@sasjs/server 3.6.1 → 3.7.0

package/build/scripts/copySwaggerUi.js

@@ -0,0 +1,14 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var path_1 = __importDefault(require("path"));
+var swaggerUiAssets_1 = require("../src/utils/swaggerUiAssets");
+// Runs from `npm run initial`, so the assets are in place for both the dev server
+// (which serves api/public directly under ts-node) and the packaged build (which
+// copies api/public into build/public). The generated files are gitignored: the
+// installed swagger-ui-dist devDependency is the only source of truth.
+var destination = path_1.default.resolve(__dirname, '..', 'public', 'SASjsApi');
+(0, swaggerUiAssets_1.copySwaggerUiAssets)(destination);
+console.log("Copied Swagger UI assets to ".concat(destination));

package/build/src/e2e/studio.spec.js

@@ -98,6 +98,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * the unit-test run deliberately excludes.
  */
 var path_1 = __importDefault(require("path"));
+var fs_1 = require("fs");
 var promises_1 = require("fs/promises");
 var mongoose_1 = __importDefault(require("mongoose"));
 var mongodb_memory_server_1 = require("mongodb-memory-server");
@@ -140,7 +141,11 @@ describe('Studio in a browser', function () {
                 case 2:
                     _a.sent();
                     _a.label = 3;
-                case 3: return [4 /*yield*/, (0, utils_1.fileExists)(path_1.default.join((0, utils_2.getWebBuildFolder)(), 'index.bundle.js'))];
+                case 3:
+                    // The screenshots folder is gitignored, so a fresh checkout has no such
+                    // directory and a failure screenshot would fail on the write itself.
+                    (0, fs_1.mkdirSync)(screenshotDir, { recursive: true });
+                    return [4 /*yield*/, (0, utils_1.fileExists)(path_1.default.join((0, utils_2.getWebBuildFolder)(), 'index.bundle.js'))];
                 case 4:
                     if (!(_a.sent())) {
                         throw new Error("No web build at ".concat((0, utils_2.getWebBuildFolder)(), ". Run `npm run build` in web/ before the browser test."));
@@ -185,7 +190,10 @@ describe('Studio in a browser', function () {
                     // An admin passes every route check, which keeps this test about the
                     // editor rather than about the permission model.
                     expect(dbUser.isAdmin).toBe(true);
-                    process.runTimes = [utils_2.RunTimeType.JS];
+                    // The fixture is a .sas program, and this suite never executes code for
+                    // real - the log case fulfils the execute request in the browser - so one
+                    // runtime, the one the fixture needs, keeps the editor from switching it.
+                    process.runTimes = [utils_2.RunTimeType.SAS];
                     process.nodeLoc = process.execPath;
                     return [4 /*yield*/, app];
                 case 13:
@@ -200,7 +208,15 @@ describe('Studio in a browser', function () {
                     return [4 /*yield*/, browser.newPage({ viewport: { width: 1280, height: 800 } })];
                 case 15:
                     page = _a.sent();
-                    page.on('pageerror', function (error) { return pageErrors.push(String(error)); });
+                    page.on('pageerror', function (error) {
+                        // A request the app aborts surfaces here as an unhandled rejection with
+                        // axios's "Canceled: Canceled". That is a request superseded by a newer one
+                        // - the editor re-syncing, a tab switching - not a fault in the tree, which
+                        // is what this collector exists to catch.
+                        if (String(error).includes('Canceled: Canceled'))
+                            return;
+                        pageErrors.push(String(error));
+                    });
                     page.on('request', function (request) {
                         var _a;
                         if (!request.url().includes('/SASjsApi/drive/fileTree'))
@@ -576,4 +592,83 @@ describe('Studio in a browser', function () {
             }
         });
     }); }, 60000);
+    it('lists the errors, warnings and notable notes of a SAS log, and hides the notes on request', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var log, _a, _b, _c, stored;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    log = [
+                        'NOTE: SAS (r) Proprietary Software 9.4 (TS1M9 MBCS3170)',
+                        '1    data want;',
+                        '2      x = age / 0;',
+                        '3    run;',
+                        'WARNING: Division by zero detected at line 3 column 11.',
+                        'NOTE: Variable y is uninitialized.',
+                        'ERROR Libref X is not assigned.',
+                        'NOTE 49-169: The meaning of an identifier after a quoted string may change.',
+                        'ERROR: File WORK.MISSING_DS.DATA does not exist.',
+                        ''
+                    ].join('\n');
+                    return [4 /*yield*/, page.route('**/SASjsApi/code/execute', function (route) {
+                            return route.fulfill({
+                                status: 200,
+                                contentType: 'text/plain',
+                                body: ['<html></html>', log, ''].join('SASJS_LOGS_SEPARATOR_163ee17b6ff24f028928972d80a26784')
+                            });
+                        })
+                        // The fixture program is a .sas file, so opening it selects the SAS runtime
+                        // and the log pane will render the parsed shape.
+                    ];
+                case 1:
+                    _d.sent();
+                    // The fixture program is a .sas file, so opening it selects the SAS runtime
+                    // and the log pane will render the parsed shape.
+                    return [4 /*yield*/, page.click('button:has-text("RUN")')];
+                case 2:
+                    // The fixture program is a .sas file, so opening it selects the SAS runtime
+                    // and the log pane will render the parsed shape.
+                    _d.sent();
+                    return [4 /*yield*/, page.waitForSelector('text=Errors (2)', { timeout: 30000 })];
+                case 3:
+                    _d.sent();
+                    _a = expect;
+                    return [4 /*yield*/, page.isVisible('text=Warnings (1)')];
+                case 4:
+                    _a.apply(void 0, [_d.sent()]).toBe(true);
+                    _b = expect;
+                    return [4 /*yield*/, page.isVisible('text=Notes (2)')];
+                case 5:
+                    _b.apply(void 0, [_d.sent()]).toBe(true);
+                    return [4 /*yield*/, page.screenshot({
+                            path: path_1.default.join(screenshotDir, '02-log-issues.png')
+                        })
+                        // The switch hides them without another run.
+                    ];
+                case 6:
+                    _d.sent();
+                    // The switch hides them without another run.
+                    return [4 /*yield*/, page.click('[aria-label="Hide notable notes"]')];
+                case 7:
+                    // The switch hides them without another run.
+                    _d.sent();
+                    return [4 /*yield*/, page.waitForSelector('text=Notes (2)', {
+                            state: 'detached',
+                            timeout: 30000
+                        })];
+                case 8:
+                    _d.sent();
+                    _c = expect;
+                    return [4 /*yield*/, page.isVisible('text=Errors (2)')];
+                case 9:
+                    _c.apply(void 0, [_d.sent()]).toBe(true);
+                    return [4 /*yield*/, page.evaluate(function () {
+                            return window.localStorage.getItem('studio-settings');
+                        })];
+                case 10:
+                    stored = _d.sent();
+                    expect(JSON.parse(stored)['log.notableNotes']).toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
 });

package/build/src/routes/api/index.js

@@ -4,7 +4,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 var express_1 = __importDefault(require("express"));
-var swagger_ui_express_1 = __importDefault(require("swagger-ui-express"));
 var middlewares_1 = require("../../middlewares");
 var info_1 = __importDefault(require("./info"));
 var admin_1 = __importDefault(require("./admin"));
@@ -34,17 +33,8 @@ router.use('/code', middlewares_1.authenticateAccessToken, code_1.default);
 router.use('/user', middlewares_1.desktopRestrict, user_1.default);
 router.use('/permission', middlewares_1.desktopRestrict, middlewares_1.authenticateAccessToken, permission_1.default);
 router.use('/authConfig', middlewares_1.desktopRestrict, middlewares_1.authenticateAccessToken, middlewares_1.verifyAdmin, authConfig_1.default);
-router.use('/', swagger_ui_express_1.default.serve, swagger_ui_express_1.default.setup(undefined, {
-    swaggerOptions: {
-        url: '/swagger.yaml',
-        requestInterceptor: function (request) {
-            request.credentials = 'include';
-            var cookie = document.cookie;
-            var startIndex = cookie.indexOf('XSRF-TOKEN');
-            var csrf = cookie.slice(startIndex + 11).split('; ')[0];
-            request.headers['X-XSRF-TOKEN'] = csrf;
-            return request;
-        }
-    }
-}));
+// The API documentation page is a file in public/SASjsApi/ (index.html plus the
+// assets copied beside it at build time), served by the express.static mount in
+// app.ts. It is not a route here: the page and its assets are plain files, and
+// nothing in them is rendered per request.
 exports.default = router;

package/build/src/routes/api/spec/permission.spec.js

@@ -58,7 +58,7 @@ var controllers_1 = require("../../../controllers/");
 var utils_1 = require("../../../utils");
 var crypto_1 = require("crypto");
 var deployPayload = {
-    appLoc: 'string',
+    appLoc: '/Public/example',
     streamWebFolder: 'string',
     fileTree: {
         members: [
@@ -772,7 +772,7 @@ describe('permission', function () {
                     case 1:
                         accessToken = _a.sent();
                         return [4 /*yield*/, (0, supertest_1.default)(app)
-                                .get('/SASjsApi/drive/deploy')
+                                .post('/SASjsApi/drive/deploy')
                                 .auth(accessToken, { type: 'bearer' })
                                 .send(deployPayload)
                                 .expect(200)];

package/build/src/routes/api/spec/swaggerAssets.spec.js

@@ -3,63 +3,85 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-var crypto_1 = __importDefault(require("crypto"));
 var fs_1 = __importDefault(require("fs"));
+var os_1 = __importDefault(require("os"));
 var path_1 = __importDefault(require("path"));
+var swaggerUiAssets_1 = require("../../../utils/swaggerUiAssets");
 /**
- * Guard for the Swagger UI assets the API serves from disk.
+ * Guard for the Swagger UI the API serves.
  *
- * `express.static('../public')` is mounted at the root, so a file under
- * `public/SASjsApi/` wins over the copy `swagger-ui-express` would serve from
- * `swagger-ui-dist`. The copy exists on purpose: the packaged executable bundles
- * `build/public/**` and cannot read the dependency from disk. The cost is that a
- * stale copy silently styles a newer UI.
+ * `public/SASjsApi/index.html` is the documentation page, and the assets beside
+ * it are copied from the pinned `swagger-ui-dist` devDependency by
+ * `scripts/copySwaggerUi.ts`. Nothing from that package is installed at
+ * runtime, because it depends on `@scarf/scarf`, whose postinstall reports the
+ * install to scarf.sh.
  *
- * That is what happened here. A 2021 stylesheet served beside the 5.33.0 bundle
- * collapsed every operation path to one character per line: the bundle renders
- * `.opblock-summary-path-description-wrapper`, which the older stylesheet does
- * not know about, while its own `.opblock-summary-path` rule still caps the
- * width at `calc(100% - 110px - 15rem)`. With no wrapper rule the cap resolved
- * against a container narrower than the subtraction, so the path wrapped at
- * every character.
- *
- * These tests keep the copy in step with the package that renders the DOM.
+ * Two things can therefore go wrong silently, and both are covered here: a page
+ * that points at an asset the build does not copy (a blank or unstyled UI), and
+ * a page that reaches a third party (the leak this arrangement exists to stop).
  */
 var apiRoot = path_1.default.resolve(__dirname, '../../../..');
-var servedCssPath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'swagger-ui.css');
-var distDirectory = path_1.default.dirname(require.resolve('swagger-ui-dist/package.json'));
-var distCssPath = path_1.default.join(distDirectory, 'swagger-ui.css');
-var distVersion = require('swagger-ui-dist/package.json').version;
-var sha256 = function (buffer) {
-    return crypto_1.default.createHash('sha256').update(buffer).digest('hex');
-};
+var pagePath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'index.html');
+var initPath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'swagger-ui-init.js');
+var page = function () { return fs_1.default.readFileSync(pagePath, 'utf8'); };
+var init = function () { return fs_1.default.readFileSync(initPath, 'utf8'); };
 describe('bundled Swagger UI assets', function () {
-    it('serves the stylesheet shipped by swagger-ui-dist', function () {
-        var served = fs_1.default.readFileSync(servedCssPath);
-        var installed = fs_1.default.readFileSync(distCssPath);
-        if (!served.equals(installed)) {
-            throw new Error("public/SASjsApi/swagger-ui.css is out of step with swagger-ui-dist@".concat(distVersion, ".\n") +
-                "  served:    ".concat(sha256(served), "\n") +
-                "  installed: ".concat(sha256(installed), "\n") +
-                'The API serves the copy in public/, so a stale copy styles a newer UI. Refresh it with:\n' +
-                '  cp node_modules/swagger-ui-dist/swagger-ui.css public/SASjsApi/swagger-ui.css');
+    var destination;
+    beforeAll(function () {
+        destination = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'sasjs-swagger-ui-'));
+        (0, swaggerUiAssets_1.copySwaggerUiAssets)(destination);
+    });
+    afterAll(function () {
+        fs_1.default.rmSync(destination, { recursive: true, force: true });
+    });
+    it('copies every asset the page loads from swagger-ui-dist', function () {
+        var distFolder = (0, swaggerUiAssets_1.swaggerUiDistFolder)();
+        for (var _i = 0, swaggerUiAssets_2 = swaggerUiAssets_1.swaggerUiAssets; _i < swaggerUiAssets_2.length; _i++) {
+            var file = swaggerUiAssets_2[_i];
+            expect(fs_1.default.existsSync(path_1.default.join(destination, file))).toBe(true);
+            expect(fs_1.default
+                .readFileSync(path_1.default.join(destination, file))
+                .equals(fs_1.default.readFileSync(path_1.default.join(distFolder, file)))).toBe(true);
+        }
+        // Apache-2.0: the licence and notice travel with the files
+        for (var _a = 0, swaggerUiNotices_1 = swaggerUiAssets_1.swaggerUiNotices; _a < swaggerUiNotices_1.length; _a++) {
+            var file = swaggerUiNotices_1[_a];
+            expect(fs_1.default.existsSync(path_1.default.join(destination, "swagger-ui-".concat(file)))).toBe(true);
+        }
+    });
+    it('loads the page and its styles from this folder, not from a third party', function () {
+        var html = page();
+        var loaded = [
+            'swagger-ui.css',
+            'swagger-ui-bundle.js',
+            'swagger-ui-standalone-preset.js',
+            'swagger-ui-init.js',
+            'favicon-32x32.png'
+        ];
+        for (var _i = 0, loaded_1 = loaded; _i < loaded_1.length; _i++) {
+            var file = loaded_1[_i];
+            expect(html).toContain("./".concat(file));
         }
+        var external = html.match(/(src|href)\s*=\s*["']?https?:\/\//gi) || [];
+        expect(external).toEqual([]);
     });
-    it('styles the summary wrapper the current bundle renders', function () {
-        var css = fs_1.default.readFileSync(servedCssPath, 'utf8');
-        // Without this rule the wrapper stays at its initial `display: block`, the
-        // path's `max-width: calc(100% - ...)` resolves against a narrow container,
-        // and every route renders one character per line.
-        expect(css).toContain('.opblock-summary-path-description-wrapper');
+    it('starts Swagger UI against the local spec with no third-party validator', function () {
+        var script = init();
+        expect(script).toContain("url: '/swagger.yaml'");
+        // the online validator posts the spec URL to validator.swagger.io
+        expect(script).toContain('validatorUrl: null');
+        // the API's own calls carry the session cookie and the CSRF header
+        expect(script).toContain("request.credentials = 'include'");
+        expect(script).toContain('X-XSRF-TOKEN');
     });
-    it('does not shadow the generated swagger-ui-init.js', function () {
-        // `swagger-ui-express` builds this file in memory from the options passed
-        // to `setup()` (its `swaggerInitFunction`), so it never needs to be on
-        // disk, and a checked-in copy wins over the generated one through the same
-        // static mount. That copy silently pins the Swagger UI to whatever
-        // `swaggerOptions` were in place when it was written, so edits to the
-        // route's options have no effect.
-        var initPath = path_1.default.join(apiRoot, 'public', 'SASjsApi', 'swagger-ui-init.js');
-        expect(fs_1.default.existsSync(initPath)).toBe(false);
+    it('keeps swagger-ui out of the runtime dependencies', function () {
+        // swagger-ui-dist is a devDependency: it is the source of the copied
+        // assets, and its tree carries @scarf/scarf's postinstall. Installing
+        // @sasjs/server must not run anything that calls out.
+        var manifest = JSON.parse(fs_1.default.readFileSync(path_1.default.join(apiRoot, 'package.json'), 'utf8'));
+        var runtime = Object.keys(manifest.dependencies || {});
+        expect(runtime).not.toContain('swagger-ui-express');
+        expect(runtime).not.toContain('swagger-ui-dist');
+        expect(Object.keys(manifest.devDependencies || {})).toContain('swagger-ui-dist');
     });
 });

package/build/src/utils/buildInfo.generated.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD_INFO = void 0;
 // Generated by scripts/generateBuildInfo.ts. Do not edit by hand.
 exports.BUILD_INFO = {
-    version: "v3.6.1",
-    gitHash: "5a53a5e",
-    buildDate: "2026-10-30T14:06:25.639Z"
+    version: "v3.7.0",
+    gitHash: "d1cc0c9",
+    buildDate: "2026-11-01T21:13:10.033Z"
 };

package/build/src/utils/swaggerUiAssets.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copySwaggerUiAssets = exports.swaggerUiDistFolder = exports.swaggerUiNotices = exports.swaggerUiAssets = void 0;
+var fs_1 = __importDefault(require("fs"));
+var path_1 = __importDefault(require("path"));
+/**
+ * The Swagger UI assets the API serves from its own public folder.
+ *
+ * They are generated from `swagger-ui-dist` at build time instead of being
+ * carried as a runtime dependency. `swagger-ui-dist` depends on `@scarf/scarf`,
+ * whose postinstall reports the installation to scarf.sh - a published package
+ * must not make outbound calls when it is installed, so nothing from
+ * swagger-ui-dist is installed with it. `swagger-ui-dist` stays a devDependency:
+ * it is the source these files are copied from, and swaggerAssets.spec.ts
+ * compares the two.
+ */
+exports.swaggerUiAssets = [
+    'swagger-ui.css',
+    'swagger-ui-bundle.js',
+    'swagger-ui-standalone-preset.js',
+    'favicon-16x16.png',
+    'favicon-32x32.png',
+    'oauth2-redirect.html'
+];
+/** Apache-2.0 requires the licence and the notice to travel with the files. */
+exports.swaggerUiNotices = ['LICENSE', 'NOTICE'];
+var swaggerUiDistFolder = function () {
+    return path_1.default.dirname(require.resolve('swagger-ui-dist/package.json'));
+};
+exports.swaggerUiDistFolder = swaggerUiDistFolder;
+/**
+ * Copies the browser assets, and the licence files, into `destination`.
+ *
+ * Same function for the build (`api/scripts/copySwaggerUi.ts`) and for the
+ * spec, so what the test compares is what the build produces.
+ */
+var copySwaggerUiAssets = function (destination) {
+    var source = (0, exports.swaggerUiDistFolder)();
+    fs_1.default.mkdirSync(destination, { recursive: true });
+    for (var _i = 0, swaggerUiAssets_1 = exports.swaggerUiAssets; _i < swaggerUiAssets_1.length; _i++) {
+        var file = swaggerUiAssets_1[_i];
+        fs_1.default.copyFileSync(path_1.default.join(source, file), path_1.default.join(destination, file));
+    }
+    for (var _a = 0, swaggerUiNotices_1 = exports.swaggerUiNotices; _a < swaggerUiNotices_1.length; _a++) {
+        var file = swaggerUiNotices_1[_a];
+        fs_1.default.copyFileSync(path_1.default.join(source, file), path_1.default.join(destination, "swagger-ui-".concat(file)));
+    }
+    return destination;
+};
+exports.copySwaggerUiAssets = copySwaggerUiAssets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/server",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "description": "NodeJS wrapper for calling the SAS binary executable",
   "license": "MIT",
   "repository": "https://github.com/sasjs/server",
@@ -35,7 +35,7 @@
     "express-session": "^1.19.0",
     "helmet": "^8.3.0",
     "http-headers-validation": "^0.0.2",
-    "joi": "^18.2.9",
+    "joi": "^18.3.1",
     "jose": "5.10.0",
     "jsonwebtoken": "^9.0.3",
     "ldapjs": "2.3.3",
@@ -43,7 +43,6 @@
     "morgan": "^1.12.1",
     "multer": "^2.4.0",
     "rotating-file-stream": "^3.2.10",
-    "swagger-ui-express": "5.0.1",
     "tsoa": "5.1.1",
     "unzipper": "^0.12.5",
     "url": "^0.11.4"