@sasjs/cli 6.2.7 → 6.4.0

package/build/utils/spec/sasjsLogin.spec.js

@@ -0,0 +1,370 @@
+"use strict";
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+    }
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
+        }
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
+        }
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var axios_1 = __importDefault(require("axios"));
+var utils_1 = require("@sasjs/utils");
+var auth_1 = require("../auth");
+jest.mock('axios');
+var request = jest.fn();
+var target = function (client) {
+    return new utils_1.Target(__assign({ name: 'sasjs-test', serverType: utils_1.ServerType.Sasjs, serverUrl: 'https://sasjs.example.com/', appLoc: '/Public/app' }, (client ? { authConfig: { client: client } } : {})));
+};
+var ok = function (data, headers) {
+    if (headers === void 0) { headers = {}; }
+    return ({
+        status: 200,
+        headers: headers,
+        data: data
+    });
+};
+var xsrfCookie = {
+    'set-cookie': ['XSRF-TOKEN=abc%3D%3D; Path=/; HttpOnly']
+};
+var happyPath = function (overrides) {
+    if (overrides === void 0) { overrides = []; }
+    var responses = __spreadArray([
+        ok('', xsrfCookie),
+        ok({ loggedIn: true, user: { displayName: 'Test User' } }),
+        ok([{ clientId: 'client-1' }]),
+        ok({ code: 'the-code' }),
+        ok({ accessToken: 'access-token', refreshToken: 'refresh-token' })
+    ], __read(overrides), false);
+    responses.forEach(function (response) { return request.mockResolvedValueOnce(response); });
+};
+describe('getTokensWithSasjsLogin', function () {
+    beforeEach(function () {
+        jest.clearAllMocks();
+        axios_1.default.create.mockReturnValue({ request: request });
+    });
+    it('should mint a token pair from the four-step local login', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result, calls;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    happyPath();
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')];
+                case 1:
+                    result = _a.sent();
+                    expect(result).toEqual({
+                        access_token: 'access-token',
+                        refresh_token: 'refresh-token',
+                        client: 'client-1',
+                        displayName: 'Test User'
+                    });
+                    calls = request.mock.calls.map(function (call) { return call[0]; });
+                    expect(calls.map(function (c) { return c.url; })).toEqual([
+                        '/',
+                        '/SASLogon/login',
+                        '/SASjsApi/client',
+                        '/SASLogon/authorize',
+                        '/SASjsApi/auth/token'
+                    ]);
+                    expect(calls[1].data).toEqual({ username: 'user1', password: 'pass1' });
+                    expect(calls[3].data).toEqual({ clientId: 'client-1' });
+                    expect(calls[4].data).toEqual({ clientId: 'client-1', code: 'the-code' });
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should send the session cookie and the decoded XSRF token', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var loginCall;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    happyPath();
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')];
+                case 1:
+                    _a.sent();
+                    loginCall = request.mock.calls[1][0];
+                    expect(loginCall.headers.Cookie).toBe('XSRF-TOKEN=abc%3D%3D');
+                    expect(loginCall.headers['X-XSRF-TOKEN']).toBe('abc==');
+                    // The first call has nothing to send yet.
+                    expect(request.mock.calls[0][0].headers.Cookie).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should not list clients when an id is supplied', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok({ code: 'the-code' }),
+                        ok({ accessToken: 'access-token' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1', 'pinned-client')];
+                case 1:
+                    result = _a.sent();
+                    expect(request).toHaveBeenCalledTimes(4);
+                    expect(result.client).toBe('pinned-client');
+                    expect(result.refresh_token).toBe('');
+                    expect(result.displayName).toBeUndefined();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should prefer the target client over the admin client listing', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var result;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok({ code: 'the-code' }),
+                        ok({ accessToken: 'access-token' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target('from-config'), 'user1', 'pass1')];
+                case 1:
+                    result = _a.sent();
+                    expect(result.client).toBe('from-config');
+                    expect(request).toHaveBeenCalledTimes(4);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail when the credentials are rejected', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: false, error: 'invalid credentials' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'wrong')).rejects.toThrow("Login failed for user 'user1' on https://sasjs.example.com/")];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail, naming SASJS_CLIENT, when no client is available', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        { status: 403, headers: {}, data: 'Forbidden' }
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/No client id is available to authorize/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail when the token endpoint returns nothing usable', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok([{ clientId: 'client-1' }]),
+                        ok({ code: 'the-code' }),
+                        ok({})
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/returned no access token/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should refuse to follow a redirect that would replay the password', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        {
+                            status: 307,
+                            headers: { location: 'https://elsewhere.example.com/login' },
+                            data: {}
+                        }
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/answered with a 307 redirect/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fall back to the raw XSRF value when it is not valid encoding', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', { 'set-cookie': ['XSRF-TOKEN=abc%ZZ; Path=/'] }),
+                        ok({ loggedIn: true }),
+                        ok([{ clientId: 'client-1' }]),
+                        ok({ code: 'the-code' }),
+                        ok({ accessToken: 'access-token' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')];
+                case 1:
+                    _a.sent();
+                    expect(request.mock.calls[1][0].headers['X-XSRF-TOKEN']).toBe('abc%ZZ');
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should hand the target TLS options to the http client', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var options;
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    happyPath();
+                    return [4 /*yield*/, (0, auth_1.getTokensWithSasjsLogin)(new utils_1.Target({
+                            name: 'sasjs-tls',
+                            serverType: utils_1.ServerType.Sasjs,
+                            serverUrl: 'https://sasjs.example.com',
+                            appLoc: '/Public/app',
+                            httpsAgentOptions: { rejectUnauthorized: false }
+                        }), 'user1', 'pass1')];
+                case 1:
+                    _a.sent();
+                    options = axios_1.default.create.mock.calls[0][0];
+                    expect(options.httpsAgent).toBeDefined();
+                    expect(options.maxRedirects).toBe(0);
+                    // Every status is inspected rather than thrown by axios, so the flow can
+                    // report a 401 or a 307 in its own words.
+                    expect(options.validateStatus(500)).toBe(true);
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should name an unnamed redirect target instead of printing undefined', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [ok('', xsrfCookie), { status: 302, headers: {}, data: {} }].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/redirect to 'unknown'/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should fail when the authorize step returns no code', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok([{ clientId: 'client-1' }]),
+                        ok({})
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/Authorization failed for client 'client-1' \(HTTP 200\)/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    it('should ignore a client listing that is not an array', function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0:
+                    ;
+                    [
+                        ok('', xsrfCookie),
+                        ok({ loggedIn: true }),
+                        ok({ message: 'not a list' })
+                    ].forEach(function (response) { return request.mockResolvedValueOnce(response); });
+                    return [4 /*yield*/, expect((0, auth_1.getTokensWithSasjsLogin)(target(), 'user1', 'pass1')).rejects.toThrow(/No client id is available to authorize/)];
+                case 1:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+});

package/package.json

@@ -126,5 +126,5 @@
   "peerDependencies": {
     "@sasjs/lint": "^4.4.0"
   },
-  "version": "6.2.7"
+  "version": "6.4.0"
 }