csv', 'x,y\n')).toEqual({
+                            status: 'success'
+                        });
+                        // the write is what the page receives after the request: a worker is
+                        // terminated between requests, so without this the upload is gone
+                        expect(runtime.takeDirty()).toEqual((_a = {},
+                            _a["".concat(root, "/data/new/deep/up.csv")] = 'x,y\n',
+                            _a));
+                        expect(runtime.read('/data/new/deep/up.csv')).toEqual({
+                            contents: 'x,y\n',
+                            binary: false
+                        });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('stores an upload as bytes, the way the server stores one', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        runtime.save('/data/pack.zip', Uint8Array.from([80, 75, 3, 4]));
+                        expect(runtime.read('/data/pack.zip')).toEqual({
+                            contents: 'UEsDBA==',
+                            binary: true
+                        });
+                        // and a service reading it gets a Buffer, as it does on the server
+                        expect(runtime.run({
+                            code: "_webout = typeof require('fs').readFileSync('".concat(root, "/data/pack.zip');")
+                        }).webout).toBe('object');
+                        expect(runtime.run({
+                            code: "_webout = require('fs').readFileSync('".concat(root, "/data/pack.zip', 'base64');")
+                        }).webout).toBe('UEsDBA==');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses to create a file over one that exists', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        expect(status(function () { return runtime.save('/data/keep.csv', 'x'); })).toBe(409);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('replaces a file, and refuses one that is not there', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        expect(runtime.update('/data/keep.csv', 'replaced')).toEqual({
+                            status: 'success'
+                        });
+                        expect(runtime.read('/data/keep.csv').contents).toBe('replaced');
+                        expect(status(function () { return runtime.update('/data/missing.csv', 'x'); })).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('deletes a file, and reports a deletion to the page', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _b.sent();
+                        expect(runtime.remove('/data/keep.csv')).toEqual({ status: 'success' });
+                        expect(runtime.takeDirty()).toEqual((_a = {},
+                            _a["".concat(root, "/data/keep.csv")] = null,
+                            _a));
+                        expect(status(function () { return runtime.read('/data/keep.csv'); })).toBe(404);
+                        expect(status(function () { return runtime.remove('/data/keep.csv'); })).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('creates a folder, and refuses one that already exists', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        expect(runtime.mkdir('/data/reports')).toEqual({ status: 'success' });
+                        expect(runtime.list('/data').folders).toContain('reports');
+                        expect(status(function () { return runtime.mkdir('/data/reports'); })).toBe(409);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('deletes a folder with everything under it', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime, cleared;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        runtime.mkdir('/data/reports');
+                        runtime.save('/data/reports/a.csv', 'a');
+                        runtime.save('/data/reports/nested/b.csv', 'b');
+                        expect(runtime.rmdir('/data/reports')).toEqual({ status: 'success' });
+                        expect(runtime.list('/data').folders).not.toContain('reports');
+                        expect(status(function () { return runtime.read('/data/reports/a.csv'); })).toBe(404);
+                        expect(status(function () { return runtime.read('/data/reports/nested/b.csv'); })).toBe(404);
+                        cleared = runtime.takeDirty();
+                        expect(cleared["".concat(root, "/data/reports/a.csv")]).toBeNull();
+                        expect(cleared["".concat(root, "/data/reports/nested/b.csv")]).toBeNull();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('renames a file, and moves a folder with its contents', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        runtime.mkdir('/data/reports');
+                        runtime.save('/data/reports/a.csv', 'a');
+                        expect(runtime.rename('/data/keep.csv', '/data/kept.csv')).toEqual({
+                            status: 'success'
+                        });
+                        expect(runtime.read('/data/kept.csv').contents).toBe('a,b\n1,2\n');
+                        expect(status(function () { return runtime.read('/data/keep.csv'); })).toBe(404);
+                        expect(runtime.rename('/data/reports', '/archive')).toEqual({
+                            status: 'success'
+                        });
+                        expect(runtime.read('/archive/a.csv').contents).toBe('a');
+                        expect(status(function () { return runtime.read('/data/reports/a.csv'); })).toBe(404);
+                        expect(runtime.list('/archive').files).toEqual(['a.csv']);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a rename onto something that exists', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        runtime.save('/data/other.csv', 'o');
+                        expect(status(function () { return runtime.rename('/data/keep.csv', '/data/other.csv'); })).toBe(409);
+                        expect(status(function () { return runtime.rename('/data/nope.csv', '/data/x.csv'); })).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses any path that lands outside the drive', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()
+                        // a leading slash is drive-relative, and '..' is resolved before the
+                        // containment test - the rule the server applies in resolveWithinDrive
+                    ];
+                    case 1:
+                        runtime = _a.sent();
+                        // a leading slash is drive-relative, and '..' is resolved before the
+                        // containment test - the rule the server applies in resolveWithinDrive
+                        expect(status(function () { return runtime.save('/../escape.csv', 'x'); })).toBe(400);
+                        expect(status(function () { return runtime.save('/data/../../escape.csv', 'x'); })).toBe(400);
+                        expect(status(function () { return runtime.remove('/../../etc/passwd'); })).toBe(400);
+                        expect(status(function () { return runtime.rename('/../x', '/data/y'); })).toBe(400);
+                        expect(status(function () { return runtime.rename('/data/keep.csv', '/../y'); })).toBe(400);
+                        // a file whose NAME starts with dots is not a traversal
+                        expect(runtime.save('/data/..weird.csv', 'x')).toEqual({
+                            status: 'success'
+                        });
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('keeps the bytes of an entry it moves', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var runtime;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, seededRuntime()];
+                    case 1:
+                        runtime = _a.sent();
+                        runtime.save('/data/pack.zip', Uint8Array.from([1, 2, 3]));
+                        runtime.rename('/data/pack.zip', '/data/moved.zip');
+                        expect(runtime.read('/data/moved.zip')).toEqual({
+                            contents: 'AQID',
+                            binary: true
+                        });
+                        expect(runtime.stats().files).toBe(2);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
 });

package/build/commands/build/internal/mockSite/spec/sw.spec.js

@@ -514,9 +514,9 @@ describe('service worker host', function () {
                     response = _b.sent();
                     expect(response.status).toBe(404);
                     _a = expect;
-                    return [4 /*yield*/, response.json()];
+                    return [4 /*yield*/, response.text()];
                 case 2:
-                    _a.apply(void 0, [(_b.sent()).message]).toBe('File not found');
+                    _a.apply(void 0, [_b.sent()]).toBe("File doesn't exist.");
                     return [2 /*return*/];
             }
         });
@@ -567,9 +567,9 @@ describe('service worker host', function () {
                     response = _c.sent();
                     expect(response.status).toBe(500);
                     _a = expect;
-                    return [4 /*yield*/, response.json()];
+                    return [4 /*yield*/, response.text()];
                 case 2:
-                    _a.apply(void 0, [(_c.sent()).message]).toContain('Corrupt binary entry');
+                    _a.apply(void 0, [_c.sent()]).toContain('Corrupt binary entry');
                     return [2 /*return*/];
             }
         });
@@ -799,4 +799,490 @@ describe('service worker host', function () {
         var dispatch = seeded().dispatch;
         expect(dispatch('/index.html')).toBeUndefined();
     });
+    describe('drive writes', function () {
+        /**
+         * The response as a client sees it. A drive refusal is plain text (the
+         * server sends `res.status(code).send(err.message)`), a success is JSON.
+         */
+        var answer = function (response) { return __awaiter(void 0, void 0, void 0, function () {
+            var resolved, type, _a;
+            var _b;
+            return __generator(this, function (_c) {
+                switch (_c.label) {
+                    case 0: return [4 /*yield*/, response];
+                    case 1:
+                        resolved = _c.sent();
+                        type = resolved.headers.get('content-type') || '';
+                        _b = {
+                            status: resolved.status
+                        };
+                        if (!type.includes('application/json')) return [3 /*break*/, 3];
+                        return [4 /*yield*/, resolved.json()];
+                    case 2:
+                        _a = _c.sent();
+                        return [3 /*break*/, 5];
+                    case 3: return [4 /*yield*/, resolved.text()];
+                    case 4:
+                        _a = _c.sent();
+                        _c.label = 5;
+                    case 5: return [2 /*return*/, (_b.body = _a,
+                            _b)];
+                }
+            });
+        }); };
+        it('answers a drive refusal as text, the way the server sends one', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, response, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/missing.csv'))
+                            // the server's drive routes answer `res.status(code).send(err.message)`,
+                            // and its own suite asserts `res.text` - so a client that reads the body
+                            // as text must get the message here too, not a JSON envelope
+                        ];
+                    case 1:
+                        response = _b.sent();
+                        // the server's drive routes answer `res.status(code).send(err.message)`,
+                        // and its own suite asserts `res.text` - so a client that reads the body
+                        // as text must get the message here too, not a JSON envelope
+                        expect(response.status).toBe(404);
+                        expect(response.headers.get('content-type')).toContain('text/plain');
+                        _a = expect;
+                        return [4 /*yield*/, response.text()];
+                    case 2:
+                        _a.apply(void 0, [_b.sent()]).toBe("File doesn't exist.");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('creates a file, which the drive then serves', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, created, read, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/users.csv'), (function () {
+                                var form = new FormData();
+                                form.set('file', new Blob(['id,name\n1,Ann\n']), 'users.csv');
+                                return { method: 'POST', body: form };
+                            })()))];
+                    case 1:
+                        created = _b.sent();
+                        expect(created).toEqual({ status: 200, body: { status: 'success' } });
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/users.csv'))];
+                    case 2:
+                        read = _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, read.text()];
+                    case 3:
+                        _a.apply(void 0, [_b.sent()]).toBe('id,name\n1,Ann\n');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('creates a file at the path in the form when the query has none', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, created, read, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['x']), 'x.txt');
+                        form.set('filePath', '/data/from-form.txt');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file', { method: 'POST', body: form }))];
+                    case 1:
+                        created = _b.sent();
+                        expect(created.body).toEqual({ status: 'success' });
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/from-form.txt'))];
+                    case 2:
+                        read = _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, read.text()];
+                    case 3:
+                        _a.apply(void 0, [_b.sent()]).toBe('x');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('answers 409 for a create over an existing file, 404 for a replace of a missing one', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, again, missing;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = function () {
+                            var f = new FormData();
+                            f.set('file', new Blob(['x']), 'x.csv');
+                            return f;
+                        };
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/x.csv'), { method: 'POST', body: form() })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/x.csv'), { method: 'POST', body: form() }))];
+                    case 2:
+                        again = _a.sent();
+                        expect(again.status).toBe(409);
+                        expect(again.body).toEqual('File already exists.');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/missing.csv'), { method: 'PATCH', body: form() }))];
+                    case 3:
+                        missing = _a.sent();
+                        expect(missing.status).toBe(404);
+                        expect(missing.body).toEqual("File doesn't exist.");
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('replaces a file and deletes one', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, replacement, replaced, read, _a, removed, gone;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['v1']), 'v.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/v.csv'), { method: 'POST', body: form })];
+                    case 1:
+                        _b.sent();
+                        replacement = new FormData();
+                        replacement.set('file', new Blob(['v2']), 'v.csv');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/v.csv'), { method: 'PATCH', body: replacement }))];
+                    case 2:
+                        replaced = _b.sent();
+                        expect(replaced.body).toEqual({ status: 'success' });
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/v.csv'))];
+                    case 3:
+                        read = _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, read.text()];
+                    case 4:
+                        _a.apply(void 0, [_b.sent()]).toBe('v2');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/v.csv'), { method: 'DELETE' }))];
+                    case 5:
+                        removed = _b.sent();
+                        expect(removed.body).toEqual({ status: 'success' });
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/v.csv'))];
+                    case 6:
+                        gone = _b.sent();
+                        expect(gone.status).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses an upload with no file, no path, or a blocked extension', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, empty, noFile, form, noPath, sh, blocked;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        empty = new FormData();
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/x.csv'), { method: 'POST', body: empty }))];
+                    case 1:
+                        noFile = _a.sent();
+                        expect(noFile.status).toBe(400);
+                        expect(noFile.body).toEqual('"file" is not present.');
+                        form = new FormData();
+                        form.set('file', new Blob(['x']), 'x.csv');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file', { method: 'POST', body: form }))];
+                    case 2:
+                        noPath = _a.sent();
+                        expect(noPath.status).toBe(400);
+                        expect(noPath.body).toEqual('"_filePath" is required');
+                        sh = new FormData();
+                        sh.set('file', new Blob(['x']), 'run.sh');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/run.sh'), { method: 'POST', body: sh }))];
+                    case 3:
+                        blocked = _a.sent();
+                        expect(blocked.status).toBe(400);
+                        expect(blocked.body).toEqual('Invalid file extension');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a path outside the drive on every write route', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, outside, rename;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['x']), 'x.csv');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/../escape.csv'), { method: 'POST', body: form }))];
+                    case 1:
+                        outside = _a.sent();
+                        expect(outside.status).toBe(400);
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/rename', {
+                                method: 'POST',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify({ oldPath: '/../x', newPath: '/data/y' })
+                            }))];
+                    case 2:
+                        rename = _a.sent();
+                        expect(rename.status).toBe(400);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('creates a folder, lists it, and deletes it with its contents', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, made, form, listed, _a, removed, gone;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/folder', {
+                                method: 'POST',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify({ folderPath: '/data/reports' })
+                            }))];
+                    case 1:
+                        made = _b.sent();
+                        expect(made.body).toEqual({ status: 'success' });
+                        form = new FormData();
+                        form.set('file', new Blob(['a']), 'a.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/reports/a.csv'), { method: 'POST', body: form })];
+                    case 2:
+                        _b.sent();
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/folder?_folderPath=' + encodeURIComponent('/data'))];
+                    case 3:
+                        listed = _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, listed.json()];
+                    case 4:
+                        _a.apply(void 0, [_b.sent()]).toEqual({
+                            files: [],
+                            folders: ['reports']
+                        });
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/folder?_folderPath=' +
+                                encodeURIComponent('/data/reports'), { method: 'DELETE' }))];
+                    case 5:
+                        removed = _b.sent();
+                        expect(removed.body).toEqual({ status: 'success' });
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/reports/a.csv'))];
+                    case 6:
+                        gone = _b.sent();
+                        expect(gone.status).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a folder delete with no path', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, removed;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/folder', { method: 'DELETE' }))];
+                    case 1:
+                        removed = _a.sent();
+                        expect(removed.status).toBe(400);
+                        expect(removed.body).toEqual('"_folderPath" is required');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a rename that would produce a blocked extension', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, toBlocked, fromBlocked;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['r']), 'r.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/old.csv'), { method: 'POST', body: form })];
+                    case 1:
+                        _a.sent();
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/rename', {
+                                method: 'POST',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify({
+                                    oldPath: '/data/old.csv',
+                                    newPath: '/data/x.sh'
+                                })
+                            }))
+                            // DELETE and PATCH run the same check on the path they are given, so a file
+                            // renamed into a blocked name could not be removed or replaced afterwards
+                        ];
+                    case 2:
+                        toBlocked = _a.sent();
+                        // DELETE and PATCH run the same check on the path they are given, so a file
+                        // renamed into a blocked name could not be removed or replaced afterwards
+                        expect(toBlocked.status).toBe(400);
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/rename', {
+                                method: 'POST',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify({
+                                    oldPath: '/data/x.sh',
+                                    newPath: '/data/new.csv'
+                                })
+                            }))];
+                    case 3:
+                        fromBlocked = _a.sent();
+                        expect(fromBlocked.status).toBe(400);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a file where a folder already holds the path', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, atFolder;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/folder', {
+                                method: 'POST',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify({ folderPath: '/data/reports' })
+                            })];
+                    case 1:
+                        _a.sent();
+                        form = new FormData();
+                        form.set('file', new Blob(['r']), 'r.csv');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/reports'), { method: 'POST', body: form }))
+                            // the server fails this at the filesystem (EISDIR); naming it as a conflict
+                            // keeps the drive from holding one path as both a file and a folder
+                        ];
+                    case 2:
+                        atFolder = _a.sent();
+                        // the server fails this at the filesystem (EISDIR); naming it as a conflict
+                        // keeps the drive from holding one path as both a file and a folder
+                        expect(atFolder.status).toBe(409);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses a file under a path that is already a file', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, child, under, stillAFile, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['a']), 'a.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/a.csv'), { method: 'POST', body: form })];
+                    case 1:
+                        _b.sent();
+                        child = new FormData();
+                        child.set('file', new Blob(['b']), 'b.csv');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/a.csv/child.csv'), { method: 'POST', body: child }))
+                            // mkdirp would otherwise turn the file into a folder to hold the child
+                        ];
+                    case 2:
+                        under = _b.sent();
+                        // mkdirp would otherwise turn the file into a folder to hold the child
+                        expect(under.status).toBe(400);
+                        expect(under.body).toBe('An ancestor of the path is a file: /data/a.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/a.csv'))];
+                    case 3:
+                        stillAFile = _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, stillAFile.text()];
+                    case 4:
+                        _a.apply(void 0, [_b.sent()]).toBe('a');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('serves a download with the type its extension implies', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, csv, _a, sas, program;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['id,name\n1,Ann\n']), 'users.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/users.csv'), { method: 'POST', body: form })];
+                    case 1:
+                        _b.sent();
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/users.csv'))
+                            // an upload is stored as bytes, as multer leaves it on the server; the
+                            // extension is what makes it answer text/csv rather than octet-stream
+                        ];
+                    case 2:
+                        csv = _b.sent();
+                        // an upload is stored as bytes, as multer leaves it on the server; the
+                        // extension is what makes it answer text/csv rather than octet-stream
+                        expect(csv.headers.get('content-type')).toBe('text/csv');
+                        _a = expect;
+                        return [4 /*yield*/, csv.text()];
+                    case 3:
+                        _a.apply(void 0, [_b.sent()]).toBe('id,name\n1,Ann\n');
+                        sas = new FormData();
+                        sas.set('file', new Blob(['data _null_; run;']), 'p.sas');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/p.sas'), { method: 'POST', body: sas })];
+                    case 4:
+                        _b.sent();
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/p.sas'))];
+                    case 5:
+                        program = _b.sent();
+                        expect(program.headers.get('content-type')).toBe('text/plain');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('refuses an upload larger than the host allows, before reading it', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, runtime, form, response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        runtime = loadWorker().runtime;
+                        form = new FormData();
+                        form.set('file', new Blob([new Uint8Array(runtime.MAX_UPLOAD_BYTES + 1)]), 'big.bin');
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/file?_filePath=' +
+                                encodeURIComponent('/data/big.bin'), { method: 'POST', body: form }))];
+                    case 1:
+                        response = _a.sent();
+                        expect(response.status).toBe(413);
+                        expect(response.body).toContain('larger than the browser host allows');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('renames a file through the route the API documents', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var dispatch, form, renamed, read, _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        dispatch = seeded().dispatch;
+                        form = new FormData();
+                        form.set('file', new Blob(['r']), 'r.csv');
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/old.csv'), { method: 'POST', body: form })];
+                    case 1:
+                        _b.sent();
+                        return [4 /*yield*/, answer(dispatch('/SASjsApi/drive/rename', {
+                                method: 'POST',
+                                headers: { 'content-type': 'application/json' },
+                                body: JSON.stringify({
+                                    oldPath: '/data/old.csv',
+                                    newPath: '/data/new.csv'
+                                })
+                            }))];
+                    case 2:
+                        renamed = _b.sent();
+                        expect(renamed.body).toEqual({ status: 'success' });
+                        return [4 /*yield*/, dispatch('/SASjsApi/drive/file?_filePath=' + encodeURIComponent('/data/new.csv'))];
+                    case 3:
+                        read = _b.sent();
+                        _a = expect;
+                        return [4 /*yield*/, read.text()];
+                    case 4:
+                        _a.apply(void 0, [_b.sent()]).toBe('r');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
 });

package/package.json

@@ -123,5 +123,5 @@
     "ws": "8.21.0",
     "nanoid": "3.3.18"
   },
-  "version": "6.10.1"
+  "version": "6.11.0"
 }