fix: sas9 public access denied handling

[medjedovicm]

Issue

Fixes #150

Intent

Covers the SAS9 Public Access Denied scenario. 2 places touched:

1. login() - User is not logged in. The login function is called with Public Account credentials. The adapter will return an object that contains an error message with error details and loggedIn is false. (image 1.)
2. request() - User with Public Account is already logged in within current browser. App loads, request function is called. The adapter will throw an error with details inside. (image 2.)

image 1.

image 2.

Checks

No PR (that involves a non-trivial code change) should be merged, unless all items below are confirmed! If an urgent fix is needed - use a tar file.

• All sasjs-cli unit tests are passing (npm test).
• (CI Runs this) All sasjs-tests are passing. If you want to run it manually (instructions available here).
• Data Controller builds and is functional on both SAS 9 and Viya

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	62.72%	2027/3232
🔴	Branches	44.67%	738/1652
🔴	Functions	53.56%	301/562
🟡	Lines	73.99% (+2.25% 🔼)	3283/4437

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Show files with reduced coverage 🔻

Reduced coverage

Status	Filename	Statements	Branches	Functions	Lines
🟢	src/job-execution/WebJobExecutor.ts	16.07%	2.6%	10.53%	100% (+72.85% 🔼)

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from 3556eb3

[YuryShkoda]

@medjedovicm please a test cases for both scenarios

[4gl-reviewer]

Bug: resolve(responseObject) on the next line will still execute after reject() is called. While the Promise is already settled (so resolve is a no-op), this is fragile and misleading. Add a return before reject:

if (this.isPublicAccessDenied(jsonResponse))
  return reject(
    new ErrorResponse('Public access has been denied', responseObject)
  )

[4gl-reviewer]

The isPublicAccessDenied function is duplicated — the same regex check exists as a module-level function in AuthManager.ts (line 414). Consider extracting it to a shared utility (e.g. utils/isPublicAccessDenied.ts) and importing in both places, to avoid drift if the error message pattern changes.

[4gl-reviewer]

The .catch() returns { result: '' } but the success path returns the full RequestClient.get response (which has .result plus other fields like .log). The caller does casSecurityCheckResponse.result so this works, but the return types are inconsistent — the catch path produces a partial object. Consider typing the return explicitly or using { result: '', log: '' } for consistency.

[4gl-reviewer]

Hermes Agent Code Review

Verdict: Request Changes — 1 bug, 2 warnings, merge conflict

Blocking Issues

1. Merge conflict — this PR is currently not mergeable (mergeable_state: dirty). Please rebase against main and resolve conflicts before this review can be considered for merge.

2. Bug: WebJobExecutor.ts:196 — resolve(responseObject) executes after reject() on the public-access-denied path. While the Promise is already settled (so resolve is a no-op), this is fragile and could break if the code is refactored. Add return before reject:

if (this.isPublicAccessDenied(jsonResponse))
  return reject(
    new ErrorResponse('Public access has been denied', responseObject)
  )

Warnings

3. Duplicated isPublicAccessDenied — The same regex check exists in both AuthManager.ts (module-level) and WebJobExecutor.ts (private method). Extract to a shared utility to avoid drift.

4. Inconsistent return type in performCASSecurityCheck catch — The .catch() returns { result: '' } (partial object) while the success path returns the full response with .result, .log, etc. Type the return explicitly for safety.

Looks Good

• Good test coverage: two new spec tests covering both logIn and redirectedLogIn paths for the public-access-denied scenario
• The errorMessage field addition to LoginResult is clean and backward-compatible (optional field)
• The regex pattern /Public access has been denied/gm is consistent across both implementations
• Mock response added to mockResponses.ts for test reuse

---

Reviewed by Hermes Agent (GitHub App)