Merge pull request 'fix(makedata): name the sasjs server group in the estate seed' (#400 ) from fix/estate-seed-admin into release/7.21

Reviewed-on: #400
fix(makedata): name the sasjs server group in the estate seed
2026-10-29 08:33:52 +00:00 · 2026-10-28 22:48:02 +00:00
2 changed files with 2 additions and 2 deletions
@@ -44,7 +44,7 @@ An unmatched `/SASjsApi/...` path answers `200` with the Swagger page, so check

 `npm run serverdata` sends `deploy/makeDataServer.json`: one `fromjs` row with `ADMIN`, `DCPATH` and `OUTFMT`. Two things about it are worth knowing before you trust its result.

- **`ADMIN` must name a group the calling account is actually in.** The shipped value is `AllUsers`, which is not a group on the shared estate - the account belongs to `all-users` (check with a call to `services/public/getgroups`, or read the `MF_GETUSER` the response echoes back). With a group the account is not in, the seed still answers `SUCCESS` and every later `getdata`/`stagedata` call aborts with `<user> is not authorised to edit <lib>.<ds> in the <lib>.MPE_SECURITY table`. Override `ADMIN` to `all-users` for the estate rather than editing the shipped JSON.
+- **`ADMIN` must name a group the calling account is actually in.** The shipped value is `all-users`, the SASjs Server group that every logged-in user is a member of, which is what the shared estate needs. A name the account is not in - a Viya-style group such as `AllUsers`, or one estate's own group carried into another - still answers `SUCCESS` from the seed, and then every later `getdata`/`stagedata` call aborts with `<user> is not authorised to edit <lib>.<ds> in the <lib>.MPE_SECURITY table`. Check what the account belongs to with a call to `services/public/getgroups` before changing the value.
 - **Each run creates a new library.** The response carries `STATUS`, `DCPATH` and `LIBREF` (for example `DC621835`), and the LIBREF is clock-derived, so a libref from an earlier run answers `dataset <lib>.<table> does not exist` - take the current one from the response.
 - **`KEEPME` controls whether the seed can be repeated.** Without it `makedata` deletes itself and the configurator after a successful run (deliberately, so it cannot be executed twice over real data), and a second seed fails with `The Program at (<appLoc>/services/admin/makedata) does not exist` until you run `sasjs cbd` again. A harness that reseeds between runs sets `KEEPME` in the input row.
 - **Seed once per deploy, not before every test run.** The suite builds its own `dctest` library from the seeded control tables; reseeding in between is wasted work, and there is no need to run `makedata` and `sasjs test` in the opposite order.
@@ -1,7 +1,7 @@
 {
  "fromjs": [
    {
-      "ADMIN": "AllUsers",
+      "ADMIN": "all-users",
      "DCPATH": "/tmp/dcdata",
      "OUTFMT": "JSON"
    }
Author	SHA1	Message	Date
allan	e6a5cce475	Merge pull request 'fix(makedata): name the sasjs server group in the estate seed' (#400 ) from fix/estate-seed-admin into release/7.21 Sites / deploy (push) Successful in 4m20s Details Build / Build-and-ng-test (pull_request) Successful in 6m53s Details Lighthouse Checks / lighthouse (pull_request) Successful in 20m47s Details Build / Build-and-test-development (pull_request) Successful in 33m53s Details Reviewed-on: #400	2026-10-29 08:33:52 +00:00
dc	eeffa92f9e	fix(makedata): name the sasjs server group in the estate seed Build / Build-and-ng-test (pull_request) Successful in 6m57s Details Lighthouse Checks / lighthouse (pull_request) Successful in 20m54s Details Build / Build-and-test-development (pull_request) Successful in 34m49s Details makeDataServer.json seeded ADMIN=AllUsers, a Viya-style group that no account on the shared estate belongs to. The seed still reports SUCCESS with a group the caller is not in, and then every getdata/stagedata call aborts with '<user> is not authorised to edit <libds> in the MPE_SECURITY table', which reads like a broken deployment. The estate's accounts are in all-users, the SASjs Server group every logged-in user has, so seed with that and describe the rule in the estate-testing skill rather than telling the reader to override the shipped value.	2026-10-28 22:48:02 +00:00