chore: draw.io diagram of authentication

2025-12-10 19:34:34 +00:00 · 2022-02-10 18:38:24 +05:00
199 changed files with 45355 additions and 33275 deletions
--- a/.all-contributorsrc
+++ b/.all-contributorsrc
@@ -1,84 +0,0 @@
-{
-  "projectName": "server",
-  "projectOwner": "sasjs",
-  "repoType": "github",
-  "repoHost": "https://github.com",
-  "files": [
-    "README.md"
-  ],
-  "imageSize": 100,
-  "commit": true,
-  "commitConvention": "angular",
-  "contributors": [
-    {
-      "login": "saadjutt01",
-      "name": "Saad Jutt",
-      "avatar_url": "https://avatars.githubusercontent.com/u/8914650?v=4",
-      "profile": "https://github.com/saadjutt01",
-      "contributions": [
-        "code",
-        "test"
-      ]
-    },
-    {
-      "login": "sabhas",
-      "name": "Sabir Hassan",
-      "avatar_url": "https://avatars.githubusercontent.com/u/82647447?v=4",
-      "profile": "https://github.com/sabhas",
-      "contributions": [
-        "code",
-        "test"
-      ]
-    },
-    {
-      "login": "YuryShkoda",
-      "name": "Yury Shkoda",
-      "avatar_url": "https://avatars.githubusercontent.com/u/25773492?v=4",
-      "profile": "https://www.erudicat.com/",
-      "contributions": [
-        "code",
-        "test"
-      ]
-    },
-    {
-      "login": "medjedovicm",
-      "name": "Mihajlo Medjedovic",
-      "avatar_url": "https://avatars.githubusercontent.com/u/18329105?v=4",
-      "profile": "https://github.com/medjedovicm",
-      "contributions": [
-        "code",
-        "test"
-      ]
-    },
-    {
-      "login": "allanbowe",
-      "name": "Allan Bowe",
-      "avatar_url": "https://avatars.githubusercontent.com/u/4420615?v=4",
-      "profile": "https://4gl.io/",
-      "contributions": [
-        "code",
-        "doc"
-      ]
-    },
-    {
-      "login": "VladislavParhomchik",
-      "name": "Vladislav Parhomchik",
-      "avatar_url": "https://avatars.githubusercontent.com/u/83717836?v=4",
-      "profile": "https://github.com/VladislavParhomchik",
-      "contributions": [
-        "test"
-      ]
-    },
-    {
-      "login": "kknapen",
-      "name": "Koen Knapen",
-      "avatar_url": "https://avatars.githubusercontent.com/u/78609432?v=4",
-      "profile": "https://github.com/kknapen",
-      "contributions": [
-        "userTesting"
-      ]
-    }
-  ],
-  "contributorsPerLine": 7,
-  "skipCi": true
-}
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,4 @@
-SAS_EXEC_PATH=<path to folder containing SAS executable>
-SAS_EXEC_NAME=<name of SAS executable file>
+SAS_EXEC=<path to folder containing SAS executable 'sas'>
 PORT_API=<port for sasjs server (api)>
 PORT_WEB=<port for sasjs web component(react)>
 ACCESS_TOKEN_SECRET=<secret>
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -1,114 +0,0 @@
-# CONTRIBUTING
-
-Contributions are very welcome!  Feel free to raise an issue or start a discussion, for help in getting started.
-
-The app can be deployed using Docker or NodeJS.
-
-## Configuration
-
-Configuration is made using `.env` files (per [README.md](https://github.com/sasjs/server#env-var-configuration) settings), _except_ for one case, when running in NodeJS in production - in which case the path to the SAS executable is made in the `configuration` section of `package.json`.
-
-The `.env` file should be created in the location(s) below.  Each folder contains a `.env.example` file that may be adjusted and renamed.
-
-* `.env` - the root .env file is used only for Docker deploys.
-* `api/.env` - this is the primary file used in NodeJS deploys
-* `web/.env` - this file is only necessary in NodeJS when running `web` and `api` seperately (on different ports).
-
-
-## Using Docker
-
-### Docker Development Mode
-
-Command to run docker for development:
-
-```
-docker-compose up -d
-```
-
-It uses default docker compose file i.e. `docker-compose.yml` present at root.
-It will build following images if running first time:
-
- `sasjs_server_api` - image for sasjs api server app based on _ExpressJS_
- `sasjs_server_web` - image for sasjs web component app based on _ReactJS_
- `mongodb` - image for mongo database
- `mongo-seed-users` - will be populating user data specified in _./mongo-seed/users/user.json_
- `mongo-seed-clients` - will be populating client data specified in _./mongo-seed/clients/client.json_
-
-
-### Docker Production Mode
-
-Command to run docker for production:
-
-```
-docker-compose -f docker-compose.prod.yml up -d
-```
-
-It uses specified docker compose file i.e. `docker-compose.prod.yml` present at root.
-It will build following images if running first time:
-
- `sasjs_server_prod` - image for sasjs server app containing api and web component's build served at route `/`
- `mongodb` - image for mongo database
- `mongo-seed-users` - will be populating user data specified in _./mongo-seed/users/user.json_
- `mongo-seed-clients` - will be populating client data specified in _./mongo-seed/clients/client.json_
-
-## Using NodeJS:
-
-Be sure to use v16 or above, and to set your environment variables in the relevant `.env` file(s) - else defaults will be used.
-
-### NodeJS Development Mode
-
-SASjs Server is split between an API server (serving REST requests) and a WEB Server (everything else).  These can be run together, or on seperate ports.
-
-### NodeJS Dev - Single Port
-
-Here the environment variables should be configured under `api.env`.  Then:
-
-```
-cd ./web && npm i && npm build
-cd ../api && npm i && npm start
-```
-
-### NodeJS Dev - Seperate Ports
-
-Set the backend variables in `api/.env` and the frontend variables in `web/.env`. Then:
-
-#### API server
-```
-cd api
-npm install
-npm start
-```
-
-#### Web Server 
-
-```
-cd web
-npm install
-npm start
-```
-
-#### NodeJS Production Mode
-
-Update the `.env` file in the *api* folder.  Then:
-
-```
-npm run server
-```
-
-This will install/build `web` and install `api`, then start prod server.
-
-
-## Executables
-
-In order to generate the final executables:
-
-```
-cd ./web && npm i && npm build && cd ../
-cd ./api && npm i && npm run exe
-```
-
-This will install/build web app and install/create executables of sasjs server at root `./executables`
-
-## Releases
-
-To cut a release, run `npm run release` on the main branch, then push the tags (per the console log link)
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-github: [sasjs]
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,10 +54,6 @@ jobs:
          ACCESS_TOKEN_SECRET: ${{secrets.ACCESS_TOKEN_SECRET}}
          REFRESH_TOKEN_SECRET: ${{secrets.REFRESH_TOKEN_SECRET}}
          AUTH_CODE_SECRET: ${{secrets.AUTH_CODE_SECRET}}
-          SESSION_SECRET: ${{secrets.SESSION_SECRET}}
-          RUN_TIMES: 'sas,js'
-          SAS_PATH: '/some/path/to/sas'
-          NODE_PATH: '/some/path/to/node'

      - name: Build Package
        working-directory: ./api
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,26 +2,16 @@ name: SASjs Server Executable Release

 on:
  push:
-    branches:
-      - main
+    tags:
+      - 'v*.*.*'

 jobs:
  release:
    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [lts/*]
-
    steps:
      - name: Checkout
        uses: actions/checkout@v2

-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v2
-        with:
-          node-version: ${{ matrix.node-version }}
-
      - name: Install Dependencies WEB
        working-directory: ./web
        run: npm ci
@@ -49,11 +39,10 @@ jobs:
          zip macos.zip api-macos
          zip windows.zip api-win.exe

-      - name: Install Semantic Release and plugins
-        run: |
-          npm i
-          npm i -g semantic-release
-
      - name: Release
-        run: |
-          GITHUB_TOKEN=${{ secrets.GH_TOKEN }} semantic-release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            ./executables/linux.zip
+            ./executables/macos.zip
+            ./executables/windows.zip
--- a/.gitignore
+++ b/.gitignore
@@ -4,12 +4,9 @@ node_modules/
 .DS_Store
 .env*
 sas/
-sasjs_root/
 tmp/
 build/
 sasjsbuild/
-sasjscore/
 certificates/
 executables/
 .env
-api/csp.config.json
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -1,10 +0,0 @@
-# This configuration file was automatically generated by Gitpod.
-# Please adjust to your needs (see https://www.gitpod.io/docs/config-gitpod-file)
-# and commit this file to your remote git repository to share the goodness with others.
-
-tasks:
-  - init: npm install
-vscode:
-  extensions:
-    - dbaeumer.vscode-eslint
-    - sasjs.sasjs-for-vscode
--- a/.nvmrc
+++ b/.nvmrc
@@ -1 +0,0 @@
-v16.15.1
--- a/.releaserc
+++ b/.releaserc
@@ -1,43 +0,0 @@
-{
-  "branches": [
-    "main"
-  ],
-  "plugins": [
-    "@semantic-release/commit-analyzer",
-    "@semantic-release/release-notes-generator",
-    "@semantic-release/changelog",
-    [
-      "@semantic-release/git",
-      {
-        "assets": [
-          "CHANGELOG.md"
-        ]
-      }
-    ],
-    [
-      "@semantic-release/github",
-      {
-        "assets": [
-          {
-            "path": "./executables/linux.zip",
-            "label": "Linux Executable Binary"
-          },
-          {
-            "path": "./executables/macos.zip",
-            "label": "Macos Executable Binary"
-          },
-          {
-            "path": "./executables/windows.zip",
-            "label": "Windows Executable Binary"
-          }
-        ]
-      }
-    ],
-    [
-      "@semantic-release/exec",
-      {
-        "publishCmd": "echo 'publish command'"
-      }
-    ]
-  ]
-}
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,977 +1,6 @@
-## [0.17.1](https://github.com/sasjs/server/compare/v0.17.0...v0.17.1) (2022-08-30)
+# Changelog

-
-### Bug Fixes
-
-* typo mistake ([ee17d37](https://github.com/sasjs/server/commit/ee17d37aa188b0ca43cea0e89d6cd1a566b765cb))
-
-# [0.17.0](https://github.com/sasjs/server/compare/v0.16.1...v0.17.0) (2022-08-25)
-
-
-### Bug Fixes
-
-* allow underscores in file name ([bce83cb](https://github.com/sasjs/server/commit/bce83cb6fbc98f8198564c9399821f5829acc767))
-
-
-### Features
-
-* add the functionality of saving file by ctrl + s in editor ([3a3c90d](https://github.com/sasjs/server/commit/3a3c90d9e690ac5267bf1acc834b5b5c5b4dadb6))
-
-## [0.16.1](https://github.com/sasjs/server/compare/v0.16.0...v0.16.1) (2022-08-24)
-
-
-### Bug Fixes
-
-* update response of /SASjsApi/stp/execute and /SASjsApi/code/execute ([98ea2ac](https://github.com/sasjs/server/commit/98ea2ac9b98631605e39e5900e533727ea0e3d85))
-
-# [0.16.0](https://github.com/sasjs/server/compare/v0.15.3...v0.16.0) (2022-08-17)
-
-
-### Bug Fixes
-
-* add a new variable _SASJS_WEBOUT_HEADERS to code.js and code.py ([882bedd](https://github.com/sasjs/server/commit/882bedd5d5da22de6ed45c03d0a261aadfb3a33c))
-* update content for code.sas file ([02e88ae](https://github.com/sasjs/server/commit/02e88ae7280d020a753bc2c095a931c79ac392d1))
-* update default content type for python and js runtimes ([8780b80](https://github.com/sasjs/server/commit/8780b800a34aa618631821e5d97e26e8b0f15806))
-
-
-### Features
-
-* implement the logic for running python stored programs ([b06993a](https://github.com/sasjs/server/commit/b06993ab9ea24b28d9e553763187387685aaa666))
-
-## [0.15.3](https://github.com/sasjs/server/compare/v0.15.2...v0.15.3) (2022-08-11)
-
-
-### Bug Fixes
-
-* adding proc printto in precode to enable print output in log.  Closes [#253](https://github.com/sasjs/server/issues/253) ([f8bb732](https://github.com/sasjs/server/commit/f8bb7327a8a4649ac77bb6237e31cea075d46bb9))
-
-## [0.15.2](https://github.com/sasjs/server/compare/v0.15.1...v0.15.2) (2022-08-10)
-
-
-### Bug Fixes
-
-* remove vulnerabitities ([f27ac51](https://github.com/sasjs/server/commit/f27ac51fc4beb21070d0ab551cfdaec1f6ba39e0))
-
-## [0.15.1](https://github.com/sasjs/server/compare/v0.15.0...v0.15.1) (2022-08-10)
-
-
-### Bug Fixes
-
-* **web:** fix UI responsiveness ([d99fdd1](https://github.com/sasjs/server/commit/d99fdd1ec7991b94a0d98338d7a7a6216f46ce45))
-
-# [0.15.0](https://github.com/sasjs/server/compare/v0.14.1...v0.15.0) (2022-08-05)
-
-
-### Bug Fixes
-
-* after selecting file in sidebar collapse sidebar in mobile view ([e215958](https://github.com/sasjs/server/commit/e215958b8b05d7a8ce9d82395e0640b5b37fb40d))
-* improve mobile view for studio page ([c67d3ee](https://github.com/sasjs/server/commit/c67d3ee2f102155e2e9781e13d5d33c1ab227cb4))
-* improve responsiveness for mobile view ([6ef40b9](https://github.com/sasjs/server/commit/6ef40b954a87ebb0a2621119064f38d58ea85148))
-* improve user experience for adding permissions ([7a162ed](https://github.com/sasjs/server/commit/7a162eda8fc60383ff647d93e6611799e2e6af7a))
-* show logout button only when user is logged in ([9227cd4](https://github.com/sasjs/server/commit/9227cd449dc46fd960a488eb281804a9b9ffc284))
-
-
-### Features
-
-* add multiple permission for same combination of type and principal at once ([754704b](https://github.com/sasjs/server/commit/754704bca89ecbdbcc3bd4ef04b94124c4f24167))
-
-## [0.14.1](https://github.com/sasjs/server/compare/v0.14.0...v0.14.1) (2022-08-04)
-
-
-### Bug Fixes
-
-* **apps:** App Stream logo fix ([87c03c5](https://github.com/sasjs/server/commit/87c03c5f8dbdfc151d4ff3722ecbcd3f7e409aea))
-* **cookie:** XSRF cookie is removed and passed token in head section ([77f8d30](https://github.com/sasjs/server/commit/77f8d30baf9b1077279c29f1c3e5ca02a5436bc0))
-* **env:** check added for not providing WHITELIST ([5966016](https://github.com/sasjs/server/commit/5966016853369146b27ac5781808cb51d65c887f))
-* **web:** show login on logged-out state ([f7fcc77](https://github.com/sasjs/server/commit/f7fcc7741aa2af93a4a2b1e651003704c9bbff0c))
-
-# [0.14.0](https://github.com/sasjs/server/compare/v0.13.3...v0.14.0) (2022-08-02)
-
-
-### Bug Fixes
-
-* add restriction on  add/remove user to public group ([d3a516c](https://github.com/sasjs/server/commit/d3a516c36e45aa1cc76c30c744e6a0e5bd553165))
-* call jwt.verify in synchronous way ([254bc07](https://github.com/sasjs/server/commit/254bc07da744a9708109bfb792be70aa3f6284f4))
-
-
-### Features
-
-* add public group to DB on seed ([c3e3bef](https://github.com/sasjs/server/commit/c3e3befc17102ee1754e1403193040b4f79fb2a7))
-* bypass authentication when route is enabled for public group ([68515f9](https://github.com/sasjs/server/commit/68515f95a65d422e29c0ed6028f3ea0ae8d9b1bf))
-
-## [0.13.3](https://github.com/sasjs/server/compare/v0.13.2...v0.13.3) (2022-08-02)
-
-
-### Bug Fixes
-
-* show non-admin user his own permissions only ([8a3054e](https://github.com/sasjs/server/commit/8a3054e19ade82e2792cfb0f2a8af9e502c5eb52))
-* update schema of Permission ([5d5a9d3](https://github.com/sasjs/server/commit/5d5a9d3788281d75c56f68f0dff231abc9c9c275))
-
-## [0.13.2](https://github.com/sasjs/server/compare/v0.13.1...v0.13.2) (2022-08-01)
-
-
-### Bug Fixes
-
-* adding ls=max to reduce log size and improve readability ([916947d](https://github.com/sasjs/server/commit/916947dffacd902ff23ac3e899d1bf5ab6238b75))
-
-## [0.13.1](https://github.com/sasjs/server/compare/v0.13.0...v0.13.1) (2022-07-31)
-
-
-### Bug Fixes
-
-* adding options to prevent unwanted windows on windows.  Closes [#244](https://github.com/sasjs/server/issues/244) ([77db14c](https://github.com/sasjs/server/commit/77db14c690e18145d733ac2b0d646ab0dbe4d521))
-
-# [0.13.0](https://github.com/sasjs/server/compare/v0.12.1...v0.13.0) (2022-07-28)
-
-
-### Bug Fixes
-
-* autofocus input field and submit on enter ([7681722](https://github.com/sasjs/server/commit/7681722e5afdc2df0c9eed201b05add3beda92a7))
-* move api button to user menu ([8de032b](https://github.com/sasjs/server/commit/8de032b5431b47daabcf783c47ff078bf817247d))
-
-
-### Features
-
-* add action and command to editor ([706e228](https://github.com/sasjs/server/commit/706e228a8e1924786fd9dc97de387974eda504b1))
-
-## [0.12.1](https://github.com/sasjs/server/compare/v0.12.0...v0.12.1) (2022-07-26)
-
-
-### Bug Fixes
-
-* **web:** disable launch icon button when file content is not saved ([c574b42](https://github.com/sasjs/server/commit/c574b4223591c4a6cd3ef5e146ce99cd8f7c9190))
-* **web:** saveAs functionality fixed in studio page ([3c987c6](https://github.com/sasjs/server/commit/3c987c61ddc258f991e2bf38c1f16a0c4248d6ae))
-* **web:** show original name as default name in rename file/folder modal ([9640f65](https://github.com/sasjs/server/commit/9640f6526496f3564664ccb1f834d0f659dcad4e))
-* **web:** webout tab item fixed in studio page ([7cdffe3](https://github.com/sasjs/server/commit/7cdffe30e36e5cad0284f48ea97925958e12704c))
-* **web:** when no file is selected save the editor content to local storage ([3b1fcb9](https://github.com/sasjs/server/commit/3b1fcb937d06d02ab99c9e8dbe307012d48a7a3a))
-
-# [0.12.0](https://github.com/sasjs/server/compare/v0.11.5...v0.12.0) (2022-07-26)
-
-
-### Bug Fixes
-
-* fileTree api response to include an additional attribute isFolder ([0f19384](https://github.com/sasjs/server/commit/0f193849994f1ac8a071afa8f10af5b46f86663d))
-* remove drive component ([06d7c91](https://github.com/sasjs/server/commit/06d7c91fc34620a954df1fd1c682eff370f79ca6))
-
-
-### Features
-
-* add api end point for delete folder ([08e0c61](https://github.com/sasjs/server/commit/08e0c61e0fd7041d6cded6f4d71fbb410e5615ce))
-* add sidebar(drive) to left of studio ([6c35412](https://github.com/sasjs/server/commit/6c35412d2f5180d4e49b12e616576d8b8dacb7d8))
-* created api endpoint for adding empty folder in drive ([941917e](https://github.com/sasjs/server/commit/941917e508ece5009135f9dddf99775dd4002f78))
-* implemented api for renaming file/folder ([fdcaba9](https://github.com/sasjs/server/commit/fdcaba9d56cddea5d56d7de5a172f1bb49be3db5))
-* implemented delete file/folder functionality ([177675b](https://github.com/sasjs/server/commit/177675bc897416f7994dd849dc7bb11ba072efe9))
-* implemented functionality for adding file/folder from sidebar context menu ([0ce94a5](https://github.com/sasjs/server/commit/0ce94a553e53bfcdbd6273b26b322095a080a341))
-* implemented the functionality for renaming file/folder from context menu ([7010a6a](https://github.com/sasjs/server/commit/7010a6a1201720d0eb4093267a344fb828b90a2f))
-* prevent user from leaving studio page when there are unsaved changes ([6c75502](https://github.com/sasjs/server/commit/6c7550286b5f505e9dfe8ca63c62fa1db1b60b2e))
-* **web:** add difference view editor in studio ([420a61a](https://github.com/sasjs/server/commit/420a61a5a6b11dcb5eb0a652ea9cecea5c3bee5f))
-
-## [0.11.5](https://github.com/sasjs/server/compare/v0.11.4...v0.11.5) (2022-07-19)
-
-
-### Bug Fixes
-
-* Revert "fix(security): missing cookie flags are added" ([ce5218a](https://github.com/sasjs/server/commit/ce5218a2278cc750f2b1032024685dc6cd72f796))
-
-## [0.11.4](https://github.com/sasjs/server/compare/v0.11.3...v0.11.4) (2022-07-19)
-
-
-### Bug Fixes
-
-* **security:** missing cookie flags are added ([526402f](https://github.com/sasjs/server/commit/526402fd73407ee4fa2d31092111a7e6a1741487))
-
-## [0.11.3](https://github.com/sasjs/server/compare/v0.11.2...v0.11.3) (2022-07-19)
-
-
-### Bug Fixes
-
-* filePath fix in code.js file for windows ([2995121](https://github.com/sasjs/server/commit/299512135d77c2ac9e34853cf35aee6f2e1d4da4))
-
-## [0.11.2](https://github.com/sasjs/server/compare/v0.11.1...v0.11.2) (2022-07-18)
-
-
-### Bug Fixes
-
-* apply icon option only for sas.exe ([d2ddd8a](https://github.com/sasjs/server/commit/d2ddd8aacadfdd143026881f2c6ae8c6b277610a))
-
-## [0.11.1](https://github.com/sasjs/server/compare/v0.11.0...v0.11.1) (2022-07-18)
-
-
-### Bug Fixes
-
-* bank operator ([aa02741](https://github.com/sasjs/server/commit/aa027414ed3ce51f1014ef36c4191e064b2e963d))
-* ensuring nosplash option only applies for sas.exe ([65e6de9](https://github.com/sasjs/server/commit/65e6de966383fe49a919b1f901d77c7f1e402c9b)), closes [#229](https://github.com/sasjs/server/issues/229)
-
-# [0.11.0](https://github.com/sasjs/server/compare/v0.10.0...v0.11.0) (2022-07-16)
-
-
-### Bug Fixes
-
-* **logs:** logs location is configurable ([e024a92](https://github.com/sasjs/server/commit/e024a92f165990e08db8aa26ee326dbcb30e2e46))
-
-
-### Features
-
-* **logs:** logs to file with rotating + code split into files ([92fda18](https://github.com/sasjs/server/commit/92fda183f3f0f3956b7c791669eb8dd52c389d1b))
-
-# [0.10.0](https://github.com/sasjs/server/compare/v0.9.0...v0.10.0) (2022-07-06)
-
-
-### Bug Fixes
-
-* add authorize middleware for appStreams ([e54a09d](https://github.com/sasjs/server/commit/e54a09db19ec8690e54a40760531a4e06d250974))
-* add isAdmin attribute to return response of get session and login requests ([bdf63df](https://github.com/sasjs/server/commit/bdf63df1d915892486005ec904807749786b1c0c))
-* add permission authorization middleware to only specific routes ([f3dfc70](https://github.com/sasjs/server/commit/f3dfc7083fbfb4b447521341b1a86730fb90b4c0))
-* bumping core and running lint ([a2d1396](https://github.com/sasjs/server/commit/a2d13960578014312d2cb5e03145bfd1829d99ec))
-* controller fixed for deleting permission ([b5f595a](https://github.com/sasjs/server/commit/b5f595a25c50550d62482409353c7629c5a5c3e0))
-* do not show admin users in add permission modal ([a75edba](https://github.com/sasjs/server/commit/a75edbaa327ec2af49523c13996ac283061da7d8))
-* export GroupResponse interface ([38a7db8](https://github.com/sasjs/server/commit/38a7db8514de0acd94d74ba96bc1efb732add30c))
-* move permission filter modal to separate file and icons for different actions ([d000f75](https://github.com/sasjs/server/commit/d000f7508f6d7384afffafee4179151fca802ca8))
-* principalId type changed to  number from any ([4fcc191](https://github.com/sasjs/server/commit/4fcc191ce9edc7e4dcd8821fb8019f4eea5db4ea))
-* remove clientId from principal types ([0781ddd](https://github.com/sasjs/server/commit/0781ddd64e3b5e5ca39647bb4e4e1a9332a0f4f8))
-* remove duplicates principals from permission filter modal ([5b319f9](https://github.com/sasjs/server/commit/5b319f9ad1f941b306db6b9473a2128b2e42bf76))
-* show loading spinner in studio while executing code ([496247d](https://github.com/sasjs/server/commit/496247d0b9975097a008cf4d3a999d77648fd930))
-* show permission component only in server mode ([f863b81](https://github.com/sasjs/server/commit/f863b81a7d40a1296a061ec93946f204382af2c3))
-* update permission model ([39fc908](https://github.com/sasjs/server/commit/39fc908de1945f2aaea18d14e6bce703f6bf0c06))
-* update permission response ([e516b77](https://github.com/sasjs/server/commit/e516b7716da5ff7e23350a5f77cfa073b1171175))
-* **web:** only admin should be able to add, update or delete permission ([be8635c](https://github.com/sasjs/server/commit/be8635ccc5eb34c3f0a5951c8a0421292ef69c97))
-
-
-### Features
-
-* add api endpoint for deleting permission ([0171344](https://github.com/sasjs/server/commit/01713440a4fa661b76368785c0ca731f096ac70a))
-* add api endpoint for updating permission setting ([540f54f](https://github.com/sasjs/server/commit/540f54fb77b364822da7889dbe75c02242f48a59))
-* add authorize middleware for validating permissions ([7d916ec](https://github.com/sasjs/server/commit/7d916ec3e9ef579dde1b73015715cd01098c2018))
-* add basic UI for settings and permissions ([5652325](https://github.com/sasjs/server/commit/56523254525a66e756196e90b39a2b8cdadc1518))
-* add documentation link under usename dropdown menu ([eeb63b3](https://github.com/sasjs/server/commit/eeb63b330c292afcdd5c8f006882b224c4235068))
-* add permission model ([6bea1f7](https://github.com/sasjs/server/commit/6bea1f76668ddb070ad95b3e02c31238af67c346))
-* add UI for updating permission ([e8c21a4](https://github.com/sasjs/server/commit/e8c21a43b215f5fced0463b70747cda1191a4e01))
-* add validation for registering permission ([e5200c1](https://github.com/sasjs/server/commit/e5200c1000903185dfad9ee49c99583e473c4388))
-* add, remove and update permissions from web component ([97ecfdc](https://github.com/sasjs/server/commit/97ecfdc95563c72dbdecaebcb504e5194250a763))
-* added get authorizedRoutes api endpoint ([b10e932](https://github.com/sasjs/server/commit/b10e9326058193dd65a57fab2d2f05b7b06096e7))
-* created modal for adding permission ([1413b18](https://github.com/sasjs/server/commit/1413b1850838ecc988ab289da4541bde36a9a346))
-* defined register permission and get all permissions api endpoints ([1103ffe](https://github.com/sasjs/server/commit/1103ffe07b88496967cb03683b08f058ca3bbb9f))
-* update swagger docs ([797c2bc](https://github.com/sasjs/server/commit/797c2bcc39005a05a995be15a150d584fecae259))
-
-# [0.9.0](https://github.com/sasjs/server/compare/v0.8.3...v0.9.0) (2022-07-03)
-
-
-### Features
-
-* removed secrets from env variables ([9c3da56](https://github.com/sasjs/server/commit/9c3da56901672a818f54267f9defc9f4701ab7fb))
-
-## [0.8.3](https://github.com/sasjs/server/compare/v0.8.2...v0.8.3) (2022-07-02)
-
-
-### Bug Fixes
-
-* **deploy:** extract first json from zip file ([e290751](https://github.com/sasjs/server/commit/e290751c872d24009482871a8c398e834357dcde))
-
-## [0.8.2](https://github.com/sasjs/server/compare/v0.8.1...v0.8.2) (2022-06-22)
-
-
-### Bug Fixes
-
-* getRuntimeAndFilePath function to handle the scenarion when path is provided with an extension other than runtimes ([5cc85b5](https://github.com/sasjs/server/commit/5cc85b57f80b13296156811fe966d7b37d45f213))
-
-## [0.8.1](https://github.com/sasjs/server/compare/v0.8.0...v0.8.1) (2022-06-21)
-
-
-### Bug Fixes
-
-* make CA_ROOT optional in getCertificates method ([1b5859e](https://github.com/sasjs/server/commit/1b5859ee37ae73c419115b9debfd5141a79733de))
-* update /logout route to /SASLogon/logout ([65380be](https://github.com/sasjs/server/commit/65380be2f3945bae559f1749064845b514447a53))
-
-# [0.8.0](https://github.com/sasjs/server/compare/v0.7.3...v0.8.0) (2022-06-21)
-
-
-### Features
-
-* **certs:** ENV variables updated and set CA Root for HTTPS server ([2119e9d](https://github.com/sasjs/server/commit/2119e9de9ab1e5ce1222658f554ac74f4f35cf4d))
-
-## [0.7.3](https://github.com/sasjs/server/compare/v0.7.2...v0.7.3) (2022-06-20)
-
-
-### Bug Fixes
-
-* path descriptions and defaults ([5d5d6ce](https://github.com/sasjs/server/commit/5d5d6ce3265a43af2e22bcd38cda54fafaf7b3ef))
-
-## [0.7.2](https://github.com/sasjs/server/compare/v0.7.1...v0.7.2) (2022-06-20)
-
-
-### Bug Fixes
-
-* removing UTF-8 options from commandline.  There appears to be no reliable way to enforce ([f6dc74f](https://github.com/sasjs/server/commit/f6dc74f16bddafa1de9c83c2f27671a241abdad4))
-
-## [0.7.1](https://github.com/sasjs/server/compare/v0.7.0...v0.7.1) (2022-06-20)
-
-
-### Bug Fixes
-
-* default runtime should be sas ([91d29cb](https://github.com/sasjs/server/commit/91d29cb1272c28afbceaf39d1e0a87e17fbfdcd6))
-* **Studio:** default selection of runtime fixed ([eb569c7](https://github.com/sasjs/server/commit/eb569c7b827c872ed2c4bc114559b97d87fd2aa0))
-* webout path fixed in code.js when running on windows ([99a1107](https://github.com/sasjs/server/commit/99a110736448f66f99a512396b268fc31a3feef0))
-
-# [0.7.0](https://github.com/sasjs/server/compare/v0.6.1...v0.7.0) (2022-06-19)
-
-
-### Bug Fixes
-
-* add runtimes to global process object ([194eaec](https://github.com/sasjs/server/commit/194eaec7d4a561468f83bf6efce484909ee532eb))
-* code fixes for executing program from program path including file extension ([53854d0](https://github.com/sasjs/server/commit/53854d001279462104b24c0e59a8c94ab4938a94))
-* code/execute controller logic to handle different runtimes ([23b6692](https://github.com/sasjs/server/commit/23b6692f02e4afa33c9dc95d242eb8645c19d546))
-* convert single executeProgram method to two methods i.e. executeSASProgram and executeJSProgram ([c58666e](https://github.com/sasjs/server/commit/c58666eb81514de500519e7b96c1981778ec149b))
-* no need to stringify _webout in preProgramVarStatements, developer should have _webout as string in actual code ([9d5a5e0](https://github.com/sasjs/server/commit/9d5a5e051fd821295664ddb3a1fd64629894a44c))
-* pass _program to execute file without extension ([5df619b](https://github.com/sasjs/server/commit/5df619b3f63571e8e326261d8114869d33881d91))
-* refactor code for session selection in preUploadMiddleware function ([b444381](https://github.com/sasjs/server/commit/b4443819d42afecebc0f382c58afb9010d4775ef))
-* refactor code in executeFile method of session controller ([dffe6d7](https://github.com/sasjs/server/commit/dffe6d7121d569e5c7d13023c6ca68d8c901c88e))
-* refactor code in preUploadMiddleware function ([6d6bda5](https://github.com/sasjs/server/commit/6d6bda56267babde7b98cf69e32973d56d719f75))
-* refactor sas/js session controller classes to inherit from base session controller class ([2c704a5](https://github.com/sasjs/server/commit/2c704a544f4e31a8e8e833a9a62ba016bcfa6c7c))
-* **Studio:** style fix for runtime dropdown ([9023cf3](https://github.com/sasjs/server/commit/9023cf33b5fa4b13c2d5e9b80ae307df69c7fc02))
-
-
-### Features
-
-* configure child process with writeStream to write logs to log file ([058b3b0](https://github.com/sasjs/server/commit/058b3b00816e582e143953c2f0b8330bde2181b8))
-* conver single session controller to two controller i.e. SASSessionController and JSSessionController ([07295aa](https://github.com/sasjs/server/commit/07295aa151175db8c93eeef806fc3b7fde40ac72))
-* create and inject code for uploaded files to code.js ([1685616](https://github.com/sasjs/server/commit/16856165fb292dc9ffa897189ba105bd9f362267))
-* validate sasjs_runtimes env var ([596ada7](https://github.com/sasjs/server/commit/596ada7ca88798d6d71f6845633a006fd22438ea))
-
-## [0.6.1](https://github.com/sasjs/server/compare/v0.6.0...v0.6.1) (2022-06-17)
-
-
-### Bug Fixes
-
-* home page wording.  Using fix to force previous change through.. ([8702a4e](https://github.com/sasjs/server/commit/8702a4e8fd1bbfaf4f426b75e8b85a87ede0e0b0))
-
-# [0.6.0](https://github.com/sasjs/server/compare/v0.5.0...v0.6.0) (2022-06-16)
-
-
-### Features
-
-* get group by group name ([6b0b94a](https://github.com/sasjs/server/commit/6b0b94ad38215ae58e62279a4f73ac3ed2d9d0e8))
-
-# [0.5.0](https://github.com/sasjs/server/compare/v0.4.2...v0.5.0) (2022-06-16)
-
-
-### Bug Fixes
-
-* npm audit fix to avoid warnings on npm i ([28a6a36](https://github.com/sasjs/server/commit/28a6a36bb708b93fb5c2b74d587e9b2e055582be))
-
-
-### Features
-
-* **api:** deployment through zipped/compressed file ([b81d742](https://github.com/sasjs/server/commit/b81d742c6c70d4cf1cab365b0e3efc087441db00))
-
-## [0.4.2](https://github.com/sasjs/server/compare/v0.4.1...v0.4.2) (2022-06-15)
-
-
-### Bug Fixes
-
-* appStream redesign ([73792fb](https://github.com/sasjs/server/commit/73792fb574c90bd280c4324e0b41c6fee7d572b6))
-
-## [0.4.1](https://github.com/sasjs/server/compare/v0.4.0...v0.4.1) (2022-06-15)
-
-
-### Bug Fixes
-
-* add/remove group to User when adding/removing user from group and return group membership on getting user ([e08bbcc](https://github.com/sasjs/server/commit/e08bbcc5435cbabaee40a41a7fb667d4a1f078e6))
-
-# [0.4.0](https://github.com/sasjs/server/compare/v0.3.10...v0.4.0) (2022-06-14)
-
-
-### Features
-
-* new APIs added for GET|PATCH|DELETE of user by username ([aef411a](https://github.com/sasjs/server/commit/aef411a0eac625c33274dfe3e88b6f75115c44d8))
-
-## [0.3.10](https://github.com/sasjs/server/compare/v0.3.9...v0.3.10) (2022-06-14)
-
-
-### Bug Fixes
-
-* correct syntax for encoding option ([32d372b](https://github.com/sasjs/server/commit/32d372b42fbf56b6c0779e8f704164eaae1c7548))
-
-## [0.3.9](https://github.com/sasjs/server/compare/v0.3.8...v0.3.9) (2022-06-14)
-
-
-### Bug Fixes
-
-* forcing utf 8 encoding. Closes [#76](https://github.com/sasjs/server/issues/76) ([8734489](https://github.com/sasjs/server/commit/8734489cf014aedaca3f325e689493e4fe0b71ca))
-
-## [0.3.8](https://github.com/sasjs/server/compare/v0.3.7...v0.3.8) (2022-06-13)
-
-
-### Bug Fixes
-
-* execution controller better error handling ([8a617a7](https://github.com/sasjs/server/commit/8a617a73ae63233332f5788c90f173d6cd5e1283))
-* execution controller error details ([3fa2a7e](https://github.com/sasjs/server/commit/3fa2a7e2e32f90050f6b09e30ce3ef725eb0b15f))
-
-## [0.3.7](https://github.com/sasjs/server/compare/v0.3.6...v0.3.7) (2022-06-08)
-
-
-### Bug Fixes
-
-* **appstream:** redirect to relative + nested resource should be accessed ([5ab35b0](https://github.com/sasjs/server/commit/5ab35b02c4417132dddb5a800982f31d0d50ef66))
-
-## [0.3.6](https://github.com/sasjs/server/compare/v0.3.5...v0.3.6) (2022-06-02)
-
-
-### Bug Fixes
-
-* **appstream:** should serve only new files for same app stream name with new deployment ([e6d1989](https://github.com/sasjs/server/commit/e6d1989847761fbe562d7861ffa0ee542839b125))
-
-## [0.3.5](https://github.com/sasjs/server/compare/v0.3.4...v0.3.5) (2022-05-30)
-
-
-### Bug Fixes
-
-* bumping sasjs/core library ([61815f8](https://github.com/sasjs/server/commit/61815f8ae18be132e17c199cd8e3afbcc2fa0b60))
-
-## [0.3.4](https://github.com/sasjs/server/compare/v0.3.3...v0.3.4) (2022-05-30)
-
-
-### Bug Fixes
-
-* **web:** system username for DESKTOP mode ([a8ba378](https://github.com/sasjs/server/commit/a8ba378fd1ff374ba025a96fdfae5c6c36954465))
-
-## [0.3.3](https://github.com/sasjs/server/compare/v0.3.2...v0.3.3) (2022-05-30)
-
-
-### Bug Fixes
-
-* usage of autoexec API in DESKTOP mode ([12d424a](https://github.com/sasjs/server/commit/12d424acce8108a6f53aefbac01fddcdc5efb48f))
-
-## [0.3.2](https://github.com/sasjs/server/compare/v0.3.1...v0.3.2) (2022-05-27)
-
-
-### Bug Fixes
-
-* **web:** ability to use get/patch User API in desktop mode. ([2c259fe](https://github.com/sasjs/server/commit/2c259fe1de95d84e6929e311aaa6b895e66b42a3))
-
-## [0.3.1](https://github.com/sasjs/server/compare/v0.3.0...v0.3.1) (2022-05-26)
-
-
-### Bug Fixes
-
-* **api:** username should be lowercase ([5ad6ee5](https://github.com/sasjs/server/commit/5ad6ee5e0f5d7d6faa45b72215f1d9d55cfc37db))
-* **web:** reduced width for autoexec input ([7d11cc7](https://github.com/sasjs/server/commit/7d11cc79161e5a07f6c5392d742ef6b9d8658071))
-
-# [0.3.0](https://github.com/sasjs/server/compare/v0.2.0...v0.3.0) (2022-05-25)
-
-
-### Features
-
-* **web:** added profile + edit + autoexec changes ([c275db1](https://github.com/sasjs/server/commit/c275db184e874f0ee3a4f08f2592cfacf1e90742))
-
-# [0.2.0](https://github.com/sasjs/server/compare/v0.1.0...v0.2.0) (2022-05-25)
-
-
-### Bug Fixes
-
-* **autoexec:** usage in case of desktop from file ([79dc2db](https://github.com/sasjs/server/commit/79dc2dba23dc48ec218a973119392a45cb3856b5))
-
-
-### Features
-
-* **api:** added autoexec + major type setting changes ([2a7223a](https://github.com/sasjs/server/commit/2a7223ad7d6b8f3d4682447fd25d9426a7c79ac3))
-
-# [0.1.0](https://github.com/sasjs/server/compare/v0.0.77...v0.1.0) (2022-05-23)
-
-
-### Bug Fixes
-
-* issue174 + issue175 + issue146 ([80b33c7](https://github.com/sasjs/server/commit/80b33c7a18c1b7727316ffeca71658346733e935))
-* **web:** click to copy + notification ([f37f8e9](https://github.com/sasjs/server/commit/f37f8e95d1a85e00ceca2413dbb5e1f3f3f72255))
-
-
-### Features
-
-* **env:** added new env variable LOG_FORMAT_MORGAN ([53bf68a](https://github.com/sasjs/server/commit/53bf68a6aff44bb7b2f40d40d6554809253a01a8))
-
-## [0.0.77](https://github.com/sasjs/server/compare/v0.0.76...v0.0.77) (2022-05-16)
-
-
-### Bug Fixes
-
-* **release:** Github workflow without npm token ([c017d13](https://github.com/sasjs/server/commit/c017d13061d21aeacd0690367992d12ca57a115b))
-
-### [0.0.76](https://github.com/sasjs/server/compare/v0.0.75...v0.0.76) (2022-05-16)
-
-
-### Bug Fixes
-
-* get csrf token from cookie if not present in header ([f89389b](https://github.com/sasjs/server/commit/f89389bbc6f1f8f7060db2bdeb89746cbd60f533))
-
-### [0.0.75](https://github.com/sasjs/server/compare/v0.0.69...v0.0.75) (2022-05-12)
-
-
-### Features
-
-* CSP_DISABLE env option ([dd3acce](https://github.com/sasjs/server/commit/dd3acce3935e7cfc0b2c44a401314306915a3a10))
-
-
-### Bug Fixes
-
-* added more cookies to req ([4a8e32d](https://github.com/sasjs/server/commit/4a8e32dd20b540b6dc92d749fad90d6c7fc69376))
-* bumping core ([c0b57b9](https://github.com/sasjs/server/commit/c0b57b9e76d6db33fc64a68556a8be979dd69e40))
-* csp updates ([7cfa239](https://github.com/sasjs/server/commit/7cfa2398e12c5e515d27c896f36ff91604c2124d))
-* helmet config on http mode ([b0fdaaa](https://github.com/sasjs/server/commit/b0fdaaaa79e3135699c51effac0388d8ec5ab23b))
-* moved getAuthCode from api to web routes ([b40de8f](https://github.com/sasjs/server/commit/b40de8fa6a5aa763ed25a6fe6a381e483e0ab824))
-* reqHeadrs.txt will contain headers to access APIs ([636301e](https://github.com/sasjs/server/commit/636301e664416fb085f704d83deb7f39ee0a91a7))
-* **web:** seperate container for auth code ([5888f04](https://github.com/sasjs/server/commit/5888f04e08a32c6d2c7bcfcbc3a1d32425bff3b3))
-
-### [0.0.74](https://github.com/sasjs/server/compare/v0.0.73...v0.0.74) (2022-05-12)
-
-
-### Bug Fixes
-
-* csp updates ([7cfa239](https://github.com/sasjs/server/commit/7cfa2398e12c5e515d27c896f36ff91604c2124d))
-
-### [0.0.73](https://github.com/sasjs/server/compare/v0.0.72...v0.0.73) (2022-05-10)
-
-
-### Bug Fixes
-
-* helmet config on http mode ([b0fdaaa](https://github.com/sasjs/server/commit/b0fdaaaa79e3135699c51effac0388d8ec5ab23b))
-
-### [0.0.72](https://github.com/sasjs/server/compare/v0.0.71...v0.0.72) (2022-05-09)
-
-### [0.0.71](https://github.com/sasjs/server/compare/v0.0.70...v0.0.71) (2022-05-07)
-
-
-### Bug Fixes
-
-* added more cookies to req ([4a8e32d](https://github.com/sasjs/server/commit/4a8e32dd20b540b6dc92d749fad90d6c7fc69376))
-* bumping core ([c0b57b9](https://github.com/sasjs/server/commit/c0b57b9e76d6db33fc64a68556a8be979dd69e40))
-* reqHeadrs.txt will contain headers to access APIs ([636301e](https://github.com/sasjs/server/commit/636301e664416fb085f704d83deb7f39ee0a91a7))
-
-### [0.0.70](https://github.com/sasjs/server/compare/v0.0.69...v0.0.70) (2022-05-06)
-
-
-### Features
-
-* CSP_DISABLE env option ([dd3acce](https://github.com/sasjs/server/commit/dd3acce3935e7cfc0b2c44a401314306915a3a10))
-
-### [0.0.69](https://github.com/sasjs/server/compare/v0.0.68...v0.0.69) (2022-05-02)
-
-
-### Bug Fixes
-
-* **upload:** appStream uses CSRF + Session authentication ([1f89279](https://github.com/sasjs/server/commit/1f8927926405887f3d134c0a1dd6452ffa33876e))
-
-### [0.0.68](https://github.com/sasjs/server/compare/v0.0.67...v0.0.68) (2022-05-02)
-
-
-### Bug Fixes
-
-* using monaco editor locally ([2548c82](https://github.com/sasjs/server/commit/2548c82dfe1149e62a570a00546dddd9e30049b1))
-
-### [0.0.67](https://github.com/sasjs/server/compare/v0.0.66...v0.0.67) (2022-05-01)
-
-### [0.0.66](https://github.com/sasjs/server/compare/v0.0.64...v0.0.66) (2022-05-01)
-
-
-### Bug Fixes
-
-* added swagger ui init file manually ([e2a97fc](https://github.com/sasjs/server/commit/e2a97fcb7c54a57a7ca118677cfce93fe9430d8f))
-* consume swagger api with CSRF ([5aaac24](https://github.com/sasjs/server/commit/5aaac24080362d6ce0c5d1157798a9343f40ae2a))
-
-### [0.0.65](https://github.com/sasjs/server/compare/v0.0.64...v0.0.65) (2022-05-01)
-
-
-### Bug Fixes
-
-* consume swagger api with CSRF ([5aaac24](https://github.com/sasjs/server/commit/5aaac24080362d6ce0c5d1157798a9343f40ae2a))
-
-### [0.0.64](https://github.com/sasjs/server/compare/v0.0.63...v0.0.64) (2022-04-30)
-
-
-### Bug Fixes
-
-* removed fileExists for serving web ([7b39cc0](https://github.com/sasjs/server/commit/7b39cc06d358f5ffecb87955040c4eb0fcc7469e))
-
-### [0.0.63](https://github.com/sasjs/server/compare/v0.0.62...v0.0.63) (2022-04-30)
-
-### [0.0.62](https://github.com/sasjs/server/compare/v0.0.61...v0.0.62) (2022-04-30)
-
-### [0.0.61](https://github.com/sasjs/server/compare/v0.0.59...v0.0.61) (2022-04-30)
-
-
-### Bug Fixes
-
-* added CSRF check for granting access via session authentication ([b060ad1](https://github.com/sasjs/server/commit/b060ad1b8e0bbc61c20dc25be553bba4cc4d2716))
-* setting CSRF Token for only rendering SPA ([b4b60c6](https://github.com/sasjs/server/commit/b4b60c69cf67a42f4797f7f1afe68b7a5eec2998))
-
-### [0.0.60](https://github.com/sasjs/server/compare/v0.0.59...v0.0.60) (2022-04-30)
-
-
-### Bug Fixes
-
-* added CSRF check for granting access via session authentication ([b060ad1](https://github.com/sasjs/server/commit/b060ad1b8e0bbc61c20dc25be553bba4cc4d2716))
-* setting CSRF Token for only rendering SPA ([b4b60c6](https://github.com/sasjs/server/commit/b4b60c69cf67a42f4797f7f1afe68b7a5eec2998))
-
-### [0.0.59](https://github.com/sasjs/server/compare/v0.0.58...v0.0.59) (2022-04-29)
-
-
-### Features
-
-* enabled csrf tokens for web component ([e462aeb](https://github.com/sasjs/server/commit/e462aebdc01f3c0068ed0074473a2063412dcf45))
-* enabled session based authentication for web ([5da93f3](https://github.com/sasjs/server/commit/5da93f318aad10b1c67032a467191e4dbb99f411))
-
-
-### Bug Fixes
-
-* fetch client from DB for each request ([4ad8c81](https://github.com/sasjs/server/commit/4ad8c81e4927c1a82220ec015a781b095c8e859e))
-* **web:** show display name instead of username ([e57443f](https://github.com/sasjs/server/commit/e57443f1ed662a022494bb93d79c3d2f10a2d082))
-
-### [0.0.58](https://github.com/sasjs/server/compare/v0.0.57...v0.0.58) (2022-04-24)
-
-
-### Bug Fixes
-
-* bumping core library to get latest user management macros ([4862071](https://github.com/sasjs/server/commit/486207128da58fc4866bd0919c1bed2bd98097ea))
-* missing dependency ([d09876c](https://github.com/sasjs/server/commit/d09876c05f89166eec20064f7aa7ed5b867be081))
-
-### [0.0.57](https://github.com/sasjs/server/compare/v0.0.56...v0.0.57) (2022-04-21)
-
-
-### Features
-
-* create AppContext ([84ee743](https://github.com/sasjs/server/commit/84ee743eae16e87eaa91969393bebf01e2d15a44))
-
-### [0.0.56](https://github.com/sasjs/server/compare/v0.0.55...v0.0.56) (2022-04-20)
-
-
-### Bug Fixes
-
-* shortening min length of username.  Closes [#61](https://github.com/sasjs/server/issues/61) ([f02996f](https://github.com/sasjs/server/commit/f02996facf1019ec4022ccfbc99c1d0137074e1b))
-
-### [0.0.55](https://github.com/sasjs/server/compare/v0.0.53...v0.0.55) (2022-04-20)
-
-
-### Bug Fixes
-
-* added db seed at server startup ([2e63831](https://github.com/sasjs/server/commit/2e63831b90c7457e0e322719ebb1193fd6181cc3))
-* drive path in server mode ([c4cea4a](https://github.com/sasjs/server/commit/c4cea4a12b7eda4daeed995f41c0b10bcea79871))
-
-### [0.0.54](https://github.com/sasjs/server/compare/v0.0.53...v0.0.54) (2022-04-19)
-
-
-### Bug Fixes
-
-* added db seed at server startup ([2e63831](https://github.com/sasjs/server/commit/2e63831b90c7457e0e322719ebb1193fd6181cc3))
-
-### [0.0.53](https://github.com/sasjs/server/compare/v0.0.49...v0.0.53) (2022-04-19)
-
-
-### Features
-
-* add api for getting server info ([9fb5f1f](https://github.com/sasjs/server/commit/9fb5f1f8e7d4e2d767cc1ff7285c99514834cf32))
-* **appstream:** Upload an app from appStream page ([74ba65f](https://github.com/sasjs/server/commit/74ba65f9f330bf8c98c12a9c66bb60773d5a7b77))
-* run button running man, sub menu added ([68e84b0](https://github.com/sasjs/server/commit/68e84b0994a3fa6ff56b07635c637c6e3a57bfda))
-* running code with CTRL+ENTER ([b93a0da](https://github.com/sasjs/server/commit/b93a0da3a380926c87548b69309b2d0c1b7e617f))
-
-
-### Bug Fixes
-
-* provide clientId to web component ([db70b1c](https://github.com/sasjs/server/commit/db70b1ce555df6b29fb09c0c960d38b911c97b1b))
-* session death time has to be a valid string number ([23db7e7](https://github.com/sasjs/server/commit/23db7e7b7df2f22bbf7ce16865f83091624d8047))
-* web component added tooltip for webout in studio ([61080d4](https://github.com/sasjs/server/commit/61080d4694859306049346d2e3174f27bb6dac16))
-* web component UI fix for studio scrolling ([f257602](https://github.com/sasjs/server/commit/f25760283492140cc1f14e51ed27673ec28baaf3))
-
-### [0.0.52](https://github.com/sasjs/server/compare/v0.0.51...v0.0.52) (2022-04-17)
-
-
-### Features
-
-* add api for getting server info ([9fb5f1f](https://github.com/sasjs/server/commit/9fb5f1f8e7d4e2d767cc1ff7285c99514834cf32))
-
-### [0.0.51](https://github.com/sasjs/server/compare/v0.0.50...v0.0.51) (2022-04-15)
-
-
-### Features
-
-* run button running man, sub menu added ([68e84b0](https://github.com/sasjs/server/commit/68e84b0994a3fa6ff56b07635c637c6e3a57bfda))
-* running code with CTRL+ENTER ([b93a0da](https://github.com/sasjs/server/commit/b93a0da3a380926c87548b69309b2d0c1b7e617f))
-
-### [0.0.50](https://github.com/sasjs/server/compare/v0.0.49...v0.0.50) (2022-04-07)
-
-
-### Features
-
-* **appstream:** Upload an app from appStream page ([74ba65f](https://github.com/sasjs/server/commit/74ba65f9f330bf8c98c12a9c66bb60773d5a7b77))
-
-
-### Bug Fixes
-
-* session death time has to be a valid string number ([23db7e7](https://github.com/sasjs/server/commit/23db7e7b7df2f22bbf7ce16865f83091624d8047))
-* web component added tooltip for webout in studio ([61080d4](https://github.com/sasjs/server/commit/61080d4694859306049346d2e3174f27bb6dac16))
-* web component UI fix for studio scrolling ([f257602](https://github.com/sasjs/server/commit/f25760283492140cc1f14e51ed27673ec28baaf3))
-
-### [0.0.49](https://github.com/sasjs/server/compare/v0.0.48...v0.0.49) (2022-04-02)
-
-
-### Bug Fixes
-
-* **stp:** read file in non-binary mode if debug one ([527f70e](https://github.com/sasjs/server/commit/527f70e90dd7369766e375ac2d6fc38b2a114d11))
-
-### [0.0.48](https://github.com/sasjs/server/compare/v0.0.47...v0.0.48) (2022-04-02)
-
-
-### Features
-
-* **deploy:** new route added for deploy with build.json ([18d0604](https://github.com/sasjs/server/commit/18d0604bdd0b20ad468f9345474b4de034ee3a67))
-
-
-### Bug Fixes
-
-* remove uploaded build.json from temp folder in all cases ([9d167ab](https://github.com/sasjs/server/commit/9d167abe2adb743bca161862b4561bf573182c00))
-* **stp:** return log+webout for debug on ([3ff6f5e](https://github.com/sasjs/server/commit/3ff6f5e86581cd2ac23bbe0b8e2c367fbea890ed))
-
-### [0.0.47](https://github.com/sasjs/server/compare/v0.0.46...v0.0.47) (2022-03-29)
-
-
-### Bug Fixes
-
-* **web:** updated STUDIO log and webout ([f700561](https://github.com/sasjs/server/commit/f700561e1a8d06c18ca2bdbe4605d7ab34f7a761))
-
-### [0.0.46](https://github.com/sasjs/server/compare/v0.0.45...v0.0.46) (2022-03-29)
-
-
-### Features
-
-* **drive:** GET folder contents API added ([0ac9e4a](https://github.com/sasjs/server/commit/0ac9e4af7d67c4431053e80eb2384bf5bdc3f8b3))
-
-### [0.0.45](https://github.com/sasjs/server/compare/v0.0.43...v0.0.45) (2022-03-29)
-
-
-### Bug Fixes
-
-* DELETE req cannot have body ([0a5aece](https://github.com/sasjs/server/commit/0a5aeceab560b022197d0c30c3da7f091b261b1e))
-* increased req body size ([6dc39c0](https://github.com/sasjs/server/commit/6dc39c0d91ac13d6d9b8c0a2240446bfc45bdd7f))
-* proving a PRINT destination during SAS invocation. ([7f4201b](https://github.com/sasjs/server/commit/7f4201ba855743144fa6d3efac2b11e816d4696e)), closes [#111](https://github.com/sasjs/server/issues/111)
-* **session:** increased session + bug fixed ([117a53c](https://github.com/sasjs/server/commit/117a53ceeadf487a6326384ae11c10e98646631f))
-* **stp:** use same session from file upload ([dd56a95](https://github.com/sasjs/server/commit/dd56a95314f0b61480489118734e45877e1745ef))
-
-### [0.0.44](https://github.com/sasjs/server/compare/v0.0.43...v0.0.44) (2022-03-29)
-
-
-### Bug Fixes
-
-* DELETE req cannot have body ([0a5aece](https://github.com/sasjs/server/commit/0a5aeceab560b022197d0c30c3da7f091b261b1e))
-* increased req body size ([6dc39c0](https://github.com/sasjs/server/commit/6dc39c0d91ac13d6d9b8c0a2240446bfc45bdd7f))
-* **session:** increased session + bug fixed ([117a53c](https://github.com/sasjs/server/commit/117a53ceeadf487a6326384ae11c10e98646631f))
-* **stp:** use same session from file upload ([dd56a95](https://github.com/sasjs/server/commit/dd56a95314f0b61480489118734e45877e1745ef))
-
-### [0.0.43](https://github.com/sasjs/server/compare/v0.0.42...v0.0.43) (2022-03-23)
-
-
-### Bug Fixes
-
-* **deploy:** user can deploy to same appName with different/same appLoc ([9ace33d](https://github.com/sasjs/server/commit/9ace33d7830a9def42d741c23b46090afe0c5510))
-* fallback logo on AppStream ([5655311](https://github.com/sasjs/server/commit/5655311b9663225823c192b39a03f39d17dda730))
-
-### [0.0.42](https://github.com/sasjs/server/compare/v0.0.41...v0.0.42) (2022-03-23)
-
-
-### Bug Fixes
-
-* execute api, webout as raw ([9c75187](https://github.com/sasjs/server/commit/9c751877d1ed0d0677aff816169a1df7c34c6bf5))
-
-### [0.0.41](https://github.com/sasjs/server/compare/v0.0.40...v0.0.41) (2022-03-23)
-
-
-### Bug Fixes
-
-* **scroll:** closes [#100](https://github.com/sasjs/server/issues/100) ([f4eb75f](https://github.com/sasjs/server/commit/f4eb75ff347e78ac334e55ee26fbdd247bb8eaa2))
-
-### [0.0.40](https://github.com/sasjs/server/compare/v0.0.39...v0.0.40) (2022-03-23)
-
-
-### Bug Fixes
-
-* **deploy:** validating empty file or service in filetree ([27e260e](https://github.com/sasjs/server/commit/27e260e6a453e9978830db63ab669bd48c029897))
-* macros available for SAS ([7a70d40](https://github.com/sasjs/server/commit/7a70d40dbf0cd91cb3af156755f10006b860f917))
-* moved macros from codebase to drive ([d27e070](https://github.com/sasjs/server/commit/d27e070fc83894854278df22a8223b8016a1f5f7))
-
-### [0.0.39](https://github.com/sasjs/server/compare/v0.0.38...v0.0.39) (2022-03-23)
-
-
-### Bug Fixes
-
-* included sasjs core macros at compile time ([e680901](https://github.com/sasjs/server/commit/e68090181acd844f86f3e81153cb5a4e3f4a307f))
-
-### [0.0.38](https://github.com/sasjs/server/compare/v0.0.37...v0.0.38) (2022-03-23)
-
-
-### Bug Fixes
-
-* quick fix for executables ([9e53470](https://github.com/sasjs/server/commit/9e53470947350f4b8d835a2cb6b70e3dabf247c4))
-
-### [0.0.37](https://github.com/sasjs/server/compare/v0.0.36...v0.0.37) (2022-03-23)
-
-
-### Bug Fixes
-
-* appStream html view ([cd00aa2](https://github.com/sasjs/server/commit/cd00aa2af8c7e0df851050a02152dfeddaec7b0f))
-* moved macros from codebase to drive ([9ac3191](https://github.com/sasjs/server/commit/9ac3191891bf53ff07135ccec6ddc83b34ea871a))
-* **webin:** closes [#99](https://github.com/sasjs/server/issues/99) ([0147bcb](https://github.com/sasjs/server/commit/0147bcb701a209266144147a3746baf1eb1ccc63))
-
-### [0.0.36](https://github.com/sasjs/server/compare/v0.0.35...v0.0.36) (2022-03-21)
-
-
-### Features
-
-* App Stream, load on startup, new route added ([98a00ec](https://github.com/sasjs/server/commit/98a00ec7ace5da765f049864799be44ba6538e8a))
-
-
-### Bug Fixes
-
-* **appstream:** app logo + improvements ([df6003d](https://github.com/sasjs/server/commit/df6003df942fd52b956f3d4069d6d7615441d372))
-
-### [0.0.35](https://github.com/sasjs/server/compare/v0.0.33...v0.0.35) (2022-03-21)
-
-
-### Features
-
-* **cors:** whitelisting is configurable through .env variables ([99f91fb](https://github.com/sasjs/server/commit/99f91fbce2a029dd963ed30c9007a9b046ea6560))
-* **web:** directory tree in sidebar of drive should be expanded by default at root level ([3d89b75](https://github.com/sasjs/server/commit/3d89b753f023beed4d51a64db4f74e1011437aab))
-
-
-### Bug Fixes
-
-* **cors:** removed trailing slashes of urls ([4fd5bf9](https://github.com/sasjs/server/commit/4fd5bf948e4ad8a274d3176d5509163e67980061))
-* desktop mode web index.html js script included ([75291f9](https://github.com/sasjs/server/commit/75291f939770de963d48c2ff1c967da9493bd668))
-* preferred to show param errors from query ([fd26298](https://github.com/sasjs/server/commit/fd2629862f10ec16e2266d68420499e715b5d58c))
-* **stp:** write original file name in sas code for upload ([8822de9](https://github.com/sasjs/server/commit/8822de95df1d2d01dadfe6957391c254172f2819))
-* **web-drive:** upon delete remove entry of deleted file from directory tree in sidebar ([fb77d99](https://github.com/sasjs/server/commit/fb77d99177851e7dc2a71e0b8f516daa3da29e36))
-
-### [0.0.34](https://github.com/sasjs/server/compare/v0.0.33...v0.0.34) (2022-03-18)
-
-
-### Features
-
-* **web:** directory tree in sidebar of drive should be expanded by default at root level ([3d89b75](https://github.com/sasjs/server/commit/3d89b753f023beed4d51a64db4f74e1011437aab))
-
-
-### Bug Fixes
-
-* desktop mode web index.html js script included ([75291f9](https://github.com/sasjs/server/commit/75291f939770de963d48c2ff1c967da9493bd668))
-* preferred to show param errors from query ([fd26298](https://github.com/sasjs/server/commit/fd2629862f10ec16e2266d68420499e715b5d58c))
-* **stp:** write original file name in sas code for upload ([8822de9](https://github.com/sasjs/server/commit/8822de95df1d2d01dadfe6957391c254172f2819))
-* **web-drive:** upon delete remove entry of deleted file from directory tree in sidebar ([fb77d99](https://github.com/sasjs/server/commit/fb77d99177851e7dc2a71e0b8f516daa3da29e36))
-
-### [0.0.33](https://github.com/sasjs/server/compare/v0.0.32...v0.0.33) (2022-03-16)
-
-
-### Features
-
-* serve deployed streaming apps ([d6fa877](https://github.com/sasjs/server/commit/d6fa87794155880adc23c2552c37c86ad606c292))
-
-
-### Bug Fixes
-
-* adde validation + code improvement ([1ff6965](https://github.com/sasjs/server/commit/1ff6965dd2f44ad74136af04b4fba8c76979ecba))
-* added api button on web component ([6b708fc](https://github.com/sasjs/server/commit/6b708fcad30d92c21713f9c97bca173c148cc875))
-
-### [0.0.32](https://github.com/sasjs/server/compare/v0.0.31...v0.0.32) (2022-03-14)
-
-
-### Features
-
-* **web:** added delete option  in Drive ([7a6e6c8](https://github.com/sasjs/server/commit/7a6e6c8becab31410d0a36bcc22e13d5359a6cdf))
-
-### [0.0.31](https://github.com/sasjs/server/compare/v0.0.30...v0.0.31) (2022-03-14)
-
-
-### Features
-
-* **drive:** new route delete file api ([3d583ff](https://github.com/sasjs/server/commit/3d583ff21d344a71aa861c7e5b1426ebc2d54c22))
-
-
-### Bug Fixes
-
-* added cookie for accessToken ([698180a](https://github.com/sasjs/server/commit/698180ab7e44d67d46c84352ececca5b6c83b230))
-* **drive:** update file API is same as create file ([7072e28](https://github.com/sasjs/server/commit/7072e282b1cd1a296d81512c57130237610c1c1e))
-* show content of get file api ([6ab42ca](https://github.com/sasjs/server/commit/6ab42ca4868366874f5f21bd711b7b8b72e36774))
-* **stp:** return plain/text header for GET & debug ([145ac45](https://github.com/sasjs/server/commit/145ac450365ed39279248ec9321bbe4918bee9fa))
-
-### [0.0.30](https://github.com/sasjs/server/compare/v0.0.29...v0.0.30) (2022-03-05)
-
-
-### Features
-
-* parse log to array ([c5ad72c](https://github.com/sasjs/server/commit/c5ad72c931ec8fbd7d5a6475838adcbd380c8aee))
-* set response headers provded by SAS Code execution ([2c4aa42](https://github.com/sasjs/server/commit/2c4aa420b3119890cafde4265ed5dddbc9d6a636))
-
-
-### Bug Fixes
-
-* added http headers to /code api as well ([da899b9](https://github.com/sasjs/server/commit/da899b90e26d5ee393eefc302be985eb7c9055a5))
-* code api is updated return type ([e2a6810](https://github.com/sasjs/server/commit/e2a6810e9531a8102d3c51fd8df2e1f78f0d965f))
-* **file:** fixes response headers ([ef41691](https://github.com/sasjs/server/commit/ef41691e408ef1c1c7a921cc1050bdd533651331))
-* get file instead of it's content ([efaf38d](https://github.com/sasjs/server/commit/efaf38d3039391392ce0e14a3accddd8f34ea7d6))
-* hot fix for web component ([0a4b202](https://github.com/sasjs/server/commit/0a4b202428e14effc8014a6813cecf7761ce3715))
-* improvement in flow of uploading ([8c1941a](https://github.com/sasjs/server/commit/8c1941a87bc184be4e0e09eeff73fc6cb69e3041))
-* macros are available Sessions with SASAUTOS ([95843fa](https://github.com/sasjs/server/commit/95843fa4c711aa695ee63ad265b8def4ba56360d))
-* minor changes ([0b5f958](https://github.com/sasjs/server/commit/0b5f958f456d291ec7a8697236657c7819d5c654))
-* multi-part file upload + validations + specs ([e60f172](https://github.com/sasjs/server/commit/e60f17268d1fa9ab623313026d46bd3f63756f69))
-* organized code for usage of multer ([ce0a5e1](https://github.com/sasjs/server/commit/ce0a5e1229bed69c450061fac2bc19711448da56))
-* return buffer in case of file response ([3e6234e](https://github.com/sasjs/server/commit/3e6234e6019c5f3ae4280fac079ecc9cb0effc07))
-* **stp:** return json for webout ([5005f20](https://github.com/sasjs/server/commit/5005f203b8d6b1d577cdf094b83886bd1fc817a2))
-* updating docs ([7312763](https://github.com/sasjs/server/commit/7312763339d6769826328561e2c8d11bbfc0c9f4))
-* **upload:** added query param as well for filepath ([feeec4e](https://github.com/sasjs/server/commit/feeec4eb149e9a47e5a52320d1fc95243bf5eb15))
-
-### [0.0.29](https://github.com/sasjs/server/compare/v0.0.28...v0.0.29) (2022-02-16)
-
-
-### Bug Fixes
-
-* adding .. in folder path ([5931fc1](https://github.com/sasjs/server/commit/5931fc1e712c545ef80454dea5b36e684017c367))
-* adding sasjs stpsrv_header() path to autoexec.  Relates to [#58](https://github.com/sasjs/server/issues/58) ([ce9bde5](https://github.com/sasjs/server/commit/ce9bde5717369de2d76dc183319be8830b2362b2))
-
-### [0.0.28](https://github.com/sasjs/server/compare/v0.0.27...v0.0.28) (2022-02-16)
-
-
-### Features
-
-* default macros and bumping core ([6f19d3d](https://github.com/sasjs/server/commit/6f19d3d0ea3815815f246a3e455495c72c8604c7))
-
-
-### Bug Fixes
-
-* moving core ([f10138b](https://github.com/sasjs/server/commit/f10138b0f2005a958f63cb3a8351e1afa52f086a))
-
-### [0.0.27](https://github.com/sasjs/server/compare/v0.0.26...v0.0.27) (2022-02-16)
-
-
-### Features
-
-* removing stpsrv_header and updating README with auth details ([d3674c7](https://github.com/sasjs/server/commit/d3674c7f9449d77977e482cd63ccdf7e974fa838))
-* **stp-execution:** add returnLog option to execution query ([bf5767e](https://github.com/sasjs/server/commit/bf5767eadfb87f7ed902659347a18361a6a6c74b))
-
-### [0.0.26](https://github.com/sasjs/server/compare/v0.0.25...v0.0.26) (2022-02-14)
-
-
-### Bug Fixes
-
-* refactored + removed unused package ([d7e1aca](https://github.com/sasjs/server/commit/d7e1aca7e33c3264c784d406fa766e29a6b15ae9))
-* release should also has https protocol ([0cfe724](https://github.com/sasjs/server/commit/0cfe724ffa089b84a9f8bca49c9033b56f51c9cb))
-* updated token expiry times ([d17a3dd](https://github.com/sasjs/server/commit/d17a3dd5900d5eb88120af8575e3fc7c2cb71ed6))
-
-### [0.0.25](https://github.com/sasjs/server/compare/v0.0.24...v0.0.25) (2022-02-11)
-
-
-### Bug Fixes
-
-* adding global macvar and bumping sasjs/core with additional server support ([404f1ec](https://github.com/sasjs/server/commit/404f1ec0593a027ed5e84b1d6a84cb9f2d09d99e))
-
-### [0.0.24](https://github.com/sasjs/server/compare/v0.0.23...v0.0.24) (2022-02-11)
-
-
-### Bug Fixes
-
-* removing sysmacdelete ([480ee4d](https://github.com/sasjs/server/commit/480ee4da831d2a89888c58ebec26bd89802ee2f5))
+All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.

 ### [0.0.23](https://github.com/sasjs/server/compare/v0.0.22...v0.0.23) (2022-02-08)

--- a/21
+++ b/21
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2022 SASjs
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
--- a/PULL_REQUEST_TEMPLATE.md
+++ b/PULL_REQUEST_TEMPLATE.md
@@ -1,19 +0,0 @@
-## Issue
-
-Link any related issue(s) in this section.
-
-## Intent
-
-What this PR intends to achieve.
-
-## Implementation
-
-What code changes have been made to achieve the intent.
-
-## Checks
-
- [ ] Code is formatted correctly (`npm run lint:fix`).
- [ ] Any new functionality has been unit tested.
- [ ] All unit tests are passing (`npm test`).
- [ ] All CI checks are green.
- [ ] Reviewer is assigned.
--- a/README.md
+++ b/README.md
@@ -1,238 +1,134 @@
 # SASjs Server

-<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-
-[![All Contributors](https://img.shields.io/badge/all_contributors-7-orange.svg?style=flat-square)](#contributors-)
-
-<!-- ALL-CONTRIBUTORS-BADGE:END -->
-
-SASjs Server provides a NodeJS wrapper for calling the SAS binary executable. It can be installed on an actual SAS server, or locally on your desktop. It provides:
+SASjs Server provides a NodeJS wrapper for calling the SAS binary executable. It can be installed on an actual SAS server, or it could even run locally on your desktop. It provides the following functionality:

 - Virtual filesystem for storing SAS programs and other content
 - Ability to execute Stored Programs from a URL
 - Ability to create web apps using simple Desktop SAS
- REST API with Swagger Docs

-One major benefit of using SASjs Server alongside other components of the SASjs framework such as the [CLI](https://cli.sasjs.io), [Adapter](https://adapter.sasjs.io) and [Core](https://core.sasjs.io) library, is that the projects you create can be very easily ported to SAS 9 (Stored Process server) or Viya (Job Execution server).
-
-SASjs Server is available in two modes - Desktop (without authentication) and Server (with authentication, and a database)
+One major benefit of using SASjs Server (alongside other components of the SASjs framework such as the [CLI](https://cli.sasjs.io), [Adapter](https://adapter.sasjs.io) and [Core](https://core.sasjs.io) library) is that the projects you create can be very easily ported to SAS 9 (Stored Process server) or Viya (Job Execution server).

 ## Installation

-Installation can be made programmatically using command line, or by manually downloading and running the executable.
-
-### Programmatic
-
-Fetch the relevant package from github using `curl`, eg as follows (for linux):
+First, download the relevant package from the [releases](https://github.com/sasjs/server/releases) page - either manually, or with commandline, eg as follow:

 ```bash
 curl -L https://github.com/sasjs/server/releases/latest/download/linux.zip > linux.zip
 unzip linux.zip
+./api-linux
 ```

-The app can then be launched with `./api-linux` and prompts followed (if ENV vars not set).
+Second, trigger by double clicking (windows) or executing from commandline.

-### Manual
+You are presented with two prompts:

-1. Download the relevant package from the [releases](https://github.com/sasjs/server/releases) page
-2. Trigger by double clicking (windows) or executing from commandline.
+* Location of your `sas.exe` / `sas.sh` executable
+* Path to a filesystem location for Stored Programs and temporary files

-You are presented with two prompts (if not set as ENV vars):
+## Configuration

- Location of your `sas.exe` / `sas.sh` executable
- Path to a filesystem location for Stored Programs and temporary files
+Configuration is made in the `configuration` section of `package.json`:

-## ENV Var configuration
+- Provide path to SAS9 executable.

-When launching the app, it will make use of specific environment variables. These can be set in the following places:
+### Using dockers:

- Configured globally in `/etc/environment` file
- Export in terminal or shell script (`export VAR=VALUE`)
- Prepended in the command
- Enter in the `.env` file alongside the executable
+There is `.env.example` file present at root of the project. [for Production]

-Example contents of a `.env` file:
+There is `.env.example` file present at `./api` of the project. [for Development]
+
+There is `.env.example` file present at `./web` of the project. [for Development]
+
+Remember to provide enviornment variables.
+
+#### Development
+
+Command to run docker for development:

 ```
-#
-## Core Settings
-#
-
-
-# MODE options: [desktop|server] default: `desktop`
-# Desktop mode is single user and designed for workstation use
-# Server mode is multi-user and suitable for intranet / internet use
-MODE=
-
-# A comma separated string that defines the available runTimes.
-# Priority is given to the runtime that comes first in the string.
-# Possible options at the moment are sas and js
-
-# This string sets the priority of the available analytic runtimes
-# Valid runtimes are SAS (sas), JavaScript (js) and Python (py)
-# For each option provided, there should be a corresponding path,
-# eg SAS_PATH, NODE_PATH or PYTHON_PATH
-# Priority is given to runtimes earlier in the string
-# Example options:  [sas,js,py | js,py | sas | sas,js]
-RUN_TIMES=
-
-# Path to SAS executable (sas.exe / sas.sh)
-SAS_PATH=/path/to/sas/executable.exe
-
-# Path to Node.js executable
-NODE_PATH=~/.nvm/versions/node/v16.14.0/bin/node
-
-# Path to Python executable
-PYTHON_PATH=/usr/bin/python
-
-# Path to working directory
-# This location is for SAS WORK, staged files, DRIVE, configuration etc
-SASJS_ROOT=./sasjs_root
-
-
-# options: [http|https] default: http
-PROTOCOL=
-
-# default: 5000
-PORT=
-
-
-#
-## Additional SAS Options
-#
-
-
-# On windows use SAS_OPTIONS and on unix use SASV9_OPTIONS
-# Any options set here are automatically applied in the SAS session
-# See: https://documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/hostunx/p0wrdmqp8k0oyyn1xbx3bp3qy2wl.htm
-# And: https://documentation.sas.com/doc/en/pgmsascdc/9.4_3.5/hostwin/p0drw76qo0gig2n1kcoliekh605k.htm#p09y7hx0grw1gin1giuvrjyx61m6
-SAS_OPTIONS= -NOXCMD
-SASV9_OPTIONS= -NOXCMD
-
-
-#
-## Additional Web Server Options
-#
-
-# ENV variables for PROTOCOL: `https`
-PRIVATE_KEY=privkey.pem (required)
-CERT_CHAIN=certificate.pem (required)
-CA_ROOT=fullchain.pem (optional)
-
-# ENV variables required for MODE: `server`
-DB_CONNECT=mongodb+srv://<DB_USERNAME>:<DB_PASSWORD>@<CLUSTER>/<DB_NAME>?retryWrites=true&w=majority
-
-# options: [disable|enable] default: `disable` for `server` & `enable` for `desktop`
-# If enabled, be sure to also configure the WHITELIST of third party servers.
-CORS=
-
-# options: <http://localhost:3000 https://abc.com ...> space separated urls
-WHITELIST=
-
-# HELMET Cross Origin Embedder Policy
-# Sets the Cross-Origin-Embedder-Policy header to require-corp when `true`
-# options: [true|false] default: true
-# Docs: https://helmetjs.github.io/#reference (`crossOriginEmbedderPolicy`)
-HELMET_COEP=
-
-# HELMET Content Security Policy
-# Path to a json file containing HELMET `contentSecurityPolicy` directives
-# Docs: https://helmetjs.github.io/#reference
-#
-# Example config:
-# {
-#   "img-src": ["'self'", "data:"],
-#   "script-src": ["'self'", "'unsafe-inline'"],
-#   "script-src-attr": ["'self'", "'unsafe-inline'"]
-# }
-HELMET_CSP_CONFIG_PATH=./csp.config.json
-
-# LOG_FORMAT_MORGAN options: [combined|common|dev|short|tiny] default: `common`
-# Docs: https://www.npmjs.com/package/morgan#predefined-formats
-LOG_FORMAT_MORGAN=
-
-# This location is for server logs with classical UNIX logrotate behavior
-LOG_LOCATION=./sasjs_root/logs
-
+docker-compose up -d
 ```

-## Persisting the Session
+It uses default docker compose file i.e. `docker-compose.yml` present at root.
+It will build following images if running first time:

-Normally the server process will stop when your terminal dies. To keep it going you can use the following suggested approaches:
+- `sasjs_server_api` - image for sasjs api server app based on _ExpressJS_
+- `sasjs_server_web` - image for sasjs web component app based on _ReactJS_
+- `mongodb` - image for mongo database
+- `mongo-seed-users` - will be populating user data specified in _./mongo-seed/users/user.json_
+- `mongo-seed-clients` - will be populating client data specified in _./mongo-seed/clients/client.json_

-1. Linux Background Job
-2. NPM package `pm2`
+#### Production

-### Background Job
-
-Trigger the command using NOHUP, redirecting the output commands, eg `nohup ./api-linux > server.log 2>&1 &`.
-
-You can now see the job running using the `jobs` command. To ensure that it will still run when your terminal is closed, execute the `disown` command. To kill it later, use the `kill -9 <pid>` command. You can see your sessions using `top -u <userid>`. Type `c` to see the commands being run against each pid.
-
-### PM2
-
-Install the npm package [pm2](https://www.npmjs.com/package/pm2) (`npm install pm2@latest -g`) and execute, eg as follows:
-
-```bash
-export SAS_PATH=/opt/sas9/SASHome/SASFoundation/9.4/sasexe/sas
-export PORT=5001
-export SASJS_ROOT=./sasjs_root
-
-pm2 start api-linux
-```
-
-To get the logs (and some useful commands):
-
-```bash
-pm2 [list|ls|status]
-pm2 logs
-pm2 logs --lines 200
-```
-
-Managing processes:
+Command to run docker for production:

 ```
-pm2 restart app_name
-pm2 reload app_name
-pm2 stop app_name
-pm2 delete app_name
+docker-compose -f docker-compose.prod.yml up -d
 ```

-Instead of `app_name` you can pass:
+It uses specified docker compose file i.e. `docker-compose.prod.yml` present at root.
+It will build following images if running first time:

- `all` to act on all processes
- `id` to act on a specific process id
+- `sasjs_server_prod` - image for sasjs server app containing api and web component's build served at route `/`
+- `mongodb` - image for mongo database
+- `mongo-seed-users` - will be populating user data specified in _./mongo-seed/users/user.json_
+- `mongo-seed-clients` - will be populating client data specified in _./mongo-seed/clients/client.json_

-## Server Version
+### Using node:

-The following credentials can be used for the initial connection to SASjs/server. It is highly recommended to change these on first use.
+#### Development (running api and web seperately):

- CLIENTID: `clientID1`
- USERNAME: `secretuser`
- PASSWORD: `secretpassword`
+##### API

-## Contributors ✨
+Navigate to `./api`
+There is `.env.example` file present at `./api` directory. Remember to provide enviornment variables else default values will be used mentioned in `.env.example` files
+Command to install and run api server.

-Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
+```
+npm install
+npm start
+```

-<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
-<!-- prettier-ignore-start -->
-<!-- markdownlint-disable -->
-<table>
-  <tr>
-    <td align="center"><a href="https://github.com/saadjutt01"><img src="https://avatars.githubusercontent.com/u/8914650?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Saad Jutt</b></sub></a><br /><a href="https://github.com/sasjs/server/commits?author=saadjutt01" title="Code">💻</a> <a href="https://github.com/sasjs/server/commits?author=saadjutt01" title="Tests">⚠️</a></td>
-    <td align="center"><a href="https://github.com/sabhas"><img src="https://avatars.githubusercontent.com/u/82647447?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Sabir Hassan</b></sub></a><br /><a href="https://github.com/sasjs/server/commits?author=sabhas" title="Code">💻</a> <a href="https://github.com/sasjs/server/commits?author=sabhas" title="Tests">⚠️</a></td>
-    <td align="center"><a href="https://www.erudicat.com/"><img src="https://avatars.githubusercontent.com/u/25773492?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Yury Shkoda</b></sub></a><br /><a href="https://github.com/sasjs/server/commits?author=YuryShkoda" title="Code">💻</a> <a href="https://github.com/sasjs/server/commits?author=YuryShkoda" title="Tests">⚠️</a></td>
-    <td align="center"><a href="https://github.com/medjedovicm"><img src="https://avatars.githubusercontent.com/u/18329105?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Mihajlo Medjedovic</b></sub></a><br /><a href="https://github.com/sasjs/server/commits?author=medjedovicm" title="Code">💻</a> <a href="https://github.com/sasjs/server/commits?author=medjedovicm" title="Tests">⚠️</a></td>
-    <td align="center"><a href="https://4gl.io/"><img src="https://avatars.githubusercontent.com/u/4420615?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Allan Bowe</b></sub></a><br /><a href="https://github.com/sasjs/server/commits?author=allanbowe" title="Code">💻</a> <a href="https://github.com/sasjs/server/commits?author=allanbowe" title="Documentation">📖</a></td>
-    <td align="center"><a href="https://github.com/VladislavParhomchik"><img src="https://avatars.githubusercontent.com/u/83717836?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Vladislav Parhomchik</b></sub></a><br /><a href="https://github.com/sasjs/server/commits?author=VladislavParhomchik" title="Tests">⚠️</a></td>
-    <td align="center"><a href="https://github.com/kknapen"><img src="https://avatars.githubusercontent.com/u/78609432?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Koen Knapen</b></sub></a><br /><a href="#userTesting-kknapen" title="User Testing">📓</a></td>
-  </tr>
-</table>
+##### Web

-<!-- markdownlint-restore -->
-<!-- prettier-ignore-end -->
+Navigate to `./web`
+There is `.env.example` file present at `./web` directory. Remember to provide enviornment variables else default values will be used mentioned in `.env.example` files
+Command to install and run api server.

-<!-- ALL-CONTRIBUTORS-LIST:END -->
+```
+npm install
+npm start
+```

-This project follows the [all-contributors](https://github.com/all-contributors/all-contributors) specification. Contributions of any kind welcome!
+#### Development (running only api server and have web build served):
+
+##### API server also serving Web build files
+
+There is `.env.example` file present at `./api` directory. Remember to provide enviornment variables else default values will be used mentioned in `.env.example` files
+Command to install and run api server.
+
+```
+cd ./web && npm i && npm build && cd ../
+cd ./api && npm i && npm start
+```
+
+#### Production
+
+##### API & WEB
+
+```
+npm run server
+```
+
+This will install/build `web` and install `api`, then start prod server.
+
+## Executables
+
+Command to generate executables
+
+```
+cd ./web && npm i && npm build && cd ../
+cd ./api && npm i && npm run exe
+```
+
+This will install/build web app and install/create executables of sasjs server at root `./executables`
--- a/SASjsServer.drawio
+++ b/SASjsServer.drawio
@@ -1,84 +1,206 @@
 <mxfile host="65bd71144e">
    <diagram id="HJy_QFGaI9JSrArARLup" name="Page-1">
-        <mxGraphModel dx="1908" dy="2140" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
+        <mxGraphModel dx="3103" dy="2723" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0">
            <root>
                <mxCell id="0"/>
                <mxCell id="1" parent="0"/>
-                <mxCell id="4" value="End user" style="shape=umlActor;verticalLabelPosition=bottom;verticalAlign=top;html=1;outlineConnect=0;fontStyle=0" vertex="1" parent="1">
-                    <mxGeometry x="-360" y="-120" width="40" height="80" as="geometry"/>
+                <mxCell id="7" value="SASjs Server" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;fontSize=30;" parent="1" vertex="1">
+                    <mxGeometry x="30" y="-150" width="360" height="1250" as="geometry"/>
                </mxCell>
-                <mxCell id="7" value="SASjs Server" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;fontSize=30;" vertex="1" parent="1">
-                    <mxGeometry x="30" y="-150" width="360" height="850" as="geometry"/>
+                <mxCell id="36" value="&lt;font style=&quot;font-size: 22px&quot;&gt;Internal Authentication&lt;/font&gt;" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;" vertex="1" parent="1">
+                    <mxGeometry x="50" y="-60" width="320" height="330" as="geometry"/>
                </mxCell>
-                <mxCell id="8" value="" style="edgeStyle=none;html=1;entryX=0;entryY=0.25;entryDx=0;entryDy=0;" edge="1" parent="1" target="28">
+                <mxCell id="4" value="End user" style="shape=umlActor;verticalLabelPosition=bottom;verticalAlign=top;html=1;outlineConnect=0;fontStyle=0" parent="1" vertex="1">
+                    <mxGeometry x="-740" y="-120" width="40" height="80" as="geometry"/>
+                </mxCell>
+                <mxCell id="8" value="" style="edgeStyle=none;html=1;entryX=0;entryY=0.25;entryDx=0;entryDy=0;" parent="1" target="28" edge="1">
                    <mxGeometry relative="1" as="geometry">
-                        <mxPoint x="-340" y="23" as="sourcePoint"/>
+                        <mxPoint x="-530" y="23" as="sourcePoint"/>
                        <mxPoint x="115" y="22.586363636363558" as="targetPoint"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="11" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;span style=&quot;color: #a31515&quot;&gt;/SASjsApi/auth/authorize&lt;br&gt;(username,password,clientId)&lt;/span&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="8">
+                <mxCell id="11" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;span style=&quot;color: #a31515&quot;&gt;/SASjsApi/auth/authorize&lt;br&gt;(username,password,clientId)&lt;/span&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" parent="8" vertex="1" connectable="0">
                    <mxGeometry x="-0.1257" y="2" relative="1" as="geometry">
                        <mxPoint as="offset"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="14" value="" style="edgeStyle=none;html=1;exitX=-0.002;exitY=0.874;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1" source="28">
+                <mxCell id="14" value="" style="edgeStyle=none;html=1;exitX=-0.002;exitY=0.874;exitDx=0;exitDy=0;exitPerimeter=0;" parent="1" source="28" edge="1">
                    <mxGeometry relative="1" as="geometry">
                        <mxPoint x="110" y="80" as="sourcePoint"/>
-                        <mxPoint x="-340" y="80" as="targetPoint"/>
+                        <mxPoint x="-530" y="80" as="targetPoint"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="16" value="&lt;font color=&quot;#a31515&quot; face=&quot;menlo, monaco, courier new, monospace&quot;&gt;&lt;span style=&quot;font-size: 12px&quot;&gt;`code`&lt;/span&gt;&lt;/font&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="14">
+                <mxCell id="16" value="&lt;font color=&quot;#a31515&quot; face=&quot;menlo, monaco, courier new, monospace&quot;&gt;&lt;span style=&quot;font-size: 12px&quot;&gt;`code`&lt;/span&gt;&lt;/font&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" parent="14" vertex="1" connectable="0">
                    <mxGeometry x="0.1931" y="-1" relative="1" as="geometry">
                        <mxPoint as="offset"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="21" value="End user" style="shape=umlActor;verticalLabelPosition=bottom;verticalAlign=top;html=1;outlineConnect=0;fontStyle=0" vertex="1" parent="1">
-                    <mxGeometry x="-360" y="545" width="40" height="80" as="geometry"/>
+                <mxCell id="21" value="End user" style="shape=umlActor;verticalLabelPosition=bottom;verticalAlign=top;html=1;outlineConnect=0;fontStyle=0" parent="1" vertex="1">
+                    <mxGeometry x="-730" y="1100" width="40" height="80" as="geometry"/>
                </mxCell>
-                <mxCell id="22" value="" style="edgeStyle=none;html=1;entryX=0;entryY=0.25;entryDx=0;entryDy=0;" edge="1" parent="1" target="30">
+                <mxCell id="22" value="" style="edgeStyle=none;html=1;entryX=0;entryY=0.25;entryDx=0;entryDy=0;" parent="1" target="30" edge="1">
                    <mxGeometry relative="1" as="geometry">
-                        <mxPoint x="-340" y="165" as="sourcePoint"/>
+                        <mxPoint x="-530" y="163" as="sourcePoint"/>
                        <mxPoint x="115" y="165" as="targetPoint"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="23" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; line-height: 18px&quot;&gt;&lt;span style=&quot;color: #a31515&quot;&gt;/SASjsApi/auth/token&lt;/span&gt;&lt;/div&gt;&lt;span style=&quot;color: #a31515&quot;&gt;(clientId,code)&lt;/span&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="22">
+                <mxCell id="23" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; line-height: 18px&quot;&gt;&lt;span style=&quot;color: #a31515&quot;&gt;/SASjsApi/auth/token&lt;/span&gt;&lt;/div&gt;&lt;span style=&quot;color: #a31515&quot;&gt;(clientId,code)&lt;/span&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" parent="22" vertex="1" connectable="0">
                    <mxGeometry x="-0.1257" y="2" relative="1" as="geometry">
                        <mxPoint as="offset"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="24" value="" style="edgeStyle=none;html=1;exitX=0.009;exitY=0.905;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1" source="30">
+                <mxCell id="24" value="" style="edgeStyle=none;html=1;exitX=0.009;exitY=0.905;exitDx=0;exitDy=0;exitPerimeter=0;" parent="1" source="30" edge="1">
                    <mxGeometry relative="1" as="geometry">
                        <mxPoint x="210" y="222.5" as="sourcePoint"/>
-                        <mxPoint x="-340" y="223" as="targetPoint"/>
+                        <mxPoint x="-530" y="223" as="targetPoint"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="25" value="&lt;font color=&quot;#a31515&quot; face=&quot;menlo, monaco, courier new, monospace&quot;&gt;&lt;span style=&quot;font-size: 12px&quot;&gt;`&lt;/span&gt;&lt;/font&gt;&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;accessToken&lt;/span&gt;&lt;span style=&quot;font-size: 12px ; color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace&quot;&gt;` &amp;amp; `&lt;/span&gt;&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;refreshToken&lt;/span&gt;&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;`&lt;/span&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="24">
+                <mxCell id="25" value="&lt;font color=&quot;#a31515&quot; face=&quot;menlo, monaco, courier new, monospace&quot;&gt;&lt;span style=&quot;font-size: 12px&quot;&gt;`&lt;/span&gt;&lt;/font&gt;&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;accessToken&lt;/span&gt;&lt;span style=&quot;font-size: 12px ; color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace&quot;&gt;` &amp;amp; `&lt;/span&gt;&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;refreshToken&lt;/span&gt;&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;`&lt;/span&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" parent="24" vertex="1" connectable="0">
                    <mxGeometry x="0.1931" y="-1" relative="1" as="geometry">
                        <mxPoint as="offset"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="26" value="" style="endArrow=none;dashed=1;html=1;dashPattern=1 3;strokeWidth=2;" edge="1" parent="1" source="21" target="4">
+                <mxCell id="26" value="" style="endArrow=none;dashed=1;html=1;dashPattern=1 3;strokeWidth=2;" parent="1" source="21" target="4" edge="1">
                    <mxGeometry width="50" height="50" relative="1" as="geometry">
-                        <mxPoint x="40" y="240" as="sourcePoint"/>
-                        <mxPoint x="90" y="190" as="targetPoint"/>
+                        <mxPoint x="-340" y="240" as="sourcePoint"/>
+                        <mxPoint x="-290" y="190" as="targetPoint"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="28" value="&lt;span&gt;Validates&lt;/span&gt;&lt;br&gt;&lt;span&gt;username/password/clientId&lt;/span&gt;&lt;br&gt;&lt;span&gt;and issue short&lt;/span&gt;&lt;br&gt;&lt;span&gt;Authorization code&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                <mxCell id="28" value="&lt;span&gt;Validates&lt;/span&gt;&lt;br&gt;&lt;span&gt;username/password/clientId&lt;/span&gt;&lt;br&gt;&lt;span&gt;and issue short&lt;/span&gt;&lt;br&gt;&lt;span&gt;Authorization code&lt;/span&gt;" style="rounded=1;whiteSpace=wrap;html=1;" parent="1" vertex="1">
                    <mxGeometry x="115" width="190" height="90" as="geometry"/>
                </mxCell>
-                <mxCell id="30" value="Validates&lt;br&gt;clientId &amp;amp; authorization code&lt;br&gt;and issue&lt;br&gt;Access Token &amp;amp; Refresh Token" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                <mxCell id="30" value="Validates&lt;br&gt;clientId &amp;amp; authorization code&lt;br&gt;and issue&lt;br&gt;Access Token &amp;amp; Refresh Token" style="rounded=1;whiteSpace=wrap;html=1;" parent="1" vertex="1">
                    <mxGeometry x="115" y="140" width="190" height="90" as="geometry"/>
                </mxCell>
-                <mxCell id="32" value="Protected APIs&lt;br&gt;Authenticate requests &lt;br&gt;with provided Bearer Token" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;" vertex="1" parent="1">
-                    <mxGeometry x="50" y="280" width="320" height="400" as="geometry"/>
+                <mxCell id="32" value="Protected APIs&lt;br&gt;Authenticate requests &lt;br&gt;with provided Bearer Token" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;" parent="1" vertex="1">
+                    <mxGeometry x="50" y="920" width="320" height="150" as="geometry"/>
                </mxCell>
-                <mxCell id="33" value="" style="edgeStyle=none;html=1;entryX=0;entryY=0.373;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" target="32">
+                <mxCell id="33" value="" style="edgeStyle=none;html=1;entryX=-0.012;entryY=0.384;entryDx=0;entryDy=0;entryPerimeter=0;" parent="1" target="32" edge="1">
                    <mxGeometry relative="1" as="geometry">
-                        <mxPoint x="-340" y="432.5" as="sourcePoint"/>
-                        <mxPoint x="-10" y="430" as="targetPoint"/>
+                        <mxPoint x="-520" y="978" as="sourcePoint"/>
+                        <mxPoint x="-80" y="819" as="targetPoint"/>
                    </mxGeometry>
                </mxCell>
-                <mxCell id="34" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; line-height: 18px&quot;&gt;&lt;font color=&quot;#a31515&quot;&gt;Request with Access Token&lt;/font&gt;&lt;/div&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="33">
+                <mxCell id="34" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; line-height: 18px&quot;&gt;&lt;font color=&quot;#a31515&quot;&gt;Request with Access Token&lt;/font&gt;&lt;/div&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" parent="33" vertex="1" connectable="0">
+                    <mxGeometry x="-0.1257" y="2" relative="1" as="geometry">
+                        <mxPoint as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="37" value="Browser" style="rounded=0;whiteSpace=wrap;html=1;fontSize=22;" vertex="1" parent="1">
+                    <mxGeometry x="-590" y="-100" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="38" value="Browser" style="rounded=0;whiteSpace=wrap;html=1;fontSize=22;" vertex="1" parent="1">
+                    <mxGeometry x="-590" y="1110" width="120" height="60" as="geometry"/>
+                </mxCell>
+                <mxCell id="39" value="" style="endArrow=none;dashed=1;html=1;fontSize=22;entryX=0.5;entryY=1;entryDx=0;entryDy=0;exitX=0.5;exitY=0;exitDx=0;exitDy=0;" edge="1" parent="1" source="38" target="37">
+                    <mxGeometry width="50" height="50" relative="1" as="geometry">
+                        <mxPoint x="-340" y="390" as="sourcePoint"/>
+                        <mxPoint x="-290" y="340" as="targetPoint"/>
+                        <Array as="points"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="40" value="&lt;font style=&quot;font-size: 22px&quot;&gt;Okta Authentication&lt;/font&gt;" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;" vertex="1" parent="1">
+                    <mxGeometry x="50" y="300" width="320" height="560" as="geometry"/>
+                </mxCell>
+                <mxCell id="41" value="" style="edgeStyle=none;html=1;entryX=-0.013;entryY=0.092;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" target="49">
+                    <mxGeometry relative="1" as="geometry">
+                        <mxPoint x="-530" y="373" as="sourcePoint"/>
+                        <mxPoint x="115" y="372.58636363636356" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="42" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;span style=&quot;color: #a31515&quot;&gt;/SASjsApi/auth/okta/authorize&lt;br&gt;&lt;/span&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="41">
+                    <mxGeometry x="-0.1257" y="2" relative="1" as="geometry">
+                        <mxPoint as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="49" value="redirects to okta server&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;OKTA OIDC middleware&lt;br&gt;https://github.com/okta/okta-oidc-middleware&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;OKTA nodeJS Express implementation&lt;br&gt;https://github.com/okta/samples-nodejs-express-4/tree/master/okta-hosted-login&lt;br&gt;" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="115" y="350" width="190" height="280" as="geometry"/>
+                </mxCell>
+                <mxCell id="75" style="edgeStyle=none;html=1;exitX=0.5;exitY=1;exitDx=0;exitDy=0;entryX=0.5;entryY=0;entryDx=0;entryDy=0;fontSize=14;" edge="1" parent="1" source="50" target="32">
+                    <mxGeometry relative="1" as="geometry"/>
+                </mxCell>
+                <mxCell id="50" value="Validates express session &lt;br&gt;through OKTA OIDC middleware" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="115" y="710" width="190" height="90" as="geometry"/>
+                </mxCell>
+                <mxCell id="51" value="&lt;span style=&quot;font-size: 22px&quot;&gt;Okta Authorization Server&lt;br&gt;&lt;/span&gt;" style="whiteSpace=wrap;html=1;verticalAlign=top;fontStyle=0;" vertex="1" parent="1">
+                    <mxGeometry x="600" y="300" width="320" height="380" as="geometry"/>
+                </mxCell>
+                <mxCell id="52" value="" style="rounded=1;whiteSpace=wrap;html=1;" vertex="1" parent="1">
+                    <mxGeometry x="665" y="350" width="190" height="280" as="geometry"/>
+                </mxCell>
+                <mxCell id="53" value="" style="endArrow=classic;html=1;fontSize=22;exitX=1.002;exitY=0.123;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1" source="49">
+                    <mxGeometry width="50" height="50" relative="1" as="geometry">
+                        <mxPoint x="400" y="480" as="sourcePoint"/>
+                        <mxPoint x="660" y="384" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="54" value="&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;/authorize&lt;/span&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=22;" vertex="1" connectable="0" parent="53">
+                    <mxGeometry x="0.0222" y="1" relative="1" as="geometry">
+                        <mxPoint as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="58" value="" style="endArrow=classic;html=1;fontSize=22;exitX=-0.016;exitY=0.291;exitDx=0;exitDy=0;exitPerimeter=0;" edge="1" parent="1" source="52">
+                    <mxGeometry relative="1" as="geometry">
+                        <mxPoint x="-300" y="470" as="sourcePoint"/>
+                        <mxPoint x="-530" y="431" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="61" value="302 redirect to authentication prompt&amp;nbsp;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=22;" vertex="1" connectable="0" parent="58">
+                    <mxGeometry x="-0.659" y="3" relative="1" as="geometry">
+                        <mxPoint x="-630" as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="62" value="" style="endArrow=classic;html=1;fontSize=22;" edge="1" parent="1">
+                    <mxGeometry relative="1" as="geometry">
+                        <mxPoint x="-530" y="500" as="sourcePoint"/>
+                        <mxPoint x="665" y="500.48" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="64" value="Authentication &amp;amp; Consent" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=22;" vertex="1" connectable="0" parent="62">
+                    <mxGeometry x="-0.4695" y="6" relative="1" as="geometry">
+                        <mxPoint as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="65" value="" style="endArrow=classic;html=1;fontSize=22;exitX=0;exitY=0.679;exitDx=0;exitDy=0;exitPerimeter=0;entryX=0.995;entryY=0.679;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" source="52" target="49">
+                    <mxGeometry width="50" height="50" relative="1" as="geometry">
+                        <mxPoint x="230" y="560" as="sourcePoint"/>
+                        <mxPoint x="280" y="510" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="66" value="Authorization Code to redirect uri" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;" vertex="1" connectable="0" parent="65">
+                    <mxGeometry x="0.0583" y="1" relative="1" as="geometry">
+                        <mxPoint x="26" as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="67" value="" style="endArrow=classic;html=1;fontSize=22;exitX=0;exitY=0.679;exitDx=0;exitDy=0;exitPerimeter=0;entryX=0.995;entryY=0.679;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
+                    <mxGeometry width="50" height="50" relative="1" as="geometry">
+                        <mxPoint x="304.0500000000002" y="569.9999999999999" as="sourcePoint"/>
+                        <mxPoint x="665.0000000000005" y="569.9999999999999" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="68" value="&lt;span style=&quot;color: rgb(163 , 21 , 21) ; font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px&quot;&gt;/token&lt;/span&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;" vertex="1" connectable="0" parent="67">
+                    <mxGeometry x="0.0583" y="1" relative="1" as="geometry">
+                        <mxPoint x="-5" y="1" as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="69" value="" style="endArrow=classic;html=1;fontSize=22;exitX=0;exitY=0.679;exitDx=0;exitDy=0;exitPerimeter=0;entryX=0.995;entryY=0.679;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
+                    <mxGeometry width="50" height="50" relative="1" as="geometry">
+                        <mxPoint x="665.9500000000005" y="599.9999999999999" as="sourcePoint"/>
+                        <mxPoint x="305.00000000000017" y="599.9999999999999" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="70" value="Access Token" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;" vertex="1" connectable="0" parent="69">
+                    <mxGeometry x="0.0583" y="1" relative="1" as="geometry">
+                        <mxPoint x="26" as="offset"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="71" value="" style="edgeStyle=none;html=1;entryX=-0.012;entryY=0.384;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1">
+                    <mxGeometry relative="1" as="geometry">
+                        <mxPoint x="-530" y="760" as="sourcePoint"/>
+                        <mxPoint x="115.00000000000031" y="759.9999999999999" as="targetPoint"/>
+                    </mxGeometry>
+                </mxCell>
+                <mxCell id="72" value="&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; font-size: 12px ; line-height: 18px&quot;&gt;&lt;div style=&quot;font-family: &amp;#34;menlo&amp;#34; , &amp;#34;monaco&amp;#34; , &amp;#34;courier new&amp;#34; , monospace ; line-height: 18px&quot;&gt;&lt;font color=&quot;#a31515&quot;&gt;Request with OKTA mechanism&lt;/font&gt;&lt;/div&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];" vertex="1" connectable="0" parent="71">
                    <mxGeometry x="-0.1257" y="2" relative="1" as="geometry">
                        <mxPoint as="offset"/>
                    </mxGeometry>
--- a/SASjsServer.svg
+++ b/SASjsServer.svg
--- a/api/.env.example
+++ b/api/.env.example
@@ -1,25 +1,11 @@
 MODE=[desktop|server] default considered as desktop
-CORS=[disable|enable] default considered as disable for server MODE & enable for desktop MODE
-WHITELIST=<space separated urls, each starting with protocol `http` or `https`>
-
-PROTOCOL=[http|https] default considered as http
-PRIVATE_KEY=privkey.pem
-CERT_CHAIN=certificate.pem
-CA_ROOT=fullchain.pem
-
+CORS=[disable|enable] default considered as disable
 PORT=[5000] default value is 5000
-
-HELMET_CSP_CONFIG_PATH=./csp.config.json if omitted HELMET default will be used
-HELMET_COEP=[true|false] if omitted HELMET default will be used
-
+PORT_WEB=[port for sasjs web component(react)] default value is 3000
+ACCESS_TOKEN_SECRET=<secret>
+REFRESH_TOKEN_SECRET=<secret>
+AUTH_CODE_SECRET=<secret>
 DB_CONNECT=mongodb+srv://<DB_USERNAME>:<DB_PASSWORD>@<CLUSTER>/<DB_NAME>?retryWrites=true&w=majority

-RUN_TIMES=[sas,js,py | js,py | sas | sas,js] default considered as sas
 SAS_PATH=/opt/sas/sas9/SASHome/SASFoundation/9.4/sas
-NODE_PATH=~/.nvm/versions/node/v16.14.0/bin/node
-PYTHON_PATH=/usr/bin/python
-
-SASJS_ROOT=./sasjs_root
-
-LOG_FORMAT_MORGAN=common
-LOG_LOCATION=./sasjs_root/logs
+DRIVE_PATH=./tmp
--- a/api/.nvmrc
+++ b/api/.nvmrc
@@ -1 +0,0 @@
-v16.15.1
--- a/api/.vscode/launch.json
+++ b/api/.vscode/launch.json
@@ -1,13 +0,0 @@
-{
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "name": "Launch via NPM",
-      "request": "launch",
-      "runtimeArgs": ["run-script", "start"],
-      "runtimeExecutable": "npm",
-      "skipFiles": ["<node_internals>/**"],
-      "type": "pwa-node"
-    }
-  ]
-}
--- a/api/csp.config.example.json
+++ b/api/csp.config.example.json
@@ -1,5 +0,0 @@
-{
-  "img-src": ["'self'", "data:"],
-  "script-src": ["'self'", "'unsafe-inline'"],
-  "script-src-attr": ["'self'", "'unsafe-inline'"]
-}
--- a/api/package-lock.json
+++ b/api/package-lock.json
--- a/api/package.json
+++ b/api/package.json
@@ -4,33 +4,32 @@
  "description": "Api of SASjs server",
  "main": "./src/server.ts",
  "scripts": {
-    "initial": "npm run swagger && npm run compileSysInit && npm run copySASjsCore",
+    "initial": "npm run swagger && npm run compileSysInit",
    "prestart": "npm run initial",
+    "prestart:prod": "npm run initial",
    "prebuild": "npm run initial",
-    "start": "NODE_ENV=development nodemon ./src/server.ts",
-    "start:prod": "node ./build/src/server.js",
+    "start": "nodemon ./src/server.ts",
+    "start:prod": "nodemon ./src/prod-server.ts",
    "build": "rimraf build && tsc",
-    "postbuild": "npm run copy:files",
    "swagger": "tsoa spec",
+    "semantic-release": "semantic-release -d",
    "prepare": "[ -d .git ] && git config core.hooksPath ./.git-hooks || true",
    "test": "mkdir -p tmp && mkdir -p ../web/build && jest --silent --coverage",
    "lint:fix": "npx prettier --write \"src/**/*.{ts,tsx,js,jsx,html,css,sass,less,yml,md,graphql}\"",
    "lint": "npx prettier --check \"src/**/*.{ts,tsx,js,jsx,html,css,sass,less,yml,md,graphql}\"",
-    "exe": "npm run build && pkg .",
-    "copy:files": "npm run public:copy && npm run sasjsbuild:copy && npm run sasjscore:copy && npm run web:copy",
+    "package:lib": "npm run build && cp ./package.json build && cp README.md build && cd build && npm version \"5.0.0\" && npm pack",
+    "exe": "npm run build && npm run exe:copy && pkg .",
+    "exe:copy": "npm run public:copy && npm run sasjsbuild:copy && npm run web:copy",
    "public:copy": "cp -r ./public/ ./build/public/",
    "sasjsbuild:copy": "cp -r ./sasjsbuild/ ./build/sasjsbuild/",
-    "sasjscore:copy": "cp -r ./sasjscore/ ./build/sasjscore/",
    "web:copy": "rimraf web && mkdir web && cp -r ../web/build/ ./web/build/",
-    "compileSysInit": "ts-node ./scripts/compileSysInit.ts",
-    "copySASjsCore": "ts-node ./scripts/copySASjsCore.ts"
+    "compileSysInit": "ts-node ./scripts/compileSysInit.ts"
  },
  "bin": "./build/src/server.js",
  "pkg": {
    "assets": [
      "./build/public/**/*",
      "./build/sasjsbuild/**/*",
-      "./build/sasjscore/**/*",
      "./web/build/**/*"
    ],
    "targets": [
@@ -47,35 +46,24 @@
  },
  "author": "4GL Ltd",
  "dependencies": {
-    "@sasjs/core": "^4.31.3",
-    "@sasjs/utils": "2.42.1",
+    "@sasjs/core": "3.11.1",
+    "@sasjs/utils": "2.34.1",
    "bcryptjs": "^2.4.3",
-    "connect-mongo": "^4.6.0",
-    "cookie-parser": "^1.4.6",
    "cors": "^2.8.5",
-    "csurf": "^1.11.0",
    "express": "^4.17.1",
-    "express-session": "^1.17.2",
-    "helmet": "^5.0.2",
    "joi": "^17.4.2",
    "jsonwebtoken": "^8.5.1",
    "mongoose": "^6.0.12",
    "mongoose-sequence": "^5.3.1",
    "morgan": "^1.10.0",
-    "multer": "^1.4.5-lts.1",
-    "rotating-file-stream": "^3.0.4",
-    "swagger-ui-express": "4.3.0",
-    "unzipper": "^0.10.11",
-    "url": "^0.10.3"
+    "multer": "^1.4.3",
+    "swagger-ui-express": "^4.1.6",
+    "tsoa": "^3.14.0"
  },
  "devDependencies": {
-    "@types/adm-zip": "^0.5.0",
    "@types/bcryptjs": "^2.4.2",
-    "@types/cookie-parser": "^1.4.2",
    "@types/cors": "^2.8.12",
-    "@types/csurf": "^1.11.2",
    "@types/express": "^4.17.12",
-    "@types/express-session": "^1.17.4",
    "@types/jest": "^26.0.24",
    "@types/jsonwebtoken": "^8.5.5",
    "@types/mongoose-sequence": "^3.0.6",
@@ -84,25 +72,20 @@
    "@types/node": "^15.12.2",
    "@types/supertest": "^2.0.11",
    "@types/swagger-ui-express": "^4.1.3",
-    "@types/unzipper": "^0.10.5",
-    "adm-zip": "^0.5.9",
    "dotenv": "^10.0.0",
-    "http-headers-validation": "^0.0.1",
    "jest": "^27.0.6",
    "mongodb-memory-server": "^8.0.0",
    "nodemon": "^2.0.7",
-    "pkg": "5.6.0",
+    "pkg": "^5.4.1",
    "prettier": "^2.3.1",
    "rimraf": "^3.0.2",
+    "semantic-release": "^17.4.3",
    "supertest": "^6.1.3",
    "ts-jest": "^27.0.3",
    "ts-node": "^10.0.0",
-    "tsoa": "3.14.1",
    "typescript": "^4.3.2"
  },
-  "nodemonConfig": {
-    "ignore": [
-      "sasjs_root/**/*"
-    ]
+  "configuration": {
+    "sasPath": "/opt/sas/sas9/SASHome/SASFoundation/9.4/sas"
  }
 }
--- a/api/public/SASjsApi/swagger-ui-init.js
+++ b/api/public/SASjsApi/swagger-ui-init.js
@@ -1,50 +0,0 @@
-window.onload = function () {
-  // Build a system
-  var url = window.location.search.match(/url=([^&]+)/)
-  if (url && url.length > 1) {
-    url = decodeURIComponent(url[1])
-  } else {
-    url = window.location.origin
-  }
-  var options = {
-    customOptions: {
-      url: '/swagger.yaml',
-      requestInterceptor: function (request) {
-        request.credentials = 'include'
-        var cookie = document.cookie
-        var startIndex = cookie.indexOf('XSRF-TOKEN')
-        var csrf = cookie.slice(startIndex + 11).split('; ')[0]
-        request.headers['X-XSRF-TOKEN'] = csrf
-        return request
-      }
-    }
-  }
-  url = options.swaggerUrl || url
-  var urls = options.swaggerUrls
-  var customOptions = options.customOptions
-  var spec1 = options.swaggerDoc
-  var swaggerOptions = {
-    spec: spec1,
-    url: url,
-    urls: urls,
-    dom_id: '#swagger-ui',
-    deepLinking: true,
-    presets: [SwaggerUIBundle.presets.apis, SwaggerUIStandalonePreset],
-    plugins: [SwaggerUIBundle.plugins.DownloadUrl],
-    layout: 'StandaloneLayout'
-  }
-  for (var attrname in customOptions) {
-    swaggerOptions[attrname] = customOptions[attrname]
-  }
-  var ui = SwaggerUIBundle(swaggerOptions)
-
-  if (customOptions.oauth) {
-    ui.initOAuth(customOptions.oauth)
-  }
-
-  if (customOptions.authAction) {
-    ui.authActions.authorize(customOptions.authAction)
-  }
-
-  window.ui = ui
-}
--- a/api/public/app-streams-script.js
+++ b/api/public/app-streams-script.js
@@ -1,49 +0,0 @@
-const inputElement = document.getElementById('fileId')
-
-document.getElementById('uploadButton').addEventListener('click', function () {
-  inputElement.click()
-})
-
-inputElement.addEventListener(
-  'change',
-  function () {
-    const fileList = this.files /* now you can work with the file list */
-
-    updateFileUploadMessage('Requesting ...')
-
-    const file = fileList[0]
-    const formData = new FormData()
-
-    formData.append('file', file)
-
-    axios
-      .post('/SASjsApi/drive/deploy/upload', formData)
-      .then((res) => res.data)
-      .then((data) => {
-        return (
-          data.message +
-          '\nstreamServiceName: ' +
-          data.streamServiceName +
-          '\nrefreshing page once alert box closes.'
-        )
-      })
-      .then((message) => {
-        alert(message)
-        location.reload()
-      })
-      .catch((error) => {
-        alert(error.response.data)
-        resetFileUpload()
-        updateFileUploadMessage('Upload New App')
-      })
-  },
-  false
-)
-
-function updateFileUploadMessage(message) {
-  document.getElementById('uploadMessage').innerHTML = message
-}
-
-function resetFileUpload() {
-  inputElement.value = null
-}
--- a/api/public/axios.min.js
+++ b/api/public/axios.min.js
--- a/api/public/plus.png
+++ b/api/public/plus.png
--- a/api/public/sasjs-logo.svg
+++ b/api/public/sasjs-logo.svg
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Generator: Adobe Illustrator 19.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
-<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
-	 viewBox="0 0 32 32" style="enable-background:new 0 0 32 32;" xml:space="preserve">
-<style type="text/css">
-	.st0{fill:#F6E40C;}
-</style>
-<rect id="XMLID_1_" width="32" height="32"/>
-<g id="XMLID_654_">
-	<path id="XMLID_656_" class="st0" d="M27.9,17.4c-1.1,0-2.1,0-3,0c-1.2,0-2.3,0-3.5,0c-0.5,0-0.7,0.2-0.6,0.7c0,2.1,0,4.3,0,6.4
-		c0,0.5-0.2,0.8-0.6,1c-2.5,1.4-4.9,2.8-7.3,4.3c-0.4,0.2-0.6,0.2-1,0c-2.4-1.4-4.9-2.9-7.3-4.3c-0.2-0.1-0.5-0.5-0.5-0.7
-		c0-3.2,0-6.4,0-9.6c0-0.1,0-0.1,0.1-0.3c0.3,0,0.5,0,0.8,0c1.9,0,3.7,0,5.6,0c0.6,0,0.7-0.2,0.7-0.7c0-2.1,0-4.2,0-6.4
-		c0-0.5,0.1-0.8,0.6-1.1c2.5-1.4,4.9-2.9,7.3-4.3c0.2-0.1,0.6-0.1,0.9,0c2.5,1.4,5,2.9,7.5,4.4c0.2,0.1,0.4,0.4,0.4,0.6
-		C27.9,10.6,27.9,13.9,27.9,17.4z M20.8,14.8c1.4,0,2.7,0,4,0c0.5,0,0.7-0.2,0.7-0.7c0-1.7,0-3.3,0-5c0-0.5-0.2-0.7-0.6-1
-		c-1.6-0.9-3.2-1.9-4.8-2.8c-0.2-0.1-0.7-0.1-0.9,0c-1.6,0.9-3.2,1.9-4.8,2.8c-0.4,0.2-0.6,0.5-0.6,1c0,3.2,0,6.3,0,9.5
-		c0,1.9,0,1.9-1.9,1.9c-0.4,0-0.6-0.1-0.6-0.6c0-0.6,0-1.3,0-1.9c0-0.5-0.2-0.6-0.6-0.6c-1.1,0-2.2,0-3.3,0c-0.5,0-0.7,0.2-0.7,0.7
-		c0,1.6,0,3.3,0,4.9c0,0.5,0.2,0.8,0.6,1c1.6,0.9,3.2,1.9,4.8,2.8c0.2,0.1,0.7,0.1,0.9,0c1.6-0.9,3.2-1.9,4.8-2.8
-		c0.4-0.2,0.6-0.5,0.6-1c0-3.1,0-6.1,0-9.2c0-1.9,0-1.9,1.9-1.9c0.5,0,0.7,0.2,0.7,0.7C20.8,13.3,20.8,14,20.8,14.8z"/>
-	<path id="XMLID_655_" class="st0" d="M18,2.1l-6.8,3.9V2.7c0-0.3,0.3-0.6,0.6-0.6H18z"/>
-</g>
-</svg>
--- a/api/public/swagger.yaml
+++ b/api/public/swagger.yaml
--- a/api/scripts/compileSysInit.ts
+++ b/api/scripts/compileSysInit.ts
@@ -1,29 +1,27 @@
 import path from 'path'
 import {
-  CompileTree,
  createFile,
  loadDependenciesFile,
  readFile,
  SASJsFileType
 } from '@sasjs/utils'
-import { apiRoot, sysInitCompiledPath } from '../src/utils/file'
+import { apiRoot, sysInitCompiledPath } from '../src/utils'

 const macroCorePath = path.join(apiRoot, 'node_modules', '@sasjs', 'core')

 const compiledSystemInit = async (systemInit: string) =>
-  'options ls=max ps=max;\n' +
+  'options ps=max;\n' +
  (await loadDependenciesFile({
    fileContent: systemInit,
    type: SASJsFileType.job,
    programFolders: [],
    macroFolders: [],
    buildSourceFolder: '',
-    binaryFolders: [],
-    macroCorePath,
-    compileTree: new CompileTree('') // dummy compileTree
+    macroCorePath
  }))

 const createSysInitFile = async () => {
+  console.log('macroCorePath', macroCorePath)
  const systemInitContent = await readFile(
    path.join(__dirname, 'systemInit.sas')
  )
--- a/api/scripts/copySASjsCore.ts
+++ b/api/scripts/copySASjsCore.ts
@@ -1,36 +0,0 @@
-import path from 'path'
-import {
-  asyncForEach,
-  copy,
-  createFile,
-  createFolder,
-  deleteFolder,
-  listFilesInFolder
-} from '@sasjs/utils'
-
-import {
-  apiRoot,
-  sasJSCoreMacros,
-  sasJSCoreMacrosInfo
-} from '../src/utils/file'
-
-const macroCorePath = path.join(apiRoot, 'node_modules', '@sasjs', 'core')
-
-export const copySASjsCore = async () => {
-  await deleteFolder(sasJSCoreMacros)
-  await createFolder(sasJSCoreMacros)
-
-  const foldersToCopy = ['base', 'ddl', 'fcmp', 'lua', 'server']
-
-  await asyncForEach(foldersToCopy, async (coreSubFolder) => {
-    const coreSubFolderPath = path.join(macroCorePath, coreSubFolder)
-
-    await copy(coreSubFolderPath, sasJSCoreMacros)
-  })
-
-  const fileNames = await listFilesInFolder(sasJSCoreMacros)
-
-  await createFile(sasJSCoreMacrosInfo, fileNames.join('\n'))
-}
-
-copySASjsCore()
--- a/api/scripts/systemInit.sas
+++ b/api/scripts/systemInit.sas
@@ -4,13 +4,10 @@
  @details This program is inserted into every sasjs/server program invocation,
  _before_ any user-provided content.

-  A number of useful CORE macros are also compiled below, so that they can be
-  available by default for Stored Programs.
-
-  Note that the full CORE library is available to sessions in SASjs Studio.
-
  <h4> SAS Macros </h4>
-  @li mfs_httpheader.sas
-  @li ms_webout.sas
+  @li mcf_stpsrv_header.sas
+
 **/

+
+%mcf_stpsrv_header(wrap=YES, insert_cmplib=YES)
--- a/api/src/app-modules/configureCors.ts
+++ b/api/src/app-modules/configureCors.ts
@@ -1,21 +0,0 @@
-import { Express } from 'express'
-import cors from 'cors'
-import { CorsType } from '../utils'
-
-export const configureCors = (app: Express) => {
-  const { CORS, WHITELIST } = process.env
-
-  if (CORS === CorsType.ENABLED) {
-    const whiteList: string[] = []
-    WHITELIST?.split(' ')
-      ?.filter((url) => !!url)
-      .forEach((url) => {
-        if (url.startsWith('http'))
-          // removing trailing slash of URLs listing for CORS
-          whiteList.push(url.replace(/\/$/, ''))
-      })
-
-    console.log('All CORS Requests are enabled for:', whiteList)
-    app.use(cors({ credentials: true, origin: whiteList }))
-  }
-}
--- a/api/src/app-modules/configureExpressSession.ts
+++ b/api/src/app-modules/configureExpressSession.ts
@@ -1,32 +0,0 @@
-import { Express } from 'express'
-import mongoose from 'mongoose'
-import session from 'express-session'
-import MongoStore from 'connect-mongo'
-
-import { ModeType } from '../utils'
-import { cookieOptions } from '../app'
-
-export const configureExpressSession = (app: Express) => {
-  const { MODE } = process.env
-
-  if (MODE === ModeType.Server) {
-    let store: MongoStore | undefined
-
-    if (process.env.NODE_ENV !== 'test') {
-      store = MongoStore.create({
-        client: mongoose.connection!.getClient() as any,
-        collectionName: 'sessions'
-      })
-    }
-
-    app.use(
-      session({
-        secret: process.secrets.SESSION_SECRET,
-        saveUninitialized: false, // don't create session until something stored
-        resave: false, //don't save session if unmodified
-        store,
-        cookie: cookieOptions
-      })
-    )
-  }
-}
--- a/api/src/app-modules/configureLogger.ts
+++ b/api/src/app-modules/configureLogger.ts
@@ -1,33 +0,0 @@
-import path from 'path'
-import { Express } from 'express'
-import morgan from 'morgan'
-import { createStream } from 'rotating-file-stream'
-import { generateTimestamp } from '@sasjs/utils'
-import { getLogFolder } from '../utils'
-
-export const configureLogger = (app: Express) => {
-  const { LOG_FORMAT_MORGAN } = process.env
-
-  let options
-  if (
-    process.env.NODE_ENV !== 'development' &&
-    process.env.NODE_ENV !== 'test'
-  ) {
-    const timestamp = generateTimestamp()
-    const filename = `${timestamp}.log`
-    const logsFolder = getLogFolder()
-
-    // create a rotating write stream
-    var accessLogStream = createStream(filename, {
-      interval: '1d', // rotate daily
-      path: logsFolder
-    })
-
-    console.log('Writing Logs to :', path.join(logsFolder, filename))
-
-    options = { stream: accessLogStream }
-  }
-
-  // setup the logger
-  app.use(morgan(LOG_FORMAT_MORGAN as string, options))
-}
--- a/api/src/app-modules/configureSecurity.ts
+++ b/api/src/app-modules/configureSecurity.ts
@@ -1,26 +0,0 @@
-import { Express } from 'express'
-import { getEnvCSPDirectives } from '../utils/parseHelmetConfig'
-import { HelmetCoepType, ProtocolType } from '../utils'
-import helmet from 'helmet'
-
-export const configureSecurity = (app: Express) => {
-  const { PROTOCOL, HELMET_CSP_CONFIG_PATH, HELMET_COEP } = process.env
-
-  const cspConfigJson: { [key: string]: string[] | null } = getEnvCSPDirectives(
-    HELMET_CSP_CONFIG_PATH
-  )
-  if (PROTOCOL === ProtocolType.HTTP)
-    cspConfigJson['upgrade-insecure-requests'] = null
-
-  app.use(
-    helmet({
-      contentSecurityPolicy: {
-        directives: {
-          ...helmet.contentSecurityPolicy.getDefaultDirectives(),
-          ...cspConfigJson
-        }
-      },
-      crossOriginEmbedderPolicy: HELMET_COEP === HelmetCoepType.TRUE
-    })
-  )
-}
--- a/api/src/app-modules/index.ts
+++ b/api/src/app-modules/index.ts
@@ -1,4 +0,0 @@
-export * from './configureCors'
-export * from './configureExpressSession'
-export * from './configureLogger'
-export * from './configureSecurity'
--- a/api/src/app.ts
+++ b/api/src/app.ts
@@ -1,97 +1,36 @@
 import path from 'path'
-import express, { ErrorRequestHandler } from 'express'
-import csrf, { CookieOptions } from 'csurf'
-import cookieParser from 'cookie-parser'
+import express from 'express'
+import morgan from 'morgan'
 import dotenv from 'dotenv'
+import cors from 'cors'

-import {
-  copySASjsCore,
-  getWebBuildFolder,
-  instantiateLogger,
-  loadAppStreamConfig,
-  ProtocolType,
-  ReturnCode,
-  setProcessVariables,
-  setupFolders,
-  verifyEnvVariables
-} from './utils'
-import {
-  configureCors,
-  configureExpressSession,
-  configureLogger,
-  configureSecurity
-} from './app-modules'
+import webRouter from './routes/web'
+import apiRouter from './routes/api'
+import { connectDB, getWebBuildFolderPath } from './utils'

 dotenv.config()

-instantiateLogger()
-
-if (verifyEnvVariables()) process.exit(ReturnCode.InvalidEnv)
-
 const app = express()

-const { PROTOCOL } = process.env
+const { MODE, CORS, PORT_WEB } = process.env
+const whiteList = [
+  `http://localhost:${PORT_WEB ?? 3000}`,
+  'https://sas.analytium.co.uk:8343'
+]

-export const cookieOptions: CookieOptions = {
-  secure: PROTOCOL === ProtocolType.HTTPS,
-  httpOnly: true,
-  sameSite: PROTOCOL === ProtocolType.HTTPS ? 'none' : undefined,
-  maxAge: 24 * 60 * 60 * 1000 // 24 hours
+if (MODE?.trim() !== 'server' || CORS?.trim() === 'enable') {
+  console.log('All CORS Requests are enabled')
+  app.use(cors({ credentials: true, origin: whiteList }))
 }

-/***********************************
- *         CSRF Protection         *
- ***********************************/
-export const csrfProtection = csrf({ cookie: cookieOptions })
+app.use(express.json({ limit: '50mb' }))
+app.use(morgan('tiny'))
+app.use(express.static(path.join(__dirname, '../public')))

-const onError: ErrorRequestHandler = (err, req, res, next) => {
-  if (err.code === 'EBADCSRFTOKEN')
-    return res.status(400).send('Invalid CSRF token!')
+app.use('/', webRouter)
+app.use('/SASjsApi', apiRouter)
+app.use(express.json({ limit: '50mb' }))

-  console.error(err.stack)
-  res.status(500).send('Something broke!')
-}
+app.use(express.static(getWebBuildFolderPath()))

-export default setProcessVariables().then(async () => {
-  app.use(cookieParser())
-
-  configureLogger(app)
-
-  /***********************************
-   *   Handle security and origin    *
-   ***********************************/
-  configureSecurity(app)
-
-  /***********************************
-   *         Enabling CORS           *
-   ***********************************/
-  configureCors(app)
-
-  /***********************************
-   *         DB Connection &          *
-   *        Express Sessions          *
-   *        With Mongo Store          *
-   ***********************************/
-  configureExpressSession(app)
-
-  app.use(express.json({ limit: '100mb' }))
-  app.use(express.static(path.join(__dirname, '../public')))
-
-  await setupFolders()
-  await copySASjsCore()
-
-  // loading these modules after setting up variables due to
-  // multer's usage of process var process.driveLoc
-  const { setupRoutes } = await import('./routes/setupRoutes')
-  setupRoutes(app)
-
-  await loadAppStreamConfig()
-
-  // should be served after setting up web route
-  // index.html needs to be injected with some js script.
-  app.use(express.static(getWebBuildFolder()))
-
-  app.use(onError)
-
-  return app
-})
+export default connectDB().then(() => app)
--- a/api/src/controllers/auth.ts
+++ b/api/src/controllers/auth.ts
@@ -1,8 +1,10 @@
 import { Security, Route, Tags, Example, Post, Body, Query, Hidden } from 'tsoa'
 import jwt from 'jsonwebtoken'
+import User from '../model/User'
 import { InfoJWT } from '../types'
 import {
  generateAccessToken,
+  generateAuthCode,
  generateRefreshToken,
  removeTokensInDB,
  saveTokensInDB
@@ -22,6 +24,20 @@ export class AuthController {
  static deleteCode = (userId: number, clientId: string) =>
    delete AuthController.authCodes[userId][clientId]

+  /**
+   * @summary Accept a valid username/password, plus a CLIENT_ID, and return an AUTH_CODE
+   *
+   */
+  @Example<AuthorizeResponse>({
+    code: 'someRandomCryptoString'
+  })
+  @Post('/authorize')
+  public async authorize(
+    @Body() body: AuthorizePayload
+  ): Promise<AuthorizeResponse> {
+    return authorize(body)
+  }
+
  /**
   * @summary Accepts client/auth code and returns access/refresh tokens
   *
@@ -62,6 +78,30 @@ export class AuthController {
  }
 }

+const authorize = async (data: any): Promise<AuthorizeResponse> => {
+  const { username, password, clientId } = data
+
+  // Authenticate User
+  const user = await User.findOne({ username })
+  if (!user) throw new Error('Username is not found.')
+
+  const validPass = user.comparePassword(password)
+  if (!validPass) throw new Error('Invalid password.')
+
+  // generate authorization code against clientId
+  const userInfo: InfoJWT = {
+    clientId,
+    userId: user.id
+  }
+  const code = AuthController.saveCode(
+    user.id,
+    clientId,
+    generateAuthCode(userInfo)
+  )
+
+  return { code }
+}
+
 const token = async (data: any): Promise<TokenResponse> => {
  const { clientId, code } = data

@@ -99,6 +139,32 @@ const logout = async (userInfo: InfoJWT) => {
  await removeTokensInDB(userInfo.userId, userInfo.clientId)
 }

+interface AuthorizePayload {
+  /**
+   * Username for user
+   * @example "secretuser"
+   */
+  username: string
+  /**
+   * Password for user
+   * @example "secretpassword"
+   */
+  password: string
+  /**
+   * Client ID
+   * @example "clientID1"
+   */
+  clientId: string
+}
+
+interface AuthorizeResponse {
+  /**
+   * Authorization code
+   * @example "someRandomCryptoString"
+   */
+  code: string
+}
+
 interface TokenPayload {
  /**
   * Client ID
@@ -129,8 +195,8 @@ const verifyAuthCode = async (
  clientId: string,
  code: string
 ): Promise<InfoJWT | undefined> => {
-  return new Promise((resolve) => {
-    jwt.verify(code, process.secrets.AUTH_CODE_SECRET, (err, data) => {
+  return new Promise((resolve, reject) => {
+    jwt.verify(code, process.env.AUTH_CODE_SECRET as string, (err, data) => {
      if (err) return resolve(undefined)

      const clientInfo: InfoJWT = {
--- a/api/src/controllers/code.ts
+++ b/api/src/controllers/code.ts
@@ -1,25 +1,14 @@
 import express from 'express'
 import { Request, Security, Route, Tags, Post, Body } from 'tsoa'
 import { ExecutionController } from './internal'
-import {
-  getPreProgramVariables,
-  getUserAutoExec,
-  ModeType,
-  parseLogToArray,
-  RunTimeType
-} from '../utils'
+import { PreProgramVars } from '../types'

-interface ExecuteCodePayload {
+interface ExecuteSASCodePayload {
  /**
-   * Code of program
-   * @example "* Code HERE;"
+   * Code of SAS program
+   * @example "* SAS Code HERE;"
   */
  code: string
-  /**
-   * runtime for program
-   * @example "js"
-   */
-  runTime: RunTimeType
 }

@Security('bearerAuth')
@@ -31,34 +20,25 @@ export class CodeController {
   * @summary Run SAS Code and returns log
   */
  @Post('/execute')
-  public async executeCode(
+  public async executeSASCode(
    @Request() request: express.Request,
-    @Body() body: ExecuteCodePayload
-  ): Promise<string | Buffer> {
-    return executeCode(request, body)
+    @Body() body: ExecuteSASCodePayload
+  ): Promise<string> {
+    return executeSASCode(request, body)
  }
 }

-const executeCode = async (
-  req: express.Request,
-  { code, runTime }: ExecuteCodePayload
-) => {
-  const { user } = req
-  const userAutoExec =
-    process.env.MODE === ModeType.Server
-      ? user?.autoExec
-      : await getUserAutoExec()
-
+const executeSASCode = async (req: any, { code }: ExecuteSASCodePayload) => {
  try {
-    const { result } = await new ExecutionController().executeProgram({
-      program: code,
-      preProgramVariables: getPreProgramVariables(req),
-      vars: { ...req.query, _debug: 131 },
-      otherArgs: { userAutoExec },
-      runTime: runTime
-    })
+    const result = await new ExecutionController().executeProgram(
+      code,
+      getPreProgramVariables(req),
+      { ...req.query, _debug: 131 },
+      undefined,
+      true
+    )

-    return result
+    return result as string
  } catch (err: any) {
    throw {
      code: 400,
@@ -68,3 +48,16 @@ const executeCode = async (
    }
  }
 }
+
+const getPreProgramVariables = (req: any): PreProgramVars => {
+  const host = req.get('host')
+  const protocol = req.protocol + '://'
+  const { user, accessToken } = req
+  return {
+    username: user.username,
+    userId: user.userId,
+    displayName: user.displayName,
+    serverUrl: protocol + host,
+    accessToken
+  }
+}
--- a/api/src/controllers/drive.ts
+++ b/api/src/controllers/drive.ts
@@ -1,8 +1,5 @@
-import path from 'path'
-import express, { Express } from 'express'
 import {
  Security,
-  Request,
  Route,
  Tags,
  Example,
@@ -11,40 +8,35 @@ import {
  Response,
  Query,
  Get,
-  Patch,
-  UploadedFile,
-  FormField,
-  Delete,
-  Hidden
+  Patch
 } from 'tsoa'
-import {
-  fileExists,
-  moveFile,
-  createFolder,
-  deleteFile as deleteFileOnSystem,
-  deleteFolder as deleteFolderOnSystem,
-  folderExists,
-  listFilesInFolder,
-  listSubFoldersInFolder,
-  isFolder,
-  FileTree,
-  isFileTree
-} from '@sasjs/utils'
+import { fileExists, readFile, createFile } from '@sasjs/utils'
 import { createFileTree, ExecutionController, getTreeExample } from './internal'

-import { TreeNode } from '../types'
-import { getFilesFolder } from '../utils'
+import { FileTree, isFileTree, TreeNode } from '../types'
+import path from 'path'
+import { getTmpFilesFolderPath } from '../utils'

 interface DeployPayload {
-  appLoc: string
-  streamWebFolder?: string
+  appLoc?: string
  fileTree: FileTree
 }
+interface FilePayload {
+  /**
+   * Path of the file
+   * @example "/Public/somefolder/some.file"
+   */
+  filePath: string
+  /**
+   * Contents of the file
+   * @example "Contents of the File"
+   */
+  fileContent: string
+}

 interface DeployResponse {
  status: string
  message: string
-  streamServiceName?: string
  example?: FileTree
 }

@@ -59,32 +51,11 @@ interface GetFileTreeResponse {
  tree: TreeNode
 }

-interface FileFolderResponse {
+interface UpdateFileResponse {
  status: string
  message?: string
 }

-interface AddFolderPayload {
-  /**
-   * Location of folder
-   * @example "/Public/someFolder"
-   */
-  folderPath: string
-}
-
-interface RenamePayload {
-  /**
-   * Old path of file/folder
-   * @example "/Public/someFolder"
-   */
-  oldPath: string
-  /**
-   * New path of file/folder
-   * @example "/Public/newFolder"
-   */
-  newPath: string
-}
-
 const fileTreeExample = getTreeExample()

 const successDeployResponse: DeployResponse = {
@@ -118,158 +89,57 @@ export class DriveController {
  }

  /**
-   * Accepts JSON file and zipped compressed JSON file as well.
-   * Compressed file should only contain one JSON file and should have same name
-   * as of compressed file e.g. deploy.JSON should be compressed to deploy.JSON.zip
-   * Any other file or JSON file in zipped will be ignored!
-   *
-   * @summary Creates/updates files within SASjs Drive using uploaded JSON/compressed JSON file.
-   *
-   */
-  @Example<DeployResponse>(successDeployResponse)
-  @Response<DeployResponse>(400, 'Invalid Format', invalidDeployFormatResponse)
-  @Response<DeployResponse>(500, 'Execution Error', execDeployErrorResponse)
-  @Post('/deploy/upload')
-  public async deployUpload(
-    @UploadedFile() file: Express.Multer.File, // passing here for API docs
-    @Query() @Hidden() body?: DeployPayload // Hidden decorator has be optional
-  ): Promise<DeployResponse> {
-    return deploy(body!)
-  }
-
-  /**
-   *
   * @summary Get file from SASjs Drive
-   * @query _filePath Location of SAS program
-   * @example _filePath "/Public/somefolder/some.file"
+   * @query filePath Location of SAS program
+   * @example filePath "/Public/somefolder/some.file"
   */
+  @Example<GetFileResponse>({
+    status: 'success',
+    fileContent: 'Contents of the File'
+  })
+  @Response<GetFileResponse>(400, 'Unable to get File', {
+    status: 'failure',
+    message: 'File request failed.'
+  })
  @Get('/file')
-  public async getFile(
-    @Request() request: express.Request,
-    @Query() _filePath: string
-  ) {
-    return getFile(request, _filePath)
+  public async getFile(@Query() filePath: string): Promise<GetFileResponse> {
+    return getFile(filePath)
  }

  /**
-   *
-   * @summary Get folder contents from SASjs Drive
-   * @query _folderPath Location of SAS program
-   * @example _folderPath "/Public/somefolder"
-   */
-  @Get('/folder')
-  public async getFolder(@Query() _folderPath?: string) {
-    return getFolder(_folderPath)
-  }
-
-  /**
-   *
-   * @summary Delete file from SASjs Drive
-   * @query _filePath Location of file
-   * @example _filePath "/Public/somefolder/some.file"
-   */
-  @Delete('/file')
-  public async deleteFile(@Query() _filePath: string) {
-    return deleteFile(_filePath)
-  }
-
-  /**
-   *
-   * @summary Delete folder from SASjs Drive
-   * @query _folderPath Location of folder
-   * @example _folderPath "/Public/somefolder/"
-   */
-  @Delete('/folder')
-  public async deleteFolder(@Query() _folderPath: string) {
-    return deleteFolder(_folderPath)
-  }
-
-  /**
-   * It's optional to either provide `_filePath` in url as query parameter
-   * Or provide `filePath` in body as form field.
-   * But it's required to provide else API will respond with Bad Request.
-   *
   * @summary Create a file in SASjs Drive
-   * @param _filePath Location of file
-   * @example _filePath "/Public/somefolder/some.file.sas"
   *
   */
-  @Example<FileFolderResponse>({
+  @Example<UpdateFileResponse>({
    status: 'success'
  })
-  @Response<FileFolderResponse>(403, 'File already exists', {
+  @Response<UpdateFileResponse>(400, 'File already exists', {
    status: 'failure',
    message: 'File request failed.'
  })
  @Post('/file')
  public async saveFile(
-    @UploadedFile() file: Express.Multer.File,
-    @Query() _filePath?: string,
-    @FormField() filePath?: string
-  ): Promise<FileFolderResponse> {
-    return saveFile((_filePath ?? filePath)!, file)
+    @Body() body: FilePayload
+  ): Promise<UpdateFileResponse> {
+    return saveFile(body)
  }

  /**
-   * @summary Create an empty folder in SASjs Drive
-   *
-   */
-  @Example<FileFolderResponse>({
-    status: 'success'
-  })
-  @Response<FileFolderResponse>(409, 'Folder already exists', {
-    status: 'failure',
-    message: 'Add folder request failed.'
-  })
-  @Post('/folder')
-  public async addFolder(
-    @Body() body: AddFolderPayload
-  ): Promise<FileFolderResponse> {
-    return addFolder(body.folderPath)
-  }
-
-  /**
-   * It's optional to either provide `_filePath` in url as query parameter
-   * Or provide `filePath` in body as form field.
-   * But it's required to provide else API will respond with Bad Request.
-   *
   * @summary Modify a file in SASjs Drive
-   * @param _filePath Location of SAS program
-   * @example _filePath "/Public/somefolder/some.file.sas"
   *
   */
-  @Example<FileFolderResponse>({
+  @Example<UpdateFileResponse>({
    status: 'success'
  })
-  @Response<FileFolderResponse>(403, `File doesn't exist`, {
+  @Response<UpdateFileResponse>(400, 'Unable to get File', {
    status: 'failure',
    message: 'File request failed.'
  })
  @Patch('/file')
  public async updateFile(
-    @UploadedFile() file: Express.Multer.File,
-    @Query() _filePath?: string,
-    @FormField() filePath?: string
-  ): Promise<FileFolderResponse> {
-    return updateFile((_filePath ?? filePath)!, file)
-  }
-
-  /**
-   * @summary Renames a file/folder in SASjs Drive
-   *
-   */
-  @Example<FileFolderResponse>({
-    status: 'success'
-  })
-  @Response<FileFolderResponse>(409, 'Folder already exists', {
-    status: 'failure',
-    message: 'rename request failed.'
-  })
-  @Post('/rename')
-  public async rename(
-    @Body() body: RenamePayload
-  ): Promise<FileFolderResponse> {
-    return rename(body.oldPath, body.newPath)
+    @Body() body: FilePayload
+  ): Promise<UpdateFileResponse> {
+    return updateFile(body)
  }

  /**
@@ -283,292 +153,91 @@ export class DriveController {
 }

 const getFileTree = () => {
-  const tree = new ExecutionController().buildDirectoryTree()
+  const tree = new ExecutionController().buildDirectorytree()
  return { status: 'success', tree }
 }

 const deploy = async (data: DeployPayload) => {
-  const driveFilesPath = getFilesFolder()
-
-  const appLocParts = data.appLoc.replace(/^\//, '').split('/')
-
-  const appLocPath = path
-    .join(getFilesFolder(), ...appLocParts)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!appLocPath.includes(driveFilesPath)) {
-    throw new Error('appLoc cannot be outside drive.')
-  }
-
  if (!isFileTree(data.fileTree)) {
    throw { code: 400, ...invalidDeployFormatResponse }
  }

-  await createFileTree(data.fileTree.members, appLocParts).catch((err) => {
+  await createFileTree(
+    data.fileTree.members,
+    data.appLoc ? data.appLoc.replace(/^\//, '').split('/') : []
+  ).catch((err) => {
    throw { code: 500, ...execDeployErrorResponse, ...err }
  })

  return successDeployResponse
 }

-const getFile = async (req: express.Request, filePath: string) => {
-  const driveFilesPath = getFilesFolder()
-
-  const filePathFull = path
-    .join(getFilesFolder(), filePath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!filePathFull.includes(driveFilesPath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Can't get file outside drive.`
-    }
-
-  if (!(await fileExists(filePathFull)))
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: `File doesn't exist.`
-    }
-
-  const extension = path.extname(filePathFull).toLowerCase()
-  if (extension === '.sas') {
-    req.res?.setHeader('Content-type', 'text/plain')
-  }
-
-  req.res?.sendFile(path.resolve(filePathFull), { dotfiles: 'allow' })
-}
-
-const getFolder = async (folderPath?: string) => {
-  const driveFilesPath = getFilesFolder()
-
-  if (folderPath) {
-    const folderPathFull = path
-      .join(getFilesFolder(), folderPath)
+const getFile = async (filePath: string): Promise<GetFileResponse> => {
+  try {
+    const filePathFull = path
+      .join(getTmpFilesFolderPath(), filePath)
      .replace(new RegExp('/', 'g'), path.sep)

-    if (!folderPathFull.includes(driveFilesPath))
-      throw {
-        code: 400,
-        status: 'Bad Request',
-        message: `Can't get folder outside drive.`
-      }
+    await validateFilePath(filePathFull)
+    const fileContent = await readFile(filePathFull)

-    if (!(await folderExists(folderPathFull)))
-      throw {
-        code: 404,
-        status: 'Not Found',
-        message: `Folder doesn't exist.`
-      }
-
-    if (!(await isFolder(folderPathFull)))
-      throw {
-        code: 400,
-        status: 'Bad Request',
-        message: 'Not a Folder.'
-      }
-
-    const files: string[] = await listFilesInFolder(folderPathFull)
-    const folders: string[] = await listSubFoldersInFolder(folderPathFull)
-    return { files, folders }
+    return { status: 'success', fileContent: fileContent }
+  } catch (err: any) {
+    throw {
+      code: 400,
+      status: 'failure',
+      message: 'File request failed.',
+      error: typeof err === 'object' ? err.toString() : err
+    }
  }
-
-  const files: string[] = await listFilesInFolder(driveFilesPath)
-  const folders: string[] = await listSubFoldersInFolder(driveFilesPath)
-  return { files, folders }
 }

-const deleteFile = async (filePath: string) => {
-  const driveFilesPath = getFilesFolder()
+const saveFile = async (body: FilePayload): Promise<GetFileResponse> => {
+  const { filePath, fileContent } = body
+  try {
+    const filePathFull = path
+      .join(getTmpFilesFolderPath(), filePath)
+      .replace(new RegExp('/', 'g'), path.sep)

-  const filePathFull = path
-    .join(getFilesFolder(), filePath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!filePathFull.includes(driveFilesPath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Can't delete file outside drive.`
+    if (await fileExists(filePathFull)) {
+      throw 'DriveController: File already exists.'
    }
-
-  if (!(await fileExists(filePathFull)))
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: `File doesn't exist.`
-    }
-
-  await deleteFileOnSystem(filePathFull)
-
-  return { status: 'success' }
-}
-
-const deleteFolder = async (folderPath: string) => {
-  const driveFolderPath = getFilesFolder()
-
-  const folderPathFull = path
-    .join(getFilesFolder(), folderPath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!folderPathFull.includes(driveFolderPath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Can't delete folder outside drive.`
-    }
-
-  if (!(await folderExists(folderPathFull)))
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: `Folder doesn't exist.`
-    }
-
-  await deleteFolderOnSystem(folderPathFull)
-
-  return { status: 'success' }
-}
-
-const saveFile = async (
-  filePath: string,
-  multerFile: Express.Multer.File
-): Promise<GetFileResponse> => {
-  const driveFilesPath = getFilesFolder()
-
-  const filePathFull = path
-    .join(driveFilesPath, filePath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!filePathFull.includes(driveFilesPath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Can't put file outside drive.`
-    }
-
-  if (await fileExists(filePathFull))
-    throw {
-      code: 409,
-      status: 'Conflict',
-      message: 'File already exists.'
-    }
-
-  const folderPath = path.dirname(filePathFull)
-  await createFolder(folderPath)
-  await moveFile(multerFile.path, filePathFull)
-
-  return { status: 'success' }
-}
-
-const addFolder = async (folderPath: string): Promise<FileFolderResponse> => {
-  const drivePath = getFilesFolder()
-
-  const folderPathFull = path
-    .join(drivePath, folderPath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!folderPathFull.includes(drivePath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Can't put folder outside drive.`
-    }
-
-  if (await folderExists(folderPathFull))
-    throw {
-      code: 409,
-      status: 'Conflict',
-      message: 'Folder already exists.'
-    }
-
-  await createFolder(folderPathFull)
-
-  return { status: 'success' }
-}
-
-const rename = async (
-  oldPath: string,
-  newPath: string
-): Promise<FileFolderResponse> => {
-  const drivePath = getFilesFolder()
-
-  const oldPathFull = path
-    .join(drivePath, oldPath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  const newPathFull = path
-    .join(drivePath, newPath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!oldPathFull.includes(drivePath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Old path can't be outside of drive.`
-    }
-
-  if (!newPathFull.includes(drivePath))
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `New path can't be outside of drive.`
-    }
-
-  if (await isFolder(oldPathFull)) {
-    if (await folderExists(newPathFull))
-      throw {
-        code: 409,
-        status: 'Conflict',
-        message: 'Folder with new name already exists.'
-      }
-    else moveFile(oldPathFull, newPathFull)
+    await createFile(filePathFull, fileContent)

    return { status: 'success' }
-  } else if (await fileExists(oldPathFull)) {
-    if (await fileExists(newPathFull))
-      throw {
-        code: 409,
-        status: 'Conflict',
-        message: 'File with new name already exists.'
-      }
-    else moveFile(oldPathFull, newPathFull)
-    return { status: 'success' }
-  }
-
-  throw {
-    code: 404,
-    status: 'Not Found',
-    message: 'No file/folder found for provided path.'
-  }
-}
-
-const updateFile = async (
-  filePath: string,
-  multerFile: Express.Multer.File
-): Promise<GetFileResponse> => {
-  const driveFilesPath = getFilesFolder()
-
-  const filePathFull = path
-    .join(driveFilesPath, filePath)
-    .replace(new RegExp('/', 'g'), path.sep)
-
-  if (!filePathFull.includes(driveFilesPath))
+  } catch (err: any) {
    throw {
      code: 400,
-      status: 'Bad Request',
-      message: `Can't modify file outside drive.`
+      status: 'failure',
+      message: 'File request failed.',
+      error: typeof err === 'object' ? err.toString() : err
    }
-
-  if (!(await fileExists(filePathFull)))
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: `File doesn't exist.`
-    }
-
-  await moveFile(multerFile.path, filePathFull)
-
-  return { status: 'success' }
+  }
+}
+
+const updateFile = async (body: FilePayload): Promise<GetFileResponse> => {
+  const { filePath, fileContent } = body
+  try {
+    const filePathFull = path
+      .join(getTmpFilesFolderPath(), filePath)
+      .replace(new RegExp('/', 'g'), path.sep)
+
+    await validateFilePath(filePathFull)
+    await createFile(filePathFull, fileContent)
+
+    return { status: 'success' }
+  } catch (err: any) {
+    throw {
+      code: 400,
+      status: 'failure',
+      message: 'File request failed.',
+      error: typeof err === 'object' ? err.toString() : err
+    }
+  }
+}
+
+const validateFilePath = async (filePath: string) => {
+  if (!(await fileExists(filePath))) {
+    throw 'DriveController: File does not exists.'
+  }
 }
--- a/api/src/controllers/group.ts
+++ b/api/src/controllers/group.ts
@@ -10,17 +10,17 @@ import {
  Body
 } from 'tsoa'

-import Group, { GroupPayload, PUBLIC_GROUP_NAME } from '../model/Group'
+import Group, { GroupPayload } from '../model/Group'
 import User from '../model/User'
 import { UserResponse } from './user'

-export interface GroupResponse {
+interface GroupResponse {
  groupId: number
  name: string
  description: string
 }

-export interface GroupDetailsResponse {
+interface GroupDetailsResponse {
  groupId: number
  name: string
  description: string
@@ -28,11 +28,6 @@ export interface GroupDetailsResponse {
  users: UserResponse[]
 }

-interface GetGroupBy {
-  groupId?: number
-  name?: string
-}
-
@Security('bearerAuth')
@Route('SASjsApi/group')
@Tags('Group')
@@ -71,18 +66,6 @@ export class GroupController {
    return createGroup(body)
  }

-  /**
-   * @summary Get list of members of a group (userName). All users can request this.
-   * @param name The group's name
-   * @example dcgroup
-   */
-  @Get('by/groupname/{name}')
-  public async getGroupByGroupName(
-    @Path() name: string
-  ): Promise<GroupDetailsResponse> {
-    return getGroup({ name })
-  }
-
  /**
   * @summary Get list of members of a group (userName). All users can request this.
   * @param groupId The group's identifier
@@ -92,7 +75,7 @@ export class GroupController {
  public async getGroup(
    @Path() groupId: number
  ): Promise<GroupDetailsResponse> {
-    return getGroup({ groupId })
+    return getGroup(groupId)
  }

  /**
@@ -146,13 +129,9 @@ export class GroupController {
   */
  @Delete('{groupId}')
  public async deleteGroup(@Path() groupId: number) {
-    const group = await Group.findOne({ groupId })
-    if (group) return await group.remove()
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: 'Group not found.'
-    }
+    const { deletedCount } = await Group.deleteOne({ groupId })
+    if (deletedCount) return
+    throw new Error('No Group deleted!')
  }
 }

@@ -166,15 +145,6 @@ const createGroup = async ({
  description,
  isActive
 }: GroupPayload): Promise<GroupDetailsResponse> => {
-  // Checking if user is already in the database
-  const groupnameExist = await Group.findOne({ name })
-  if (groupnameExist)
-    throw {
-      code: 409,
-      status: 'Conflict',
-      message: 'Group name already exists.'
-    }
-
  const group = new Group({
    name,
    description,
@@ -192,20 +162,15 @@ const createGroup = async ({
  }
 }

-const getGroup = async (findBy: GetGroupBy): Promise<GroupDetailsResponse> => {
+const getGroup = async (groupId: number): Promise<GroupDetailsResponse> => {
  const group = (await Group.findOne(
-    findBy,
+    { groupId },
    'groupId name description isActive users -_id'
  ).populate(
    'users',
-    'id username displayName isAdmin -_id'
+    'id username displayName -_id'
  )) as unknown as GroupDetailsResponse
-  if (!group)
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: 'Group not found.'
-    }
+  if (!group) throw new Error('Group not found.')

  return {
    groupId: group.groupId,
@@ -234,39 +199,16 @@ const updateUsersListInGroup = async (
  action: 'addUser' | 'removeUser'
 ): Promise<GroupDetailsResponse> => {
  const group = await Group.findOne({ groupId })
-  if (!group)
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: 'Group not found.'
-    }
-
-  if (group.name === PUBLIC_GROUP_NAME)
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: `Can't add/remove user to '${PUBLIC_GROUP_NAME}' group.`
-    }
+  if (!group) throw new Error('Group not found.')

  const user = await User.findOne({ id: userId })
-  if (!user)
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: 'User not found.'
-    }
+  if (!user) throw new Error('User not found.')

-  const updatedGroup =
-    action === 'addUser'
-      ? await group.addUser(user)
-      : await group.removeUser(user)
+  const updatedGroup = (action === 'addUser'
+    ? await group.addUser(user._id)
+    : await group.removeUser(user._id)) as unknown as GroupDetailsResponse

-  if (!updatedGroup)
-    throw {
-      code: 400,
-      status: 'Bad Request',
-      message: 'Unable to update group.'
-    }
+  if (!updatedGroup) throw new Error('Unable to update group')

  return {
    groupId: updatedGroup.groupId,
--- a/api/src/controllers/index.ts
+++ b/api/src/controllers/index.ts
@@ -3,9 +3,6 @@ export * from './client'
 export * from './code'
 export * from './drive'
 export * from './group'
-export * from './info'
-export * from './permission'
 export * from './session'
 export * from './stp'
 export * from './user'
-export * from './web'
--- a/api/src/controllers/info.ts
+++ b/api/src/controllers/info.ts
@@ -1,58 +0,0 @@
-import { Route, Tags, Example, Get } from 'tsoa'
-import { getAuthorizedRoutes } from '../utils'
-export interface AuthorizedRoutesResponse {
-  paths: string[]
-}
-
-export interface InfoResponse {
-  mode: string
-  cors: string
-  whiteList: string[]
-  protocol: string
-  runTimes: string[]
-}
-
-@Route('SASjsApi/info')
-@Tags('Info')
-export class InfoController {
-  /**
-   * @summary Get server info (mode, cors, whiteList, protocol).
-   *
-   */
-  @Example<InfoResponse>({
-    mode: 'desktop',
-    cors: 'enable',
-    whiteList: ['http://example.com', 'http://example2.com'],
-    protocol: 'http',
-    runTimes: ['sas', 'js']
-  })
-  @Get('/')
-  public info(): InfoResponse {
-    const response = {
-      mode: process.env.MODE ?? 'desktop',
-      cors:
-        process.env.CORS ||
-        (process.env.MODE === 'server' ? 'disable' : 'enable'),
-      whiteList:
-        process.env.WHITELIST?.split(' ')?.filter((url) => !!url) ?? [],
-      protocol: process.env.PROTOCOL ?? 'http',
-      runTimes: process.runTimes
-    }
-    return response
-  }
-
-  /**
-   * @summary Get the list of available routes to which permissions can be applied.  Used to populate the dialog in the URI Permissions feature.
-   *
-   */
-  @Example<AuthorizedRoutesResponse>({
-    paths: ['/AppStream', '/SASjsApi/stp/execute']
-  })
-  @Get('/authorizedRoutes')
-  public authorizedRoutes(): AuthorizedRoutesResponse {
-    const response = {
-      paths: getAuthorizedRoutes()
-    }
-    return response
-  }
-}
--- a/api/src/controllers/internal/Execution.ts
+++ b/api/src/controllers/internal/Execution.ts
@@ -1,132 +1,149 @@
 import path from 'path'
 import fs from 'fs'
-import { getSessionController, processProgram } from './'
-import { readFile, fileExists, createFile, readFileBinary } from '@sasjs/utils'
-import { PreProgramVars, Session, TreeNode } from '../../types'
-import {
-  extractHeaders,
-  getFilesFolder,
-  HTTPHeaders,
-  isDebugOn,
-  RunTimeType
-} from '../../utils'
-
-export interface ExecutionVars {
-  [key: string]: string | number | undefined
-}
-
-export interface ExecuteReturnRaw {
-  httpHeaders: HTTPHeaders
-  result: string | Buffer
-}
-
-interface ExecuteFileParams {
-  programPath: string
-  preProgramVariables: PreProgramVars
-  vars: ExecutionVars
-  otherArgs?: any
-  returnJson?: boolean
-  session?: Session
-  runTime: RunTimeType
-}
-
-interface ExecuteProgramParams extends Omit<ExecuteFileParams, 'programPath'> {
-  program: string
-}
+import { getSessionController } from './'
+import { readFile, fileExists, createFile, moveFile } from '@sasjs/utils'
+import { PreProgramVars, TreeNode } from '../../types'
+import { generateFileUploadSasCode, getTmpFilesFolderPath } from '../../utils'

 export class ExecutionController {
-  async executeFile({
-    programPath,
-    preProgramVariables,
-    vars,
-    otherArgs,
-    returnJson,
-    session,
-    runTime
-  }: ExecuteFileParams) {
+  async executeFile(
+    programPath: string,
+    preProgramVariables: PreProgramVars,
+    vars: { [key: string]: string | number | undefined },
+    otherArgs?: any,
+    returnJson?: boolean
+  ) {
+    if (!(await fileExists(programPath)))
+      throw 'ExecutionController: SAS file does not exist.'
+
    const program = await readFile(programPath)

-    return this.executeProgram({
+    return this.executeProgram(
      program,
      preProgramVariables,
      vars,
      otherArgs,
-      returnJson,
-      session,
-      runTime
-    })
+      returnJson
+    )
  }
+  async executeProgram(
+    program: string,
+    preProgramVariables: PreProgramVars,
+    vars: { [key: string]: string | number | undefined },
+    otherArgs?: any,
+    returnJson?: boolean
+  ) {
+    const sessionController = getSessionController()

-  async executeProgram({
-    program,
-    preProgramVariables,
-    vars,
-    otherArgs,
-    session: sessionByFileUpload,
-    runTime
-  }: ExecuteProgramParams): Promise<ExecuteReturnRaw> {
-    const sessionController = getSessionController(runTime)
-
-    const session =
-      sessionByFileUpload ?? (await sessionController.getSession())
+    const session = await sessionController.getSession()
    session.inUse = true
    session.consumed = true

    const logPath = path.join(session.path, 'log.log')
-    const headersPath = path.join(session.path, 'stpsrv_header.txt')
-    const weboutPath = path.join(session.path, 'webout.txt')
-    const tokenFile = path.join(session.path, 'reqHeaders.txt')

+    const weboutPath = path.join(session.path, 'webout.txt')
    await createFile(weboutPath, '')
+
+    const tokenFile = path.join(session.path, 'accessToken.txt')
    await createFile(
      tokenFile,
-      preProgramVariables?.httpHeaders.join('\n') ?? ''
+      preProgramVariables?.accessToken ?? 'accessToken'
    )

-    await processProgram(
-      program,
-      preProgramVariables,
-      vars,
-      session,
-      weboutPath,
-      headersPath,
-      tokenFile,
-      runTime,
-      logPath,
-      otherArgs
+    const varStatments = Object.keys(vars).reduce(
+      (computed: string, key: string) =>
+        `${computed}%let ${key}=${vars[key]};\n`,
+      ''
    )
+    const preProgramVarStatments = `
+%let _sasjs_tokenfile=${tokenFile};
+%let _sasjs_username=${preProgramVariables?.username};
+%let _sasjs_userid=${preProgramVariables?.userId};
+%let _sasjs_displayname=${preProgramVariables?.displayName};
+%let _sasjs_apiserverurl=${preProgramVariables?.serverUrl};
+%let _sasjs_apipath=/SASjsApi/stp/execute;
+%let _metaperson=&_sasjs_displayname;
+%let _metauser=&_sasjs_username;
+%let sasjsprocessmode=Stored Program;
+
+%global SYSPROCESSMODE SYSTCPIPHOSTNAME;
+%macro _sasjs_server_init();
+  %if "&SYSPROCESSMODE"="" %then %let SYSPROCESSMODE=&sasjsprocessmode;
+  %if "&SYSTCPIPHOSTNAME"="" %then %let SYSTCPIPHOSTNAME=&_sasjs_apiserverurl;
+%mend;
+%_sasjs_server_init()
+%sysmacdelete _sasjs_server_init;
+`
+
+    program = `
+/* runtime vars */
+${varStatments}
+filename _webout "${weboutPath}" mod;
+
+/* dynamic user-provided vars */
+${preProgramVarStatments}
+
+/* actual job code */
+${program}`
+
+    // if no files are uploaded filesNamesMap will be undefined
+    if (otherArgs && otherArgs.filesNamesMap) {
+      const uploadSasCode = await generateFileUploadSasCode(
+        otherArgs.filesNamesMap,
+        session.path
+      )
+
+      //If sas code for the file is generated it will be appended to the top of sasCode
+      if (uploadSasCode.length > 0) {
+        program = `${uploadSasCode}` + program
+      }
+    }
+
+    const codePath = path.join(session.path, 'code.sas')
+
+    // Creating this file in a RUNNING session will break out
+    // the autoexec loop and actually execute the program
+    // but - given it will take several milliseconds to create
+    // (which can mean SAS trying to run a partial program, or
+    // failing due to file lock) we first create the file THEN
+    // we rename it.
+    await createFile(codePath + '.bkp', program)
+    await moveFile(codePath + '.bkp', codePath)
+
+    // we now need to poll the session status
+    while (!session.completed) {
+      await delay(50)
+    }

    const log = (await fileExists(logPath)) ? await readFile(logPath) : ''
-    const headersContent = (await fileExists(headersPath))
-      ? await readFile(headersPath)
-      : ''
-    const httpHeaders: HTTPHeaders = extractHeaders(headersContent)
-    const fileResponse: boolean = httpHeaders.hasOwnProperty('content-type')
-
    const webout = (await fileExists(weboutPath))
-      ? fileResponse
-        ? await readFileBinary(weboutPath)
-        : await readFile(weboutPath)
+      ? await readFile(weboutPath)
      : ''

+    const debugValue =
+      typeof vars._debug === 'string' ? parseInt(vars._debug) : vars._debug
+
    // it should be deleted by scheduleSessionDestroy
    session.inUse = false

-    return {
-      httpHeaders,
-      result:
-        isDebugOn(vars) || session.crashed
-          ? `${webout}\n${process.logsUUID}\n${log}`
-          : webout
+    if (returnJson) {
+      return {
+        webout,
+        log:
+          (debugValue && debugValue >= 131) || session.crashed ? log : undefined
+      }
    }
+
+    return (debugValue && debugValue >= 131) || session.crashed
+      ? `<html><body>${webout}<div style="text-align:left"><hr /><h2>SAS Log</h2><pre>${log}</pre></div></body></html>`
+      : webout
  }

-  buildDirectoryTree() {
+  buildDirectorytree() {
    const root: TreeNode = {
      name: 'files',
      relativePath: '',
-      absolutePath: getFilesFolder(),
-      isFolder: true,
+      absolutePath: getTmpFilesFolderPath(),
      children: []
    }

@@ -136,22 +153,15 @@ export class ExecutionController {
      const currentNode = stack.pop()

      if (currentNode) {
-        currentNode.isFolder = fs
-          .statSync(currentNode.absolutePath)
-          .isDirectory()
-
        const children = fs.readdirSync(currentNode.absolutePath)

        for (let child of children) {
-          const absoluteChildPath = path.join(currentNode.absolutePath, child)
-          // relative path will only be used in frontend component
-          // so, no need to convert '/' to platform specific separator
+          const absoluteChildPath = `${currentNode.absolutePath}/${child}`
          const relativeChildPath = `${currentNode.relativePath}/${child}`
          const childNode: TreeNode = {
            name: child,
            relativePath: relativeChildPath,
            absolutePath: absoluteChildPath,
-            isFolder: false,
            children: []
          }
          currentNode.children.push(childNode)
@@ -166,3 +176,5 @@ export class ExecutionController {
    return root
  }
 }
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
--- a/api/src/controllers/internal/FileUploadController.ts
+++ b/api/src/controllers/internal/FileUploadController.ts
@@ -1,20 +1,14 @@
-import { Request, RequestHandler } from 'express'
-import multer from 'multer'
 import { uuidv4 } from '@sasjs/utils'
 import { getSessionController } from '.'
-import {
-  executeProgramRawValidation,
-  getRunTimeAndFilePath,
-  RunTimeType
-} from '../../utils'
+const multer = require('multer')

 export class FileUploadController {
  private storage = multer.diskStorage({
-    destination: function (req: Request, file: any, cb: any) {
+    destination: function (req: any, file: any, cb: any) {
      //Sending the intercepted files to the sessions subfolder
-      cb(null, req.sasjsSession?.path)
+      cb(null, req.sasSession.path)
    },
-    filename: function (req: Request, file: any, cb: any) {
+    filename: function (req: any, file: any, cb: any) {
      //req_file prefix + unique hash added to sas request files
      cb(null, `req_file_${uuidv4().replace(/-/gm, '')}`)
    }
@@ -24,43 +18,14 @@ export class FileUploadController {

  //It will intercept request and generate unique uuid to be used as a subfolder name
  //that will store the files uploaded
-  public preUploadMiddleware: RequestHandler = async (req, res, next) => {
-    const { error: errQ, value: query } = executeProgramRawValidation(req.query)
-    const { error: errB, value: body } = executeProgramRawValidation(req.body)
+  public preuploadMiddleware = async (req: any, res: any, next: any) => {
+    let session

-    if (errQ && errB) return res.status(400).send(errB.details[0].message)
+    const sessionController = getSessionController()
+    session = await sessionController.getSession()
+    session.inUse = true

-    const programPath = (query?._program ?? body?._program) as string
-
-    let runTime
-
-    try {
-      ;({ runTime } = await getRunTimeAndFilePath(programPath))
-    } catch (err: any) {
-      return res.status(400).send({
-        status: 'failure',
-        message: 'Job execution failed',
-        error: typeof err === 'object' ? err.toString() : err
-      })
-    }
-
-    let sessionController
-    try {
-      sessionController = getSessionController(runTime)
-    } catch (err: any) {
-      return res.status(400).send({
-        status: 'failure',
-        message: err.message,
-        error: typeof err === 'object' ? err.toString() : err
-      })
-    }
-
-    const session = await sessionController.getSession()
-    // marking consumed true, so that it's not available
-    // as readySession for any other request
-    session.consumed = true
-
-    req.sasjsSession = session
+    req.sasSession = session

    next()
  }
--- a/api/src/controllers/internal/Session.ts
+++ b/api/src/controllers/internal/Session.ts
@@ -3,10 +3,9 @@ import { Session } from '../../types'
 import { promisify } from 'util'
 import { execFile } from 'child_process'
 import {
-  getSessionsFolder,
+  getTmpSessionsFolderPath,
  generateUniqueFileName,
-  sysInitCompiledPath,
-  RunTimeType
+  sysInitCompiledPath
 } from '../../utils'
 import {
  deleteFolder,
@@ -14,19 +13,17 @@ import {
  fileExists,
  generateTimestamp,
  readFile,
-  isWindows
+  moveFile
 } from '@sasjs/utils'

 const execFilePromise = promisify(execFile)

-abstract class SessionController {
-  protected sessions: Session[] = []
+export class SessionController {
+  private sessions: Session[] = []

-  protected getReadySessions = (): Session[] =>
+  private getReadySessions = (): Session[] =>
    this.sessions.filter((sess: Session) => sess.ready && !sess.consumed)

-  protected abstract createSession(): Promise<Session>
-
  public async getSession() {
    const readySessions = this.getReadySessions()

@@ -34,19 +31,16 @@ abstract class SessionController {
      ? readySessions[0]
      : await this.createSession()

-    if (readySessions.length < 3) this.createSession()
+    if (readySessions.length < 2) this.createSession()

    return session
  }
-}

-export class SASSessionController extends SessionController {
-  protected async createSession(): Promise<Session> {
+  private async createSession(): Promise<Session> {
    const sessionId = generateUniqueFileName(generateTimestamp())
-    const sessionFolder = path.join(getSessionsFolder(), sessionId)
+    const sessionFolder = path.join(getTmpSessionsFolderPath(), sessionId)

    const creationTimeStamp = sessionId.split('-').pop() as string
-    // death time of session is 15 mins from creation
    const deathTimeStamp = (
      parseInt(creationTimeStamp) +
      15 * 60 * 1000 -
@@ -73,10 +67,7 @@ export class SASSessionController extends SessionController {

    // the autoexec file is executed on SAS startup
    const autoExecPath = path.join(sessionFolder, 'autoexec.sas')
-    const contentForAutoExec = `/* compiled systemInit */
-${compiledSystemInitContent}
-/* autoexec */
-${autoExecContent}`
+    const contentForAutoExec = `/* compiled systemInit */\n${compiledSystemInitContent}\n/* autoexec */\n${autoExecContent}`
    await createFile(autoExecPath, contentForAutoExec)

    // create empty code.sas as SAS will not start without a SYSIN
@@ -88,25 +79,16 @@ ${autoExecContent}`
    // however we also need a promise so that we can update the
    // session array to say that it has (eventually) finished.

-    // Additional windows specific options to avoid the desktop popups.
-
-    execFilePromise(process.sasLoc!, [
+    execFilePromise(process.sasLoc, [
      '-SYSIN',
      codePath,
      '-LOG',
      path.join(session.path, 'log.log'),
-      '-PRINT',
-      path.join(session.path, 'output.lst'),
      '-WORK',
      session.path,
      '-AUTOEXEC',
      autoExecPath,
-      process.sasLoc!.endsWith('sas.exe') ? '-nosplash' : '',
-      process.sasLoc!.endsWith('sas.exe') ? '-icon' : '',
-      process.sasLoc!.endsWith('sas.exe') ? '-nodms' : '',
-      process.sasLoc!.endsWith('sas.exe') ? '-noterminal' : '',
-      process.sasLoc!.endsWith('sas.exe') ? '-nostatuswin' : '',
-      isWindows() ? '-nologo' : ''
+      process.platform === 'win32' ? '-nosplash' : ''
    ])
      .then(() => {
        session.completed = true
@@ -153,9 +135,7 @@ ${autoExecContent}`
  private scheduleSessionDestroy(session: Session) {
    setTimeout(async () => {
      if (session.inUse) {
-        // adding 10 more minutes
-        const newDeathTimeStamp = parseInt(session.deathTimeStamp) + 10 * 1000
-        session.deathTimeStamp = newDeathTimeStamp.toString()
+        session.deathTimeStamp = session.deathTimeStamp + 1000 * 10

        this.scheduleSessionDestroy(session)
      } else {
@@ -165,110 +145,12 @@ ${autoExecContent}`
  }
 }

-export class JSSessionController extends SessionController {
-  protected async createSession(): Promise<Session> {
-    const sessionId = generateUniqueFileName(generateTimestamp())
-    const sessionFolder = path.join(getSessionsFolder(), sessionId)
+export const getSessionController = (): SessionController => {
+  if (process.sessionController) return process.sessionController

-    const creationTimeStamp = sessionId.split('-').pop() as string
-    // death time of session is 15 mins from creation
-    const deathTimeStamp = (
-      parseInt(creationTimeStamp) +
-      15 * 60 * 1000 -
-      1000
-    ).toString()
+  process.sessionController = new SessionController()

-    const session: Session = {
-      id: sessionId,
-      ready: true,
-      inUse: true,
-      consumed: false,
-      completed: false,
-      creationTimeStamp,
-      deathTimeStamp,
-      path: sessionFolder
-    }
-
-    const headersPath = path.join(session.path, 'stpsrv_header.txt')
-    await createFile(headersPath, 'Content-type: text/plain')
-
-    this.sessions.push(session)
-    return session
-  }
-}
-
-export class PythonSessionController extends SessionController {
-  protected async createSession(): Promise<Session> {
-    const sessionId = generateUniqueFileName(generateTimestamp())
-    const sessionFolder = path.join(getSessionsFolder(), sessionId)
-
-    const creationTimeStamp = sessionId.split('-').pop() as string
-    // death time of session is 15 mins from creation
-    const deathTimeStamp = (
-      parseInt(creationTimeStamp) +
-      15 * 60 * 1000 -
-      1000
-    ).toString()
-
-    const session: Session = {
-      id: sessionId,
-      ready: true,
-      inUse: true,
-      consumed: false,
-      completed: false,
-      creationTimeStamp,
-      deathTimeStamp,
-      path: sessionFolder
-    }
-
-    const headersPath = path.join(session.path, 'stpsrv_header.txt')
-    await createFile(headersPath, 'Content-type: text/plain')
-
-    this.sessions.push(session)
-    return session
-  }
-}
-
-export const getSessionController = (
-  runTime: RunTimeType
-): SASSessionController | JSSessionController | PythonSessionController => {
-  if (runTime === RunTimeType.SAS) {
-    return getSASSessionController()
-  }
-
-  if (runTime === RunTimeType.JS) {
-    return getJSSessionController()
-  }
-
-  if (runTime === RunTimeType.PY) {
-    return getPythonSessionController()
-  }
-
-  throw new Error('No Runtime is configured')
-}
-
-const getSASSessionController = (): SASSessionController => {
-  if (process.sasSessionController) return process.sasSessionController
-
-  process.sasSessionController = new SASSessionController()
-
-  return process.sasSessionController
-}
-
-const getJSSessionController = (): JSSessionController => {
-  if (process.jsSessionController) return process.jsSessionController
-
-  process.jsSessionController = new JSSessionController()
-
-  return process.jsSessionController
-}
-
-const getPythonSessionController = (): PythonSessionController => {
-  if (process.pythonSessionController) return process.pythonSessionController
-
-  process.pythonSessionController = new PythonSessionController()
-
-  return process.pythonSessionController
+  return process.sessionController
 }

 const autoExecContent = `
--- a/api/src/controllers/internal/createJSProgram.ts
+++ b/api/src/controllers/internal/createJSProgram.ts
@@ -1,72 +0,0 @@
-import { isWindows } from '@sasjs/utils'
-import { PreProgramVars, Session } from '../../types'
-import { generateFileUploadJSCode } from '../../utils'
-import { ExecutionVars } from './'
-
-export const createJSProgram = async (
-  program: string,
-  preProgramVariables: PreProgramVars,
-  vars: ExecutionVars,
-  session: Session,
-  weboutPath: string,
-  headersPath: string,
-  tokenFile: string,
-  otherArgs?: any
-) => {
-  const varStatments = Object.keys(vars).reduce(
-    (computed: string, key: string) =>
-      `${computed}const ${key} = '${vars[key]}';\n`,
-    ''
-  )
-
-  const preProgramVarStatments = `
-let _webout = '';
-const weboutPath = '${
-    isWindows() ? weboutPath.replace(/\\/g, '\\\\') : weboutPath
-  }'; 
-const _SASJS_TOKENFILE = '${
-    isWindows() ? tokenFile.replace(/\\/g, '\\\\') : tokenFile
-  }';
-const _SASJS_WEBOUT_HEADERS = '${headersPath}';
-const _SASJS_USERNAME = '${preProgramVariables?.username}';
-const _SASJS_USERID = '${preProgramVariables?.userId}';
-const _SASJS_DISPLAYNAME = '${preProgramVariables?.displayName}';
-const _METAPERSON = _SASJS_DISPLAYNAME;
-const _METAUSER = _SASJS_USERNAME;
-const SASJSPROCESSMODE = 'Stored Program';
-`
-
-  const requiredModules = `const fs = require('fs')`
-
-  program = `
-/* runtime vars */
-${varStatments}
-
-/* dynamic user-provided vars */
-${preProgramVarStatments}
-
-/* actual job code */
-${program}
-
-/* write webout file only if webout exists*/
-if (_webout) {
-  fs.writeFile(weboutPath, _webout, function (err) {
-    if (err) throw err;
-  })
-}
-`
-  // if no files are uploaded filesNamesMap will be undefined
-  if (otherArgs?.filesNamesMap) {
-    const uploadJsCode = await generateFileUploadJSCode(
-      otherArgs.filesNamesMap,
-      session.path
-    )
-
-    // If any files are uploaded, the program needs to be updated with some
-    // dynamically generated variables (pointers) for ease of ingestion
-    if (uploadJsCode.length > 0) {
-      program = `${uploadJsCode}\n` + program
-    }
-  }
-  return requiredModules + program
-}
--- a/api/src/controllers/internal/createPythonProgram.ts
+++ b/api/src/controllers/internal/createPythonProgram.ts
@@ -1,68 +0,0 @@
-import { isWindows } from '@sasjs/utils'
-import { PreProgramVars, Session } from '../../types'
-import { generateFileUploadPythonCode } from '../../utils'
-import { ExecutionVars } from './'
-
-export const createPythonProgram = async (
-  program: string,
-  preProgramVariables: PreProgramVars,
-  vars: ExecutionVars,
-  session: Session,
-  weboutPath: string,
-  headersPath: string,
-  tokenFile: string,
-  otherArgs?: any
-) => {
-  const varStatments = Object.keys(vars).reduce(
-    (computed: string, key: string) => `${computed}${key} = '${vars[key]}';\n`,
-    ''
-  )
-
-  const preProgramVarStatments = `
-_SASJS_SESSION_PATH = '${
-    isWindows() ? session.path.replace(/\\/g, '\\\\') : session.path
-  }';
-_WEBOUT = '${isWindows() ? weboutPath.replace(/\\/g, '\\\\') : weboutPath}'; 
-_SASJS_WEBOUT_HEADERS = '${headersPath}';
-_SASJS_TOKENFILE = '${
-    isWindows() ? tokenFile.replace(/\\/g, '\\\\') : tokenFile
-  }';
-_SASJS_USERNAME = '${preProgramVariables?.username}';
-_SASJS_USERID = '${preProgramVariables?.userId}';
-_SASJS_DISPLAYNAME = '${preProgramVariables?.displayName}';
-_METAPERSON = _SASJS_DISPLAYNAME;
-_METAUSER = _SASJS_USERNAME;
-SASJSPROCESSMODE = 'Stored Program';
-`
-
-  const requiredModules = `import os`
-
-  program = `
-# runtime vars
-${varStatments}
-
-# dynamic user-provided vars
-${preProgramVarStatments}
-
-# change working directory to  session folder
-os.chdir(_SASJS_SESSION_PATH)
-
-# actual job code
-${program}
-
-`
-  // if no files are uploaded filesNamesMap will be undefined
-  if (otherArgs?.filesNamesMap) {
-    const uploadPythonCode = await generateFileUploadPythonCode(
-      otherArgs.filesNamesMap,
-      session.path
-    )
-
-    // If any files are uploaded, the program needs to be updated with some
-    // dynamically generated variables (pointers) for ease of ingestion
-    if (uploadPythonCode.length > 0) {
-      program = `${uploadPythonCode}\n` + program
-    }
-  }
-  return requiredModules + program
-}
--- a/api/src/controllers/internal/createSASProgram.ts
+++ b/api/src/controllers/internal/createSASProgram.ts
@@ -1,77 +0,0 @@
-import { PreProgramVars, Session } from '../../types'
-import { generateFileUploadSasCode, getMacrosFolder } from '../../utils'
-import { ExecutionVars } from './'
-
-export const createSASProgram = async (
-  program: string,
-  preProgramVariables: PreProgramVars,
-  vars: ExecutionVars,
-  session: Session,
-  weboutPath: string,
-  tokenFile: string,
-  otherArgs?: any
-) => {
-  const varStatments = Object.keys(vars).reduce(
-    (computed: string, key: string) => `${computed}%let ${key}=${vars[key]};\n`,
-    ''
-  )
-
-  const preProgramVarStatments = `
-%let _sasjs_tokenfile=${tokenFile};
-%let _sasjs_username=${preProgramVariables?.username};
-%let _sasjs_userid=${preProgramVariables?.userId};
-%let _sasjs_displayname=${preProgramVariables?.displayName};
-%let _sasjs_apiserverurl=${preProgramVariables?.serverUrl};
-%let _sasjs_apipath=/SASjsApi/stp/execute;
-%let _sasjs_webout_headers=%sysfunc(pathname(work))/../stpsrv_header.txt;
-%let _metaperson=&_sasjs_displayname;
-%let _metauser=&_sasjs_username;
-
-/* the below is here for compatibility and will be removed in a future release */
-%let sasjs_stpsrv_header_loc=&_sasjs_webout_headers;
-
-%let sasjsprocessmode=Stored Program;
-
-%global SYSPROCESSMODE SYSTCPIPHOSTNAME SYSHOSTINFOLONG;
-%macro _sasjs_server_init();
-%if "&SYSPROCESSMODE"="" %then %let SYSPROCESSMODE=&sasjsprocessmode;
-%if "&SYSTCPIPHOSTNAME"="" %then %let SYSTCPIPHOSTNAME=&_sasjs_apiserverurl;
-%mend;
-%_sasjs_server_init()
-
-proc printto print="%sysfunc(getoption(log))";
-run;
-`
-
-  program = `
-options insert=(SASAUTOS="${getMacrosFolder()}");
-
-/* runtime vars */
-${varStatments}
-filename _webout "${weboutPath}" mod;
-
-/* dynamic user-provided vars */
-${preProgramVarStatments}
-
-/* user autoexec starts */
-${otherArgs?.userAutoExec ?? ''}
-/* user autoexec ends */
-
-/* actual job code */
-${program}`
-
-  // if no files are uploaded filesNamesMap will be undefined
-  if (otherArgs?.filesNamesMap) {
-    const uploadSasCode = await generateFileUploadSasCode(
-      otherArgs.filesNamesMap,
-      session.path
-    )
-
-    // If any files are uploaded, the program needs to be updated with some
-    // dynamically generated variables (pointers) for ease of ingestion
-    if (uploadSasCode.length > 0) {
-      program = `${uploadSasCode}` + program
-    }
-  }
-  return program
-}
--- a/api/src/controllers/internal/deploy.ts
+++ b/api/src/controllers/internal/deploy.ts
@@ -1,52 +1,37 @@
+import { MemberType, FolderMember, ServiceMember, FileTree } from '../../types'
+import { getTmpFilesFolderPath } from '../../utils/file'
+import { createFolder, createFile, asyncForEach } from '@sasjs/utils'
 import path from 'path'
-import { getFilesFolder } from '../../utils/file'
-import {
-  createFolder,
-  createFile,
-  asyncForEach,
-  FolderMember,
-  ServiceMember,
-  FileMember,
-  MemberType,
-  FileTree
-} from '@sasjs/utils'

 // REFACTOR: export FileTreeCpntroller
 export const createFileTree = async (
-  members: (FolderMember | ServiceMember | FileMember)[],
+  members: (FolderMember | ServiceMember)[],
  parentFolders: string[] = []
 ) => {
  const destinationPath = path.join(
-    getFilesFolder(),
+    getTmpFilesFolderPath(),
    path.join(...parentFolders)
  )

-  await asyncForEach(
-    members,
-    async (member: FolderMember | ServiceMember | FileMember) => {
-      let name = member.name
+  await asyncForEach(members, async (member: FolderMember | ServiceMember) => {
+    let name = member.name

-      if (member.type === MemberType.service) name += '.sas'
+    if (member.type === MemberType.service) name += '.sas'

-      if (member.type === MemberType.folder) {
-        await createFolder(path.join(destinationPath, name)).catch((err) =>
-          Promise.reject({ error: err, failedToCreate: name })
-        )
+    if (member.type === MemberType.folder) {
+      await createFolder(path.join(destinationPath, name)).catch((err) =>
+        Promise.reject({ error: err, failedToCreate: name })
+      )

-        await createFileTree(member.members, [...parentFolders, name]).catch(
-          (err) => Promise.reject({ error: err, failedToCreate: name })
-        )
-      } else {
-        const encoding = member.type === MemberType.file ? 'base64' : undefined
-
-        await createFile(
-          path.join(destinationPath, name),
-          member.code,
-          encoding
-        ).catch((err) => Promise.reject({ error: err, failedToCreate: name }))
-      }
+      await createFileTree(member.members, [...parentFolders, name]).catch(
+        (err) => Promise.reject({ error: err, failedToCreate: name })
+      )
+    } else {
+      await createFile(path.join(destinationPath, name), member.code).catch(
+        (err) => Promise.reject({ error: err, failedToCreate: name })
+      )
    }
-  )
+  })

  return Promise.resolve()
 }
--- a/api/src/controllers/internal/index.ts
+++ b/api/src/controllers/internal/index.ts
@@ -2,7 +2,3 @@ export * from './deploy'
 export * from './Session'
 export * from './Execution'
 export * from './FileUploadController'
-export * from './createSASProgram'
-export * from './createJSProgram'
-export * from './createPythonProgram'
-export * from './processProgram'
--- a/api/src/controllers/internal/processProgram.ts
+++ b/api/src/controllers/internal/processProgram.ts
@@ -1,130 +0,0 @@
-import path from 'path'
-import fs from 'fs'
-import { execFileSync } from 'child_process'
-import { once } from 'stream'
-import { createFile, moveFile } from '@sasjs/utils'
-import { PreProgramVars, Session } from '../../types'
-import { RunTimeType } from '../../utils'
-import {
-  ExecutionVars,
-  createSASProgram,
-  createJSProgram,
-  createPythonProgram
-} from './'
-
-export const processProgram = async (
-  program: string,
-  preProgramVariables: PreProgramVars,
-  vars: ExecutionVars,
-  session: Session,
-  weboutPath: string,
-  headersPath: string,
-  tokenFile: string,
-  runTime: RunTimeType,
-  logPath: string,
-  otherArgs?: any
-) => {
-  if (runTime === RunTimeType.JS) {
-    program = await createJSProgram(
-      program,
-      preProgramVariables,
-      vars,
-      session,
-      weboutPath,
-      headersPath,
-      tokenFile,
-      otherArgs
-    )
-
-    const codePath = path.join(session.path, 'code.js')
-
-    try {
-      await createFile(codePath, program)
-
-      // create a stream that will write to console outputs to log file
-      const writeStream = fs.createWriteStream(logPath)
-
-      // waiting for the open event so that we can have underlying file descriptor
-      await once(writeStream, 'open')
-
-      execFileSync(process.nodeLoc!, [codePath], {
-        stdio: ['ignore', writeStream, writeStream]
-      })
-
-      // copy the code.js program to log and end write stream
-      writeStream.end(program)
-
-      session.completed = true
-      console.log('session completed', session)
-    } catch (err: any) {
-      session.completed = true
-      session.crashed = err.toString()
-      console.log('session crashed', session.id, session.crashed)
-    }
-  } else if (runTime === RunTimeType.PY) {
-    program = await createPythonProgram(
-      program,
-      preProgramVariables,
-      vars,
-      session,
-      weboutPath,
-      headersPath,
-      tokenFile,
-      otherArgs
-    )
-
-    const codePath = path.join(session.path, 'code.py')
-
-    try {
-      await createFile(codePath, program)
-
-      // create a stream that will write to console outputs to log file
-      const writeStream = fs.createWriteStream(logPath)
-
-      // waiting for the open event so that we can have underlying file descriptor
-      await once(writeStream, 'open')
-
-      execFileSync(process.pythonLoc!, [codePath], {
-        stdio: ['ignore', writeStream, writeStream]
-      })
-
-      // copy the code.py program to log and end write stream
-      writeStream.end(program)
-
-      session.completed = true
-      console.log('session completed', session)
-    } catch (err: any) {
-      session.completed = true
-      session.crashed = err.toString()
-      console.log('session crashed', session.id, session.crashed)
-    }
-  } else {
-    program = await createSASProgram(
-      program,
-      preProgramVariables,
-      vars,
-      session,
-      weboutPath,
-      tokenFile,
-      otherArgs
-    )
-
-    const codePath = path.join(session.path, 'code.sas')
-
-    // Creating this file in a RUNNING session will break out
-    // the autoexec loop and actually execute the program
-    // but - given it will take several milliseconds to create
-    // (which can mean SAS trying to run a partial program, or
-    // failing due to file lock) we first create the file THEN
-    // we rename it.
-    await createFile(codePath + '.bkp', program)
-    await moveFile(codePath + '.bkp', codePath)
-
-    // we now need to poll the session status
-    while (!session.completed) {
-      await delay(50)
-    }
-  }
-}
-
-const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))
--- a/api/src/controllers/permission.ts
+++ b/api/src/controllers/permission.ts
@@ -1,368 +0,0 @@
-import express from 'express'
-import {
-  Security,
-  Route,
-  Tags,
-  Path,
-  Example,
-  Get,
-  Post,
-  Patch,
-  Delete,
-  Body,
-  Request
-} from 'tsoa'
-
-import Permission from '../model/Permission'
-import User from '../model/User'
-import Group from '../model/Group'
-import { UserResponse } from './user'
-import { GroupDetailsResponse } from './group'
-
-export enum PermissionType {
-  route = 'Route'
-}
-
-export enum PrincipalType {
-  user = 'user',
-  group = 'group'
-}
-
-export enum PermissionSettingForRoute {
-  grant = 'Grant',
-  deny = 'Deny'
-}
-
-interface RegisterPermissionPayload {
-  /**
-   * Name of affected resource
-   * @example "/SASjsApi/code/execute"
-   */
-  path: string
-  /**
-   * Type of affected resource
-   * @example "Route"
-   */
-  type: PermissionType
-  /**
-   * The indication of whether (and to what extent) access is provided
-   * @example "Grant"
-   */
-  setting: PermissionSettingForRoute
-  /**
-   * Indicates the type of principal
-   * @example "user"
-   */
-  principalType: PrincipalType
-  /**
-   * The id of user or group to which a rule is assigned.
-   * @example 123
-   */
-  principalId: number
-}
-
-interface UpdatePermissionPayload {
-  /**
-   * The indication of whether (and to what extent) access is provided
-   * @example "Grant"
-   */
-  setting: PermissionSettingForRoute
-}
-
-export interface PermissionDetailsResponse {
-  permissionId: number
-  path: string
-  type: string
-  setting: string
-  user?: UserResponse
-  group?: GroupDetailsResponse
-}
-
-@Security('bearerAuth')
-@Route('SASjsApi/permission')
-@Tags('Permission')
-export class PermissionController {
-  /**
-   * Get the list of permission rules applicable the authenticated user.
-   * If the user is an admin, all rules are returned.
-   *
-   * @summary Get the list of permission rules. If the user is admin, all rules are returned.
-   *
-   */
-  @Example<PermissionDetailsResponse[]>([
-    {
-      permissionId: 123,
-      path: '/SASjsApi/code/execute',
-      type: 'Route',
-      setting: 'Grant',
-      user: {
-        id: 1,
-        username: 'johnSnow01',
-        displayName: 'John Snow',
-        isAdmin: false
-      }
-    },
-    {
-      permissionId: 124,
-      path: '/SASjsApi/code/execute',
-      type: 'Route',
-      setting: 'Grant',
-      group: {
-        groupId: 1,
-        name: 'DCGroup',
-        description: 'This group represents Data Controller Users',
-        isActive: true,
-        users: []
-      }
-    }
-  ])
-  @Get('/')
-  public async getAllPermissions(
-    @Request() request: express.Request
-  ): Promise<PermissionDetailsResponse[]> {
-    return getAllPermissions(request)
-  }
-
-  /**
-   * @summary Create a new permission. Admin only.
-   *
-   */
-  @Example<PermissionDetailsResponse>({
-    permissionId: 123,
-    path: '/SASjsApi/code/execute',
-    type: 'Route',
-    setting: 'Grant',
-    user: {
-      id: 1,
-      username: 'johnSnow01',
-      displayName: 'John Snow',
-      isAdmin: false
-    }
-  })
-  @Post('/')
-  public async createPermission(
-    @Body() body: RegisterPermissionPayload
-  ): Promise<PermissionDetailsResponse> {
-    return createPermission(body)
-  }
-
-  /**
-   * @summary Update permission setting. Admin only
-   * @param permissionId The permission's identifier
-   * @example permissionId 1234
-   */
-  @Example<PermissionDetailsResponse>({
-    permissionId: 123,
-    path: '/SASjsApi/code/execute',
-    type: 'Route',
-    setting: 'Grant',
-    user: {
-      id: 1,
-      username: 'johnSnow01',
-      displayName: 'John Snow',
-      isAdmin: false
-    }
-  })
-  @Patch('{permissionId}')
-  public async updatePermission(
-    @Path() permissionId: number,
-    @Body() body: UpdatePermissionPayload
-  ): Promise<PermissionDetailsResponse> {
-    return updatePermission(permissionId, body)
-  }
-
-  /**
-   * @summary Delete a permission. Admin only.
-   * @param permissionId The user's identifier
-   * @example permissionId 1234
-   */
-  @Delete('{permissionId}')
-  public async deletePermission(@Path() permissionId: number) {
-    return deletePermission(permissionId)
-  }
-}
-
-const getAllPermissions = async (
-  req: express.Request
-): Promise<PermissionDetailsResponse[]> => {
-  const { user } = req
-
-  if (user?.isAdmin) return await Permission.get({})
-  else {
-    const permissions: PermissionDetailsResponse[] = []
-
-    const dbUser = await User.findOne({ id: user?.userId })
-    if (!dbUser)
-      throw {
-        code: 404,
-        status: 'Not Found',
-        message: 'User not found.'
-      }
-
-    permissions.push(...(await Permission.get({ user: dbUser._id })))
-
-    for (const group of dbUser.groups) {
-      permissions.push(...(await Permission.get({ group })))
-    }
-
-    return permissions
-  }
-}
-
-const createPermission = async ({
-  path,
-  type,
-  setting,
-  principalType,
-  principalId
-}: RegisterPermissionPayload): Promise<PermissionDetailsResponse> => {
-  const permission = new Permission({
-    path,
-    type,
-    setting
-  })
-
-  let user: UserResponse | undefined
-  let group: GroupDetailsResponse | undefined
-
-  switch (principalType) {
-    case PrincipalType.user: {
-      const userInDB = await User.findOne({ id: principalId })
-      if (!userInDB)
-        throw {
-          code: 404,
-          status: 'Not Found',
-          message: 'User not found.'
-        }
-
-      if (userInDB.isAdmin)
-        throw {
-          code: 400,
-          status: 'Bad Request',
-          message: 'Can not add permission for admin user.'
-        }
-
-      const alreadyExists = await Permission.findOne({
-        path,
-        type,
-        user: userInDB._id
-      })
-
-      if (alreadyExists)
-        throw {
-          code: 409,
-          status: 'Conflict',
-          message:
-            'Permission already exists with provided Path, Type and User.'
-        }
-
-      permission.user = userInDB._id
-
-      user = {
-        id: userInDB.id,
-        username: userInDB.username,
-        displayName: userInDB.displayName,
-        isAdmin: userInDB.isAdmin
-      }
-      break
-    }
-    case PrincipalType.group: {
-      const groupInDB = await Group.findOne({ groupId: principalId })
-      if (!groupInDB)
-        throw {
-          code: 404,
-          status: 'Not Found',
-          message: 'Group not found.'
-        }
-
-      const alreadyExists = await Permission.findOne({
-        path,
-        type,
-        group: groupInDB._id
-      })
-      if (alreadyExists)
-        throw {
-          code: 409,
-          status: 'Conflict',
-          message:
-            'Permission already exists with provided Path, Type and Group.'
-        }
-
-      permission.group = groupInDB._id
-
-      group = {
-        groupId: groupInDB.groupId,
-        name: groupInDB.name,
-        description: groupInDB.description,
-        isActive: groupInDB.isActive,
-        users: groupInDB.populate({
-          path: 'users',
-          select: 'id username displayName isAdmin -_id',
-          options: { limit: 15 }
-        }) as unknown as UserResponse[]
-      }
-      break
-    }
-    default:
-      throw {
-        code: 400,
-        status: 'Bad Request',
-        message: 'Invalid principal type. Valid types are user or group.'
-      }
-  }
-
-  const savedPermission = await permission.save()
-
-  return {
-    permissionId: savedPermission.permissionId,
-    path: savedPermission.path,
-    type: savedPermission.type,
-    setting: savedPermission.setting,
-    user,
-    group
-  }
-}
-
-const updatePermission = async (
-  id: number,
-  data: UpdatePermissionPayload
-): Promise<PermissionDetailsResponse> => {
-  const { setting } = data
-
-  const updatedPermission = (await Permission.findOneAndUpdate(
-    { permissionId: id },
-    { setting },
-    { new: true }
-  )
-    .select({
-      _id: 0,
-      permissionId: 1,
-      path: 1,
-      type: 1,
-      setting: 1
-    })
-    .populate({ path: 'user', select: 'id username displayName isAdmin -_id' })
-    .populate({
-      path: 'group',
-      select: 'groupId name description -_id'
-    })) as unknown as PermissionDetailsResponse
-  if (!updatedPermission)
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: 'Permission not found.'
-    }
-
-  return updatedPermission
-}
-
-const deletePermission = async (id: number) => {
-  const permission = await Permission.findOne({ permissionId: id })
-  if (!permission)
-    throw {
-      code: 404,
-      status: 'Not Found',
-      message: 'Permission not found.'
-    }
-  await Permission.deleteOne({ permissionId: id })
-}
--- a/api/src/controllers/session.ts
+++ b/api/src/controllers/session.ts
@@ -13,8 +13,7 @@ export class SessionController {
  @Example<UserResponse>({
    id: 123,
    username: 'johnusername',
-    displayName: 'John',
-    isAdmin: false
+    displayName: 'John'
  })
  @Get('/')
  public async session(
@@ -24,9 +23,8 @@ export class SessionController {
  }
 }

-const session = (req: express.Request) => ({
-  id: req.user!.userId,
-  username: req.user!.username,
-  displayName: req.user!.displayName,
-  isAdmin: req.user!.isAdmin
+const session = (req: any) => ({
+  id: req.user.id,
+  username: req.user.username,
+  displayName: req.user.displayName
 })
--- a/api/src/controllers/stp.ts
+++ b/api/src/controllers/stp.ts
@@ -1,107 +1,85 @@
 import express from 'express'
+import path from 'path'
 import { Request, Security, Route, Tags, Post, Body, Get, Query } from 'tsoa'
-import { ExecutionController, ExecutionVars } from './internal'
-import {
-  getPreProgramVariables,
-  HTTPHeaders,
-  LogLine,
-  makeFilesNamesMap,
-  getRunTimeAndFilePath
-} from '../utils'
-import { MulterFile } from '../types/Upload'
+import { ExecutionController } from './internal'
+import { PreProgramVars } from '../types'
+import { getTmpFilesFolderPath, makeFilesNamesMap } from '../utils'

-interface ExecutePostRequestPayload {
+interface ExecuteReturnJsonPayload {
  /**
   * Location of SAS program
   * @example "/Public/somefolder/some.file"
   */
  _program?: string
 }
+interface ExecuteReturnJsonResponse {
+  status: string
+  _webout: string
+  log?: string
+  message?: string
+}

@Security('bearerAuth')
@Route('SASjsApi/stp')
@Tags('STP')
 export class STPController {
  /**
-   * Trigger a SAS or JS program using the _program URL parameter.
-   *
-   * Accepts URL parameters and file uploads.  For more details, see docs:
-   *
-   * https://server.sasjs.io/storedprograms
-   *
-   * @summary Execute a Stored Program, returns raw _webout content.
-   * @param _program Location of SAS or JS code
-   * @example _program "/Projects/myApp/some/program"
+   * Trigger a SAS program using it's location in the _program parameter.
+   * Enable debugging using the _debug parameter.
+   * Additional URL parameters are turned into SAS macro variables.
+   * Any files provided are placed into the session and
+   * corresponding _WEBIN_XXX variables are created.
+   * @summary Execute Stored Program, return raw content
+   * @query _program Location of SAS program
+   * @example _program "/Public/somefolder/some.file"
   */
  @Get('/execute')
-  public async executeGetRequest(
+  public async executeReturnRaw(
    @Request() request: express.Request,
    @Query() _program: string
-  ): Promise<string | Buffer> {
-    const vars = request.query as ExecutionVars
-    return execute(request, _program, vars)
+  ): Promise<string> {
+    return executeReturnRaw(request, _program)
  }

  /**
-   * Trigger a SAS or JS program using the _program URL parameter.
-   *
-   * Accepts URL parameters and file uploads.  For more details, see docs:
-   *
-   * https://server.sasjs.io/storedprograms
-   *
-   * The response will be a JSON object with the following root attributes:
-   * log, webout, headers.
-   *
-   * The webout attribute will be nested JSON ONLY if the response-header
-   * contains a content-type of application/json AND it is valid JSON.
-   * Otherwise it will be a stringified version of the webout content.
-   *
-   * @summary Execute a Stored Program, return a JSON object
-   * @param _program Location of SAS or JS code
-   * @example _program "/Projects/myApp/some/program"
+   * Trigger a SAS program using it's location in the _program parameter.
+   * Enable debugging using the _debug parameter.
+   * Additional URL parameters are turned into SAS macro variables.
+   * Any files provided are placed into the session and
+   * corresponding _WEBIN_XXX variables are created.
+   * @summary Execute Stored Program, return JSON
+   * @query _program Location of SAS program
+   * @example _program "/Public/somefolder/some.file"
   */
  @Post('/execute')
-  public async executePostRequest(
+  public async executeReturnJson(
    @Request() request: express.Request,
-    @Body() body?: ExecutePostRequestPayload,
+    @Body() body?: ExecuteReturnJsonPayload,
    @Query() _program?: string
-  ): Promise<string | Buffer> {
+  ): Promise<ExecuteReturnJsonResponse> {
    const program = _program ?? body?._program
-    const vars = { ...request.query, ...request.body }
-    const filesNamesMap = request.files?.length
-      ? makeFilesNamesMap(request.files as MulterFile[])
-      : null
-    const otherArgs = { filesNamesMap: filesNamesMap }
-
-    return execute(request, program!, vars, otherArgs)
+    return executeReturnJson(request, program!)
  }
 }

-const execute = async (
+const executeReturnRaw = async (
  req: express.Request,
-  _program: string,
-  vars: ExecutionVars,
-  otherArgs?: any
-): Promise<string | Buffer> => {
-  try {
-    const { codePath, runTime } = await getRunTimeAndFilePath(_program)
+  _program: string
+): Promise<string> => {
+  const query = req.query as { [key: string]: string | number | undefined }
+  const sasCodePath =
+    path
+      .join(getTmpFilesFolderPath(), _program)
+      .replace(new RegExp('/', 'g'), path.sep) + '.sas'

-    const { result, httpHeaders } = await new ExecutionController().executeFile(
-      {
-        programPath: codePath,
-        runTime,
-        preProgramVariables: getPreProgramVariables(req),
-        vars,
-        otherArgs,
-        session: req.sasjsSession
-      }
+  try {
+    const result = await new ExecutionController().executeFile(
+      sasCodePath,
+      getPreProgramVariables(req),
+      query
    )

-    if (result instanceof Buffer) {
-      ;(req as any).sasHeaders = httpHeaders
-    }
-
-    return result
+    return result as string
  } catch (err: any) {
    throw {
      code: 400,
@@ -111,3 +89,50 @@ const execute = async (
    }
  }
 }
+
+const executeReturnJson = async (
+  req: any,
+  _program: string
+): Promise<ExecuteReturnJsonResponse> => {
+  const sasCodePath =
+    path
+      .join(getTmpFilesFolderPath(), _program)
+      .replace(new RegExp('/', 'g'), path.sep) + '.sas'
+
+  const filesNamesMap = req.files?.length ? makeFilesNamesMap(req.files) : null
+
+  try {
+    const { webout, log } = (await new ExecutionController().executeFile(
+      sasCodePath,
+      getPreProgramVariables(req),
+      { ...req.query, ...req.body },
+      { filesNamesMap: filesNamesMap },
+      true
+    )) as { webout: string; log: string }
+    return {
+      status: 'success',
+      _webout: webout,
+      log
+    }
+  } catch (err: any) {
+    throw {
+      code: 400,
+      status: 'failure',
+      message: 'Job execution failed.',
+      error: typeof err === 'object' ? err.toString() : err
+    }
+  }
+}
+
+const getPreProgramVariables = (req: any): PreProgramVars => {
+  const host = req.get('host')
+  const protocol = req.protocol + '://'
+  const { user, accessToken } = req
+  return {
+    username: user.username,
+    userId: user.userId,
+    displayName: user.displayName,
+    serverUrl: protocol + host,
+    accessToken
+  }
+}
--- a/api/src/controllers/user.ts
+++ b/api/src/controllers/user.ts
@@ -1,4 +1,3 @@
-import express from 'express'
 import {
  Security,
  Route,
@@ -11,30 +10,23 @@ import {
  Patch,
  Delete,
  Body,
-  Hidden,
-  Request
+  Hidden
 } from 'tsoa'
-import { desktopUser } from '../middlewares'

 import User, { UserPayload } from '../model/User'
-import { getUserAutoExec, updateUserAutoExec, ModeType } from '../utils'
-import { GroupResponse } from './group'

 export interface UserResponse {
  id: number
  username: string
  displayName: string
-  isAdmin: boolean
 }

-export interface UserDetailsResponse {
+interface UserDetailsResponse {
  id: number
  displayName: string
  username: string
  isActive: boolean
  isAdmin: boolean
-  autoExec?: string
-  groups?: GroupResponse[]
 }

@Security('bearerAuth')
@@ -49,14 +41,12 @@ export class UserController {
    {
      id: 123,
      username: 'johnusername',
-      displayName: 'John',
-      isAdmin: false
+      displayName: 'John'
    },
    {
      id: 456,
      username: 'starkusername',
-      displayName: 'Stark',
-      isAdmin: true
+      displayName: 'Stark'
    }
  ])
  @Get('/')
@@ -83,68 +73,13 @@ export class UserController {
  }

  /**
-   * Only Admin or user itself will get user autoExec code.
-   * @summary Get user properties - such as group memberships, userName, displayName.
-   * @param username The User's username
-   * @example username "johnSnow01"
-   */
-  @Get('by/username/{username}')
-  public async getUserByUsername(
-    @Request() req: express.Request,
-    @Path() username: string
-  ): Promise<UserDetailsResponse> {
-    const { MODE } = process.env
-
-    if (MODE === ModeType.Desktop) return getDesktopAutoExec()
-
-    const { user } = req
-    const getAutoExec = user!.isAdmin || user!.username == username
-    return getUser({ username }, getAutoExec)
-  }
-
-  /**
-   * Only Admin or user itself will get user autoExec code.
   * @summary Get user properties - such as group memberships, userName, displayName.
   * @param userId The user's identifier
   * @example userId 1234
   */
  @Get('{userId}')
-  public async getUser(
-    @Request() req: express.Request,
-    @Path() userId: number
-  ): Promise<UserDetailsResponse> {
-    const { MODE } = process.env
-
-    if (MODE === ModeType.Desktop) return getDesktopAutoExec()
-
-    const { user } = req
-    const getAutoExec = user!.isAdmin || user!.userId == userId
-    return getUser({ id: userId }, getAutoExec)
-  }
-
-  /**
-   * @summary Update user properties - such as displayName. Can be performed either by admins, or the user in question.
-   * @param username The User's username
-   * @example username "johnSnow01"
-   */
-  @Example<UserDetailsResponse>({
-    id: 1234,
-    displayName: 'John Snow',
-    username: 'johnSnow01',
-    isAdmin: false,
-    isActive: true
-  })
-  @Patch('by/username/{username}')
-  public async updateUserByUsername(
-    @Path() username: string,
-    @Body() body: UserPayload
-  ): Promise<UserDetailsResponse> {
-    const { MODE } = process.env
-
-    if (MODE === ModeType.Desktop)
-      return updateDesktopAutoExec(body.autoExec ?? '')
-
-    return updateUser({ username }, body)
+  public async getUser(@Path() userId: number): Promise<UserDetailsResponse> {
+    return getUser(userId)
  }

  /**
@@ -164,26 +99,7 @@ export class UserController {
    @Path() userId: number,
    @Body() body: UserPayload
  ): Promise<UserDetailsResponse> {
-    const { MODE } = process.env
-
-    if (MODE === ModeType.Desktop)
-      return updateDesktopAutoExec(body.autoExec ?? '')
-
-    return updateUser({ id: userId }, body)
-  }
-
-  /**
-   * @summary Delete a user. Can be performed either by admins, or the user in question.
-   * @param username The User's username
-   * @example username "johnSnow01"
-   */
-  @Delete('by/username/{username}')
-  public async deleteUserByUsername(
-    @Path() username: string,
-    @Body() body: { password?: string },
-    @Query() @Hidden() isAdmin: boolean = false
-  ) {
-    return deleteUser({ username }, isAdmin, body)
+    return updateUser(userId, body)
  }

  /**
@@ -197,17 +113,17 @@ export class UserController {
    @Body() body: { password?: string },
    @Query() @Hidden() isAdmin: boolean = false
  ) {
-    return deleteUser({ id: userId }, isAdmin, body)
+    return deleteUser(userId, isAdmin, body)
  }
 }

 const getAllUsers = async (): Promise<UserResponse[]> =>
  await User.find({})
-    .select({ _id: 0, id: 1, username: 1, displayName: 1, isAdmin: 1 })
+    .select({ _id: 0, id: 1, username: 1, displayName: 1 })
    .exec()

 const createUser = async (data: UserPayload): Promise<UserDetailsResponse> => {
-  const { displayName, username, password, isAdmin, isActive, autoExec } = data
+  const { displayName, username, password, isAdmin, isActive } = data

  // Checking if user is already in the database
  const usernameExist = await User.findOne({ username })
@@ -222,8 +138,7 @@ const createUser = async (data: UserPayload): Promise<UserDetailsResponse> => {
    username,
    password: hashPassword,
    isAdmin,
-    isActive,
-    autoExec
+    isActive
  })

  const savedUser = await user.save()
@@ -233,67 +148,38 @@ const createUser = async (data: UserPayload): Promise<UserDetailsResponse> => {
    displayName: savedUser.displayName,
    username: savedUser.username,
    isActive: savedUser.isActive,
-    isAdmin: savedUser.isAdmin,
-    autoExec: savedUser.autoExec
+    isAdmin: savedUser.isAdmin
  }
 }

-interface GetUserBy {
-  id?: number
-  username?: string
-}
-
-const getUser = async (
-  findBy: GetUserBy,
-  getAutoExec: boolean
-): Promise<UserDetailsResponse> => {
-  const user = (await User.findOne(
-    findBy,
-    `id displayName username isActive isAdmin autoExec -_id`
-  ).populate(
-    'groups',
-    'groupId name description -_id'
-  )) as unknown as UserDetailsResponse
-
+const getUser = async (id: number): Promise<UserDetailsResponse> => {
+  const user = await User.findOne({ id })
+    .select({
+      _id: 0,
+      id: 1,
+      username: 1,
+      displayName: 1,
+      isAdmin: 1,
+      isActive: 1
+    })
+    .exec()
  if (!user) throw new Error('User is not found.')

-  return {
-    id: user.id,
-    displayName: user.displayName,
-    username: user.username,
-    isActive: user.isActive,
-    isAdmin: user.isAdmin,
-    autoExec: getAutoExec ? user.autoExec ?? '' : undefined,
-    groups: user.groups
-  }
-}
-
-const getDesktopAutoExec = async () => {
-  return {
-    ...desktopUser,
-    id: desktopUser.userId,
-    autoExec: await getUserAutoExec()
-  }
+  return user
 }

 const updateUser = async (
-  findBy: GetUserBy,
-  data: Partial<UserPayload>
+  id: number,
+  data: UserPayload
 ): Promise<UserDetailsResponse> => {
-  const { displayName, username, password, isAdmin, isActive, autoExec } = data
+  const { displayName, username, password, isAdmin, isActive } = data

-  const params: any = { displayName, isAdmin, isActive, autoExec }
+  const params: any = { displayName, isAdmin, isActive }

  if (username) {
    // Checking if user is already in the database
    const usernameExist = await User.findOne({ username })
-    if (usernameExist) {
-      if (
-        (findBy.id && usernameExist.id != findBy.id) ||
-        (findBy.username && usernameExist.username != findBy.username)
-      )
-        throw new Error('Username already exists.')
-    }
+    if (usernameExist?.id != id) throw new Error('Username already exists.')
    params.username = username
  }

@@ -302,36 +188,27 @@ const updateUser = async (
    params.password = User.hashPassword(password)
  }

-  const updatedUser = await User.findOneAndUpdate(findBy, params, { new: true })
+  const updatedUser = await User.findOneAndUpdate({ id }, params, { new: true })
+    .select({
+      _id: 0,
+      id: 1,
+      username: 1,
+      displayName: 1,
+      isAdmin: 1,
+      isActive: 1
+    })
+    .exec()
+  if (!updatedUser) throw new Error('Unable to update user')

-  if (!updatedUser)
-    throw new Error(`Unable to find user with ${findBy.id || findBy.username}`)
-
-  return {
-    id: updatedUser.id,
-    username: updatedUser.username,
-    displayName: updatedUser.displayName,
-    isAdmin: updatedUser.isAdmin,
-    isActive: updatedUser.isActive,
-    autoExec: updatedUser.autoExec
-  }
-}
-
-const updateDesktopAutoExec = async (autoExec: string) => {
-  await updateUserAutoExec(autoExec)
-  return {
-    ...desktopUser,
-    id: desktopUser.userId,
-    autoExec
-  }
+  return updatedUser
 }

 const deleteUser = async (
-  findBy: GetUserBy,
+  id: number,
  isAdmin: boolean,
  { password }: { password?: string }
 ) => {
-  const user = await User.findOne(findBy)
+  const user = await User.findOne({ id })
  if (!user) throw new Error('User is not found.')

  if (!isAdmin) {
@@ -339,5 +216,5 @@ const deleteUser = async (
    if (!validPass) throw new Error('Invalid password.')
  }

-  await User.deleteOne(findBy)
+  await User.deleteOne({ id })
 }
--- a/api/src/controllers/web.ts
+++ b/api/src/controllers/web.ts
@@ -1,159 +0,0 @@
-import path from 'path'
-import express from 'express'
-import { Request, Route, Tags, Post, Body, Get, Example } from 'tsoa'
-import { readFile } from '@sasjs/utils'
-
-import User from '../model/User'
-import Client from '../model/Client'
-import { getWebBuildFolder, generateAuthCode } from '../utils'
-import { InfoJWT } from '../types'
-import { AuthController } from './auth'
-
-@Route('/')
-@Tags('Web')
-export class WebController {
-  /**
-   * @summary Render index.html
-   *
-   */
-  @Get('/')
-  public async home() {
-    return home()
-  }
-
-  /**
-   * @summary Accept a valid username/password
-   *
-   */
-  @Post('/SASLogon/login')
-  public async login(
-    @Request() req: express.Request,
-    @Body() body: LoginPayload
-  ) {
-    return login(req, body)
-  }
-
-  /**
-   * @summary Accept a valid username/password, plus a CLIENT_ID, and return an AUTH_CODE
-   *
-   */
-  @Example<AuthorizeResponse>({
-    code: 'someRandomCryptoString'
-  })
-  @Post('/SASLogon/authorize')
-  public async authorize(
-    @Request() req: express.Request,
-    @Body() body: AuthorizePayload
-  ): Promise<AuthorizeResponse> {
-    return authorize(req, body.clientId)
-  }
-
-  /**
-   * @summary Destroy the session stored in cookies
-   *
-   */
-  @Get('/SASLogon/logout')
-  public async logout(@Request() req: express.Request) {
-    return new Promise((resolve) => {
-      req.session.destroy(() => {
-        resolve(true)
-      })
-    })
-  }
-}
-
-const home = async () => {
-  const indexHtmlPath = path.join(getWebBuildFolder(), 'index.html')
-
-  // Attention! Cannot use fileExists here,
-  // due to limitation after building executable
-  const content = await readFile(indexHtmlPath)
-
-  return content
-}
-
-const login = async (
-  req: express.Request,
-  { username, password }: LoginPayload
-) => {
-  // Authenticate User
-  const user = await User.findOne({ username })
-  if (!user) throw new Error('Username is not found.')
-
-  const validPass = user.comparePassword(password)
-  if (!validPass) throw new Error('Invalid password.')
-
-  req.session.loggedIn = true
-  req.session.user = {
-    userId: user.id,
-    clientId: 'web_app',
-    username: user.username,
-    displayName: user.displayName,
-    isAdmin: user.isAdmin,
-    isActive: user.isActive,
-    autoExec: user.autoExec
-  }
-
-  return {
-    loggedIn: true,
-    user: {
-      id: user.id,
-      username: user.username,
-      displayName: user.displayName,
-      isAdmin: user.isAdmin
-    }
-  }
-}
-
-const authorize = async (
-  req: express.Request,
-  clientId: string
-): Promise<AuthorizeResponse> => {
-  const userId = req.session.user?.userId
-  if (!userId) throw new Error('Invalid userId.')
-
-  const client = await Client.findOne({ clientId })
-  if (!client) throw new Error('Invalid clientId.')
-
-  // generate authorization code against clientId
-  const userInfo: InfoJWT = {
-    clientId,
-    userId
-  }
-  const code = AuthController.saveCode(
-    userId,
-    clientId,
-    generateAuthCode(userInfo)
-  )
-
-  return { code }
-}
-
-interface LoginPayload {
-  /**
-   * Username for user
-   * @example "secretuser"
-   */
-  username: string
-  /**
-   * Password for user
-   * @example "secretpassword"
-   */
-  password: string
-}
-
-interface AuthorizePayload {
-  /**
-   * Client ID
-   * @example "clientID1"
-   */
-  clientId: string
-}
-
-interface AuthorizeResponse {
-  /**
-   * Authorization code
-   * @example "someRandomCryptoString"
-   */
-  code: string
-}
--- a/api/src/middlewares/authenticateToken.ts
+++ b/api/src/middlewares/authenticateToken.ts
@@ -1,82 +1,37 @@
-import { RequestHandler, Request, Response, NextFunction } from 'express'
 import jwt from 'jsonwebtoken'
-import { csrfProtection } from '../app'
-import {
-  fetchLatestAutoExec,
-  ModeType,
-  verifyTokenInDB,
-  isAuthorizingRoute,
-  isPublicRoute,
-  publicUser
-} from '../utils'
-import { desktopUser } from './desktop'
-import { authorize } from './authorize'
+import { verifyTokenInDB } from '../utils'

-export const authenticateAccessToken: RequestHandler = async (
-  req,
-  res,
-  next
-) => {
-  const { MODE } = process.env
-  if (MODE === ModeType.Desktop) {
-    req.user = desktopUser
-    return next()
-  }
-
-  const nextFunction = isAuthorizingRoute(req)
-    ? () => authorize(req, res, next)
-    : next
-
-  // if request is coming from web and has valid session
-  // it can be validated.
-  if (req.session?.loggedIn) {
-    if (req.session.user) {
-      const user = await fetchLatestAutoExec(req.session.user)
-
-      if (user) {
-        if (user.isActive) {
-          req.user = user
-          return csrfProtection(req, res, nextFunction)
-        } else return res.sendStatus(401)
-      }
-    }
-    return res.sendStatus(401)
-  }
-
-  await authenticateToken(
+export const authenticateAccessToken = (req: any, res: any, next: any) => {
+  authenticateToken(
    req,
    res,
-    nextFunction,
-    process.secrets.ACCESS_TOKEN_SECRET,
+    next,
+    process.env.ACCESS_TOKEN_SECRET as string,
    'accessToken'
  )
 }

-export const authenticateRefreshToken: RequestHandler = async (
-  req,
-  res,
-  next
-) => {
-  await authenticateToken(
+export const authenticateRefreshToken = (req: any, res: any, next: any) => {
+  authenticateToken(
    req,
    res,
    next,
-    process.secrets.REFRESH_TOKEN_SECRET,
+    process.env.REFRESH_TOKEN_SECRET as string,
    'refreshToken'
  )
 }

-const authenticateToken = async (
-  req: Request,
-  res: Response,
-  next: NextFunction,
+const authenticateToken = (
+  req: any,
+  res: any,
+  next: any,
  key: string,
  tokenType: 'accessToken' | 'refreshToken'
 ) => {
  const { MODE } = process.env
-  if (MODE === ModeType.Desktop) {
+  if (MODE?.trim() !== 'server') {
    req.user = {
-      userId: 1234,
+      userId: '1234',
      clientId: 'desktopModeClientId',
      username: 'desktopModeUsername',
      displayName: 'desktopModeDisplayName',
@@ -89,12 +44,12 @@ const authenticateToken = async (

  const authHeader = req.headers['authorization']
  const token = authHeader?.split(' ')[1]
+  if (!token) return res.sendStatus(401)

-  try {
-    if (!token) throw 'Unauthorized'
-
-    const data: any = jwt.verify(token, key)
+  jwt.verify(token, key, async (err: any, data: any) => {
+    if (err) return res.sendStatus(401)

+    // verify this valid token's entry in DB
    const user = await verifyTokenInDB(
      data?.userId,
      data?.clientId,
@@ -107,16 +62,8 @@ const authenticateToken = async (
        req.user = user
        if (tokenType === 'accessToken') req.accessToken = token
        return next()
-      } else throw 'Unauthorized'
+      } else return res.sendStatus(401)
    }
-
-    throw 'Unauthorized'
-  } catch (error) {
-    if (await isPublicRoute(req)) {
-      req.user = publicUser
-      return next()
-    }
-
-    res.sendStatus(401)
-  }
+    return res.sendStatus(401)
+  })
 }
--- a/api/src/middlewares/authorize.ts
+++ b/api/src/middlewares/authorize.ts
@@ -1,51 +0,0 @@
-import { RequestHandler } from 'express'
-import User from '../model/User'
-import Permission from '../model/Permission'
-import {
-  PermissionSettingForRoute,
-  PermissionType
-} from '../controllers/permission'
-import { getPath, isPublicRoute } from '../utils'
-
-export const authorize: RequestHandler = async (req, res, next) => {
-  const { user } = req
-
-  if (!user) {
-    return res.sendStatus(401)
-  }
-
-  // no need to check for permissions when user is admin
-  if (user.isAdmin) return next()
-
-  // no need to check for permissions when route is Public
-  if (await isPublicRoute(req)) return next()
-
-  const dbUser = await User.findOne({ id: user.userId })
-  if (!dbUser) return res.sendStatus(401)
-
-  const path = getPath(req)
-
-  // find permission w.r.t user
-  const permission = await Permission.findOne({
-    path,
-    type: PermissionType.route,
-    user: dbUser._id
-  })
-
-  if (permission) {
-    if (permission.setting === PermissionSettingForRoute.grant) return next()
-    else return res.sendStatus(401)
-  }
-
-  // find permission w.r.t user's groups
-  for (const group of dbUser.groups) {
-    const groupPermission = await Permission.findOne({
-      path,
-      type: PermissionType.route,
-      group
-    })
-    if (groupPermission?.setting === PermissionSettingForRoute.grant)
-      return next()
-  }
-  return res.sendStatus(401)
-}
--- a/api/src/middlewares/desktop.ts
+++ b/api/src/middlewares/desktop.ts
@@ -1,37 +1,18 @@
-import { RequestHandler, Request } from 'express'
-import { userInfo } from 'os'
-import { RequestUser } from '../types'
-import { ModeType } from '../utils'
-
-const regexUser = /^\/SASjsApi\/user\/[0-9]*$/ // /SASjsApi/user/1
-
-const allowedInDesktopMode: { [key: string]: RegExp[] } = {
-  GET: [regexUser],
-  PATCH: [regexUser]
-}
-
-const reqAllowedInDesktopMode = (request: Request): boolean => {
-  const { method, originalUrl: url } = request
-
-  return !!allowedInDesktopMode[method]?.find((urlRegex) => urlRegex.test(url))
-}
-
-export const desktopRestrict: RequestHandler = (req, res, next) => {
+export const desktopRestrict = (req: any, res: any, next: any) => {
  const { MODE } = process.env
-
-  if (MODE === ModeType.Desktop) {
-    if (!reqAllowedInDesktopMode(req))
-      return res.status(403).send('Not Allowed while in Desktop Mode.')
-  }
+  if (MODE?.trim() !== 'server')
+    return res.status(403).send('Not Allowed while in Desktop Mode.')

  next()
 }
+export const desktopUsername = (req: any, res: any, next: any) => {
+  const { MODE } = process.env
+  if (MODE?.trim() !== 'server')
+    return res.status(200).send({
+      userId: 12345,
+      username: 'DESKTOPusername',
+      displayName: 'DESKTOP User'
+    })

-export const desktopUser: RequestUser = {
-  userId: 12345,
-  clientId: 'desktop_app',
-  username: userInfo().username,
-  displayName: userInfo().username,
-  isAdmin: true,
-  isActive: true
+  next()
 }
--- a/api/src/middlewares/index.ts
+++ b/api/src/middlewares/index.ts
@@ -2,4 +2,3 @@ export * from './authenticateToken'
 export * from './desktop'
 export * from './verifyAdmin'
 export * from './verifyAdminIfNeeded'
-export * from './authorize'
--- a/api/src/middlewares/multer.ts
+++ b/api/src/middlewares/multer.ts
@@ -1,72 +0,0 @@
-import path from 'path'
-import { Request } from 'express'
-import multer, { FileFilterCallback, Options } from 'multer'
-import { blockFileRegex, getUploadsFolder } from '../utils'
-
-const fieldNameSize = 300
-const fileSize = 104857600 // 100 MB
-
-const storage = multer.diskStorage({
-  destination: getUploadsFolder(),
-  filename: function (
-    _req: Request,
-    file: Express.Multer.File,
-    callback: (error: Error | null, filename: string) => void
-  ) {
-    callback(
-      null,
-      file.fieldname + path.extname(file.originalname) + '-' + Date.now()
-    )
-  }
-})
-
-const limits: Options['limits'] = {
-  fieldNameSize,
-  fileSize
-}
-
-const fileFilter: Options['fileFilter'] = (
-  req: Request,
-  file: Express.Multer.File,
-  callback: FileFilterCallback
-) => {
-  const fileExtension = path.extname(file.originalname)
-  const shouldBlockUpload = blockFileRegex.test(file.originalname)
-  if (shouldBlockUpload) {
-    return callback(
-      new Error(`File extension '${fileExtension}' not acceptable.`)
-    )
-  }
-
-  const uploadFileSize = parseInt(req.headers['content-length'] ?? '')
-  if (uploadFileSize > fileSize) {
-    return callback(
-      new Error(
-        `File size is over limit. File limit is: ${fileSize / 1024 / 1024} MB`
-      )
-    )
-  }
-
-  callback(null, true)
-}
-
-const options: Options = { storage, limits, fileFilter }
-
-const multerInstance = multer(options)
-
-export const multerSingle = (fileName: string, arg: any) => {
-  const [req, res, next] = arg
-  const upload = multerInstance.single(fileName)
-
-  upload(req, res, function (err) {
-    if (err instanceof multer.MulterError) {
-      return res.status(500).send(err.message)
-    } else if (err) {
-      return res.status(400).send(err.message)
-    }
-    // Everything went fine.
-    next()
-  })
-}
-
-export default multerInstance
--- a/api/src/middlewares/verifyAdmin.ts
+++ b/api/src/middlewares/verifyAdmin.ts
@@ -1,9 +1,6 @@
-import { RequestHandler } from 'express'
-import { ModeType } from '../utils'
-
-export const verifyAdmin: RequestHandler = (req, res, next) => {
+export const verifyAdmin = (req: any, res: any, next: any) => {
  const { MODE } = process.env
-  if (MODE === ModeType.Desktop) return next()
+  if (MODE?.trim() !== 'server') return next()

  const { user } = req
  if (!user?.isAdmin) return res.status(401).send('Admin account required')
--- a/api/src/middlewares/verifyAdminIfNeeded.ts
+++ b/api/src/middlewares/verifyAdminIfNeeded.ts
@@ -1,22 +1,9 @@
-import { RequestHandler } from 'express'
-
-// This middleware checks if a non-admin user trying to
-// access information of other user
-export const verifyAdminIfNeeded: RequestHandler = (req, res, next) => {
+export const verifyAdminIfNeeded = (req: any, res: any, next: any) => {
  const { user } = req
+  const userId = parseInt(req.params.userId)

-  if (!user?.isAdmin) {
-    let adminAccountRequired: boolean = true
-
-    if (req.params.userId) {
-      adminAccountRequired = user?.userId !== parseInt(req.params.userId)
-    } else if (req.params.username) {
-      adminAccountRequired = user?.username !== req.params.username
-    }
-
-    if (adminAccountRequired)
-      return res.status(401).send('Admin account required')
+  if (!user.isAdmin && user.userId !== userId) {
+    return res.status(401).send('Admin account required')
  }
-
  next()
 }
--- a/api/src/model/Configuration.ts
+++ b/api/src/model/Configuration.ts
@@ -1,45 +0,0 @@
-import mongoose, { Schema } from 'mongoose'
-
-export interface ConfigurationType {
-  /**
-   * SecretOrPrivateKey to sign Access Token
-   * @example "someRandomCryptoString"
-   */
-  ACCESS_TOKEN_SECRET: string
-  /**
-   * SecretOrPrivateKey to sign Refresh Token
-   * @example "someRandomCryptoString"
-   */
-  REFRESH_TOKEN_SECRET: string
-  /**
-   * SecretOrPrivateKey to sign Auth Code
-   * @example "someRandomCryptoString"
-   */
-  AUTH_CODE_SECRET: string
-  /**
-   * Secret used to sign the session cookie
-   * @example "someRandomCryptoString"
-   */
-  SESSION_SECRET: string
-}
-
-const ConfigurationSchema = new Schema<ConfigurationType>({
-  ACCESS_TOKEN_SECRET: {
-    type: String,
-    required: true
-  },
-  REFRESH_TOKEN_SECRET: {
-    type: String,
-    required: true
-  },
-  AUTH_CODE_SECRET: {
-    type: String,
-    required: true
-  },
-  SESSION_SECRET: {
-    type: String,
-    required: true
-  }
-})
-
-export default mongoose.model('Configuration', ConfigurationSchema)
--- a/api/src/model/Group.ts
+++ b/api/src/model/Group.ts
@@ -1,10 +1,6 @@
 import mongoose, { Schema, model, Document, Model } from 'mongoose'
-import { GroupDetailsResponse } from '../controllers'
-import User, { IUser } from './User'
 const AutoIncrement = require('mongoose-sequence')(mongoose)

-export const PUBLIC_GROUP_NAME = 'Public'
-
 export interface GroupPayload {
  /**
   * Name of the group
@@ -30,17 +26,15 @@ interface IGroupDocument extends GroupPayload, Document {
 }

 interface IGroup extends IGroupDocument {
-  addUser(user: IUser): Promise<GroupDetailsResponse>
-  removeUser(user: IUser): Promise<GroupDetailsResponse>
-  hasUser(user: IUser): boolean
+  addUser(userObjectId: Schema.Types.ObjectId): Promise<IGroup>
+  removeUser(userObjectId: Schema.Types.ObjectId): Promise<IGroup>
 }
 interface IGroupModel extends Model<IGroup> {}

 const groupSchema = new Schema<IGroupDocument>({
  name: {
    type: String,
-    required: true,
-    unique: true
+    required: true
  },
  description: {
    type: String,
@@ -52,7 +46,6 @@ const groupSchema = new Schema<IGroupDocument>({
  },
  users: [{ type: Schema.Types.ObjectId, ref: 'User' }]
 })
-
 groupSchema.plugin(AutoIncrement, { inc_field: 'groupId' })

 // Hooks
@@ -62,43 +55,29 @@ groupSchema.post('save', function (group: IGroup, next: Function) {
  })
 })

-// pre remove hook to remove all references of group from users
-groupSchema.pre('remove', async function () {
-  const userIds = this.users
-  await Promise.all(
-    userIds.map(async (userId) => {
-      const user = await User.findById(userId)
-      user?.removeGroup(this._id)
-    })
-  )
-})
-
 // Instance Methods
-groupSchema.method('addUser', async function (user: IUser) {
-  const userObjectId = user._id
-  const userIdIndex = this.users.indexOf(userObjectId)
-  if (userIdIndex === -1) {
-    this.users.push(userObjectId)
-    user.addGroup(this._id)
+groupSchema.method(
+  'addUser',
+  async function (userObjectId: Schema.Types.ObjectId) {
+    const userIdIndex = this.users.indexOf(userObjectId)
+    if (userIdIndex === -1) {
+      this.users.push(userObjectId)
+    }
+    this.markModified('users')
+    return this.save()
  }
-  this.markModified('users')
-  return this.save()
-})
-groupSchema.method('removeUser', async function (user: IUser) {
-  const userObjectId = user._id
-  const userIdIndex = this.users.indexOf(userObjectId)
-  if (userIdIndex > -1) {
-    this.users.splice(userIdIndex, 1)
-    user.removeGroup(this._id)
+)
+groupSchema.method(
+  'removeUser',
+  async function (userObjectId: Schema.Types.ObjectId) {
+    const userIdIndex = this.users.indexOf(userObjectId)
+    if (userIdIndex > -1) {
+      this.users.splice(userIdIndex, 1)
+    }
+    this.markModified('users')
+    return this.save()
  }
-  this.markModified('users')
-  return this.save()
-})
-groupSchema.method('hasUser', function (user: IUser) {
-  const userObjectId = user._id
-  const userIdIndex = this.users.indexOf(userObjectId)
-  return userIdIndex > -1
-})
+)

 export const Group: IGroupModel = model<IGroup, IGroupModel>(
  'Group',
--- a/api/src/model/Permission.ts
+++ b/api/src/model/Permission.ts
@@ -1,73 +0,0 @@
-import mongoose, { Schema, model, Document, Model } from 'mongoose'
-const AutoIncrement = require('mongoose-sequence')(mongoose)
-import { PermissionDetailsResponse } from '../controllers'
-
-interface GetPermissionBy {
-  user?: Schema.Types.ObjectId
-  group?: Schema.Types.ObjectId
-}
-
-interface IPermissionDocument extends Document {
-  path: string
-  type: string
-  setting: string
-  permissionId: number
-  user: Schema.Types.ObjectId
-  group: Schema.Types.ObjectId
-}
-
-interface IPermission extends IPermissionDocument {}
-
-interface IPermissionModel extends Model<IPermission> {
-  get(getBy: GetPermissionBy): Promise<PermissionDetailsResponse[]>
-}
-
-const permissionSchema = new Schema<IPermissionDocument>({
-  path: {
-    type: String,
-    required: true
-  },
-  type: {
-    type: String,
-    required: true
-  },
-  setting: {
-    type: String,
-    required: true
-  },
-  user: { type: Schema.Types.ObjectId, ref: 'User' },
-  group: { type: Schema.Types.ObjectId, ref: 'Group' }
-})
-
-permissionSchema.plugin(AutoIncrement, { inc_field: 'permissionId' })
-
-// Static Methods
-permissionSchema.static('get', async function (getBy: GetPermissionBy): Promise<
-  PermissionDetailsResponse[]
-> {
-  return (await this.find(getBy)
-    .select({
-      _id: 0,
-      permissionId: 1,
-      path: 1,
-      type: 1,
-      setting: 1
-    })
-    .populate({ path: 'user', select: 'id username displayName isAdmin -_id' })
-    .populate({
-      path: 'group',
-      select: 'groupId name description -_id',
-      populate: {
-        path: 'users',
-        select: 'id username displayName isAdmin -_id',
-        options: { limit: 15 }
-      }
-    })) as unknown as PermissionDetailsResponse[]
-})
-
-export const Permission: IPermissionModel = model<
-  IPermission,
-  IPermissionModel
->('Permission', permissionSchema)
-
-export default Permission
--- a/api/src/model/User.ts
+++ b/api/src/model/User.ts
@@ -27,27 +27,18 @@ export interface UserPayload {
   * @example "true"
   */
  isActive?: boolean
-  /**
-   * User-specific auto-exec code
-   * @example ""
-   */
-  autoExec?: string
 }

 interface IUserDocument extends UserPayload, Document {
-  _id: Schema.Types.ObjectId
  id: number
  isAdmin: boolean
  isActive: boolean
-  autoExec: string
  groups: Schema.Types.ObjectId[]
  tokens: [{ [key: string]: string }]
 }

-export interface IUser extends IUserDocument {
+interface IUser extends IUserDocument {
  comparePassword(password: string): boolean
-  addGroup(groupObjectId: Schema.Types.ObjectId): Promise<IUser>
-  removeGroup(groupObjectId: Schema.Types.ObjectId): Promise<IUser>
 }
 interface IUserModel extends Model<IUser> {
  hashPassword(password: string): string
@@ -75,9 +66,6 @@ const userSchema = new Schema<IUserDocument>({
    type: Boolean,
    default: true
  },
-  autoExec: {
-    type: String
-  },
  groups: [{ type: Schema.Types.ObjectId, ref: 'Group' }],
  tokens: [
    {
@@ -109,28 +97,6 @@ userSchema.method('comparePassword', function (password: string): boolean {
  if (bcrypt.compareSync(password, this.password)) return true
  return false
 })
-userSchema.method(
-  'addGroup',
-  async function (groupObjectId: Schema.Types.ObjectId) {
-    const groupIdIndex = this.groups.indexOf(groupObjectId)
-    if (groupIdIndex === -1) {
-      this.groups.push(groupObjectId)
-    }
-    this.markModified('groups')
-    return this.save()
-  }
-)
-userSchema.method(
-  'removeGroup',
-  async function (groupObjectId: Schema.Types.ObjectId) {
-    const groupIdIndex = this.groups.indexOf(groupObjectId)
-    if (groupIdIndex > -1) {
-      this.groups.splice(groupIdIndex, 1)
-    }
-    this.markModified('groups')
-    return this.save()
-  }
-)

 export const User: IUserModel = model<IUser, IUserModel>('User', userSchema)

--- a/api/src/prod-server.ts
+++ b/api/src/prod-server.ts
@@ -0,0 +1,21 @@
+import path from 'path'
+import { readFileSync } from 'fs'
+import * as https from 'https'
+import appPromise from './app'
+
+const keyPath = path.join('..', 'certificates', 'privkey.pem')
+const certPath = path.join('..', 'certificates', 'fullchain.pem')
+
+const key = readFileSync(keyPath)
+const cert = readFileSync(certPath)
+
+appPromise.then((app) => {
+  const httpsServer = https.createServer({ key, cert }, app)
+
+  const sasJsPort = process.env.PORT ?? 5000
+  httpsServer.listen(sasJsPort, () => {
+    console.log(
+      `⚡️[server]: Server is running at https://localhost:${sasJsPort}`
+    )
+  })
+})
--- a/api/src/routes/api/auth.ts
+++ b/api/src/routes/api/auth.ts
@@ -1,22 +1,58 @@
 import express from 'express'

 import { AuthController } from '../../controllers/'
+import Client from '../../model/Client'

 import {
  authenticateAccessToken,
  authenticateRefreshToken
 } from '../../middlewares'

-import { authorizeValidation, tokenValidation } from '../../utils'
+import {
+  authorizeValidation,
+  getDesktopFields,
+  tokenValidation
+} from '../../utils'
 import { InfoJWT } from '../../types'

 const authRouter = express.Router()
-const controller = new AuthController()
+
+const clientIDs = new Set()
+
+export const populateClients = async () => {
+  const result = await Client.find()
+  clientIDs.clear()
+  result.forEach((r) => {
+    clientIDs.add(r.clientId)
+  })
+}
+
+authRouter.post('/authorize', async (req, res) => {
+  const { error, value: body } = authorizeValidation(req.body)
+  if (error) return res.status(400).send(error.details[0].message)
+
+  const { clientId } = body
+
+  // Verify client ID
+  if (!clientIDs.has(clientId)) {
+    return res.status(403).send('Invalid clientId.')
+  }
+
+  const controller = new AuthController()
+  try {
+    const response = await controller.authorize(body)
+
+    res.send(response)
+  } catch (err: any) {
+    res.status(403).send(err.toString())
+  }
+})

 authRouter.post('/token', async (req, res) => {
  const { error, value: body } = tokenValidation(req.body)
  if (error) return res.status(400).send(error.details[0].message)

+  const controller = new AuthController()
  try {
    const response = await controller.token(body)

@@ -26,12 +62,10 @@ authRouter.post('/token', async (req, res) => {
  }
 })

-authRouter.post('/refresh', authenticateRefreshToken, async (req, res) => {
-  const userInfo: InfoJWT = {
-    userId: req.user!.userId!,
-    clientId: req.user!.clientId!
-  }
+authRouter.post('/refresh', authenticateRefreshToken, async (req: any, res) => {
+  const userInfo: InfoJWT = req.user

+  const controller = new AuthController()
  try {
    const response = await controller.refresh(userInfo)

@@ -41,12 +75,10 @@ authRouter.post('/refresh', authenticateRefreshToken, async (req, res) => {
  }
 })

-authRouter.delete('/logout', authenticateAccessToken, async (req, res) => {
-  const userInfo: InfoJWT = {
-    userId: req.user!.userId!,
-    clientId: req.user!.clientId!
-  }
+authRouter.delete('/logout', authenticateAccessToken, async (req: any, res) => {
+  const userInfo: InfoJWT = req.user

+  const controller = new AuthController()
  try {
    await controller.logout(userInfo)
  } catch (e) {}
--- a/api/src/routes/api/code.ts
+++ b/api/src/routes/api/code.ts
@@ -1,5 +1,5 @@
 import express from 'express'
-import { runCodeValidation } from '../../utils'
+import { runSASValidation } from '../../utils'
 import { CodeController } from '../../controllers/'

 const runRouter = express.Router()
@@ -7,17 +7,11 @@ const runRouter = express.Router()
 const controller = new CodeController()

 runRouter.post('/execute', async (req, res) => {
-  const { error, value: body } = runCodeValidation(req.body)
+  const { error, value: body } = runSASValidation(req.body)
  if (error) return res.status(400).send(error.details[0].message)

  try {
-    const response = await controller.executeCode(req, body)
-
-    if (response instanceof Buffer) {
-      res.writeHead(200, (req as any).sasHeaders)
-      return res.end(response)
-    }
-
+    const response = await controller.executeSASCode(req, body)
    res.send(response)
  } catch (err: any) {
    const statusCode = err.code
--- a/api/src/routes/api/drive.ts
+++ b/api/src/routes/api/drive.ts
@@ -1,43 +1,13 @@
 import express from 'express'
-import { deleteFile, readFile } from '@sasjs/utils'
-
-import { publishAppStream } from '../appStream'
-
-import { multerSingle } from '../../middlewares/multer'
 import { DriveController } from '../../controllers/'
-import {
-  deployValidation,
-  extractJSONFromZip,
-  extractName,
-  fileBodyValidation,
-  fileParamValidation,
-  folderBodyValidation,
-  folderParamValidation,
-  isZipFile,
-  renameBodyValidation
-} from '../../utils'
-
-const controller = new DriveController()
+import { getFileDriveValidation, updateFileDriveValidation } from '../../utils'

 const driveRouter = express.Router()

 driveRouter.post('/deploy', async (req, res) => {
-  const { error, value: body } = deployValidation(req.body)
-  if (error) return res.status(400).send(error.details[0].message)
-
+  const controller = new DriveController()
  try {
-    const response = await controller.deploy(body)
-
-    if (body.streamWebFolder) {
-      const { streamServiceName } = await publishAppStream(
-        body.appLoc,
-        body.streamWebFolder,
-        body.streamServiceName,
-        body.streamLogo
-      )
-      response.streamServiceName = streamServiceName
-    }
-
+    const response = await controller.deploy(req.body)
    res.send(response)
  } catch (err: any) {
    const statusCode = err.code
@@ -48,239 +18,59 @@ driveRouter.post('/deploy', async (req, res) => {
  }
 })

-driveRouter.post(
-  '/deploy/upload',
-  (...arg) => multerSingle('file', arg),
-  async (req, res) => {
-    if (!req.file) return res.status(400).send('"file" is not present.')
-
-    let fileContent: string = ''
-
-    const { value: zipFile } = isZipFile(req.file)
-    if (zipFile) {
-      fileContent = await extractJSONFromZip(zipFile)
-      const fileInZip = extractName(zipFile.originalname)
-
-      if (!fileContent) {
-        deleteFile(req.file.path)
-        return res
-          .status(400)
-          .send(
-            `No content present in ${fileInZip} of compressed file ${zipFile.originalname}`
-          )
-      }
-    } else {
-      fileContent = await readFile(req.file.path)
-    }
-
-    let jsonContent
-    try {
-      jsonContent = JSON.parse(fileContent)
-    } catch (err) {
-      deleteFile(req.file.path)
-      return res.status(400).send('File containing invalid JSON content.')
-    }
-
-    const { error, value: body } = deployValidation(jsonContent)
-    if (error) {
-      deleteFile(req.file.path)
-      return res.status(400).send(error.details[0].message)
-    }
-
-    try {
-      const response = await controller.deployUpload(req.file, body)
-
-      if (body.streamWebFolder) {
-        const { streamServiceName } = await publishAppStream(
-          body.appLoc,
-          body.streamWebFolder,
-          body.streamServiceName,
-          body.streamLogo
-        )
-        response.streamServiceName = streamServiceName
-      }
-
-      res.send(response)
-    } catch (err: any) {
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err)
-    } finally {
-      deleteFile(req.file.path)
-    }
-  }
-)
-
 driveRouter.get('/file', async (req, res) => {
-  const { error: errQ, value: query } = fileParamValidation(req.query)
-
-  if (errQ) return res.status(400).send(errQ.details[0].message)
-
-  try {
-    await controller.getFile(req, query._filePath)
-  } catch (err: any) {
-    const statusCode = err.code
-
-    delete err.code
-
-    res.status(statusCode).send(err.message)
-  }
-})
-
-driveRouter.get('/folder', async (req, res) => {
-  const { error: errQ, value: query } = folderParamValidation(req.query)
-
-  if (errQ) return res.status(400).send(errQ.details[0].message)
-
-  try {
-    const response = await controller.getFolder(query._folderPath)
-    res.send(response)
-  } catch (err: any) {
-    const statusCode = err.code
-
-    delete err.code
-
-    res.status(statusCode).send(err.message)
-  }
-})
-
-driveRouter.delete('/file', async (req, res) => {
-  const { error: errQ, value: query } = fileParamValidation(req.query)
-
-  if (errQ) return res.status(400).send(errQ.details[0].message)
-
-  try {
-    const response = await controller.deleteFile(query._filePath)
-    res.send(response)
-  } catch (err: any) {
-    const statusCode = err.code
-
-    delete err.code
-
-    res.status(statusCode).send(err.message)
-  }
-})
-
-driveRouter.delete('/folder', async (req, res) => {
-  const { error: errQ, value: query } = folderParamValidation(req.query, true)
-
-  if (errQ) return res.status(400).send(errQ.details[0].message)
-
-  try {
-    const response = await controller.deleteFolder(query._folderPath)
-    res.send(response)
-  } catch (err: any) {
-    const statusCode = err.code
-
-    delete err.code
-
-    res.status(statusCode).send(err.message)
-  }
-})
-
-driveRouter.post(
-  '/file',
-  (...arg) => multerSingle('file', arg),
-  async (req, res) => {
-    const { error: errQ, value: query } = fileParamValidation(req.query)
-    const { error: errB, value: body } = fileBodyValidation(req.body)
-
-    if (errQ && errB) {
-      if (req.file) await deleteFile(req.file.path)
-      return res.status(400).send(errQ.details[0].message)
-    }
-
-    if (!req.file) return res.status(400).send('"file" is not present.')
-
-    try {
-      const response = await controller.saveFile(
-        req.file,
-        query._filePath,
-        body.filePath
-      )
-      res.send(response)
-    } catch (err: any) {
-      await deleteFile(req.file.path)
-
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
-    }
-  }
-)
-
-driveRouter.post('/folder', async (req, res) => {
-  const { error, value: body } = folderBodyValidation(req.body)
-
+  const { error, value: query } = getFileDriveValidation(req.query)
  if (error) return res.status(400).send(error.details[0].message)

+  const controller = new DriveController()
  try {
-    const response = await controller.addFolder(body)
+    const response = await controller.getFile(query.filePath)
    res.send(response)
  } catch (err: any) {
    const statusCode = err.code

    delete err.code

-    res.status(statusCode).send(err.message)
+    res.status(statusCode).send(err)
  }
 })

-driveRouter.patch(
-  '/file',
-  (...arg) => multerSingle('file', arg),
-  async (req, res) => {
-    const { error: errQ, value: query } = fileParamValidation(req.query)
-    const { error: errB, value: body } = fileBodyValidation(req.body)
-
-    if (errQ && errB) {
-      if (req.file) await deleteFile(req.file.path)
-      return res.status(400).send(errQ.details[0].message)
-    }
-
-    if (!req.file) return res.status(400).send('"file" is not present.')
-
-    try {
-      const response = await controller.updateFile(
-        req.file,
-        query._filePath,
-        body.filePath
-      )
-      res.send(response)
-    } catch (err: any) {
-      await deleteFile(req.file.path)
-
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
-    }
-  }
-)
-
-driveRouter.post('/rename', async (req, res) => {
-  const { error, value: body } = renameBodyValidation(req.body)
-
+driveRouter.post('/file', async (req, res) => {
+  const { error, value: body } = updateFileDriveValidation(req.body)
  if (error) return res.status(400).send(error.details[0].message)

+  const controller = new DriveController()
  try {
-    const response = await controller.rename(body)
+    const response = await controller.saveFile(body)
    res.send(response)
  } catch (err: any) {
    const statusCode = err.code

    delete err.code

-    res.status(statusCode).send(err.message)
+    res.status(statusCode).send(err)
+  }
+})
+
+driveRouter.patch('/file', async (req, res) => {
+  const { error, value: body } = updateFileDriveValidation(req.body)
+  if (error) return res.status(400).send(error.details[0].message)
+
+  const controller = new DriveController()
+  try {
+    const response = await controller.updateFile(body)
+    res.send(response)
+  } catch (err: any) {
+    const statusCode = err.code
+
+    delete err.code
+
+    res.status(statusCode).send(err)
  }
 })

 driveRouter.get('/fileTree', async (req, res) => {
+  const controller = new DriveController()
  try {
    const response = await controller.getFileTree()
    res.send(response)
--- a/api/src/routes/api/group.ts
+++ b/api/src/routes/api/group.ts
@@ -1,7 +1,7 @@
 import express from 'express'
 import { GroupController } from '../../controllers/'
 import { authenticateAccessToken, verifyAdmin } from '../../middlewares'
-import { getGroupValidation, registerGroupValidation } from '../../utils'
+import { registerGroupValidation } from '../../utils'

 const groupRouter = express.Router()

@@ -18,11 +18,7 @@ groupRouter.post(
      const response = await controller.createGroup(body)
      res.send(response)
    } catch (err: any) {
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
+      res.status(403).send(err.toString())
    }
  }
 )
@@ -33,73 +29,35 @@ groupRouter.get('/', authenticateAccessToken, async (req, res) => {
    const response = await controller.getAllGroups()
    res.send(response)
  } catch (err: any) {
-    const statusCode = err.code
-
-    delete err.code
-
-    res.status(statusCode).send(err.message)
+    res.status(403).send(err.toString())
  }
 })

-groupRouter.get('/:groupId', authenticateAccessToken, async (req, res) => {
+groupRouter.get('/:groupId', authenticateAccessToken, async (req: any, res) => {
  const { groupId } = req.params

  const controller = new GroupController()
  try {
-    const response = await controller.getGroup(parseInt(groupId))
+    const response = await controller.getGroup(groupId)
    res.send(response)
  } catch (err: any) {
-    const statusCode = err.code
-
-    delete err.code
-
-    res.status(statusCode).send(err.message)
+    res.status(403).send(err.toString())
  }
 })

-groupRouter.get(
-  '/by/groupname/:name',
-  authenticateAccessToken,
-  async (req, res) => {
-    const { error, value: params } = getGroupValidation(req.params)
-    if (error) return res.status(400).send(error.details[0].message)
-
-    const { name } = params
-
-    const controller = new GroupController()
-    try {
-      const response = await controller.getGroupByGroupName(name)
-      res.send(response)
-    } catch (err: any) {
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
-    }
-  }
-)
-
 groupRouter.post(
  '/:groupId/:userId',
  authenticateAccessToken,
  verifyAdmin,
-  async (req, res) => {
+  async (req: any, res) => {
    const { groupId, userId } = req.params

    const controller = new GroupController()
    try {
-      const response = await controller.addUserToGroup(
-        parseInt(groupId),
-        parseInt(userId)
-      )
+      const response = await controller.addUserToGroup(groupId, userId)
      res.send(response)
    } catch (err: any) {
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
+      res.status(403).send(err.toString())
    }
  }
 )
@@ -108,22 +66,15 @@ groupRouter.delete(
  '/:groupId/:userId',
  authenticateAccessToken,
  verifyAdmin,
-  async (req, res) => {
+  async (req: any, res) => {
    const { groupId, userId } = req.params

    const controller = new GroupController()
    try {
-      const response = await controller.removeUserFromGroup(
-        parseInt(groupId),
-        parseInt(userId)
-      )
+      const response = await controller.removeUserFromGroup(groupId, userId)
      res.send(response)
    } catch (err: any) {
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
+      res.status(403).send(err.toString())
    }
  }
 )
@@ -132,19 +83,15 @@ groupRouter.delete(
  '/:groupId',
  authenticateAccessToken,
  verifyAdmin,
-  async (req, res) => {
+  async (req: any, res) => {
    const { groupId } = req.params

    const controller = new GroupController()
    try {
-      await controller.deleteGroup(parseInt(groupId))
+      await controller.deleteGroup(groupId)
      res.status(200).send('Group Deleted!')
    } catch (err: any) {
-      const statusCode = err.code
-
-      delete err.code
-
-      res.status(statusCode).send(err.message)
+      res.status(403).send(err.toString())
    }
  }
 )
--- a/api/src/routes/api/index.ts
+++ b/api/src/routes/api/index.ts
@@ -5,10 +5,10 @@ import swaggerUi from 'swagger-ui-express'
 import {
  authenticateAccessToken,
  desktopRestrict,
+  desktopUsername,
  verifyAdmin
 } from '../../middlewares'

-import infoRouter from './info'
 import driveRouter from './drive'
 import stpRouter from './stp'
 import codeRouter from './code'
@@ -17,12 +17,10 @@ import groupRouter from './group'
 import clientRouter from './client'
 import authRouter from './auth'
 import sessionRouter from './session'
-import permissionRouter from './permission'

 const router = express.Router()

-router.use('/info', infoRouter)
-router.use('/session', authenticateAccessToken, sessionRouter)
+router.use('/session', desktopUsername, authenticateAccessToken, sessionRouter)
 router.use('/auth', desktopRestrict, authRouter)
 router.use(
  '/client',
@@ -36,28 +34,12 @@ router.use('/group', desktopRestrict, groupRouter)
 router.use('/stp', authenticateAccessToken, stpRouter)
 router.use('/code', authenticateAccessToken, codeRouter)
 router.use('/user', desktopRestrict, userRouter)
-router.use(
-  '/permission',
-  desktopRestrict,
-  authenticateAccessToken,
-  permissionRouter
-)
-
 router.use(
  '/',
  swaggerUi.serve,
  swaggerUi.setup(undefined, {
    swaggerOptions: {
-      url: '/swagger.yaml',
-      requestInterceptor: (request: any) => {
-        request.credentials = 'include'
-
-        const cookie = document.cookie
-        const startIndex = cookie.indexOf('XSRF-TOKEN')
-        const csrf = cookie.slice(startIndex + 11).split('; ')[0]
-        request.headers['X-XSRF-TOKEN'] = csrf
-        return request
-      }
+      url: '/swagger.yaml'
    }
  })
 )
--- a/api/src/routes/api/info.ts
+++ b/api/src/routes/api/info.ts
@@ -1,26 +0,0 @@
-import express from 'express'
-import { InfoController } from '../../controllers'
-
-const infoRouter = express.Router()
-
-infoRouter.get('/', async (req, res) => {
-  const controller = new InfoController()
-  try {
-    const response = controller.info()
-    res.send(response)
-  } catch (err: any) {
-    res.status(403).send(err.toString())
-  }
-})
-
-infoRouter.get('/authorizedRoutes', async (req, res) => {
-  const controller = new InfoController()
-  try {
-    const response = controller.authorizedRoutes()
-    res.send(response)
-  } catch (err: any) {
-    res.status(403).send(err.toString())
-  }
-})
-
-export default infoRouter
--- a/api/src/routes/api/permission.ts
+++ b/api/src/routes/api/permission.ts
@@ -1,69 +0,0 @@
-import express from 'express'
-import { PermissionController } from '../../controllers/'
-import { verifyAdmin } from '../../middlewares'
-import {
-  registerPermissionValidation,
-  updatePermissionValidation
-} from '../../utils'
-
-const permissionRouter = express.Router()
-const controller = new PermissionController()
-
-permissionRouter.get('/', async (req, res) => {
-  try {
-    const response = await controller.getAllPermissions(req)
-    res.send(response)
-  } catch (err: any) {
-    const statusCode = err.code
-    delete err.code
-    res.status(statusCode).send(err.message)
-  }
-})
-
-permissionRouter.post('/', verifyAdmin, async (req, res) => {
-  const { error, value: body } = registerPermissionValidation(req.body)
-  if (error) return res.status(400).send(error.details[0].message)
-
-  try {
-    const response = await controller.createPermission(body)
-    res.send(response)
-  } catch (err: any) {
-    const statusCode = err.code
-    delete err.code
-    res.status(statusCode).send(err.message)
-  }
-})
-
-permissionRouter.patch('/:permissionId', verifyAdmin, async (req: any, res) => {
-  const { permissionId } = req.params
-
-  const { error, value: body } = updatePermissionValidation(req.body)
-  if (error) return res.status(400).send(error.details[0].message)
-
-  try {
-    const response = await controller.updatePermission(permissionId, body)
-    res.send(response)
-  } catch (err: any) {
-    const statusCode = err.code
-    delete err.code
-    res.status(statusCode).send(err.message)
-  }
-})
-
-permissionRouter.delete(
-  '/:permissionId',
-  verifyAdmin,
-  async (req: any, res) => {
-    const { permissionId } = req.params
-
-    try {
-      await controller.deletePermission(permissionId)
-      res.status(200).send('Permission Deleted!')
-    } catch (err: any) {
-      const statusCode = err.code
-      delete err.code
-      res.status(statusCode).send(err.message)
-    }
-  }
-)
-export default permissionRouter
--- a/api/src/routes/api/session.ts
+++ b/api/src/routes/api/session.ts
@@ -1,5 +1,6 @@
 import express from 'express'
 import { SessionController } from '../../controllers'
+import { authenticateAccessToken } from '../../middlewares'

 const sessionRouter = express.Router()

--- a/api/src/routes/api/spec/auth.spec.ts
+++ b/api/src/routes/api/spec/auth.spec.ts
@@ -8,6 +8,7 @@ import {
  ClientController,
  AuthController
 } from '../../../controllers/'
+import { populateClients } from '../auth'
 import { InfoJWT } from '../../../types'
 import {
  generateAccessToken,
@@ -17,6 +18,11 @@ import {
  verifyTokenInDB
 } from '../../../utils'

+let app: Express
+appPromise.then((_app) => {
+  app = _app
+})
+
 const clientId = 'someclientID'
 const clientSecret = 'someclientSecret'
 const user = {
@@ -29,18 +35,16 @@ const user = {
 }

 describe('auth', () => {
-  let app: Express
  let con: Mongoose
  let mongoServer: MongoMemoryServer
  const userController = new UserController()
  const clientController = new ClientController()

  beforeAll(async () => {
-    app = await appPromise
-
    mongoServer = await MongoMemoryServer.create()
    con = await mongoose.connect(mongoServer.getUri())
    await clientController.createClient({ clientId, clientSecret })
+    await populateClients()
  })

  afterAll(async () => {
@@ -49,6 +53,114 @@ describe('auth', () => {
    await mongoServer.stop()
  })

+  describe('authorize', () => {
+    afterEach(async () => {
+      const collections = mongoose.connection.collections
+      const collection = collections['users']
+      await collection.deleteMany({})
+    })
+
+    it('should respond with authorization code', async () => {
+      await userController.createUser(user)
+
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          username: user.username,
+          password: user.password,
+          clientId
+        })
+        .expect(200)
+
+      expect(res.body).toHaveProperty('code')
+    })
+
+    it('should respond with Bad Request if username is missing', async () => {
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          password: user.password,
+          clientId
+        })
+        .expect(400)
+
+      expect(res.text).toEqual(`"username" is required`)
+      expect(res.body).toEqual({})
+    })
+
+    it('should respond with Bad Request if password is missing', async () => {
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          username: user.username,
+          clientId
+        })
+        .expect(400)
+
+      expect(res.text).toEqual(`"password" is required`)
+      expect(res.body).toEqual({})
+    })
+
+    it('should respond with Bad Request if clientId is missing', async () => {
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          username: user.username,
+          password: user.password
+        })
+        .expect(400)
+
+      expect(res.text).toEqual(`"clientId" is required`)
+      expect(res.body).toEqual({})
+    })
+
+    it('should respond with Forbidden if username is incorrect', async () => {
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          username: user.username,
+          password: user.password,
+          clientId
+        })
+        .expect(403)
+
+      expect(res.text).toEqual('Error: Username is not found.')
+      expect(res.body).toEqual({})
+    })
+
+    it('should respond with Forbidden if password is incorrect', async () => {
+      await userController.createUser(user)
+
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          username: user.username,
+          password: 'WrongPassword',
+          clientId
+        })
+        .expect(403)
+
+      expect(res.text).toEqual('Error: Invalid password.')
+      expect(res.body).toEqual({})
+    })
+
+    it('should respond with Forbidden if clientId is incorrect', async () => {
+      await userController.createUser(user)
+
+      const res = await request(app)
+        .post('/SASjsApi/auth/authorize')
+        .send({
+          username: user.username,
+          password: user.password,
+          clientId: 'WrongClientID'
+        })
+        .expect(403)
+
+      expect(res.text).toEqual('Invalid clientId.')
+      expect(res.body).toEqual({})
+    })
+  })
+
  describe('token', () => {
    const userInfo: InfoJWT = {
      clientId,
--- a/api/src/routes/api/spec/client.spec.ts
+++ b/api/src/routes/api/spec/client.spec.ts
@@ -6,6 +6,11 @@ import appPromise from '../../../app'
 import { UserController, ClientController } from '../../../controllers/'
 import { generateAccessToken, saveTokensInDB } from '../../../utils'

+let app: Express
+appPromise.then((_app) => {
+  app = _app
+})
+
 const client = {
  clientId: 'someclientID',
  clientSecret: 'someclientSecret'
@@ -23,15 +28,12 @@ const newClient = {
 }

 describe('client', () => {
-  let app: Express
  let con: Mongoose
  let mongoServer: MongoMemoryServer
  const userController = new UserController()
  const clientController = new ClientController()

  beforeAll(async () => {
-    app = await appPromise
-
    mongoServer = await MongoMemoryServer.create()
    con = await mongoose.connect(mongoServer.getUri())
  })
--- a/api/src/routes/api/spec/drive.spec.ts
+++ b/api/src/routes/api/spec/drive.spec.ts
--- a/api/src/routes/api/spec/files/sample.exe
+++ b/api/src/routes/api/spec/files/sample.exe
@@ -1 +0,0 @@
-some code of sas
--- a/api/src/routes/api/spec/files/sample.sas
+++ b/api/src/routes/api/spec/files/sample.sas
@@ -1 +0,0 @@
-some code of sas
--- a/api/src/routes/api/spec/group.spec.ts
+++ b/api/src/routes/api/spec/group.spec.ts
@@ -5,7 +5,11 @@ import request from 'supertest'
 import appPromise from '../../../app'
 import { UserController, GroupController } from '../../../controllers/'
 import { generateAccessToken, saveTokensInDB } from '../../../utils'
-import { PUBLIC_GROUP_NAME } from '../../../model/Group'
+
+let app: Express
+appPromise.then((_app) => {
+  app = _app
+})

 const clientId = 'someclientID'
 const adminUser = {
@@ -24,28 +28,19 @@ const user = {
 }

 const group = {
-  name: 'dcgroup1',
+  name: 'DCGroup1',
  description: 'DC group for testing purposes.'
 }

-const PUBLIC_GROUP = {
-  name: PUBLIC_GROUP_NAME,
-  description:
-    'A special group that can be used to bypass authentication for particular routes.'
-}
-
 const userController = new UserController()
 const groupController = new GroupController()

 describe('group', () => {
-  let app: Express
  let con: Mongoose
  let mongoServer: MongoMemoryServer
  let adminAccessToken: string

  beforeAll(async () => {
-    app = await appPromise
-
    mongoServer = await MongoMemoryServer.create()
    con = await mongoose.connect(mongoServer.getUri())

@@ -77,32 +72,6 @@ describe('group', () => {
      expect(res.body.users).toEqual([])
    })

-    it('should respond with Conflict when group already exists with same name', async () => {
-      await groupController.createGroup(group)
-
-      const res = await request(app)
-        .post('/SASjsApi/group')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send(group)
-        .expect(409)
-
-      expect(res.text).toEqual('Group name already exists.')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request when group name does not match the group name schema', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/group')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({ ...group, name: 'Wrong Group Name' })
-        .expect(400)
-
-      expect(res.text).toEqual(
-        '"name" must only contain alpha-numeric characters'
-      )
-      expect(res.body).toEqual({})
-    })
-
    it('should respond with Unauthorized if access token is not present', async () => {
      const res = await request(app).post('/SASjsApi/group').send().expect(401)

@@ -158,51 +127,14 @@ describe('group', () => {
      expect(res.body).toEqual({})
    })

-    it(`should delete group's reference from users' groups array`, async () => {
-      const dbGroup = await groupController.createGroup(group)
-      const dbUser1 = await userController.createUser({
-        ...user,
-        username: 'deletegroup1'
-      })
-      const dbUser2 = await userController.createUser({
-        ...user,
-        username: 'deletegroup2'
-      })
-
-      await groupController.addUserToGroup(dbGroup.groupId, dbUser1.id)
-      await groupController.addUserToGroup(dbGroup.groupId, dbUser2.id)
-
-      await request(app)
-        .delete(`/SASjsApi/group/${dbGroup.groupId}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      const res1 = await request(app)
-        .get(`/SASjsApi/user/${dbUser1.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res1.body.groups).toEqual([])
-
-      const res2 = await request(app)
-        .get(`/SASjsApi/user/${dbUser2.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res2.body.groups).toEqual([])
-    })
-
-    it('should respond with Not Found if groupId is incorrect', async () => {
+    it('should respond with Forbidden if groupId is incorrect', async () => {
      const res = await request(app)
        .delete(`/SASjsApi/group/1234`)
        .auth(adminAccessToken, { type: 'bearer' })
        .send()
-        .expect(404)
+        .expect(403)

-      expect(res.text).toEqual('Group not found.')
+      expect(res.text).toEqual('Error: No Group deleted!')
      expect(res.body).toEqual({})
    })

@@ -286,76 +218,16 @@ describe('group', () => {
      expect(res.body).toEqual({})
    })

-    it('should respond with Not Found if groupId is incorrect', async () => {
+    it('should respond with Forbidden if groupId is incorrect', async () => {
      const res = await request(app)
        .get('/SASjsApi/group/1234')
        .auth(adminAccessToken, { type: 'bearer' })
        .send()
-        .expect(404)
+        .expect(403)

-      expect(res.text).toEqual('Group not found.')
+      expect(res.text).toEqual('Error: Group not found.')
      expect(res.body).toEqual({})
    })
-
-    describe('by group name', () => {
-      it('should respond with group', async () => {
-        const { name } = await groupController.createGroup(group)
-
-        const res = await request(app)
-          .get(`/SASjsApi/group/by/groupname/${name}`)
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send()
-          .expect(200)
-
-        expect(res.body.groupId).toBeTruthy()
-        expect(res.body.name).toEqual(group.name)
-        expect(res.body.description).toEqual(group.description)
-        expect(res.body.isActive).toEqual(true)
-        expect(res.body.users).toEqual([])
-      })
-
-      it('should respond with group when access token is not of an admin account', async () => {
-        const accessToken = await generateSaveTokenAndCreateUser({
-          ...user,
-          username: 'getbyname' + user.username
-        })
-
-        const { name } = await groupController.createGroup(group)
-
-        const res = await request(app)
-          .get(`/SASjsApi/group/by/groupname/${name}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send()
-          .expect(200)
-
-        expect(res.body.groupId).toBeTruthy()
-        expect(res.body.name).toEqual(group.name)
-        expect(res.body.description).toEqual(group.description)
-        expect(res.body.isActive).toEqual(true)
-        expect(res.body.users).toEqual([])
-      })
-
-      it('should respond with Unauthorized if access token is not present', async () => {
-        const res = await request(app)
-          .get('/SASjsApi/group/by/groupname/dcgroup')
-          .send()
-          .expect(401)
-
-        expect(res.text).toEqual('Unauthorized')
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Not Found if groupname is incorrect', async () => {
-        const res = await request(app)
-          .get('/SASjsApi/group/by/groupname/randomCharacters')
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send()
-          .expect(404)
-
-        expect(res.text).toEqual('Group not found.')
-        expect(res.body).toEqual({})
-      })
-    })
  })

  describe('getAll', () => {
@@ -375,8 +247,8 @@ describe('group', () => {
      expect(res.body).toEqual([
        {
          groupId: expect.anything(),
-          name: group.name,
-          description: group.description
+          name: 'DCGroup1',
+          description: 'DC group for testing purposes.'
        }
      ])
    })
@@ -397,8 +269,8 @@ describe('group', () => {
      expect(res.body).toEqual([
        {
          groupId: expect.anything(),
-          name: group.name,
-          description: group.description
+          name: 'DCGroup1',
+          description: 'DC group for testing purposes.'
        }
      ])
    })
@@ -439,34 +311,6 @@ describe('group', () => {
      ])
    })

-    it(`should add group to user's groups array`, async () => {
-      const dbGroup = await groupController.createGroup(group)
-      const dbUser = await userController.createUser({
-        ...user,
-        username: 'addUserToGroup'
-      })
-
-      await request(app)
-        .post(`/SASjsApi/group/${dbGroup.groupId}/${dbUser.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      const res = await request(app)
-        .get(`/SASjsApi/user/${dbUser.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.body.groups).toEqual([
-        {
-          groupId: expect.anything(),
-          name: group.name,
-          description: group.description
-        }
-      ])
-    })
-
    it('should respond with group without duplicating user', async () => {
      const dbGroup = await groupController.createGroup(group)
      const dbUser = await userController.createUser({
@@ -520,46 +364,28 @@ describe('group', () => {
      expect(res.body).toEqual({})
    })

-    it('should respond with Not Found if groupId is incorrect', async () => {
+    it('should respond with Forbidden if groupId is incorrect', async () => {
      const res = await request(app)
        .post('/SASjsApi/group/123/123')
        .auth(adminAccessToken, { type: 'bearer' })
        .send()
-        .expect(404)
+        .expect(403)

-      expect(res.text).toEqual('Group not found.')
+      expect(res.text).toEqual('Error: Group not found.')
      expect(res.body).toEqual({})
    })

-    it('should respond with Not Found if userId is incorrect', async () => {
+    it('should respond with Forbidden if userId is incorrect', async () => {
      const dbGroup = await groupController.createGroup(group)
      const res = await request(app)
        .post(`/SASjsApi/group/${dbGroup.groupId}/123`)
        .auth(adminAccessToken, { type: 'bearer' })
        .send()
-        .expect(404)
+        .expect(403)

-      expect(res.text).toEqual('User not found.')
+      expect(res.text).toEqual('Error: User not found.')
      expect(res.body).toEqual({})
    })
-
-    it('should respond with Bad Request when adding user to Public group', async () => {
-      const dbGroup = await groupController.createGroup(PUBLIC_GROUP)
-      const dbUser = await userController.createUser({
-        ...user,
-        username: 'publicUser'
-      })
-
-      const res = await request(app)
-        .post(`/SASjsApi/group/${dbGroup.groupId}/${dbUser.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(400)
-
-      expect(res.text).toEqual(
-        `Can't add/remove user to '${PUBLIC_GROUP_NAME}' group.`
-      )
-    })
  })

  describe('RemoveUser', () => {
@@ -588,29 +414,6 @@ describe('group', () => {
      expect(res.body.users).toEqual([])
    })

-    it(`should remove group from user's groups array`, async () => {
-      const dbGroup = await groupController.createGroup(group)
-      const dbUser = await userController.createUser({
-        ...user,
-        username: 'removeGroupFromUser'
-      })
-      await groupController.addUserToGroup(dbGroup.groupId, dbUser.id)
-
-      await request(app)
-        .delete(`/SASjsApi/group/${dbGroup.groupId}/${dbUser.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      const res = await request(app)
-        .get(`/SASjsApi/user/${dbUser.id}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.body.groups).toEqual([])
-    })
-
    it('should respond with Unauthorized if access token is not present', async () => {
      const res = await request(app)
        .delete('/SASjsApi/group/123/123')
@@ -637,26 +440,26 @@ describe('group', () => {
      expect(res.body).toEqual({})
    })

-    it('should respond with Not Found if groupId is incorrect', async () => {
+    it('should respond with Forbidden if groupId is incorrect', async () => {
      const res = await request(app)
        .delete('/SASjsApi/group/123/123')
        .auth(adminAccessToken, { type: 'bearer' })
        .send()
-        .expect(404)
+        .expect(403)

-      expect(res.text).toEqual('Group not found.')
+      expect(res.text).toEqual('Error: Group not found.')
      expect(res.body).toEqual({})
    })

-    it('should respond with Not Found if userId is incorrect', async () => {
+    it('should respond with Forbidden if userId is incorrect', async () => {
      const dbGroup = await groupController.createGroup(group)
      const res = await request(app)
        .delete(`/SASjsApi/group/${dbGroup.groupId}/123`)
        .auth(adminAccessToken, { type: 'bearer' })
        .send()
-        .expect(404)
+        .expect(403)

-      expect(res.text).toEqual('User not found.')
+      expect(res.text).toEqual('Error: User not found.')
      expect(res.body).toEqual({})
    })
  })
--- a/api/src/routes/api/spec/info.spec.ts
+++ b/api/src/routes/api/spec/info.spec.ts
@@ -1,20 +0,0 @@
-import { Express } from 'express'
-import request from 'supertest'
-import appPromise from '../../../app'
-
-describe('Info', () => {
-  let app: Express
-
-  beforeAll(async () => {
-    app = await appPromise
-  })
-
-  it('should should return configured information of the server instance', async () => {
-    const res = await request(app).get('/SASjsApi/info').expect(200)
-
-    expect(res.body.mode).toEqual('server')
-    expect(res.body.cors).toEqual('disable')
-    expect(res.body.whiteList).toEqual([])
-    expect(res.body.protocol).toEqual('http')
-  })
-})
--- a/api/src/routes/api/spec/permission.spec.ts
+++ b/api/src/routes/api/spec/permission.spec.ts
@@ -1,596 +0,0 @@
-import { Express } from 'express'
-import mongoose, { Mongoose } from 'mongoose'
-import { MongoMemoryServer } from 'mongodb-memory-server'
-import request from 'supertest'
-import appPromise from '../../../app'
-import {
-  DriveController,
-  UserController,
-  GroupController,
-  PermissionController,
-  PrincipalType,
-  PermissionType,
-  PermissionSettingForRoute
-} from '../../../controllers/'
-import {
-  UserDetailsResponse,
-  PermissionDetailsResponse
-} from '../../../controllers'
-import { generateAccessToken, saveTokensInDB } from '../../../utils'
-
-const deployPayload = {
-  appLoc: 'string',
-  streamWebFolder: 'string',
-  fileTree: {
-    members: [
-      {
-        name: 'string',
-        type: 'folder',
-        members: [
-          'string',
-          {
-            name: 'string',
-            type: 'service',
-            code: 'string'
-          }
-        ]
-      }
-    ]
-  }
-}
-
-const clientId = 'someclientID'
-const adminUser = {
-  displayName: 'Test Admin',
-  username: 'testAdminUsername',
-  password: '12345678',
-  isAdmin: true,
-  isActive: true
-}
-const user = {
-  displayName: 'Test User',
-  username: 'testUsername',
-  password: '87654321',
-  isAdmin: false,
-  isActive: true
-}
-
-const permission = {
-  path: '/SASjsApi/code/execute',
-  type: PermissionType.route,
-  setting: PermissionSettingForRoute.grant,
-  principalType: PrincipalType.user
-}
-
-const group = {
-  name: 'DCGroup1',
-  description: 'DC group for testing purposes.'
-}
-
-const userController = new UserController()
-const groupController = new GroupController()
-const permissionController = new PermissionController()
-
-describe('permission', () => {
-  let app: Express
-  let con: Mongoose
-  let mongoServer: MongoMemoryServer
-  let adminAccessToken: string
-  let dbUser: UserDetailsResponse
-
-  beforeAll(async () => {
-    app = await appPromise
-
-    mongoServer = await MongoMemoryServer.create()
-    con = await mongoose.connect(mongoServer.getUri())
-
-    adminAccessToken = await generateSaveTokenAndCreateUser()
-    dbUser = await userController.createUser(user)
-  })
-
-  afterAll(async () => {
-    await con.connection.dropDatabase()
-    await con.connection.close()
-    await mongoServer.stop()
-  })
-
-  describe('create', () => {
-    afterEach(async () => {
-      await deleteAllPermissions()
-    })
-
-    it('should respond with new permission when principalType is user', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({ ...permission, principalId: dbUser.id })
-        .expect(200)
-
-      expect(res.body.permissionId).toBeTruthy()
-      expect(res.body.path).toEqual(permission.path)
-      expect(res.body.type).toEqual(permission.type)
-      expect(res.body.setting).toEqual(permission.setting)
-      expect(res.body.user).toBeTruthy()
-    })
-
-    it('should respond with new permission when principalType is group', async () => {
-      const dbGroup = await groupController.createGroup(group)
-
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalType: 'group',
-          principalId: dbGroup.groupId
-        })
-        .expect(200)
-
-      expect(res.body.permissionId).toBeTruthy()
-      expect(res.body.path).toEqual(permission.path)
-      expect(res.body.type).toEqual(permission.type)
-      expect(res.body.setting).toEqual(permission.setting)
-      expect(res.body.group).toBeTruthy()
-    })
-
-    it('should respond with Unauthorized if access token is not present', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .send(permission)
-        .expect(401)
-
-      expect(res.text).toEqual('Unauthorized')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Unauthorized if access token is not of an admin account', async () => {
-      const accessToken = await generateAndSaveToken(dbUser.id)
-
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(accessToken, { type: 'bearer' })
-        .send(permission)
-        .expect(401)
-
-      expect(res.text).toEqual('Admin account required')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if path is missing', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          path: undefined
-        })
-        .expect(400)
-
-      expect(res.text).toEqual(`"path" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if path is not valid', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          path: '/some/random/api/endpoint'
-        })
-        .expect(400)
-
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if type is not valid', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          type: 'invalid'
-        })
-        .expect(400)
-
-      expect(res.text).toEqual('"type" must be [Route]')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if type is missing', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          type: undefined
-        })
-        .expect(400)
-
-      expect(res.text).toEqual(`"type" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if setting is missing', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          setting: undefined
-        })
-        .expect(400)
-
-      expect(res.text).toEqual(`"setting" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if setting is not valid', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          setting: 'invalid'
-        })
-        .expect(400)
-
-      expect(res.text).toEqual('"setting" must be one of [Grant, Deny]')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if principalType is missing', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalType: undefined
-        })
-        .expect(400)
-
-      expect(res.text).toEqual(`"principalType" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if principal type is not valid', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalType: 'invalid'
-        })
-        .expect(400)
-
-      expect(res.text).toEqual('"principalType" must be one of [user, group]')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if principalId is missing', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalId: undefined
-        })
-        .expect(400)
-
-      expect(res.text).toEqual(`"principalId" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if principalId is not a number', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalId: 'someCharacters'
-        })
-        .expect(400)
-
-      expect(res.text).toEqual('"principalId" must be a number')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if adding permission for admin user', async () => {
-      const adminUser = await userController.createUser({
-        ...user,
-        username: 'adminUser',
-        isAdmin: true
-      })
-
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalId: adminUser.id
-        })
-        .expect(400)
-
-      expect(res.text).toEqual('Can not add permission for admin user.')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Not Found (404) if user is not found', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalId: 123
-        })
-        .expect(404)
-
-      expect(res.text).toEqual('User not found.')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Not Found (404) if group is not found', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          ...permission,
-          principalType: 'group',
-          principalId: 123
-        })
-        .expect(404)
-
-      expect(res.text).toEqual('Group not found.')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Conflict (409) if permission already exists', async () => {
-      await permissionController.createPermission({
-        ...permission,
-        principalId: dbUser.id
-      })
-
-      const res = await request(app)
-        .post('/SASjsApi/permission')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({ ...permission, principalId: dbUser.id })
-        .expect(409)
-
-      expect(res.text).toEqual(
-        'Permission already exists with provided Path, Type and User.'
-      )
-      expect(res.body).toEqual({})
-    })
-  })
-
-  describe('update', () => {
-    let dbPermission: PermissionDetailsResponse | undefined
-    beforeAll(async () => {
-      dbPermission = await permissionController.createPermission({
-        ...permission,
-        principalId: dbUser.id
-      })
-    })
-
-    afterEach(async () => {
-      await deleteAllPermissions()
-    })
-
-    it('should respond with updated permission', async () => {
-      const res = await request(app)
-        .patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({ setting: PermissionSettingForRoute.deny })
-        .expect(200)
-
-      expect(res.body.setting).toEqual('Deny')
-    })
-
-    it('should respond with Unauthorized if access token is not present', async () => {
-      const res = await request(app)
-        .patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
-        .send()
-        .expect(401)
-
-      expect(res.text).toEqual('Unauthorized')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Unauthorized if access token is not of an admin account', async () => {
-      const accessToken = await generateSaveTokenAndCreateUser({
-        ...user,
-        username: 'update' + user.username
-      })
-
-      const res = await request(app)
-        .patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
-        .auth(accessToken, { type: 'bearer' })
-        .send()
-        .expect(401)
-
-      expect(res.text).toEqual('Admin account required')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if setting is missing', async () => {
-      const res = await request(app)
-        .patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(400)
-
-      expect(res.text).toEqual(`"setting" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Bad Request if setting is  invalid', async () => {
-      const res = await request(app)
-        .patch(`/SASjsApi/permission/${dbPermission?.permissionId}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          setting: 'invalid'
-        })
-        .expect(400)
-
-      expect(res.text).toEqual('"setting" must be one of [Grant, Deny]')
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with not found (404) if permission with provided id does not exist', async () => {
-      const res = await request(app)
-        .patch('/SASjsApi/permission/123')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({
-          setting: PermissionSettingForRoute.deny
-        })
-        .expect(404)
-
-      expect(res.text).toEqual('Permission not found.')
-      expect(res.body).toEqual({})
-    })
-  })
-
-  describe('delete', () => {
-    it('should delete permission', async () => {
-      const dbPermission = await permissionController.createPermission({
-        ...permission,
-        principalId: dbUser.id
-      })
-      const res = await request(app)
-        .delete(`/SASjsApi/permission/${dbPermission?.permissionId}`)
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.text).toEqual('Permission Deleted!')
-    })
-
-    it('should respond with not found (404) if permission with provided id does not exists', async () => {
-      const res = await request(app)
-        .delete('/SASjsApi/permission/123')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(404)
-
-      expect(res.text).toEqual('Permission not found.')
-    })
-  })
-
-  describe('get', () => {
-    beforeAll(async () => {
-      await permissionController.createPermission({
-        ...permission,
-        path: '/test-1',
-        principalId: dbUser.id
-      })
-      await permissionController.createPermission({
-        ...permission,
-        path: '/test-2',
-        principalId: dbUser.id
-      })
-    })
-
-    it('should give a list of all permissions when user is admin', async () => {
-      const res = await request(app)
-        .get('/SASjsApi/permission/')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.body).toHaveLength(2)
-    })
-
-    it(`should give a list of user's own  permissions when user is not admin`, async () => {
-      const nonAdminUser = await userController.createUser({
-        ...user,
-        username: 'get' + user.username
-      })
-      const accessToken = await generateAndSaveToken(nonAdminUser.id)
-      await permissionController.createPermission({
-        path: '/test-1',
-        type: PermissionType.route,
-        principalType: PrincipalType.user,
-        principalId: nonAdminUser.id,
-        setting: PermissionSettingForRoute.grant
-      })
-
-      const permissionCount = 1
-
-      const res = await request(app)
-        .get('/SASjsApi/permission/')
-        .auth(accessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.body).toHaveLength(permissionCount)
-    })
-  })
-
-  describe('verify', () => {
-    beforeAll(async () => {
-      await permissionController.createPermission({
-        ...permission,
-        path: '/SASjsApi/drive/deploy',
-        principalId: dbUser.id
-      })
-    })
-
-    beforeEach(() => {
-      jest
-        .spyOn(DriveController.prototype, 'deploy')
-        .mockImplementation((deployPayload) =>
-          Promise.resolve({
-            status: 'success',
-            message: 'Files deployed successfully to @sasjs/server.'
-          })
-        )
-    })
-
-    afterEach(() => {
-      jest.resetAllMocks()
-    })
-
-    it('should create files in SASJS drive', async () => {
-      const accessToken = await generateAndSaveToken(dbUser.id)
-
-      await request(app)
-        .get('/SASjsApi/drive/deploy')
-        .auth(accessToken, { type: 'bearer' })
-        .send(deployPayload)
-        .expect(200)
-    })
-
-    it('should respond unauthorized', async () => {
-      const accessToken = await generateAndSaveToken(dbUser.id)
-
-      await request(app)
-        .get('/SASjsApi/drive/deploy/upload')
-        .auth(accessToken, { type: 'bearer' })
-        .send()
-        .expect(401)
-    })
-  })
-})
-
-const generateSaveTokenAndCreateUser = async (
-  someUser?: any
-): Promise<string> => {
-  const dbUser = await userController.createUser(someUser ?? adminUser)
-
-  return generateAndSaveToken(dbUser.id)
-}
-
-const generateAndSaveToken = async (userId: number) => {
-  const adminAccessToken = generateAccessToken({
-    clientId,
-    userId
-  })
-  await saveTokensInDB(userId, clientId, adminAccessToken, 'refreshToken')
-  return adminAccessToken
-}
-
-const deleteAllPermissions = async () => {
-  const { collections } = mongoose.connection
-  const collection = collections['permissions']
-  await collection.deleteMany({})
-}
--- a/api/src/routes/api/spec/stp.spec.ts
+++ b/api/src/routes/api/spec/stp.spec.ts
@@ -1,511 +0,0 @@
-import path from 'path'
-import { Express } from 'express'
-import mongoose, { Mongoose } from 'mongoose'
-import { MongoMemoryServer } from 'mongodb-memory-server'
-import request from 'supertest'
-import appPromise from '../../../app'
-import {
-  UserController,
-  PermissionController,
-  PermissionType,
-  PermissionSettingForRoute,
-  PrincipalType
-} from '../../../controllers/'
-import {
-  generateAccessToken,
-  saveTokensInDB,
-  getFilesFolder,
-  RunTimeType,
-  generateUniqueFileName,
-  getSessionsFolder
-} from '../../../utils'
-import { createFile, generateTimestamp, deleteFolder } from '@sasjs/utils'
-import {
-  SASSessionController,
-  JSSessionController,
-  PythonSessionController
-} from '../../../controllers/internal'
-import * as ProcessProgramModule from '../../../controllers/internal/processProgram'
-import { Session } from '../../../types'
-
-const clientId = 'someclientID'
-
-const user = {
-  displayName: 'Test User',
-  username: 'testUsername',
-  password: '87654321',
-  isAdmin: false,
-  isActive: true
-}
-
-const sampleSasProgram = '%put hello world!;'
-const sampleJsProgram = `console.log('hello world!/')`
-const samplePyProgram = `print('hello world!/')`
-
-const filesFolder = getFilesFolder()
-const testFilesFolder = `test-stp-${generateTimestamp()}`
-
-let app: Express
-let accessToken: string
-
-describe('stp', () => {
-  let con: Mongoose
-  let mongoServer: MongoMemoryServer
-  const userController = new UserController()
-  const permissionController = new PermissionController()
-
-  beforeAll(async () => {
-    app = await appPromise
-    mongoServer = await MongoMemoryServer.create()
-    con = await mongoose.connect(mongoServer.getUri())
-    const dbUser = await userController.createUser(user)
-    accessToken = await generateAndSaveToken(dbUser.id)
-    await permissionController.createPermission({
-      path: '/SASjsApi/stp/execute',
-      type: PermissionType.route,
-      principalType: PrincipalType.user,
-      principalId: dbUser.id,
-      setting: PermissionSettingForRoute.grant
-    })
-  })
-
-  afterAll(async () => {
-    await con.connection.dropDatabase()
-    await con.connection.close()
-    await mongoServer.stop()
-  })
-
-  describe('execute', () => {
-    describe('get', () => {
-      describe('with runtime js', () => {
-        const testFilesFolder = `test-stp-${generateTimestamp()}`
-
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.JS]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute js program when both js and sas program are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.JS, RunTimeType.SAS],
-            200,
-            RunTimeType.JS
-          )
-        })
-
-        it('should throw error when js program is not present but sas program exists', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime py', () => {
-        const testFilesFolder = `test-stp-${generateTimestamp()}`
-
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.PY]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute python program when python, js and sas programs are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.PY, RunTimeType.SAS, RunTimeType.JS],
-            200,
-            RunTimeType.PY
-          )
-        })
-
-        it('should throw error when py program is not present but js or sas program exists', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime sas', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.SAS]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute sas program when both sas and js programs are present', async () => {
-          await makeRequestAndAssert([RunTimeType.SAS], 200, RunTimeType.SAS)
-        })
-
-        it('should throw error when sas program do not exit but js exists', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime js and sas', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.JS, RunTimeType.SAS]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute js program when both js and sas program are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.SAS, RunTimeType.JS],
-            200,
-            RunTimeType.JS
-          )
-        })
-
-        it('should execute sas program when js program is not present but sas program exists', async () => {
-          await makeRequestAndAssert([RunTimeType.SAS], 200, RunTimeType.SAS)
-        })
-
-        it('should throw error when both sas and js programs do not exist', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime py and sas', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.PY, RunTimeType.SAS]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute python program when both python and sas program are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.PY, RunTimeType.SAS],
-            200,
-            RunTimeType.PY
-          )
-        })
-
-        it('should execute sas program when python program is not present but sas program exists', async () => {
-          await makeRequestAndAssert([RunTimeType.SAS], 200, RunTimeType.SAS)
-        })
-
-        it('should throw error when both sas and js programs do not exist', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime sas and js', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.SAS, RunTimeType.JS]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute sas program when both sas and js programs  exist', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.SAS, RunTimeType.JS],
-            200,
-            RunTimeType.SAS
-          )
-        })
-
-        it('should execute js program when sas program is not present but js program exists', async () => {
-          await makeRequestAndAssert([RunTimeType.JS], 200, RunTimeType.JS)
-        })
-
-        it('should throw error when both sas and js programs do not exist', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime sas and py', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.SAS, RunTimeType.PY]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute sas program when both sas and python programs exist', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.SAS, RunTimeType.PY],
-            200,
-            RunTimeType.SAS
-          )
-        })
-
-        it('should execute python program when sas program is not present but python program exists', async () => {
-          await makeRequestAndAssert([RunTimeType.PY], 200, RunTimeType.PY)
-        })
-
-        it('should throw error when both sas and python programs do not exist', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime sas, js and py', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.SAS, RunTimeType.JS, RunTimeType.PY]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute sas program when it exists, no matter js and python programs exist or not', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.SAS, RunTimeType.PY, RunTimeType.JS],
-            200,
-            RunTimeType.SAS
-          )
-        })
-
-        it('should execute js program when sas program is absent but js and python programs are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.JS, RunTimeType.PY],
-            200,
-            RunTimeType.JS
-          )
-        })
-
-        it('should execute python program when both sas and js programs are not present', async () => {
-          await makeRequestAndAssert([RunTimeType.PY], 200, RunTimeType.PY)
-        })
-
-        it('should throw error when no program exists', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime js, sas and py', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.JS, RunTimeType.SAS, RunTimeType.PY]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute js program when it exists, no matter sas and python programs exist or not', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.JS, RunTimeType.SAS, RunTimeType.PY],
-            200,
-            RunTimeType.JS
-          )
-        })
-
-        it('should execute sas program when js program is absent but sas and python programs are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.SAS, RunTimeType.PY],
-            200,
-            RunTimeType.SAS
-          )
-        })
-
-        it('should execute python program when both sas and js programs are not present', async () => {
-          await makeRequestAndAssert([RunTimeType.PY], 200, RunTimeType.PY)
-        })
-
-        it('should throw error when no program exists', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-
-      describe('with runtime py, sas and js', () => {
-        beforeAll(() => {
-          process.runTimes = [RunTimeType.PY, RunTimeType.SAS, RunTimeType.JS]
-        })
-
-        beforeEach(() => {
-          jest.resetModules() // it clears the cache
-          setupMocks()
-        })
-
-        afterEach(async () => {
-          jest.resetAllMocks()
-          await deleteFolder(path.join(filesFolder, testFilesFolder))
-        })
-
-        it('should execute python program when it exists, no matter sas and js programs exist or not', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.PY, RunTimeType.SAS, RunTimeType.JS],
-            200,
-            RunTimeType.PY
-          )
-        })
-
-        it('should execute sas program when python program is absent but sas and js programs are present', async () => {
-          await makeRequestAndAssert(
-            [RunTimeType.SAS, RunTimeType.JS],
-            200,
-            RunTimeType.SAS
-          )
-        })
-
-        it('should execute js program when both sas and python programs are not present', async () => {
-          await makeRequestAndAssert([RunTimeType.JS], 200, RunTimeType.JS)
-        })
-
-        it('should throw error when no program exists', async () => {
-          await makeRequestAndAssert([], 400)
-        })
-      })
-    })
-  })
-})
-
-const makeRequestAndAssert = async (
-  programTypes: RunTimeType[],
-  expectedStatusCode: number,
-  expectedRuntime?: RunTimeType
-) => {
-  const programPath = path.join(testFilesFolder, 'program')
-  for (const programType of programTypes) {
-    if (programType === RunTimeType.JS)
-      await createFile(
-        path.join(filesFolder, `${programPath}.js`),
-        sampleJsProgram
-      )
-    else if (programType === RunTimeType.PY)
-      await createFile(
-        path.join(filesFolder, `${programPath}.py`),
-        samplePyProgram
-      )
-    else if (programType === RunTimeType.SAS)
-      await createFile(
-        path.join(filesFolder, `${programPath}.sas`),
-        sampleSasProgram
-      )
-  }
-
-  await request(app)
-    .get(`/SASjsApi/stp/execute?_program=${programPath}`)
-    .auth(accessToken, { type: 'bearer' })
-    .send()
-    .expect(expectedStatusCode)
-
-  if (expectedRuntime)
-    expect(ProcessProgramModule.processProgram).toHaveBeenCalledWith(
-      expect.anything(),
-      expect.anything(),
-      expect.anything(),
-      expect.anything(),
-      expect.anything(),
-      expect.anything(),
-      expect.anything(),
-      expectedRuntime,
-      expect.anything(),
-      undefined
-    )
-}
-
-const generateAndSaveToken = async (userId: number) => {
-  const accessToken = generateAccessToken({
-    clientId,
-    userId
-  })
-  await saveTokensInDB(userId, clientId, accessToken, 'refreshToken')
-  return accessToken
-}
-
-const setupMocks = async () => {
-  jest
-    .spyOn(SASSessionController.prototype, 'getSession')
-    .mockImplementation(mockedGetSession)
-
-  jest
-    .spyOn(JSSessionController.prototype, 'getSession')
-    .mockImplementation(mockedGetSession)
-
-  jest
-    .spyOn(PythonSessionController.prototype, 'getSession')
-    .mockImplementation(mockedGetSession)
-
-  jest
-    .spyOn(ProcessProgramModule, 'processProgram')
-    .mockImplementation(() => Promise.resolve())
-}
-
-const mockedGetSession = async () => {
-  const sessionId = generateUniqueFileName(generateTimestamp())
-  const sessionFolder = path.join(getSessionsFolder(), sessionId)
-
-  const creationTimeStamp = sessionId.split('-').pop() as string
-  // death time of session is 15 mins from creation
-  const deathTimeStamp = (
-    parseInt(creationTimeStamp) +
-    15 * 60 * 1000 -
-    1000
-  ).toString()
-
-  const session: Session = {
-    id: sessionId,
-    ready: true,
-    inUse: true,
-    consumed: false,
-    completed: false,
-    creationTimeStamp,
-    deathTimeStamp,
-    path: sessionFolder
-  }
-
-  return session
-}
--- a/api/src/routes/api/spec/user.spec.ts
+++ b/api/src/routes/api/spec/user.spec.ts
@@ -3,36 +3,37 @@ import mongoose, { Mongoose } from 'mongoose'
 import { MongoMemoryServer } from 'mongodb-memory-server'
 import request from 'supertest'
 import appPromise from '../../../app'
-import { UserController, GroupController } from '../../../controllers/'
+import { UserController } from '../../../controllers/'
 import { generateAccessToken, saveTokensInDB } from '../../../utils'

+let app: Express
+appPromise.then((_app) => {
+  app = _app
+})
+
 const clientId = 'someclientID'
 const adminUser = {
  displayName: 'Test Admin',
-  username: 'testadminusername',
+  username: 'testAdminUsername',
  password: '12345678',
  isAdmin: true,
  isActive: true
 }
 const user = {
  displayName: 'Test User',
-  username: 'testusername',
+  username: 'testUsername',
  password: '87654321',
  isAdmin: false,
-  isActive: true,
-  autoExec: 'some sas code for auto exec;'
+  isActive: true
 }

 const controller = new UserController()

 describe('user', () => {
-  let app: Express
  let con: Mongoose
  let mongoServer: MongoMemoryServer

  beforeAll(async () => {
-    app = await appPromise
-
    mongoServer = await MongoMemoryServer.create()
    con = await mongoose.connect(mongoServer.getUri())
  })
@@ -65,21 +66,6 @@ describe('user', () => {
      expect(res.body.displayName).toEqual(user.displayName)
      expect(res.body.isAdmin).toEqual(user.isAdmin)
      expect(res.body.isActive).toEqual(user.isActive)
-      expect(res.body.autoExec).toEqual(user.autoExec)
-    })
-
-    it('should respond with new user having username as lowercase', async () => {
-      const res = await request(app)
-        .post('/SASjsApi/user')
-        .auth(adminAccessToken, { type: 'bearer' })
-        .send({ ...user, username: user.username.toUpperCase() })
-        .expect(200)
-
-      expect(res.body.username).toEqual(user.username)
-      expect(res.body.displayName).toEqual(user.displayName)
-      expect(res.body.isAdmin).toEqual(user.isAdmin)
-      expect(res.body.isActive).toEqual(user.isActive)
-      expect(res.body.autoExec).toEqual(user.autoExec)
    })

    it('should respond with Unauthorized if access token is not present', async () => {
@@ -258,7 +244,7 @@ describe('user', () => {
      const dbUser1 = await controller.createUser(user)
      const dbUser2 = await controller.createUser({
        ...user,
-        username: 'randomuser'
+        username: 'randomUser'
      })

      const res = await request(app)
@@ -270,102 +256,6 @@ describe('user', () => {
      expect(res.text).toEqual('Error: Username already exists.')
      expect(res.body).toEqual({})
    })
-
-    describe('by username', () => {
-      it('should respond with updated user when admin user requests', async () => {
-        const dbUser = await controller.createUser(user)
-        const newDisplayName = 'My new display Name'
-
-        const res = await request(app)
-          .patch(`/SASjsApi/user/by/username/${user.username}`)
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send({ ...user, displayName: newDisplayName })
-          .expect(200)
-
-        expect(res.body.username).toEqual(user.username)
-        expect(res.body.displayName).toEqual(newDisplayName)
-        expect(res.body.isAdmin).toEqual(user.isAdmin)
-        expect(res.body.isActive).toEqual(user.isActive)
-      })
-
-      it('should respond with updated user when user himself requests', async () => {
-        const dbUser = await controller.createUser(user)
-        const accessToken = await generateAndSaveToken(dbUser.id)
-        const newDisplayName = 'My new display Name'
-
-        const res = await request(app)
-          .patch(`/SASjsApi/user/by/username/${user.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send({
-            displayName: newDisplayName,
-            username: user.username,
-            password: user.password
-          })
-          .expect(200)
-
-        expect(res.body.username).toEqual(user.username)
-        expect(res.body.displayName).toEqual(newDisplayName)
-        expect(res.body.isAdmin).toEqual(user.isAdmin)
-        expect(res.body.isActive).toEqual(user.isActive)
-      })
-
-      it('should respond with Bad Request, only admin can update isAdmin/isActive', async () => {
-        const dbUser = await controller.createUser(user)
-        const accessToken = await generateAndSaveToken(dbUser.id)
-        const newDisplayName = 'My new display Name'
-
-        await request(app)
-          .patch(`/SASjsApi/user/by/username/${user.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send({ ...user, displayName: newDisplayName })
-          .expect(400)
-      })
-
-      it('should respond with Unauthorized if access token is not present', async () => {
-        const res = await request(app)
-          .patch('/SASjsApi/user/by/username/1234')
-          .send(user)
-          .expect(401)
-
-        expect(res.text).toEqual('Unauthorized')
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Unauthorized when access token is not of an admin account or himself', async () => {
-        const dbUser1 = await controller.createUser(user)
-        const dbUser2 = await controller.createUser({
-          ...user,
-          username: 'randomUser'
-        })
-        const accessToken = await generateAndSaveToken(dbUser2.id)
-
-        const res = await request(app)
-          .patch(`/SASjsApi/user/${dbUser1.id}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send(user)
-          .expect(401)
-
-        expect(res.text).toEqual('Admin account required')
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Forbidden if username is already present', async () => {
-        const dbUser1 = await controller.createUser(user)
-        const dbUser2 = await controller.createUser({
-          ...user,
-          username: 'randomuser'
-        })
-
-        const res = await request(app)
-          .patch(`/SASjsApi/user/by/username/${dbUser1.username}`)
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send({ username: dbUser2.username })
-          .expect(403)
-
-        expect(res.text).toEqual('Error: Username already exists.')
-        expect(res.body).toEqual({})
-      })
-    })
  })

  describe('delete', () => {
@@ -459,89 +349,6 @@ describe('user', () => {
      expect(res.text).toEqual('Error: Invalid password.')
      expect(res.body).toEqual({})
    })
-
-    describe('by username', () => {
-      it('should respond with OK when admin user requests', async () => {
-        const dbUser = await controller.createUser(user)
-
-        const res = await request(app)
-          .delete(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send()
-          .expect(200)
-
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with OK when user himself requests', async () => {
-        const dbUser = await controller.createUser(user)
-        const accessToken = await generateAndSaveToken(dbUser.id)
-
-        const res = await request(app)
-          .delete(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send({ password: user.password })
-          .expect(200)
-
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Bad Request when user himself requests and password is missing', async () => {
-        const dbUser = await controller.createUser(user)
-        const accessToken = await generateAndSaveToken(dbUser.id)
-
-        const res = await request(app)
-          .delete(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send()
-          .expect(400)
-
-        expect(res.text).toEqual(`"password" is required`)
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Unauthorized when access token is not present', async () => {
-        const res = await request(app)
-          .delete('/SASjsApi/user/by/username/RandomUsername')
-          .send(user)
-          .expect(401)
-
-        expect(res.text).toEqual('Unauthorized')
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Unauthorized when access token is not of an admin account or himself', async () => {
-        const dbUser1 = await controller.createUser(user)
-        const dbUser2 = await controller.createUser({
-          ...user,
-          username: 'randomUser'
-        })
-        const accessToken = await generateAndSaveToken(dbUser2.id)
-
-        const res = await request(app)
-          .delete(`/SASjsApi/user/by/username/${dbUser1.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send(user)
-          .expect(401)
-
-        expect(res.text).toEqual('Admin account required')
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Forbidden when user himself requests and password is incorrect', async () => {
-        const dbUser = await controller.createUser(user)
-        const accessToken = await generateAndSaveToken(dbUser.id)
-
-        const res = await request(app)
-          .delete(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send({ password: 'incorrectpassword' })
-          .expect(403)
-
-        expect(res.text).toEqual('Error: Invalid password.')
-        expect(res.body).toEqual({})
-      })
-    })
  })

  describe('get', () => {
@@ -555,26 +362,7 @@ describe('user', () => {
      await deleteAllUsers()
    })

-    it('should respond with user autoExec when same user requests', async () => {
-      const dbUser = await controller.createUser(user)
-      const userId = dbUser.id
-      const accessToken = await generateAndSaveToken(userId)
-
-      const res = await request(app)
-        .get(`/SASjsApi/user/${userId}`)
-        .auth(accessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.body.username).toEqual(user.username)
-      expect(res.body.displayName).toEqual(user.displayName)
-      expect(res.body.isAdmin).toEqual(user.isAdmin)
-      expect(res.body.isActive).toEqual(user.isActive)
-      expect(res.body.autoExec).toEqual(user.autoExec)
-      expect(res.body.groups).toEqual([])
-    })
-
-    it('should respond with user autoExec when admin user requests', async () => {
+    it('should respond with user', async () => {
      const dbUser = await controller.createUser(user)
      const userId = dbUser.id

@@ -588,8 +376,6 @@ describe('user', () => {
      expect(res.body.displayName).toEqual(user.displayName)
      expect(res.body.isAdmin).toEqual(user.isAdmin)
      expect(res.body.isActive).toEqual(user.isActive)
-      expect(res.body.autoExec).toEqual(user.autoExec)
-      expect(res.body.groups).toEqual([])
    })

    it('should respond with user when access token is not of an admin account', async () => {
@@ -611,35 +397,6 @@ describe('user', () => {
      expect(res.body.displayName).toEqual(user.displayName)
      expect(res.body.isAdmin).toEqual(user.isAdmin)
      expect(res.body.isActive).toEqual(user.isActive)
-      expect(res.body.autoExec).toBeUndefined()
-      expect(res.body.groups).toEqual([])
-    })
-
-    it('should respond with user along with associated groups', async () => {
-      const dbUser = await controller.createUser(user)
-      const userId = dbUser.id
-      const accessToken = await generateAndSaveToken(userId)
-
-      const group = {
-        name: 'DCGroup1',
-        description: 'DC group for testing purposes.'
-      }
-      const groupController = new GroupController()
-      const dbGroup = await groupController.createGroup(group)
-      await groupController.addUserToGroup(dbGroup.groupId, dbUser.id)
-
-      const res = await request(app)
-        .get(`/SASjsApi/user/${userId}`)
-        .auth(accessToken, { type: 'bearer' })
-        .send()
-        .expect(200)
-
-      expect(res.body.username).toEqual(user.username)
-      expect(res.body.displayName).toEqual(user.displayName)
-      expect(res.body.isAdmin).toEqual(user.isAdmin)
-      expect(res.body.isActive).toEqual(user.isActive)
-      expect(res.body.autoExec).toEqual(user.autoExec)
-      expect(res.body.groups.length).toBeGreaterThan(0)
    })

    it('should respond with Unauthorized if access token is not present', async () => {
@@ -664,86 +421,6 @@ describe('user', () => {
      expect(res.text).toEqual('Error: User is not found.')
      expect(res.body).toEqual({})
    })
-
-    describe('by username', () => {
-      it('should respond with user autoExec when same user requests', async () => {
-        const dbUser = await controller.createUser(user)
-        const userId = dbUser.id
-        const accessToken = await generateAndSaveToken(userId)
-
-        const res = await request(app)
-          .get(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send()
-          .expect(200)
-
-        expect(res.body.username).toEqual(user.username)
-        expect(res.body.displayName).toEqual(user.displayName)
-        expect(res.body.isAdmin).toEqual(user.isAdmin)
-        expect(res.body.isActive).toEqual(user.isActive)
-        expect(res.body.autoExec).toEqual(user.autoExec)
-      })
-
-      it('should respond with user autoExec when admin user requests', async () => {
-        const dbUser = await controller.createUser(user)
-
-        const res = await request(app)
-          .get(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send()
-          .expect(200)
-
-        expect(res.body.username).toEqual(user.username)
-        expect(res.body.displayName).toEqual(user.displayName)
-        expect(res.body.isAdmin).toEqual(user.isAdmin)
-        expect(res.body.isActive).toEqual(user.isActive)
-        expect(res.body.autoExec).toEqual(user.autoExec)
-      })
-
-      it('should respond with user when access token is not of an admin account', async () => {
-        const accessToken = await generateSaveTokenAndCreateUser({
-          ...user,
-          username: 'randomUser'
-        })
-
-        const dbUser = await controller.createUser(user)
-
-        const res = await request(app)
-          .get(`/SASjsApi/user/by/username/${dbUser.username}`)
-          .auth(accessToken, { type: 'bearer' })
-          .send()
-          .expect(200)
-
-        expect(res.body.username).toEqual(user.username)
-        expect(res.body.displayName).toEqual(user.displayName)
-        expect(res.body.isAdmin).toEqual(user.isAdmin)
-        expect(res.body.isActive).toEqual(user.isActive)
-        expect(res.body.autoExec).toBeUndefined()
-      })
-
-      it('should respond with Unauthorized if access token is not present', async () => {
-        const res = await request(app)
-          .get('/SASjsApi/user/by/username/randomUsername')
-          .send()
-          .expect(401)
-
-        expect(res.text).toEqual('Unauthorized')
-        expect(res.body).toEqual({})
-      })
-
-      it('should respond with Forbidden if username is incorrect', async () => {
-        await controller.createUser(user)
-
-        const res = await request(app)
-          .get('/SASjsApi/user/by/username/randomUsername')
-          .auth(adminAccessToken, { type: 'bearer' })
-          .send()
-          .expect(403)
-
-        expect(res.text).toEqual('Error: User is not found.')
-        expect(res.body).toEqual({})
-      })
-    })
  })

  describe('getAll', () => {
@@ -770,14 +447,12 @@ describe('user', () => {
        {
          id: expect.anything(),
          username: adminUser.username,
-          displayName: adminUser.displayName,
-          isAdmin: adminUser.isAdmin
+          displayName: adminUser.displayName
        },
        {
          id: expect.anything(),
          username: user.username,
-          displayName: user.displayName,
-          isAdmin: user.isAdmin
+          displayName: user.displayName
        }
      ])
    })
@@ -798,14 +473,12 @@ describe('user', () => {
        {
          id: expect.anything(),
          username: adminUser.username,
-          displayName: adminUser.displayName,
-          isAdmin: adminUser.isAdmin
+          displayName: adminUser.displayName
        },
        {
          id: expect.anything(),
          username: 'randomUser',
-          displayName: user.displayName,
-          isAdmin: user.isAdmin
+          displayName: user.displayName
        }
      ])
    })
--- a/api/src/routes/api/spec/web.spec.ts
+++ b/api/src/routes/api/spec/web.spec.ts
@@ -1,182 +0,0 @@
-import { Express } from 'express'
-import mongoose, { Mongoose } from 'mongoose'
-import { MongoMemoryServer } from 'mongodb-memory-server'
-import request from 'supertest'
-import appPromise from '../../../app'
-import { UserController, ClientController } from '../../../controllers/'
-
-const clientId = 'someclientID'
-const clientSecret = 'someclientSecret'
-const user = {
-  id: 1234,
-  displayName: 'Test User',
-  username: 'testusername',
-  password: '87654321',
-  isAdmin: false,
-  isActive: true
-}
-
-describe('web', () => {
-  let app: Express
-  let con: Mongoose
-  let mongoServer: MongoMemoryServer
-  const userController = new UserController()
-  const clientController = new ClientController()
-
-  beforeAll(async () => {
-    app = await appPromise
-
-    mongoServer = await MongoMemoryServer.create()
-    con = await mongoose.connect(mongoServer.getUri())
-    await clientController.createClient({ clientId, clientSecret })
-  })
-
-  afterAll(async () => {
-    await con.connection.dropDatabase()
-    await con.connection.close()
-    await mongoServer.stop()
-  })
-
-  describe('home', () => {
-    it('should respond with CSRF Token', async () => {
-      const res = await request(app).get('/').expect(200)
-
-      expect(res.text).toMatch(
-        /<script>document.cookie = '(XSRF-TOKEN=.*; Max-Age=86400; SameSite=Strict; Path=\/;)'<\/script>/
-      )
-    })
-  })
-
-  describe('SASLogon/login', () => {
-    let csrfToken: string
-    let cookies: string
-
-    beforeAll(async () => {
-      ;({ csrfToken, cookies } = await getCSRF(app))
-    })
-
-    afterEach(async () => {
-      const collections = mongoose.connection.collections
-      const collection = collections['users']
-      await collection.deleteMany({})
-    })
-
-    it('should respond with successful login', async () => {
-      await userController.createUser(user)
-
-      const res = await request(app)
-        .post('/SASLogon/login')
-        .set('Cookie', cookies)
-        .set('x-xsrf-token', csrfToken)
-        .send({
-          username: user.username,
-          password: user.password
-        })
-        .expect(200)
-
-      expect(res.body.loggedIn).toBeTruthy()
-      expect(res.body.user).toEqual({
-        id: expect.any(Number),
-        username: user.username,
-        displayName: user.displayName,
-        isAdmin: user.isAdmin
-      })
-    })
-  })
-
-  describe('SASLogon/authorize', () => {
-    let csrfToken: string
-    let cookies: string
-    let authCookies: string
-
-    beforeAll(async () => {
-      ;({ csrfToken, cookies } = await getCSRF(app))
-
-      await userController.createUser(user)
-
-      const credentials = {
-        username: user.username,
-        password: user.password
-      }
-
-      ;({ cookies: authCookies } = await performLogin(
-        app,
-        credentials,
-        cookies,
-        csrfToken
-      ))
-    })
-
-    afterAll(async () => {
-      const collections = mongoose.connection.collections
-      const collection = collections['users']
-      await collection.deleteMany({})
-    })
-
-    it('should respond with authorization code', async () => {
-      const res = await request(app)
-        .post('/SASLogon/authorize')
-        .set('Cookie', [authCookies, cookies].join('; '))
-        .set('x-xsrf-token', csrfToken)
-        .send({ clientId })
-
-      expect(res.body).toHaveProperty('code')
-    })
-
-    it('should respond with Bad Request if clientId is missing', async () => {
-      const res = await request(app)
-        .post('/SASLogon/authorize')
-        .set('Cookie', [authCookies, cookies].join('; '))
-        .set('x-xsrf-token', csrfToken)
-        .send({})
-        .expect(400)
-
-      expect(res.text).toEqual(`"clientId" is required`)
-      expect(res.body).toEqual({})
-    })
-
-    it('should respond with Forbidden if clientId is incorrect', async () => {
-      const res = await request(app)
-        .post('/SASLogon/authorize')
-        .set('Cookie', [authCookies, cookies].join('; '))
-        .set('x-xsrf-token', csrfToken)
-        .send({
-          clientId: 'WrongClientID'
-        })
-        .expect(403)
-
-      expect(res.text).toEqual('Error: Invalid clientId.')
-      expect(res.body).toEqual({})
-    })
-  })
-})
-
-const getCSRF = async (app: Express) => {
-  // make request to get CSRF
-  const { header, text } = await request(app).get('/')
-  const cookies = header['set-cookie'].join()
-
-  const csrfToken = extractCSRF(text)
-  return { csrfToken, cookies }
-}
-
-const performLogin = async (
-  app: Express,
-  credentials: { username: string; password: string },
-  cookies: string,
-  csrfToken: string
-) => {
-  const { header } = await request(app)
-    .post('/SASLogon/login')
-    .set('Cookie', cookies)
-    .set('x-xsrf-token', csrfToken)
-    .send(credentials)
-
-  const newCookies: string = header['set-cookie'].join()
-  return { cookies: newCookies }
-}
-
-const extractCSRF = (text: string) =>
-  /<script>document.cookie = 'XSRF-TOKEN=(.*); Max-Age=86400; SameSite=Strict; Path=\/;'<\/script>/.exec(
-    text
-  )![1]
--- a/api/src/routes/api/stp.ts
+++ b/api/src/routes/api/stp.ts
@@ -1,5 +1,5 @@
 import express from 'express'
-import { executeProgramRawValidation } from '../../utils'
+import { executeProgramRawValidation, runSASValidation } from '../../utils'
 import { STPController } from '../../controllers/'
 import { FileUploadController } from '../../controllers/internal'

@@ -13,13 +13,7 @@ stpRouter.get('/execute', async (req, res) => {
  if (error) return res.status(400).send(error.details[0].message)

  try {
-    const response = await controller.executeGetRequest(req, query._program)
-
-    if (response instanceof Buffer) {
-      res.writeHead(200, (req as any).sasHeaders)
-      return res.end(response)
-    }
-
+    const response = await controller.executeReturnRaw(req, query._program)
    res.send(response)
  } catch (err: any) {
    const statusCode = err.code
@@ -32,28 +26,20 @@ stpRouter.get('/execute', async (req, res) => {

 stpRouter.post(
  '/execute',
-  fileUploadController.preUploadMiddleware,
+  fileUploadController.preuploadMiddleware,
  fileUploadController.getMulterUploadObject().any(),
-  async (req, res: any) => {
-    // below validations are moved to preUploadMiddleware
-    // const { error: errQ, value: query } = executeProgramRawValidation(req.query)
-    // const { error: errB, value: body } = executeProgramRawValidation(req.body)
+  async (req: any, res: any) => {
+    const { error: errQ, value: query } = executeProgramRawValidation(req.query)
+    const { error: errB, value: body } = executeProgramRawValidation(req.body)

-    // if (errQ && errB) return res.status(400).send(errB.details[0].message)
+    if (errQ && errB) return res.status(400).send(errB.details[0].message)

    try {
-      const response = await controller.executePostRequest(
+      const response = await controller.executeReturnJson(
        req,
-        req.body,
-        req.query?._program as string
+        body,
+        query?._program
      )
-
-      // TODO: investigate if this code is required
-      // if (response instanceof Buffer) {
-      //   res.writeHead(200, (req as any).sasHeaders)
-      //   return res.end(response)
-      // }
-
      res.send(response)
    } catch (err: any) {
      const statusCode = err.code
--- a/api/src/routes/api/user.ts
+++ b/api/src/routes/api/user.ts
@@ -7,7 +7,6 @@ import {
 } from '../../middlewares'
 import {
  deleteUserValidation,
-  getUserValidation,
  registerUserValidation,
  updateUserValidation
 } from '../../utils'
@@ -37,80 +36,33 @@ userRouter.get('/', authenticateAccessToken, async (req, res) => {
  }
 })

-userRouter.get(
-  '/by/username/:username',
-  authenticateAccessToken,
-  async (req, res) => {
-    const { error, value: params } = getUserValidation(req.params)
-    if (error) return res.status(400).send(error.details[0].message)
-
-    const { username } = params
-
-    const controller = new UserController()
-    try {
-      const response = await controller.getUserByUsername(req, username)
-      res.send(response)
-    } catch (err: any) {
-      res.status(403).send(err.toString())
-    }
-  }
-)
-
-userRouter.get('/:userId', authenticateAccessToken, async (req, res) => {
+userRouter.get('/:userId', authenticateAccessToken, async (req: any, res) => {
  const { userId } = req.params

  const controller = new UserController()
  try {
-    const response = await controller.getUser(req, parseInt(userId))
+    const response = await controller.getUser(userId)
    res.send(response)
  } catch (err: any) {
    res.status(403).send(err.toString())
  }
 })

-userRouter.patch(
-  '/by/username/:username',
-  authenticateAccessToken,
-  verifyAdminIfNeeded,
-  async (req, res) => {
-    const { user } = req
-    const { error: errorUsername, value: params } = getUserValidation(
-      req.params
-    )
-    if (errorUsername)
-      return res.status(400).send(errorUsername.details[0].message)
-
-    const { username } = params
-
-    // only an admin can update `isActive` and `isAdmin` fields
-    const { error, value: body } = updateUserValidation(req.body, user!.isAdmin)
-    if (error) return res.status(400).send(error.details[0].message)
-
-    const controller = new UserController()
-    try {
-      const response = await controller.updateUserByUsername(username, body)
-      res.send(response)
-    } catch (err: any) {
-      res.status(403).send(err.toString())
-    }
-  }
-)
-
 userRouter.patch(
  '/:userId',
  authenticateAccessToken,
  verifyAdminIfNeeded,
-  async (req, res) => {
+  async (req: any, res) => {
    const { user } = req
    const { userId } = req.params

    // only an admin can update `isActive` and `isAdmin` fields
-    const { error, value: body } = updateUserValidation(req.body, user!.isAdmin)
+    const { error, value: body } = updateUserValidation(req.body, user.isAdmin)
    if (error) return res.status(400).send(error.details[0].message)

    const controller = new UserController()
    try {
-      const response = await controller.updateUser(parseInt(userId), body)
+      const response = await controller.updateUser(userId, body)
      res.send(response)
    } catch (err: any) {
      res.status(403).send(err.toString())
@@ -118,49 +70,21 @@ userRouter.patch(
  }
 )

-userRouter.delete(
-  '/by/username/:username',
-  authenticateAccessToken,
-  verifyAdminIfNeeded,
-  async (req, res) => {
-    const { user } = req
-    const { error: errorUsername, value: params } = getUserValidation(
-      req.params
-    )
-    if (errorUsername)
-      return res.status(400).send(errorUsername.details[0].message)
-
-    const { username } = params
-
-    // only an admin can delete user without providing password
-    const { error, value: data } = deleteUserValidation(req.body, user!.isAdmin)
-    if (error) return res.status(400).send(error.details[0].message)
-
-    const controller = new UserController()
-    try {
-      await controller.deleteUserByUsername(username, data, user!.isAdmin)
-      res.status(200).send('Account Deleted!')
-    } catch (err: any) {
-      res.status(403).send(err.toString())
-    }
-  }
-)
-
 userRouter.delete(
  '/:userId',
  authenticateAccessToken,
  verifyAdminIfNeeded,
-  async (req, res) => {
+  async (req: any, res) => {
    const { user } = req
    const { userId } = req.params

    // only an admin can delete user without providing password
-    const { error, value: data } = deleteUserValidation(req.body, user!.isAdmin)
+    const { error, value: data } = deleteUserValidation(req.body, user.isAdmin)
    if (error) return res.status(400).send(error.details[0].message)

    const controller = new UserController()
    try {
-      await controller.deleteUser(parseInt(userId), data, user!.isAdmin)
+      await controller.deleteUser(userId, data, user.isAdmin)
      res.status(200).send('Account Deleted!')
    } catch (err: any) {
      res.status(403).send(err.toString())
--- a/api/src/routes/appStream/appStreamHtml.ts
+++ b/api/src/routes/appStream/appStreamHtml.ts
@@ -1,52 +0,0 @@
-import { AppStreamConfig } from '../../types'
-import { style } from './style'
-
-const defaultAppLogo = '/sasjs-logo.svg'
-
-const singleAppStreamHtml = (
-  streamServiceName: string,
-  appLoc: string,
-  logo?: string
-) =>
-  ` <a class="app" href="${streamServiceName}" title="${appLoc}">
-      <img
-        src="${logo ? streamServiceName + '/' + logo : defaultAppLogo}"
-        onerror="this.src = '${defaultAppLogo}';"
-      />
-      ${streamServiceName}
-    </a>`
-
-export const appStreamHtml = (appStreamConfig: AppStreamConfig) => `
-<html>
-  <head>
-    <base href="/AppStream/">
-    ${style}
-  </head>
-  <body>
-    <header>
-      <a href="/"><img src="/logo.png" alt="logo" class="logo"></a>
-      <h1>App Stream</h1>
-    </header>
-    <div class="app-container">
-        ${Object.entries(appStreamConfig)
-          .map(([streamServiceName, entry]) =>
-            singleAppStreamHtml(
-              streamServiceName,
-              entry.appLoc,
-              entry.streamLogo
-            )
-          )
-          .join('')}
-
-        <a class="app" title="Upload build.json">
-          <input id="fileId" type="file" hidden />
-          <button id="uploadButton" style="margin-bottom: 5px; cursor: pointer">
-            <img src="/plus.png" />
-          </button>
-          <span id="uploadMessage">Upload New App</span>
-        </a>
-    </div>
-    <script src="/axios.min.js"></script>
-    <script src="/app-streams-script.js"></script>
-  </body>
-</html>`
--- a/api/src/routes/appStream/index.ts
+++ b/api/src/routes/appStream/index.ts
@@ -1,92 +0,0 @@
-import path from 'path'
-import express, { Request } from 'express'
-import { authenticateAccessToken } from '../../middlewares'
-import { folderExists } from '@sasjs/utils'
-
-import { addEntryToAppStreamConfig, getFilesFolder } from '../../utils'
-import { appStreamHtml } from './appStreamHtml'
-
-const appStreams: { [key: string]: string } = {}
-
-const router = express.Router()
-
-router.get('/', authenticateAccessToken, async (req, res) => {
-  const content = appStreamHtml(process.appStreamConfig)
-
-  res.cookie('XSRF-TOKEN', req.csrfToken())
-
-  return res.send(content)
-})
-
-export const publishAppStream = async (
-  appLoc: string,
-  streamWebFolder: string,
-  streamServiceName?: string,
-  streamLogo?: string,
-  addEntryToFile: boolean = true
-) => {
-  const driveFilesPath = getFilesFolder()
-
-  const appLocParts = appLoc.replace(/^\//, '')?.split('/')
-  const appLocPath = path.join(driveFilesPath, ...appLocParts)
-  if (!appLocPath.includes(driveFilesPath)) {
-    throw new Error('appLoc cannot be outside drive.')
-  }
-
-  const pathToDeployment = path.join(appLocPath, 'services', streamWebFolder)
-  if (!pathToDeployment.includes(appLocPath)) {
-    throw new Error('streamWebFolder cannot be outside appLoc.')
-  }
-
-  if (await folderExists(pathToDeployment)) {
-    const appCount = process.appStreamConfig
-      ? Object.keys(process.appStreamConfig).length
-      : 0
-
-    if (!streamServiceName) {
-      streamServiceName = `AppStreamName${appCount + 1}`
-    }
-
-    appStreams[streamServiceName] = pathToDeployment
-
-    addEntryToAppStreamConfig(
-      streamServiceName,
-      appLoc,
-      streamWebFolder,
-      streamLogo,
-      addEntryToFile
-    )
-
-    const sasJsPort = process.env.PORT || 5000
-    console.log(
-      'Serving Stream App: ',
-      `http://localhost:${sasJsPort}/AppStream/${streamServiceName}`
-    )
-    return { streamServiceName }
-  }
-  return {}
-}
-
-router.get(`/*`, authenticateAccessToken, function (req: Request, res, next) {
-  const reqPath = req.path.replace(/^\//, '')
-
-  // Redirecting to url with trailing slash for appStream base URL only
-  if (reqPath.split('/').length === 1 && !reqPath.endsWith('/'))
-    // navigating to same url with slash at start
-    return res.redirect(301, `${reqPath}/`)
-
-  const appStream = reqPath.split('/')[0]
-  const appStreamFilesPath = appStreams[appStream]
-  if (appStreamFilesPath) {
-    // resourcePath is without appStream base path
-    const resourcePath = reqPath.split('/').slice(1).join('/') || 'index.html'
-
-    req.url = resourcePath
-
-    return express.static(appStreamFilesPath)(req, res, next)
-  }
-
-  return res.send("There's no App Stream available here.")
-})
-
-export default router
--- a/api/src/routes/appStream/style.ts
+++ b/api/src/routes/appStream/style.ts
@@ -1,76 +0,0 @@
-export const style = `<style>
-* {
-  font-family: 'Roboto', sans-serif;
-}
-.app-container {
-  display: flex;
-  flex-wrap: wrap;
-  align-items: center;
-  justify-content: center;
-  padding-top: 50px;
-}
-.app-container .app {
-  width: 150px;
-  height: 180px;
-  margin: 10px;
-  overflow: hidden;
-  text-align: center;
-
-  text-decoration: none;
-  color: black;
-
-  background: #efefef;
-  padding: 10px;
-  border-radius: 7px;
-  border: 1px solid #d7d7d7;
-}
-.app-container .app img{
-  width: 100%;
-  height: calc(100% - 30px);
-  margin-bottom: 10px;
-  border-radius: 10px;
-}
-#uploadButton {
-  border: 0
-}
-
-#uploadButton:focus {
-  outline: 0
-}
-
-#uploadMessage {
-  position: relative;
-  bottom: -5px;
-}
-
-header {
-  transition: box-shadow 300ms cubic-bezier(0.4, 0, 0.2, 1) 0ms;
-  box-shadow: rgb(0 0 0 / 20%) 0px 2px 4px -1px, rgb(0 0 0 / 14%) 0px 4px 5px 0px, rgb(0 0 0 / 12%) 0px 1px 10px 0px;
-  display: flex;
-  width: 100%;
-  box-sizing: border-box;
-  flex-shrink: 0;
-  position: fixed;
-  top: 0px;
-  left: auto;
-  right: 0px;
-  background-color: rgb(0, 0, 0);
-  color: rgb(255, 255, 255);
-  z-index: 1201;
-}
-
-header h1 {
-  margin: 13px;
-  font-size: 20px;
-}
-
-header a {
-  align-self: center;
-}
-
-header .logo {
-  width: 35px;
-  margin-left: 10px;
-  align-self: center;
-}
-</style>`
--- a/api/src/routes/setupRoutes.ts
+++ b/api/src/routes/setupRoutes.ts
@@ -1,19 +0,0 @@
-import { Express } from 'express'
-
-import webRouter from './web'
-import apiRouter from './api'
-import appStreamRouter from './appStream'
-
-import { csrfProtection } from '../app'
-
-export const setupRoutes = (app: Express) => {
-  app.use('/SASjsApi', apiRouter)
-
-  app.use('/AppStream', csrfProtection, function (req, res, next) {
-    // this needs to be a function to hook on
-    // whatever the current router is
-    appStreamRouter(req, res, next)
-  })
-
-  app.use('/', csrfProtection, webRouter)
-}
--- a/api/src/routes/web/web.ts
+++ b/api/src/routes/web/web.ts
@@ -1,64 +1,34 @@
+import { readFile } from '@sasjs/utils'
 import express from 'express'
-import { WebController } from '../../controllers/web'
-import { authenticateAccessToken, desktopRestrict } from '../../middlewares'
-import { authorizeValidation, loginWebValidation } from '../../utils'
+import path from 'path'
+import { getWebBuildFolderPath } from '../../utils'

 const webRouter = express.Router()
-const controller = new WebController()

-webRouter.get('/', async (req, res) => {
-  let response
+const codeToInject = `
+<script>
+  localStorage.setItem('accessToken', JSON.stringify('accessToken'))
+  localStorage.setItem('refreshToken', JSON.stringify('refreshToken'))
+</script>`
+
+webRouter.get('/', async (_, res) => {
+  let content: string
  try {
-    response = await controller.home()
+    const indexHtmlPath = path.join(getWebBuildFolderPath(), 'index.html')
+    content = await readFile(indexHtmlPath)
  } catch (_) {
-    response = '<html><head></head><body>Web Build is not present</body></html>'
-  } finally {
-    const codeToInject = `<script>document.cookie = 'XSRF-TOKEN=${req.csrfToken()}; Max-Age=86400; SameSite=Strict; Path=/;'</script>`
-    const injectedContent = response?.replace(
-      '</head>',
-      `${codeToInject}</head>`
-    )
+    return res.send('Web Build is not present')
+  }

+  const { MODE } = process.env
+  if (MODE?.trim() !== 'server') {
+    const injectedContent = content.replace('</head>', `${codeToInject}</head>`)
+
+    res.setHeader('Content-Type', 'text/html')
    return res.send(injectedContent)
  }
-})

-webRouter.post('/SASLogon/login', desktopRestrict, async (req, res) => {
-  const { error, value: body } = loginWebValidation(req.body)
-  if (error) return res.status(400).send(error.details[0].message)
-
-  try {
-    const response = await controller.login(req, body)
-    res.send(response)
-  } catch (err: any) {
-    res.status(403).send(err.toString())
-  }
-})
-
-webRouter.post(
-  '/SASLogon/authorize',
-  desktopRestrict,
-  authenticateAccessToken,
-  async (req, res) => {
-    const { error, value: body } = authorizeValidation(req.body)
-    if (error) return res.status(400).send(error.details[0].message)
-
-    try {
-      const response = await controller.authorize(req, body)
-      res.send(response)
-    } catch (err: any) {
-      res.status(403).send(err.toString())
-    }
-  }
-)
-
-webRouter.get('/SASLogon/logout', desktopRestrict, async (req, res) => {
-  try {
-    await controller.logout(req)
-    res.status(200).send('OK!')
-  } catch (err: any) {
-    res.status(403).send(err.toString())
-  }
+  return res.send(content)
 })

 export default webRouter
--- a/api/src/server.ts
+++ b/api/src/server.ts
@@ -1,28 +1,10 @@
-import { createServer } from 'https'
-
 import appPromise from './app'
-import { getCertificates } from './utils'

-appPromise.then(async (app) => {
-  const protocol = process.env.PROTOCOL || 'http'
-  const sasJsPort = process.env.PORT || 5000
-
-  console.log('PROTOCOL: ', protocol)
-
-  if (protocol !== 'https') {
-    app.listen(sasJsPort, () => {
-      console.log(
-        `⚡️[server]: Server is running at http://localhost:${sasJsPort}`
-      )
-    })
-  } else {
-    const { key, cert, ca } = await getCertificates()
-
-    const httpsServer = createServer({ key, cert, ca }, app)
-    httpsServer.listen(sasJsPort, () => {
-      console.log(
-        `⚡️[server]: Server is running at https://localhost:${sasJsPort}`
-      )
-    })
-  }
+appPromise.then((app) => {
+  const sasJsPort = process.env.PORT ?? 5000
+  app.listen(sasJsPort, () => {
+    console.log(
+      `⚡️[server]: Server is running at http://localhost:${sasJsPort}`
+    )
+  })
 })
--- a/api/src/types/AppStreamConfig.ts
+++ b/api/src/types/AppStreamConfig.ts
@@ -1,7 +0,0 @@
-export interface AppStreamConfig {
-  [key: string]: {
-    appLoc: string
-    streamWebFolder: string
-    streamLogo?: string
-  }
-}
--- a/api/src/types/FileTree.ts
+++ b/api/src/types/FileTree.ts
@@ -0,0 +1,47 @@
+export interface FileTree {
+  members: (FolderMember | ServiceMember)[]
+}
+
+export enum MemberType {
+  folder = 'folder',
+  service = 'service'
+}
+
+export interface FolderMember {
+  name: string
+  type: MemberType.folder
+  members: (FolderMember | ServiceMember)[]
+}
+
+export interface ServiceMember {
+  name: string
+  type: MemberType.service
+  code: string
+}
+
+export const isFileTree = (arg: any): arg is FileTree =>
+  arg &&
+  arg.members &&
+  Array.isArray(arg.members) &&
+  arg.members.filter(
+    (member: FolderMember | ServiceMember) =>
+      !isFolderMember(member) && !isServiceMember(member)
+  ).length === 0
+
+const isFolderMember = (arg: any): arg is FolderMember =>
+  arg &&
+  typeof arg.name === 'string' &&
+  arg.type === MemberType.folder &&
+  arg.members &&
+  Array.isArray(arg.members) &&
+  arg.members.filter(
+    (member: FolderMember | ServiceMember) =>
+      !isFolderMember(member) && !isServiceMember(member)
+  ).length === 0
+
+const isServiceMember = (arg: any): arg is ServiceMember =>
+  arg &&
+  typeof arg.name === 'string' &&
+  arg.type === MemberType.service &&
+  arg.code &&
+  typeof arg.code === 'string'
--- a/api/src/types/PreProgramVars.ts
+++ b/api/src/types/PreProgramVars.ts
@@ -3,5 +3,5 @@ export interface PreProgramVars {
  userId: number
  displayName: string
  serverUrl: string
-  httpHeaders: string[]
+  accessToken: string
 }
--- a/api/src/types/Process.d.ts
+++ b/api/src/types/Process.d.ts
@@ -0,0 +1,7 @@
+declare namespace NodeJS {
+  export interface Process {
+    sasLoc: string
+    driveLoc: string
+    sessionController?: import('../controllers/internal').SessionController
+  }
+}
--- a/Show More
+++ b/Show More