@sasjs/server 3.6.0 → 3.6.2

package/build/scripts/copySwaggerUi.js

@@ -0,0 +1,14 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var path_1 = __importDefault(require("path"));
+var swaggerUiAssets_1 = require("../src/utils/swaggerUiAssets");
+// Runs from `npm run initial`, so the assets are in place for both the dev server
+// (which serves api/public directly under ts-node) and the packaged build (which
+// copies api/public into build/public). The generated files are gitignored: the
+// installed swagger-ui-dist devDependency is the only source of truth.
+var destination = path_1.default.resolve(__dirname, '..', 'public', 'SASjsApi');
+(0, swaggerUiAssets_1.copySwaggerUiAssets)(destination);
+console.log("Copied Swagger UI assets to ".concat(destination));

package/build/src/routes/api/index.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var express_1 = __importDefault(require("express"));
-var swagger_ui_express_1 = __importDefault(require("swagger-ui-express"));
 var middlewares_1 = require("../../middlewares");
 var info_1 = __importDefault(require("./info"));
 var admin_1 = __importDefault(require("./admin"));
@@ -34,17 +33,8 @@ router.use('/code', middlewares_1.authenticateAccessToken, code_1.default);
 router.use('/user', middlewares_1.desktopRestrict, user_1.default);
 router.use('/permission', middlewares_1.desktopRestrict, middlewares_1.authenticateAccessToken, permission_1.default);
 router.use('/authConfig', middlewares_1.desktopRestrict, middlewares_1.authenticateAccessToken, middlewares_1.verifyAdmin, authConfig_1.default);
-router.use('/', swagger_ui_express_1.default.serve, swagger_ui_express_1.default.setup(undefined, {
-    swaggerOptions: {
-        url: '/swagger.yaml',
-        requestInterceptor: function (request) {
-            request.credentials = 'include';
-            var cookie = document.cookie;
-            var startIndex = cookie.indexOf('XSRF-TOKEN');
-            var csrf = cookie.slice(startIndex + 11).split('; ')[0];
-            request.headers['X-XSRF-TOKEN'] = csrf;
-            return request;
-        }
-    }
-}));
+// The API documentation page is a file in public/SASjsApi/ (index.html plus the
+// assets copied beside it at build time), served by the express.static mount in
+// app.ts. It is not a route here: the page and its assets are plain files, and
+// nothing in them is rendered per request.
 exports.default = router;

package/build/src/routes/api/spec/permission.spec.js

@@ -58,7 +58,7 @@ var controllers_1 = require("../../../controllers/");
 var utils_1 = require("../../../utils");
 var crypto_1 = require("crypto");
 var deployPayload = {
-    appLoc: 'string',
+    appLoc: '/Public/example',
     streamWebFolder: 'string',
     fileTree: {
         members: [
@@ -772,7 +772,7 @@ describe('permission', function () {
                     case 1:
                         accessToken = _a.sent();
                         return [4 /*yield*/, (0, supertest_1.default)(app)
-                                .get('/SASjsApi/drive/deploy')
+                                .post('/SASjsApi/drive/deploy')
                                 .auth(accessToken, { type: 'bearer' })
                                 .send(deployPayload)
                                 .expect(200)];

package/build/src/routes/api/spec/swaggerAssets.spec.js

@@ -3,63 +3,85 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-var crypto_1 = __importDefault(require("crypto"));
 var fs_1 = __importDefault(require("fs"));
+var os_1 = __importDefault(require("os"));
 var path_1 = __importDefault(require("path"));
+var swaggerUiAssets_1 = require("../../../utils/swaggerUiAssets");
 /**
- * Guard for the Swagger UI assets the API serves from disk.
+ * Guard for the Swagger UI the API serves.
  *
- * `express.static('../public')` is mounted at the root, so a file under
- * `public/SASjsApi/` wins over the copy `swagger-ui-express` would serve from
- * `swagger-ui-dist`. The copy exists on purpose: the packaged executable bundles
- * `build/public/**` and cannot read the dependency from disk. The cost is that a
- * stale copy silently styles a newer UI.
+ * `public/SASjsApi/index.html` is the documentation page, and the assets beside
+ * it are copied from the pinned `swagger-ui-dist` devDependency by
+ * `scripts/copySwaggerUi.ts`. Nothing from that package is installed at
+ * runtime, because it depends on `@scarf/scarf`, whose postinstall reports the
+ * install to scarf.sh.
  *
- * That is what happened here. A 2021 stylesheet served beside the 5.33.0 bundle
- * collapsed every operation path to one character per line: the bundle renders
- * `.opblock-summary-path-description-wrapper`, which the older stylesheet does
- * not know about, while its own `.opblock-summary-path` rule still caps the
- * width at `calc(100% - 110px - 15rem)`. With no wrapper rule the cap resolved
- * against a container narrower than the subtraction, so the path wrapped at
- * every character.
- *
- * These tests keep the copy in step with the package that renders the DOM.
+ * Two things can therefore go wrong silently, and both are covered here: a page
+ * that points at an asset the build does not copy (a blank or unstyled UI), and
+ * a page that reaches a third party (the leak this arrangement exists to stop).
  */
 var apiRoot = path_1.default.resolve(__dirname, '../../../..');
-var servedCssPath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'swagger-ui.css');
-var distDirectory = path_1.default.dirname(require.resolve('swagger-ui-dist/package.json'));
-var distCssPath = path_1.default.join(distDirectory, 'swagger-ui.css');
-var distVersion = require('swagger-ui-dist/package.json').version;
-var sha256 = function (buffer) {
-    return crypto_1.default.createHash('sha256').update(buffer).digest('hex');
-};
+var pagePath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'index.html');
+var initPath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'swagger-ui-init.js');
+var page = function () { return fs_1.default.readFileSync(pagePath, 'utf8'); };
+var init = function () { return fs_1.default.readFileSync(initPath, 'utf8'); };
 describe('bundled Swagger UI assets', function () {
-    it('serves the stylesheet shipped by swagger-ui-dist', function () {
-        var served = fs_1.default.readFileSync(servedCssPath);
-        var installed = fs_1.default.readFileSync(distCssPath);
-        if (!served.equals(installed)) {
-            throw new Error("public/SASjsApi/swagger-ui.css is out of step with swagger-ui-dist@".concat(distVersion, ".\n") +
-                "  served:    ".concat(sha256(served), "\n") +
-                "  installed: ".concat(sha256(installed), "\n") +
-                'The API serves the copy in public/, so a stale copy styles a newer UI. Refresh it with:\n' +
-                '  cp node_modules/swagger-ui-dist/swagger-ui.css public/SASjsApi/swagger-ui.css');
+    var destination;
+    beforeAll(function () {
+        destination = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'sasjs-swagger-ui-'));
+        (0, swaggerUiAssets_1.copySwaggerUiAssets)(destination);
+    });
+    afterAll(function () {
+        fs_1.default.rmSync(destination, { recursive: true, force: true });
+    });
+    it('copies every asset the page loads from swagger-ui-dist', function () {
+        var distFolder = (0, swaggerUiAssets_1.swaggerUiDistFolder)();
+        for (var _i = 0, swaggerUiAssets_2 = swaggerUiAssets_1.swaggerUiAssets; _i < swaggerUiAssets_2.length; _i++) {
+            var file = swaggerUiAssets_2[_i];
+            expect(fs_1.default.existsSync(path_1.default.join(destination, file))).toBe(true);
+            expect(fs_1.default
+                .readFileSync(path_1.default.join(destination, file))
+                .equals(fs_1.default.readFileSync(path_1.default.join(distFolder, file)))).toBe(true);
+        }
+        // Apache-2.0: the licence and notice travel with the files
+        for (var _a = 0, swaggerUiNotices_1 = swaggerUiAssets_1.swaggerUiNotices; _a < swaggerUiNotices_1.length; _a++) {
+            var file = swaggerUiNotices_1[_a];
+            expect(fs_1.default.existsSync(path_1.default.join(destination, "swagger-ui-".concat(file)))).toBe(true);
+        }
+    });
+    it('loads the page and its styles from this folder, not from a third party', function () {
+        var html = page();
+        var loaded = [
+            'swagger-ui.css',
+            'swagger-ui-bundle.js',
+            'swagger-ui-standalone-preset.js',
+            'swagger-ui-init.js',
+            'favicon-32x32.png'
+        ];
+        for (var _i = 0, loaded_1 = loaded; _i < loaded_1.length; _i++) {
+            var file = loaded_1[_i];
+            expect(html).toContain("./".concat(file));
         }
+        var external = html.match(/(src|href)\s*=\s*["']?https?:\/\//gi) || [];
+        expect(external).toEqual([]);
     });
-    it('styles the summary wrapper the current bundle renders', function () {
-        var css = fs_1.default.readFileSync(servedCssPath, 'utf8');
-        // Without this rule the wrapper stays at its initial `display: block`, the
-        // path's `max-width: calc(100% - ...)` resolves against a narrow container,
-        // and every route renders one character per line.
-        expect(css).toContain('.opblock-summary-path-description-wrapper');
+    it('starts Swagger UI against the local spec with no third-party validator', function () {
+        var script = init();
+        expect(script).toContain("url: '/swagger.yaml'");
+        // the online validator posts the spec URL to validator.swagger.io
+        expect(script).toContain('validatorUrl: null');
+        // the API's own calls carry the session cookie and the CSRF header
+        expect(script).toContain("request.credentials = 'include'");
+        expect(script).toContain('X-XSRF-TOKEN');
     });
-    it('does not shadow the generated swagger-ui-init.js', function () {
-        // `swagger-ui-express` builds this file in memory from the options passed
-        // to `setup()` (its `swaggerInitFunction`), so it never needs to be on
-        // disk, and a checked-in copy wins over the generated one through the same
-        // static mount. That copy silently pins the Swagger UI to whatever
-        // `swaggerOptions` were in place when it was written, so edits to the
-        // route's options have no effect.
-        var initPath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'swagger-ui-init.js');
-        expect(fs_1.default.existsSync(initPath)).toBe(false);
+    it('keeps swagger-ui out of the runtime dependencies', function () {
+        // swagger-ui-dist is a devDependency: it is the source of the copied
+        // assets, and its tree carries @scarf/scarf's postinstall. Installing
+        // @sasjs/server must not run anything that calls out.
+        var manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(apiRoot, 'package.json'), 'utf8'));
+        var runtime = Object.keys(manifest.dependencies || {});
+        expect(runtime).not.toContain('swagger-ui-express');
+        expect(runtime).not.toContain('swagger-ui-dist');
+        expect(Object.keys(manifest.devDependencies || {})).toContain('swagger-ui-dist');
     });
 });

package/build/src/server.js

@@ -1,3 +1,4 @@
+#!/usr/bin/env node
 "use strict";
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }

package/build/src/utils/buildInfo.generated.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD_INFO = void 0;
 // Generated by scripts/generateBuildInfo.ts. Do not edit by hand.
 exports.BUILD_INFO = {
-    version: "v3.6.0",
-    gitHash: "14c706a",
-    buildDate: "2026-10-30T13:00:41.471Z"
+    version: "v3.6.2",
+    gitHash: "6141e36",
+    buildDate: "2026-10-30T14:54:32.248Z"
 };

package/build/src/utils/swaggerUiAssets.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copySwaggerUiAssets = exports.swaggerUiDistFolder = exports.swaggerUiNotices = exports.swaggerUiAssets = void 0;
+var fs_1 = __importDefault(require("fs"));
+var path_1 = __importDefault(require("path"));
+/**
+ * The Swagger UI assets the API serves from its own public folder.
+ *
+ * They are generated from `swagger-ui-dist` at build time instead of being
+ * carried as a runtime dependency. `swagger-ui-dist` depends on `@scarf/scarf`,
+ * whose postinstall reports the installation to scarf.sh - a published package
+ * must not make outbound calls when it is installed, so nothing from
+ * swagger-ui-dist is installed with it. `swagger-ui-dist` stays a devDependency:
+ * it is the source these files are copied from, and swaggerAssets.spec.ts
+ * compares the two.
+ */
+exports.swaggerUiAssets = [
+    'swagger-ui.css',
+    'swagger-ui-bundle.js',
+    'swagger-ui-standalone-preset.js',
+    'favicon-16x16.png',
+    'favicon-32x32.png',
+    'oauth2-redirect.html'
+];
+/** Apache-2.0 requires the licence and the notice to travel with the files. */
+exports.swaggerUiNotices = ['LICENSE', 'NOTICE'];
+var swaggerUiDistFolder = function () {
+    return path_1.default.dirname(require.resolve('swagger-ui-dist/package.json'));
+};
+exports.swaggerUiDistFolder = swaggerUiDistFolder;
+/**
+ * Copies the browser assets, and the licence files, into `destination`.
+ *
+ * Same function for the build (`api/scripts/copySwaggerUi.ts`) and for the
+ * spec, so what the test compares is what the build produces.
+ */
+var copySwaggerUiAssets = function (destination) {
+    var source = (0, exports.swaggerUiDistFolder)();
+    fs_1.default.mkdirSync(destination, { recursive: true });
+    for (var _i = 0, swaggerUiAssets_1 = exports.swaggerUiAssets; _i < swaggerUiAssets_1.length; _i++) {
+        var file = swaggerUiAssets_1[_i];
+        fs_1.default.copyFileSync(path_1.default.join(source, file), path_1.default.join(destination, file));
+    }
+    for (var _a = 0, swaggerUiNotices_1 = exports.swaggerUiNotices; _a < swaggerUiNotices_1.length; _a++) {
+        var file = swaggerUiNotices_1[_a];
+        fs_1.default.copyFileSync(path_1.default.join(source, file), path_1.default.join(destination, "swagger-ui-".concat(file)));
+    }
+    return destination;
+};
+exports.copySwaggerUiAssets = copySwaggerUiAssets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/server",
-  "version": "3.6.0",
+  "version": "3.6.2",
   "description": "NodeJS wrapper for calling the SAS binary executable",
   "license": "MIT",
   "repository": "https://github.com/sasjs/server",
@@ -43,7 +43,6 @@
     "morgan": "^1.12.1",
     "multer": "^2.4.0",
     "rotating-file-stream": "^3.2.10",
-    "swagger-ui-express": "5.0.1",
     "tsoa": "5.1.1",
     "unzipper": "^0.12.5",
     "url": "^0.11.4"