@sasjs/cli 6.2.7 → 6.3.0

package/build/commands/auth/authCommand.js

@@ -68,15 +68,17 @@ var syntax = 'auth [subCommand] [options]';
 var usage = 'sasjs auth login --target <target-name> | sasjs auth [options]';
 var description = "Authenticates against the specified target.\n" +
     "With the 'login' subCommand, authentication is performed with a SAS username and password " +
-    "(no OAuth client/secret required, SASVIYA targets only) and the resulting tokens are saved.\n" +
+    "(no OAuth client/secret required) and the resulting tokens are saved. " +
+    "Supported on SASVIYA targets, and on SASJS targets, where the server's own local login is used.\n" +
     "Without a subCommand, behaves like 'sasjs add cred' (client/secret based authentication).\n" +
     "\n" +
     "Non-interactive use (CI/agents): set SAS_USERNAME and SAS_PASSWORD environment variables, " +
-    "or pipe the password and use --password-stdin.";
+    "or pipe the password and use --password-stdin. On a SASJS target, set SASJS_CLIENT to the " +
+    "registered client id when the account is not an administrator.";
 var examples = [
     {
         command: 'sasjs auth login --target <target-name>',
-        description: 'Logs in with SAS username/password (no client/secret required).'
+        description: 'Logs in with SAS username/password (no client/secret required) on a SASVIYA or SASJS target.'
     },
     {
         command: 'sasjs auth login -t <target-name>',

package/build/commands/auth/login.d.ts

@@ -1,11 +1,17 @@
 import { Target } from '@sasjs/utils';
 /**
- * Authenticates against a SASVIYA target using a SAS username and password
- * (OAuth2 resource owner password grant against the built-in, secret-less
- * `sas.cli` client) and persists the resulting token pair. This enables all
+ * Authenticates against a SASVIYA or SASJS target using a SAS username and
+ * password, and persists the resulting token pair. This enables all
  * authenticated commands (`sasjs run`, `sasjs deploy`, etc.) on estates where
  * no administrator-registered OAuth client/secret is available.
  *
+ * The two server types issue tokens differently: SASVIYA uses the OAuth2
+ * resource owner password grant against the built-in, secret-less `sas.cli`
+ * client, while SASJS has no password grant and is authenticated through the
+ * server's own local login (@see getTokensWithSasjsLogin). Everything else -
+ * how the credentials are obtained, and the rule that nothing is prompted for
+ * when there is no TTY - is shared by both.
+ *
  * Credentials are resolved in this order (highest precedence first):
  *
  *   Username:  SAS_USERNAME env var  >  interactive prompt (TTY only)

package/build/commands/auth/login.js

@@ -139,12 +139,18 @@ var readPasswordFromStdin = function () { return __awaiter(void 0, void 0, void
     });
 }); };
 /**
- * Authenticates against a SASVIYA target using a SAS username and password
- * (OAuth2 resource owner password grant against the built-in, secret-less
- * `sas.cli` client) and persists the resulting token pair. This enables all
+ * Authenticates against a SASVIYA or SASJS target using a SAS username and
+ * password, and persists the resulting token pair. This enables all
  * authenticated commands (`sasjs run`, `sasjs deploy`, etc.) on estates where
  * no administrator-registered OAuth client/secret is available.
  *
+ * The two server types issue tokens differently: SASVIYA uses the OAuth2
+ * resource owner password grant against the built-in, secret-less `sas.cli`
+ * client, while SASJS has no password grant and is authenticated through the
+ * server's own local login (@see getTokensWithSasjsLogin). Everything else -
+ * how the credentials are obtained, and the rule that nothing is prompted for
+ * when there is no TTY - is shared by both.
+ *
  * Credentials are resolved in this order (highest precedence first):
  *
  *   Username:  SAS_USERNAME env var  >  interactive prompt (TTY only)
@@ -175,15 +181,16 @@ var authLogin = function (target_1) {
         args_1[_i - 1] = arguments[_i];
     }
     return __awaiter(void 0, __spreadArray([target_1], __read(args_1), false), void 0, function (target, insecure, passwordStdin) {
-        var isTty, envUser, envPass, user, hint, pass, promptedPass, _a, access_token, refresh_token, _b, id, name;
-        var _c, _d, _e;
+        var isTty, envUser, envPass, user, hint, pass, promptedPass, _a, access_token_1, refresh_token_1, client, displayName, _b, access_token, refresh_token, _c, id, name;
+        var _d, _e, _f, _g, _h;
         if (insecure === void 0) { insecure = false; }
         if (passwordStdin === void 0) { passwordStdin = false; }
-        return __generator(this, function (_f) {
-            switch (_f.label) {
+        return __generator(this, function (_j) {
+            switch (_j.label) {
                 case 0:
-                    if (target.serverType !== utils_1.ServerType.SasViya) {
-                        throw new Error("'sasjs auth login' is only supported for SASVIYA targets. " +
+                    if (target.serverType !== utils_1.ServerType.SasViya &&
+                        target.serverType !== utils_1.ServerType.Sasjs) {
+                        throw new Error("'sasjs auth login' is supported for SASVIYA and SASJS targets. " +
                             "Target '".concat(target.name, "' is of type '").concat(target.serverType, "'. ") +
                             "Use 'sasjs add cred -t ".concat(target.name, "' instead."));
                     }
@@ -192,7 +199,7 @@ var authLogin = function (target_1) {
                     }
                     if (insecure) {
                         target = new utils_1.Target(__assign(__assign({}, target.toJson(false)), { httpsAgentOptions: __assign(__assign({}, target.httpsAgentOptions), { allowInsecureRequests: true, rejectUnauthorized: false }) }));
-                        (_c = process.logger) === null || _c === void 0 ? void 0 : _c.warn('Executing with insecure connection.');
+                        (_d = process.logger) === null || _d === void 0 ? void 0 : _d.warn('Executing with insecure connection.');
                     }
                     isTty = !!process.stdin.isTTY;
                     envUser = process.env.SAS_USERNAME;
@@ -204,7 +211,7 @@ var authLogin = function (target_1) {
                     if (!(isTty && !passwordStdin)) return [3 /*break*/, 3];
                     return [4 /*yield*/, (0, utils_1.getString)('Please enter your SAS username', function (v) { return !!v || 'Username is required.'; })];
                 case 2:
-                    user = _f.sent();
+                    user = _j.sent();
                     return [3 /*break*/, 4];
                 case 3:
                     hint = passwordStdin
@@ -215,7 +222,7 @@ var authLogin = function (target_1) {
                     if (!passwordStdin) return [3 /*break*/, 6];
                     return [4 /*yield*/, readPasswordFromStdin()];
                 case 5:
-                    pass = _f.sent();
+                    pass = _j.sent();
                     if (!pass) {
                         throw new Error("--password-stdin was specified but no password was read from stdin. " +
                             "Pipe the password, e.g. echo \"$SAS_PASSWORD\" | sasjs auth login --password-stdin -t ".concat(target.name, "."));
@@ -237,23 +244,35 @@ var authLogin = function (target_1) {
                             }
                         })];
                 case 8:
-                    promptedPass = (_f.sent()).pass;
+                    promptedPass = (_j.sent()).pass;
                     pass = promptedPass;
                     return [3 /*break*/, 10];
                 case 9: throw new Error("A SAS password is required but was not provided. " +
                     "Set the SAS_PASSWORD environment variable, or pipe the password and use --password-stdin " +
                     "(e.g. echo \"$SAS_PASSWORD\" | sasjs auth login --password-stdin -t ".concat(target.name, ")."));
-                case 10: return [4 /*yield*/, (0, utils_2.getTokensWithPasswordGrant)(target, user, pass)];
+                case 10:
+                    if (!(target.serverType === utils_1.ServerType.Sasjs)) return [3 /*break*/, 13];
+                    return [4 /*yield*/, (0, utils_2.getTokensWithSasjsLogin)(target, user, pass, process.env.SASJS_CLIENT)];
                 case 11:
-                    _a = _f.sent(), access_token = _a.access_token, refresh_token = _a.refresh_token;
-                    return [4 /*yield*/, (0, utils_2.fetchLoggedInUser)(target, access_token)];
+                    _a = _j.sent(), access_token_1 = _a.access_token, refresh_token_1 = _a.refresh_token, client = _a.client, displayName = _a.displayName;
+                    return [4 /*yield*/, (0, utils_2.saveTokens)(target.name, access_token_1, refresh_token_1, client)];
                 case 12:
-                    _b = _f.sent(), id = _b.id, name = _b.name;
+                    _j.sent();
+                    (_e = process.logger) === null || _e === void 0 ? void 0 : _e.success("Logged in as ".concat(displayName || user, " on ").concat(target.serverUrl, "."));
+                    (_f = process.logger) === null || _f === void 0 ? void 0 : _f.info("The access token is valid for the duration configured on the server " +
+                        "(24 hours by default). When it expires, re-run 'sasjs auth login -t ".concat(target.name, "'."));
+                    return [2 /*return*/];
+                case 13: return [4 /*yield*/, (0, utils_2.getTokensWithPasswordGrant)(target, user, pass)];
+                case 14:
+                    _b = _j.sent(), access_token = _b.access_token, refresh_token = _b.refresh_token;
+                    return [4 /*yield*/, (0, utils_2.fetchLoggedInUser)(target, access_token)];
+                case 15:
+                    _c = _j.sent(), id = _c.id, name = _c.name;
                     return [4 /*yield*/, (0, utils_2.saveTokens)(target.name, access_token, refresh_token || '')];
-                case 13:
-                    _f.sent();
-                    (_d = process.logger) === null || _d === void 0 ? void 0 : _d.success("Logged in as ".concat(id || 'unknown user').concat(name ? " (".concat(name, ")") : '', " on ").concat(target.serverUrl, "."));
-                    (_e = process.logger) === null || _e === void 0 ? void 0 : _e.info("The access token is valid for the duration configured on the server (12 hours by default). " +
+                case 16:
+                    _j.sent();
+                    (_g = process.logger) === null || _g === void 0 ? void 0 : _g.success("Logged in as ".concat(id || 'unknown user').concat(name ? " (".concat(name, ")") : '', " on ").concat(target.serverUrl, "."));
+                    (_h = process.logger) === null || _h === void 0 ? void 0 : _h.info("The access token is valid for the duration configured on the server (12 hours by default). " +
                         "When it expires, re-run 'sasjs auth login -t ".concat(target.name, "'."));
                     return [2 /*return*/];
             }

package/build/commands/auth/spec/login.spec.js

@@ -103,7 +103,7 @@ var utils_2 = require("@sasjs/utils");
 // Mock the three orchestration dependencies that authLogin delegates to.
 // We spy on the utils barrel (../../utils) which re-exports from auth.ts and
 // config.ts, so the spies are the same references login.ts resolves at runtime.
-jest.mock('../../../utils', function () { return (__assign(__assign({}, jest.requireActual('../../../utils')), { getTokensWithPasswordGrant: jest.fn(), fetchLoggedInUser: jest.fn(), saveTokens: jest.fn() })); });
+jest.mock('../../../utils', function () { return (__assign(__assign({}, jest.requireActual('../../../utils')), { getTokensWithPasswordGrant: jest.fn(), getTokensWithSasjsLogin: jest.fn(), fetchLoggedInUser: jest.fn(), saveTokens: jest.fn() })); });
 var viyaTarget = new utils_1.Target({
     name: 'viya-test',
     serverType: utils_1.ServerType.SasViya,
@@ -111,6 +111,12 @@ var viyaTarget = new utils_1.Target({
     appLoc: '/Public/test',
     contextName: 'test context'
 });
+var sasjsTarget = new utils_1.Target({
+    name: 'sasjs-test',
+    serverType: utils_1.ServerType.Sasjs,
+    serverUrl: 'https://sasjs.example.com',
+    appLoc: '/Public/app'
+});
 var sas9Target = new utils_1.Target({
     name: 'sas9-test',
     serverType: utils_1.ServerType.Sas9,
@@ -157,10 +163,10 @@ describe('authLogin', function () {
     // ---------------------------------------------------------------------------
     // Guard 1: Non-Viya rejection
     // ---------------------------------------------------------------------------
-    it('should reject when target.serverType is not SASVIYA', function () { return __awaiter(void 0, void 0, void 0, function () {
+    it('should reject when target.serverType is SAS9', function () { return __awaiter(void 0, void 0, void 0, function () {
         return __generator(this, function (_a) {
             switch (_a.label) {
-                case 0: return [4 /*yield*/, expect(authLoginModule.authLogin(sas9Target)).rejects.toThrow("'sasjs auth login' is only supported for SASVIYA targets.")];
+                case 0: return [4 /*yield*/, expect(authLoginModule.authLogin(sas9Target)).rejects.toThrow("'sasjs auth login' is supported for SASVIYA and SASJS targets.")];
                 case 1:
                     _a.sent();
                     expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
@@ -672,4 +678,98 @@ describe('authLogin', function () {
             }
         });
     }); });
+    // ---------------------------------------------------------------------------
+    // SASJS: local login against a SASjs Server target
+    // ---------------------------------------------------------------------------
+    describe('SASJS target', function () {
+        beforeEach(function () {
+            delete process.env.SASJS_CLIENT;
+            utilsModule.getTokensWithSasjsLogin.mockResolvedValue({
+                access_token: 'sasjs-access',
+                refresh_token: 'sasjs-refresh',
+                client: 'client-id-1',
+                displayName: 'SASJS Test User'
+            });
+        });
+        afterEach(function () {
+            delete process.env.SASJS_CLIENT;
+        });
+        it('should mint tokens with the SASJS login flow instead of the password grant', function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, authLoginModule.authLogin(sasjsTarget)];
+                    case 1:
+                        _a.sent();
+                        expect(utilsModule.getTokensWithPasswordGrant).not.toHaveBeenCalled();
+                        expect(utilsModule.getTokensWithSasjsLogin).toHaveBeenCalledWith(expect.objectContaining({ name: 'sasjs-test' }), 'test-user', 'test-pass', undefined);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should persist the client alongside the tokens', function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, authLoginModule.authLogin(sasjsTarget)];
+                    case 1:
+                        _a.sent();
+                        expect(utilsModule.saveTokens).toHaveBeenCalledWith('sasjs-test', 'sasjs-access', 'sasjs-refresh', 'client-id-1');
+                        expect(utilsModule.fetchLoggedInUser).not.toHaveBeenCalled();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should pass SASJS_CLIENT through so CI can pin the client', function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        process.env.SASJS_CLIENT = 'pinned-client';
+                        return [4 /*yield*/, authLoginModule.authLogin(sasjsTarget)];
+                    case 1:
+                        _a.sent();
+                        expect(utilsModule.getTokensWithSasjsLogin).toHaveBeenCalledWith(expect.objectContaining({ name: 'sasjs-test' }), 'test-user', 'test-pass', 'pinned-client');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should authenticate from env vars with no TTY, as CI would', function () { return __awaiter(void 0, void 0, void 0, function () {
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        process.env.SAS_USERNAME = 'ci-user';
+                        process.env.SAS_PASSWORD = 'ci-pass';
+                        Object.defineProperty(process.stdin, 'isTTY', {
+                            value: false,
+                            configurable: true
+                        });
+                        return [4 /*yield*/, authLoginModule.authLogin(sasjsTarget)];
+                    case 1:
+                        _a.sent();
+                        expect(utilsModule.getTokensWithSasjsLogin).toHaveBeenCalledWith(expect.objectContaining({ name: 'sasjs-test' }), 'ci-user', 'ci-pass', undefined);
+                        expect(utils_2.getString).not.toHaveBeenCalled();
+                        expect(prompts_1.default).not.toHaveBeenCalled();
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('should fall back to the username when the server reports no display name', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var success;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        ;
+                        utilsModule.getTokensWithSasjsLogin.mockResolvedValue({
+                            access_token: 'sasjs-access',
+                            refresh_token: 'sasjs-refresh',
+                            client: 'client-id-1'
+                        });
+                        success = jest.spyOn(process.logger, 'success');
+                        return [4 /*yield*/, authLoginModule.authLogin(sasjsTarget)];
+                    case 1:
+                        _a.sent();
+                        expect(success).toHaveBeenCalledWith(expect.stringContaining('Logged in as test-user on'));
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
 });

package/build/utils/auth.d.ts

@@ -59,3 +59,33 @@ export declare function getNewAccessToken(sasjsInstance: SASjs, clientId: string
     access_token: string;
     refresh_token: string;
 }>;
+/**
+ * Mints a token pair from the local login of a SASjs Server target.
+ *
+ * SASjs Server has no secret-less OAuth client and no password grant: the
+ * tokens it issues come from its own sign-in flow, the one its web app uses.
+ * Reproducing that flow here is what makes `sasjs auth login` usable on a SASjs
+ * target from CI, where there is no browser to visit /SASjsLogon and no
+ * administrator-registered client secret to fall back on:
+ *
+ *   GET  /                     sets the XSRF-TOKEN cookie
+ *   POST /SASLogon/login       creates the session
+ *   POST /SASLogon/authorize   returns a single-use authorization code
+ *   POST /SASjsApi/auth/token  exchanges it for an access/refresh pair
+ *
+ * @param {Target} target - the SASJS target to authenticate against.
+ * @param {string} user - the SASjs Server username.
+ * @param {string} pass - the SASjs Server password.
+ * @param {string} [clientId] - the registered client to authorize, usually from
+ *   the SASJS_CLIENT environment variable. When absent, the target's configured
+ *   client is used, and failing that the first registered client if the account
+ *   is an administrator.
+ * @returns the token pair, the client that was authorized, and the display name
+ *   the server reports for the user.
+ */
+export declare function getTokensWithSasjsLogin(target: Target, user: string, pass: string, clientId?: string): Promise<{
+    access_token: string;
+    refresh_token: string;
+    client: string;
+    displayName?: string;
+}>;

package/build/utils/auth.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -35,6 +68,34 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SAS_CLI_CLIENT_ID = exports.getAuthUrl = void 0;
 exports.getAuthCode = getAuthCode;
@@ -42,6 +103,9 @@ exports.refreshTokens = refreshTokens;
 exports.getTokensWithPasswordGrant = getTokensWithPasswordGrant;
 exports.fetchLoggedInUser = fetchLoggedInUser;
 exports.getNewAccessToken = getNewAccessToken;
+exports.getTokensWithSasjsLogin = getTokensWithSasjsLogin;
+var axios_1 = __importDefault(require("axios"));
+var https = __importStar(require("https"));
 var utils_1 = require("@sasjs/utils");
 var node_1 = require("@sasjs/adapter/node");
 /**
@@ -217,3 +281,169 @@ function getNewAccessToken(sasjsInstance, clientId, clientSecret, target) {
         });
     });
 }
+/**
+ * Mints a token pair from the local login of a SASjs Server target.
+ *
+ * SASjs Server has no secret-less OAuth client and no password grant: the
+ * tokens it issues come from its own sign-in flow, the one its web app uses.
+ * Reproducing that flow here is what makes `sasjs auth login` usable on a SASjs
+ * target from CI, where there is no browser to visit /SASjsLogon and no
+ * administrator-registered client secret to fall back on:
+ *
+ *   GET  /                     sets the XSRF-TOKEN cookie
+ *   POST /SASLogon/login       creates the session
+ *   POST /SASLogon/authorize   returns a single-use authorization code
+ *   POST /SASjsApi/auth/token  exchanges it for an access/refresh pair
+ *
+ * @param {Target} target - the SASJS target to authenticate against.
+ * @param {string} user - the SASjs Server username.
+ * @param {string} pass - the SASjs Server password.
+ * @param {string} [clientId] - the registered client to authorize, usually from
+ *   the SASJS_CLIENT environment variable. When absent, the target's configured
+ *   client is used, and failing that the first registered client if the account
+ *   is an administrator.
+ * @returns the token pair, the client that was authorized, and the display name
+ *   the server reports for the user.
+ */
+function getTokensWithSasjsLogin(target, user, pass, clientId) {
+    return __awaiter(this, void 0, void 0, function () {
+        var baseUrl, cookies, safeDecode, collectCookies, instance, call, fail, login, client, clients, authorized, code, tokens;
+        var _this = this;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        return __generator(this, function (_k) {
+            switch (_k.label) {
+                case 0:
+                    baseUrl = target.serverUrl.replace(/\/+$/, '');
+                    cookies = new Map();
+                    safeDecode = function (value) {
+                        try {
+                            return decodeURIComponent(value);
+                        }
+                        catch (_a) {
+                            return value;
+                        }
+                    };
+                    collectCookies = function (setCookie) {
+                        var entries = Array.isArray(setCookie)
+                            ? setCookie
+                            : setCookie
+                                ? [setCookie]
+                                : [];
+                        entries.forEach(function (entry) {
+                            var pair = entry.split(';')[0];
+                            var index = pair.indexOf('=');
+                            if (index > 0) {
+                                cookies.set(pair.slice(0, index).trim(), pair.slice(index + 1).trim());
+                            }
+                        });
+                    };
+                    instance = axios_1.default.create({
+                        baseURL: baseUrl,
+                        validateStatus: function () { return true; },
+                        // The login request carries the password in a body, so a redirect must not
+                        // replay it to wherever 'Location' points. A redirect is a configuration
+                        // problem (proxy, SSO front end) - report it instead of following it.
+                        maxRedirects: 0,
+                        httpsAgent: target.httpsAgentOptions
+                            ? new https.Agent(target.httpsAgentOptions)
+                            : undefined,
+                        headers: { Accept: 'application/json' }
+                    });
+                    call = function (method, path, data) { return __awaiter(_this, void 0, void 0, function () {
+                        var headers, xsrf, response;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    headers = {};
+                                    if (cookies.size) {
+                                        headers.Cookie = __spreadArray([], __read(cookies), false).map(function (_a) {
+                                            var _b = __read(_a, 2), name = _b[0], value = _b[1];
+                                            return "".concat(name, "=").concat(value);
+                                        })
+                                            .join('; ');
+                                    }
+                                    xsrf = cookies.get('XSRF-TOKEN');
+                                    if (xsrf)
+                                        headers['X-XSRF-TOKEN'] = safeDecode(xsrf);
+                                    return [4 /*yield*/, instance.request({
+                                            method: method,
+                                            url: path,
+                                            data: data,
+                                            headers: headers
+                                        })];
+                                case 1:
+                                    response = _a.sent();
+                                    if (response.status >= 300 && response.status < 400) {
+                                        throw new Error("".concat(baseUrl).concat(path, " answered with a ").concat(response.status, " redirect to ") +
+                                            "'".concat(response.headers.location || 'unknown', "'. It is not followed: ") +
+                                            "the sign-in request carries the password. Point the target at the " +
+                                            "final URL.");
+                                    }
+                                    collectCookies(response.headers['set-cookie']);
+                                    return [2 /*return*/, response];
+                            }
+                        });
+                    }); };
+                    fail = function (message) {
+                        return new Error("".concat(message, "\nCheck that '").concat(user, "' can sign in to ").concat(target.serverUrl, ", and that ") +
+                            "the client id is set (SASJS_CLIENT) if the account is not an administrator.");
+                    };
+                    // GET / serves the single page app but sets the XSRF cookie the login needs.
+                    return [4 /*yield*/, call('get', '/')];
+                case 1:
+                    // GET / serves the single page app but sets the XSRF cookie the login needs.
+                    _k.sent();
+                    return [4 /*yield*/, call('post', '/SASLogon/login', {
+                            username: user,
+                            password: pass
+                        })];
+                case 2:
+                    login = _k.sent();
+                    if (login.status !== 200 || !((_a = login.data) === null || _a === void 0 ? void 0 : _a.loggedIn)) {
+                        throw fail("Login failed for user '".concat(user, "' on ").concat(target.serverUrl, " (HTTP ").concat(login.status, ")."));
+                    }
+                    client = clientId || ((_b = target.authConfig) === null || _b === void 0 ? void 0 : _b.client) || '';
+                    if (!!client) return [3 /*break*/, 4];
+                    return [4 /*yield*/, call('get', '/SASjsApi/client')];
+                case 3:
+                    clients = _k.sent();
+                    if (Array.isArray(clients.data) && clients.data.length) {
+                        client = clients.data[0].clientId;
+                        // Say which one was picked: the listing order is the server's, and a
+                        // silent choice here is impossible to debug from the tokens alone.
+                        (_c = process.logger) === null || _c === void 0 ? void 0 : _c.info("Using the first registered client ('".concat(client, "'). Set SASJS_CLIENT ") +
+                            "to authorize a specific client.");
+                    }
+                    _k.label = 4;
+                case 4:
+                    if (!client) {
+                        throw fail('No client id is available to authorize.');
+                    }
+                    return [4 /*yield*/, call('post', '/SASLogon/authorize', {
+                            clientId: client
+                        })];
+                case 5:
+                    authorized = _k.sent();
+                    code = (_d = authorized.data) === null || _d === void 0 ? void 0 : _d.code;
+                    if (!code) {
+                        throw fail("Authorization failed for client '".concat(client, "' (HTTP ").concat(authorized.status, ")."));
+                    }
+                    return [4 /*yield*/, call('post', '/SASjsApi/auth/token', {
+                            clientId: client,
+                            code: code
+                        })];
+                case 6:
+                    tokens = _k.sent();
+                    if (!((_e = tokens.data) === null || _e === void 0 ? void 0 : _e.accessToken)) {
+                        throw fail("The token endpoint returned no access token (HTTP ".concat(tokens.status, ")."));
+                    }
+                    return [2 /*return*/, {
+                            access_token: tokens.data.accessToken,
+                            refresh_token: tokens.data.refreshToken || '',
+                            client: client,
+                            displayName: ((_g = (_f = login.data) === null || _f === void 0 ? void 0 : _f.user) === null || _g === void 0 ? void 0 : _g.displayName) || ((_j = (_h = login.data) === null || _h === void 0 ? void 0 : _h.user) === null || _j === void 0 ? void 0 : _j.username)
+                        }];
+            }
+        });
+    });
+}

package/build/utils/config.js

@@ -968,7 +968,7 @@ var saveTokens = function (targetName, access_token, refresh_token, client, secr
                 if (!isLocalTarget) return [3 /*break*/, 3];
                 VERBOSE = process.env.VERBOSE;
                 clientSecretContent = client
-                    ? "CLIENT=".concat(client, "\nSECRET=").concat(secret || '', "\n")
+                    ? "CLIENT=".concat(client, "\n").concat(secret ? "SECRET=".concat(secret, "\n") : '')
                     : '';
                 envFileContent = "".concat(clientSecretContent, "ACCESS_TOKEN=").concat(access_token, "\nREFRESH_TOKEN=").concat(refresh_token, "\n").concat(VERBOSE ? 'VERBOSE=' + VERBOSE + '\n' : '');
                 envFilePath = path_1.default.join(process.projectDir, ".env.".concat(targetName));
@@ -986,7 +986,7 @@ var saveTokens = function (targetName, access_token, refresh_token, client, secr
                 }
                 targetJson = __assign({}, target);
                 targetJson.authConfig = __assign(__assign(__assign({}, (targetJson.authConfig || {})), (client
-                    ? { client: client, secret: secret || '' }
+                    ? { client: client, secret: secret || undefined }
                     : { client: undefined, secret: undefined })), { access_token: access_token, refresh_token: refresh_token });
                 return [4 /*yield*/, saveToGlobalConfig(new utils_1.Target(targetJson), globalConfig.defaultTarget === targetName)];
             case 5:

package/build/utils/spec/sasjsLogin.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/build/utils/spec/sasjsLogin.spec.js

@@ -0,0 +1,370 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var axios_1 = __importDefault(require("axios"));
+var utils_1 = require("@sasjs/utils");
+var auth_1 = require("../auth");
+jest.mock('axios');
+var request = jest.fn();
+var target = function (client) {
+    return new utils_1.Target(__assign({ name: 'sasjs-test', serverType: utils_1.ServerType.Sasjs, serverUrl: 'https://sasjs.example.com/', appLoc: '/Public/app' }, (client ? { authConfig: { client: client } } : {})));
+};
+var ok = function (data, headers) {
+    if (headers === void 0) { headers = {}; }
+    return ({
+        status: 200,
+        headers: headers,
+        data: data
+    });
+};
+var xsrfCookie = {
+    'set-cookie': ['XSRF-TOKEN=abc%3D%3D; Path=/; HttpOnly']
+};
+var happyPath = function (overrides) {
+    if (overrides === void 0) { overrides = []; }
+    var responses = __spreadArray([
+        ok('', xsrfCookie),
+        ok({ loggedIn: true, user: { displayName: 'Test User' } }),
+        ok([{ clientId: 'client-1' }]),
+        ok({ code: 'the-code' }),
+        ok({ accessToken: 'access-token', refreshToken: 'refresh-token' })
+    ], __read(overrides), false);
+    responses.forEach(function (response) { return request.mockResolvedValueOnce(response); });
+};
+describe('getTokensWithSasjsLogin', function () {
+    beforeEach(function () {
+        jest.clearAllMocks();
+        axios_1.default.create.mockReturnValue({ request: request });
+    });
+    it('should mint a token pair from the four-step local login', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result, calls;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    happyPath();
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')];
+                case 1:
+                    result = _a.sent();
+                    expect(result).toEqual({
+                        access_token: 'access-token',
+                        refresh_token: 'refresh-token',
+                        client: 'client-1',
+                        displayName: 'Test User'
+                    });
+                    calls = request.mock.calls.map(function (call) { return call[0]; });
+                    expect(calls.map(function (c) { return c.url; })).toEqual([
+                        '/',
+                        '/SASLogon/login',
+                        '/SASjsApi/client',
+                        '/SASLogon/authorize',
+                        '/SASjsApi/auth/token'
+                    ]);
+                    expect(calls[1].data).toEqual({ username: 'user1', password: 'pass1' });
+                    expect(calls[3].data).toEqual({ clientId: 'client-1' });
+                    expect(calls[4].data).toEqual({ clientId: 'client-1', code: 'the-code' });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should send the session cookie and the decoded XSRF token', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var loginCall;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    happyPath();
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')];
+                case 1:
+                    _a.sent();
+                    loginCall = request.mock.calls[1][0];
+                    expect(loginCall.headers.Cookie).toBe('XSRF-TOKEN=abc%3D%3D');
+                    expect(loginCall.headers['X-XSRF-TOKEN']).toBe('abc==');
+                    // The first call has nothing to send yet.
+                    expect(request.mock.calls[0][0].headers.Cookie).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should not list clients when an id is supplied', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok({ code: 'the-code' }),
+                        ok({ accessToken: 'access-token' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1', 'pinned-client')];
+                case 1:
+                    result = _a.sent();
+                    expect(request).toHaveBeenCalledTimes(4);
+                    expect(result.client).toBe('pinned-client');
+                    expect(result.refresh_token).toBe('');
+                    expect(result.displayName).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should prefer the target client over the admin client listing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok({ code: 'the-code' }),
+                        ok({ accessToken: 'access-token' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target('from-config'), 'user1', 'pass1')];
+                case 1:
+                    result = _a.sent();
+                    expect(result.client).toBe('from-config');
+                    expect(request).toHaveBeenCalledTimes(4);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail when the credentials are rejected', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: false, error: 'invalid credentials' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'wrong')).rejects.toThrow("Login failed for user 'user1' on https://sasjs.example.com/")];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail, naming SASJS_CLIENT, when no client is available', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        { status: 403, headers: {}, data: 'Forbidden' }
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/No client id is available to authorize/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail when the token endpoint returns nothing usable', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok([{ clientId: 'client-1' }]),
+                        ok({ code: 'the-code' }),
+                        ok({})
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/returned no access token/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should refuse to follow a redirect that would replay the password', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        {
+                            status: 307,
+                            headers: { location: 'https://elsewhere.example.com/login' },
+                            data: {}
+                        }
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/answered with a 307 redirect/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fall back to the raw XSRF value when it is not valid encoding', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', { 'set-cookie': ['XSRF-TOKEN=abc%ZZ; Path=/'] }),
+                        ok({ loggedIn: true }),
+                        ok([{ clientId: 'client-1' }]),
+                        ok({ code: 'the-code' }),
+                        ok({ accessToken: 'access-token' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')];
+                case 1:
+                    _a.sent();
+                    expect(request.mock.calls[1][0].headers['X-XSRF-TOKEN']).toBe('abc%ZZ');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should hand the target TLS options to the http client', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var options;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    happyPath();
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(new utils_1.Target({
+                            name: 'sasjs-tls',
+                            serverType: utils_1.ServerType.Sasjs,
+                            serverUrl: 'https://sasjs.example.com',
+                            appLoc: '/Public/app',
+                            httpsAgentOptions: { rejectUnauthorized: false }
+                        }), 'user1', 'pass1')];
+                case 1:
+                    _a.sent();
+                    options = axios_1.default.create.mock.calls[0][0];
+                    expect(options.httpsAgent).toBeDefined();
+                    expect(options.maxRedirects).toBe(0);
+                    // Every status is inspected rather than thrown by axios, so the flow can
+                    // report a 401 or a 307 in its own words.
+                    expect(options.validateStatus(500)).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should name an unnamed redirect target instead of printing undefined', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [ok('', xsrfCookie), { status: 302, headers: {}, data: {} }].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/redirect to 'unknown'/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail when the authorize step returns no code', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok([{ clientId: 'client-1' }]),
+                        ok({})
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/Authorization failed for client 'client-1' \(HTTP 200\)/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should ignore a client listing that is not an array', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok({ message: 'not a list' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/No client id is available to authorize/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/package.json

@@ -126,5 +126,5 @@
   "peerDependencies": {
     "@sasjs/lint": "^4.4.0"
   },
-  "version": "6.2.7"
+  "version": "6.3.0"
 }