@synopackageland/cli 0.13.1 → 0.15.0

package/assets/go/gateway/groups.go

@@ -1,66 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"context"
-	"fmt"
-	"os"
-	"slices"
-	"strings"
-)
-
-// groupsOf reads local group files fresh on each request. Directory accounts
-// use NSS afresh; DSM provider caching may delay directory membership changes.
-// DSM keeps no member list for the group
-// that is an account's primary group (users), so membership is the member
-// list or the primary gid from the passwd file. Accounts absent from passwd use
-// DSM NSS; no local member-list fallback is permitted on lookup failure.
-func (a *dsmAuthenticator) groupsOf(ctx context.Context, user string) ([]string, error) {
-	primary, err := a.primaryGID(user)
-	if err != nil {
-		return nil, err
-	}
-	if primary == "" {
-		if a.directoryGroups == nil {
-			return nil, fmt.Errorf("directory group lookup unavailable")
-		}
-		return a.directoryGroups(ctx, user)
-	}
-	f, err := os.Open(a.groupFile)
-	if err != nil {
-		return nil, fmt.Errorf("read groups: %w", err)
-	}
-	defer f.Close()
-	var groups []string
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Split(scanner.Text(), ":")
-		if len(fields) == 4 && (fields[2] == primary || slices.Contains(strings.Split(fields[3], ","), user)) {
-			groups = append(groups, fields[0])
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("read groups: %w", err)
-	}
-	return groups, nil
-}
-
-// primaryGID is the account's gid in the passwd file; "" when the account has
-// no local entry, which requires a fresh directory lookup.
-func (a *dsmAuthenticator) primaryGID(user string) (string, error) {
-	f, err := os.Open(a.passwdFile)
-	if err != nil {
-		return "", fmt.Errorf("read accounts: %w", err)
-	}
-	defer f.Close()
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		if fields := strings.Split(scanner.Text(), ":"); len(fields) >= 4 && fields[0] == user {
-			return fields[3], nil
-		}
-	}
-	if err := scanner.Err(); err != nil {
-		return "", fmt.Errorf("read accounts: %w", err)
-	}
-	return "", nil
-}

package/assets/go/gateway/main.go

@@ -1,45 +0,0 @@
-// Command gateway is the DSM-authenticated front door of a container package.
-// DSM runs it as a CGI (ui/cgi/gateway.cgi in the package) under the package
-// account, once per request.
-package main
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http/cgi"
-	"os"
-)
-
-// Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
-var (
-	packageID  = "dev"
-	configJSON = ""
-)
-
-func main() {
-	log.SetFlags(0)
-	log.SetPrefix(packageID + ": ")
-	if os.Getenv("GATEWAY_INTERFACE") == "" {
-		fmt.Fprintf(os.Stderr, "%s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID)
-		os.Exit(2)
-	}
-	var cfg config
-	decoder := json.NewDecoder(bytes.NewReader([]byte(configJSON)))
-	decoder.DisallowUnknownFields()
-	if err := decoder.Decode(&cfg); err != nil {
-		log.Fatalf("invalid gateway configuration: %v", err)
-	}
-	g, err := newGateway(cfg, newDSMAuthenticator())
-	if err != nil {
-		log.Fatal(err)
-	}
-	req, err := cgi.Request()
-	if err != nil {
-		log.Fatal(err)
-	}
-	if err := serveCGI(g, req, os.Stdin, os.Stdout); err != nil {
-		log.Fatal(err)
-	}
-}

package/dist/build-spk/gateway.d.ts

@@ -1,31 +0,0 @@
-import { type CommandRunner } from "../standalone/build.js";
-import type { AppContract } from "../types.js";
-import type { NativeArchFamily } from "./dsm-arch.js";
-export { gatewayEntryPath } from "../contract/web-launch.js";
-/** Where the gateway CGI sits in the package payload; DSM serves `ui/` under /webman/3rdparty/<package>/. */
-export declare const GATEWAY_CGI_PAYLOAD = "ui/cgi/gateway.cgi";
-/** Readable copy of the baked-in configuration, for inspection; the CGI does not read it. */
-export declare const GATEWAY_CONFIG_PAYLOAD = "gateway.json";
-export type GatewayErrorCode = "GATEWAY_GO_MISSING" | "GATEWAY_BUILD_FAILED";
-export interface GatewayConfig {
-    upstream: string;
-    access: "users" | "admins" | "groups";
-    groups?: string[];
-}
-/** The access rule and container address the gateway enforces; undefined for an App without one. */
-export declare function gatewayConfig(contract: AppContract, adminport: number): GatewayConfig | undefined;
-/** Compiles the fixed gateway module for `arch`; the result is a static ELF or a coded failure. */
-export declare function buildGatewayBinary(input: {
-    packageId: string;
-    arch: NativeArchFamily;
-    config: GatewayConfig;
-    work: string;
-    run?: CommandRunner;
-}): Promise<{
-    binary: string;
-} | {
-    error: GatewayErrorCode;
-    detail: string;
-}>;
-/** Puts the CGI (mode 0755) and its readable configuration into the package payload. */
-export declare function writeGatewayPayload(packageDir: string, binary: string, config: GatewayConfig): void;

package/dist/build-spk/gateway.js

@@ -1,60 +0,0 @@
-import { goChildEnv } from "../runtime/go-env.js";
-import { chmodSync, copyFileSync, mkdirSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { checkCgiBinary } from "../standalone/binary.js";
-import { runCommand } from "../standalone/build.js";
-import { resolvedWebAccess } from "../contract/web-launch.js";
-import { goAssetDir } from "../template-paths.js";
-import { PINNED_GO_HINT, pinnedGoBuildEnv, pinnedGoProblem } from "./go-toolchain.js";
-export { gatewayEntryPath } from "../contract/web-launch.js";
-/** Where the gateway CGI sits in the package payload; DSM serves `ui/` under /webman/3rdparty/<package>/. */
-export const GATEWAY_CGI_PAYLOAD = "ui/cgi/gateway.cgi";
-/** Readable copy of the baked-in configuration, for inspection; the CGI does not read it. */
-export const GATEWAY_CONFIG_PAYLOAD = "gateway.json";
-const ACCESS = { "dsm-users": "users", "dsm-admins": "admins", "dsm-groups": "groups" };
-/** The access rule and container address the gateway enforces; undefined for an App without one. */
-export function gatewayConfig(contract, adminport) {
-    const access = resolvedWebAccess(contract);
-    if (!access || access.mode === "public") {
-        return undefined;
-    }
-    return {
-        upstream: `127.0.0.1:${adminport}`,
-        access: ACCESS[access.mode],
-        ...(access.mode === "dsm-groups" ? { groups: access.groups } : {}),
-    };
-}
-/** Compiles the fixed gateway module for `arch`; the result is a static ELF or a coded failure. */
-export async function buildGatewayBinary(input) {
-    const out = join(input.work, `gateway-${input.arch}.cgi`);
-    const ldflags = ["-s", "-w", "-buildid=", `-X main.packageID=${input.packageId}`, `-X 'main.configJSON=${JSON.stringify(input.config)}'`].join(" ");
-    const result = await (input.run ?? runCommand)("go", ["build", "-trimpath", "-buildvcs=false", "-ldflags", ldflags, "-o", out, "."], {
-        cwd: goAssetDir("gateway"),
-        env: goChildEnv({ ...process.env, ...pinnedGoBuildEnv(input.arch) }),
-    });
-    if (result.missing) {
-        return { error: "GATEWAY_GO_MISSING", detail: `The go command was not found. Building the DSM verification gateway needs Go 1.21 or later (https://go.dev/dl/). ${PINNED_GO_HINT}` };
-    }
-    if (result.status !== 0) {
-        return { error: "GATEWAY_BUILD_FAILED", detail: `go build (${input.arch}) failed. ${PINNED_GO_HINT}\n${result.stderr}` };
-    }
-    const problem = checkCgiBinary(input.work, out, input.arch);
-    if (problem) {
-        return { error: "GATEWAY_BUILD_FAILED", detail: problem.message };
-    }
-    const toolchainProblem = pinnedGoProblem(out);
-    if (toolchainProblem) {
-        return { error: "GATEWAY_BUILD_FAILED", detail: toolchainProblem };
-    }
-    return { binary: out };
-}
-/** Puts the CGI (mode 0755) and its readable configuration into the package payload. */
-export function writeGatewayPayload(packageDir, binary, config) {
-    const cgi = join(packageDir, GATEWAY_CGI_PAYLOAD);
-    mkdirSync(join(cgi, ".."), { recursive: true });
-    copyFileSync(binary, cgi);
-    chmodSync(cgi, 0o755);
-    const configPath = join(packageDir, GATEWAY_CONFIG_PAYLOAD);
-    writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
-    chmodSync(configPath, 0o644);
-}

package/dist/compose/privilege.d.ts

@@ -1,14 +0,0 @@
-import type { AppContract, ComposeDocument } from "../types.js";
-export declare const PRIVILEGE_FLAGS: readonly ["privileged", "host_network", "host_pid", "host_ipc", "devices", "cap_add"];
-export type PrivilegeFlag = (typeof PRIVILEGE_FLAGS)[number];
-export interface PrivilegeFinding {
-    flag: PrivilegeFlag;
-    code: string;
-    serviceName: string;
-    path: string;
-    message: string;
-    suggestion: string;
-}
-export declare function declaredPrivilegeFlags(contract: AppContract): Set<PrivilegeFlag>;
-export declare function scanComposePrivilege(compose: ComposeDocument): PrivilegeFinding[];
-export declare function undeclaredPrivilegeFindings(compose: ComposeDocument, declared: ReadonlySet<PrivilegeFlag>): PrivilegeFinding[];

package/dist/compose/privilege.js

@@ -1,102 +0,0 @@
-export const PRIVILEGE_FLAGS = [
-    "privileged",
-    "host_network",
-    "host_pid",
-    "host_ipc",
-    "devices",
-    "cap_add",
-];
-const FLAG_ERRORS = {
-    privileged: {
-        code: "COMPOSE_PRIVILEGED_FORBIDDEN",
-        message: "Compose uses a privileged container but the contract does not declare privilege.privileged.",
-        suggestion: "Add privilege.privileged: true to synology-app.yaml, or remove privileged: true.",
-    },
-    host_network: {
-        code: "COMPOSE_HOST_NETWORK_FORBIDDEN",
-        message: "Compose uses host network but the contract does not declare privilege.host_network.",
-        suggestion: "Add privilege.host_network: true to synology-app.yaml, or use a controlled network mode.",
-    },
-    host_pid: {
-        code: "COMPOSE_HOST_PID_FORBIDDEN",
-        message: "Compose uses host PID but the contract does not declare privilege.host_pid.",
-        suggestion: "Add privilege.host_pid: true to synology-app.yaml, or remove pid: host.",
-    },
-    host_ipc: {
-        code: "COMPOSE_HOST_IPC_FORBIDDEN",
-        message: "Compose uses host IPC but the contract does not declare privilege.host_ipc.",
-        suggestion: "Add privilege.host_ipc: true to synology-app.yaml, or remove ipc: host.",
-    },
-    devices: {
-        code: "COMPOSE_DEVICES_FORBIDDEN",
-        message: "Compose mounts devices but the contract does not declare privilege.devices.",
-        suggestion: "Add privilege.devices: true to synology-app.yaml, or remove devices.",
-    },
-    cap_add: {
-        code: "COMPOSE_CAP_ADD_FORBIDDEN",
-        message: "Compose uses extra cap_add but the contract does not declare privilege.cap_add.",
-        suggestion: "Add privilege.cap_add: true to synology-app.yaml, or remove cap_add.",
-    },
-};
-export function declaredPrivilegeFlags(contract) {
-    const raw = contract.privilege;
-    const flags = new Set();
-    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-        return flags;
-    }
-    const record = raw;
-    for (const flag of PRIVILEGE_FLAGS) {
-        if (record[flag] === true) {
-            flags.add(flag);
-        }
-    }
-    return flags;
-}
-export function scanComposePrivilege(compose) {
-    const findings = [];
-    if (!compose.services) {
-        return findings;
-    }
-    for (const [serviceName, service] of Object.entries(compose.services)) {
-        const basePath = `services.${serviceName}`;
-        const add = (flag, path) => {
-            const spec = FLAG_ERRORS[flag];
-            findings.push({
-                flag,
-                code: spec.code,
-                serviceName,
-                path,
-                message: spec.message,
-                suggestion: spec.suggestion,
-            });
-        };
-        if (service.privileged === true) {
-            add("privileged", `${basePath}.privileged`);
-        }
-        if (service.network_mode === "host") {
-            add("host_network", `${basePath}.network_mode`);
-        }
-        if (service.pid === "host") {
-            add("host_pid", `${basePath}.pid`);
-        }
-        if (service.ipc === "host") {
-            add("host_ipc", `${basePath}.ipc`);
-        }
-        if (hasEntries(service.devices)) {
-            add("devices", `${basePath}.devices`);
-        }
-        if (hasEntries(service.cap_add)) {
-            add("cap_add", `${basePath}.cap_add`);
-        }
-    }
-    return findings;
-}
-export function undeclaredPrivilegeFindings(compose, declared) {
-    return scanComposePrivilege(compose).filter((item) => !declared.has(item.flag));
-}
-function hasEntries(value) {
-    if (Array.isArray(value)) {
-        return value.length > 0;
-    }
-    return typeof value === "string" && value.trim() !== "";
-}