@sasjs/server 3.6.2 → 3.7.1

package/README.md

@@ -19,55 +19,61 @@ SASjs Server is available in two modes - Desktop (without authentication) and Se
 
 ## Installation
 
-Installation can be made programmatically using command line, or by manually downloading and running the executable.
+Two channels - the npm package and the standalone executable. Both read the same
+environment variables and serve the same API.
 
-### Programmatic
+### npm
 
-Fetch the relevant package from github using `curl`, eg as follows (for linux):
+```bash
+npx @sasjs/server@3.6.2
+```
+
+Or install it once and run `sasjs-server` from then on:
 
 ```bash
-curl -L https://github.com/sasjs/server/releases/latest/download/linux.zip > linux.zip
-unzip linux.zip
+npm install -g @sasjs/server
+sasjs-server
 ```
 
-The app can then be launched with `./api-linux` and prompts followed (if ENV vars not set).
+Requires Node 22 or later. Useful where Node is already managed by the platform,
+and the only channel that runs on arm64 (Apple Silicon, Graviton, a Pi), because
+the standalone executables are built for x64 only.
 
-### Manual
+Three things to know before choosing it:
 
-1. Download the relevant package from the [releases](https://github.com/sasjs/server/releases) page
-2. Trigger by double clicking (windows) or executing from commandline.
+- **Pin the version**, as above: an unpinned `npx @sasjs/server` re-resolves
+  `latest` on every run, so a restart becomes a silent upgrade.
+- **`.env` is read from the working directory.** `dotenv.config()` is relative to
+  where the process starts, so run it from the project directory you want the
+  server to own (that directory also gets the `./sasjs_root`). Under `npx` the
+  package itself lives in an evictable `~/.npm/_npx/<hash>` cache, so an `.env`
+  placed there would be lost - it belongs beside the command, not the code.
+- **It starts in desktop mode**, the single-user mode. The `RUN_AS` check still
+  refuses to run as root, so install it under the account that should own the SAS
+  sessions rather than starting it with `sudo`.
 
-You are presented with two prompts (if not set as ENV vars):
+Installing the package runs no install script, so it makes no network call of its
+own.
 
-- Location of your `sas.exe` / `sas.sh` executable
-- Path to a filesystem location for Stored Programs and temporary files
+### Standalone executable
 
-## Deployment options
+Download the relevant package from the [releases](https://github.com/sasjs/server/releases)
+page, or fetch it programmatically (linux):
 
-The server runs as a standalone executable (above) and as a Node process. Both
-read the same environment variables and serve the same API.
+```bash
+curl -L https://github.com/sasjs/server/releases/latest/download/linux.zip > linux.zip
+unzip linux.zip
+```
 
-- **Standalone executable** - the zip from the releases page, with SAS and a data
-  path supplied either as prompts or as `SAS_PATH` / `DATA_DIR`.
-- **Node** - `npx @sasjs/server@3.4.0`, or `npm install -g @sasjs/server` and run
-  `sasjs-server`. Useful where Node is already managed by the platform, and the
-  only channel that runs on arm64 (Apple Silicon, Graviton, a Pi), because the
-  standalone executables are built for x64 only.
+Then launch `./api-linux` (on windows, double click `api-win.exe` - no
+administrative privileges are needed) and answer the two prompts, unless the ENV
+vars are set:
 
-Both channels read the same environment variables and serve the same API, with
-two differences worth knowing before choosing the Node one:
+- Location of your `sas.exe` / `sas.sh` executable
+- Path to a filesystem location for Stored Programs and temporary files
 
-- **Pin the version.** An unpinned `npx @sasjs/server` re-resolves `latest` on
-  every run, so a restart becomes a silent upgrade. The examples above pin it.
-- **`.env` is read from the working directory.** `dotenv.config()` is relative to
-  where the process starts, so run it from the project directory you want the
-  server to own (that directory also gets the `./sasjs_root`). Under `npx` the
-  package itself lives in an evictable `~/.npm/_npx/<hash>` cache, so an `.env`
-  placed there would be lost - it belongs beside the command, not the code.
+## Deployment options
 
-The Node channel starts in desktop mode, which is the single-user mode; the
-`RUN_AS` check still refuses to run as root, so install it under the account that
-should own the SAS sessions rather than starting it with `sudo`.
 - **Embedded** - the server's pieces are also used inside other SASjs tooling,
   such as the VS Code extension, and the mock backend runs in the browser for
   front-end development without a server at all.

package/build/src/e2e/studio.spec.js

@@ -98,6 +98,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  * the unit-test run deliberately excludes.
  */
 var path_1 = __importDefault(require("path"));
+var fs_1 = require("fs");
 var promises_1 = require("fs/promises");
 var mongoose_1 = __importDefault(require("mongoose"));
 var mongodb_memory_server_1 = require("mongodb-memory-server");
@@ -140,7 +141,11 @@ describe('Studio in a browser', function () {
                 case 2:
                     _a.sent();
                     _a.label = 3;
-                case 3: return [4 /*yield*/, (0, utils_1.fileExists)(path_1.default.join((0, utils_2.getWebBuildFolder)(), 'index.bundle.js'))];
+                case 3:
+                    // The screenshots folder is gitignored, so a fresh checkout has no such
+                    // directory and a failure screenshot would fail on the write itself.
+                    (0, fs_1.mkdirSync)(screenshotDir, { recursive: true });
+                    return [4 /*yield*/, (0, utils_1.fileExists)(path_1.default.join((0, utils_2.getWebBuildFolder)(), 'index.bundle.js'))];
                 case 4:
                     if (!(_a.sent())) {
                         throw new Error("No web build at ".concat((0, utils_2.getWebBuildFolder)(), ". Run `npm run build` in web/ before the browser test."));
@@ -185,7 +190,10 @@ describe('Studio in a browser', function () {
                     // An admin passes every route check, which keeps this test about the
                     // editor rather than about the permission model.
                     expect(dbUser.isAdmin).toBe(true);
-                    process.runTimes = [utils_2.RunTimeType.JS];
+                    // The fixture is a .sas program, and this suite never executes code for
+                    // real - the log case fulfils the execute request in the browser - so one
+                    // runtime, the one the fixture needs, keeps the editor from switching it.
+                    process.runTimes = [utils_2.RunTimeType.SAS];
                     process.nodeLoc = process.execPath;
                     return [4 /*yield*/, app];
                 case 13:
@@ -200,7 +208,15 @@ describe('Studio in a browser', function () {
                     return [4 /*yield*/, browser.newPage({ viewport: { width: 1280, height: 800 } })];
                 case 15:
                     page = _a.sent();
-                    page.on('pageerror', function (error) { return pageErrors.push(String(error)); });
+                    page.on('pageerror', function (error) {
+                        // A request the app aborts surfaces here as an unhandled rejection with
+                        // axios's "Canceled: Canceled". That is a request superseded by a newer one
+                        // - the editor re-syncing, a tab switching - not a fault in the tree, which
+                        // is what this collector exists to catch.
+                        if (String(error).includes('Canceled: Canceled'))
+                            return;
+                        pageErrors.push(String(error));
+                    });
                     page.on('request', function (request) {
                         var _a;
                         if (!request.url().includes('/SASjsApi/drive/fileTree'))
@@ -576,4 +592,83 @@ describe('Studio in a browser', function () {
             }
         });
     }); }, 60000);
+    it('lists the errors, warnings and notable notes of a SAS log, and hides the notes on request', function () { return __awaiter(void 0, void 0, void 0, function () {
+        var log, _a, _b, _c, stored;
+        return __generator(this, function (_d) {
+            switch (_d.label) {
+                case 0:
+                    log = [
+                        'NOTE: SAS (r) Proprietary Software 9.4 (TS1M9 MBCS3170)',
+                        '1    data want;',
+                        '2      x = age / 0;',
+                        '3    run;',
+                        'WARNING: Division by zero detected at line 3 column 11.',
+                        'NOTE: Variable y is uninitialized.',
+                        'ERROR Libref X is not assigned.',
+                        'NOTE 49-169: The meaning of an identifier after a quoted string may change.',
+                        'ERROR: File WORK.MISSING_DS.DATA does not exist.',
+                        ''
+                    ].join('\n');
+                    return [4 /*yield*/, page.route('**/SASjsApi/code/execute', function (route) {
+                            return route.fulfill({
+                                status: 200,
+                                contentType: 'text/plain',
+                                body: ['<html></html>', log, ''].join('SASJS_LOGS_SEPARATOR_163ee17b6ff24f028928972d80a26784')
+                            });
+                        })
+                        // The fixture program is a .sas file, so opening it selects the SAS runtime
+                        // and the log pane will render the parsed shape.
+                    ];
+                case 1:
+                    _d.sent();
+                    // The fixture program is a .sas file, so opening it selects the SAS runtime
+                    // and the log pane will render the parsed shape.
+                    return [4 /*yield*/, page.click('button:has-text("RUN")')];
+                case 2:
+                    // The fixture program is a .sas file, so opening it selects the SAS runtime
+                    // and the log pane will render the parsed shape.
+                    _d.sent();
+                    return [4 /*yield*/, page.waitForSelector('text=Errors (2)', { timeout: 30000 })];
+                case 3:
+                    _d.sent();
+                    _a = expect;
+                    return [4 /*yield*/, page.isVisible('text=Warnings (1)')];
+                case 4:
+                    _a.apply(void 0, [_d.sent()]).toBe(true);
+                    _b = expect;
+                    return [4 /*yield*/, page.isVisible('text=Notes (2)')];
+                case 5:
+                    _b.apply(void 0, [_d.sent()]).toBe(true);
+                    return [4 /*yield*/, page.screenshot({
+                            path: path_1.default.join(screenshotDir, '02-log-issues.png')
+                        })
+                        // The switch hides them without another run.
+                    ];
+                case 6:
+                    _d.sent();
+                    // The switch hides them without another run.
+                    return [4 /*yield*/, page.click('[aria-label="Hide notable notes"]')];
+                case 7:
+                    // The switch hides them without another run.
+                    _d.sent();
+                    return [4 /*yield*/, page.waitForSelector('text=Notes (2)', {
+                            state: 'detached',
+                            timeout: 30000
+                        })];
+                case 8:
+                    _d.sent();
+                    _c = expect;
+                    return [4 /*yield*/, page.isVisible('text=Errors (2)')];
+                case 9:
+                    _c.apply(void 0, [_d.sent()]).toBe(true);
+                    return [4 /*yield*/, page.evaluate(function () {
+                            return window.localStorage.getItem('studio-settings');
+                        })];
+                case 10:
+                    stored = _d.sent();
+                    expect(JSON.parse(stored)['log.notableNotes']).toBe(false);
+                    return [2 /*return*/];
+            }
+        });
+    }); }, 120000);
 });

package/build/src/routes/api/spec/csrfRouting.spec.js

@@ -0,0 +1,146 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+var supertest_1 = __importDefault(require("supertest"));
+var app_1 = __importDefault(require("../../../app"));
+var utils_1 = require("../../../utils");
+/**
+ * A path nothing claims is a 404, not a refused CSRF check (sasjs/server#495).
+ *
+ * The check hung off the web router's mount, so it ran before any route was
+ * matched: a POST to a path no route claims came back 400 'Invalid CSRF token!'
+ * - the same answer as a real request with a stale token. A caller reading that
+ * response cannot tell a typo in the URL from a token problem, and a frontend
+ * developer reading it sees a CSRF error for a URL that simply does not exist.
+ *
+ * The check stays on in desktop mode. It is the only cross-site defence that
+ * mode has - authenticateToken hands every request the fixed local user without
+ * asking for a credential, which is exactly what makes the session-bound token
+ * load bearing: without it, any page the user's browser has open can drive a
+ * POST at the local server. Fixing the 404-versus-400 confusion does not need
+ * the check dropped, so it is kept.
+ */
+describe('CSRF and routing order', function () {
+    var app;
+    var mode = process.env.MODE;
+    beforeAll(function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, app_1.default];
+                case 1:
+                    app = _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); });
+    afterEach(function () {
+        process.env.MODE = mode;
+    });
+    describe('server mode', function () {
+        beforeEach(function () {
+            process.env.MODE = utils_1.ModeType.Server;
+        });
+        it('answers a POST to an unclaimed path with 404', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, supertest_1.default)(app)
+                            .post('/NotAWebRoute')
+                            .send({ anything: true })];
+                    case 1:
+                        response = _a.sent();
+                        expect(response.status).toBe(404);
+                        expect(response.text).not.toContain('Invalid CSRF token!');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('still refuses a state-changing request that carries no token', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, supertest_1.default)(app)
+                            .post('/SASLogon/login')
+                            .send({ username: 'someone', password: 'something' })];
+                    case 1:
+                        response = _a.sent();
+                        expect(response.status).toBe(400);
+                        expect(response.text).toContain('Invalid CSRF token!');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+    describe('desktop mode', function () {
+        beforeEach(function () {
+            process.env.MODE = utils_1.ModeType.Desktop;
+        });
+        it('answers a POST to an unclaimed path with 404', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, supertest_1.default)(app)
+                            .post('/NotAWebRoute')
+                            .send({ anything: true })];
+                    case 1:
+                        response = _a.sent();
+                        expect(response.status).toBe(404);
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+        it('still refuses a login that carries no token', function () { return __awaiter(void 0, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0: return [4 /*yield*/, (0, supertest_1.default)(app)
+                            .post('/SASLogon/login')
+                            .send({ username: 'someone', password: 'something' })];
+                    case 1:
+                        response = _a.sent();
+                        expect(response.status).toBe(400);
+                        expect(response.text).toContain('Invalid CSRF token!');
+                        return [2 /*return*/];
+                }
+            });
+        }); });
+    });
+});

package/build/src/routes/web/index.js

@@ -8,7 +8,6 @@ var sas9_web_1 = __importDefault(require("./sas9-web"));
 var sasviya_web_1 = __importDefault(require("./sasviya-web"));
 var web_1 = __importDefault(require("./web"));
 var utils_1 = require("../../utils");
-var middlewares_1 = require("../../middlewares");
 var router = express_1.default.Router();
 var MOCK_SERVERTYPE = process.env.MOCK_SERVERTYPE;
 switch (MOCK_SERVERTYPE) {
@@ -21,7 +20,11 @@ switch (MOCK_SERVERTYPE) {
         break;
     }
     default: {
-        router.use('/', middlewares_1.csrfProtection, web_1.default);
+        // The CSRF check is attached to the routes that change state (see
+        // webRouter's POSTs) rather than to the mount: a mount-level check refuses a
+        // POST to a path no route claims, answering 400 where the truth is 404
+        // (sasjs/server#495).
+        router.use('/', web_1.default);
     }
 }
 exports.default = router;

package/build/src/routes/web/web.js

@@ -71,7 +71,7 @@ webRouter.get('/', function (req, res) { return __awaiter(void 0, void 0, void 0
         }
     });
 }); });
-webRouter.post('/SASLogon/login', middlewares_2.desktopRestrict, function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
+webRouter.post('/SASLogon/login', middlewares_2.csrfProtection, middlewares_2.desktopRestrict, function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
     var _a, error, body, lockoutRemaining, response, err_1;
     return __generator(this, function (_b) {
         switch (_b.label) {
@@ -112,7 +112,7 @@ webRouter.post('/SASLogon/login', middlewares_2.desktopRestrict, function (req,
         }
     });
 }); });
-webRouter.post('/SASLogon/authorize', middlewares_2.desktopRestrict, middlewares_2.authenticateAccessToken, function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
+webRouter.post('/SASLogon/authorize', middlewares_2.csrfProtection, middlewares_2.desktopRestrict, middlewares_2.authenticateAccessToken, function (req, res) { return __awaiter(void 0, void 0, void 0, function () {
     var _a, error, body, response, err_2;
     return __generator(this, function (_b) {
         switch (_b.label) {

package/build/src/utils/buildInfo.generated.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD_INFO = void 0;
 // Generated by scripts/generateBuildInfo.ts. Do not edit by hand.
 exports.BUILD_INFO = {
-    version: "v3.6.2",
-    gitHash: "6141e36",
-    buildDate: "2026-10-30T14:54:32.248Z"
+    version: "v3.7.1",
+    gitHash: "eb89808",
+    buildDate: "2026-11-01T22:27:31.287Z"
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/server",
-  "version": "3.6.2",
+  "version": "3.7.1",
   "description": "NodeJS wrapper for calling the SAS binary executable",
   "license": "MIT",
   "repository": "https://github.com/sasjs/server",
@@ -35,7 +35,7 @@
     "express-session": "^1.19.0",
     "helmet": "^8.3.0",
     "http-headers-validation": "^0.0.2",
-    "joi": "^18.2.9",
+    "joi": "^18.3.1",
     "jose": "5.10.0",
     "jsonwebtoken": "^9.0.3",
     "ldapjs": "2.3.3",