@synopackageland/cli 0.14.1 → 0.15.0

package/assets/go/gateway/cgi_test.go

@@ -1,156 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func cgiRequest(t *testing.T) *http.Request {
-	t.Helper()
-	return httptest.NewRequest("GET", "/webman/3rdparty/App/cgi/gateway.cgi/", nil)
-}
-
-func TestCGIReplyIsAStatusLineThenHeadersThenBody(t *testing.T) {
-	var out bytes.Buffer
-	err := serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/plain")
-		w.Header().Set("X-Thing", "1")
-		w.WriteHeader(404)
-		io.WriteString(w, "nope")
-	}), cgiRequest(t), strings.NewReader(""), &out)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := "Status: 404 Not Found\r\nContent-Type: text/plain\r\nX-Thing: 1\r\n\r\nnope"; out.String() != want {
-		t.Fatalf("got %q\nwant %q", out.String(), want)
-	}
-}
-
-func TestCGIReplyWithoutAWriteStillCarriesAStatus(t *testing.T) {
-	var out bytes.Buffer
-	if err := serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}), cgiRequest(t), strings.NewReader(""), &out); err != nil {
-		t.Fatal(err)
-	}
-	if !strings.HasPrefix(out.String(), "Status: 200 OK\r\n") || !strings.HasSuffix(out.String(), "\r\n\r\n") {
-		t.Fatalf("got %q", out.String())
-	}
-}
-
-func TestCGIReplySniffsAMissingContentType(t *testing.T) {
-	var out bytes.Buffer
-	serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { io.WriteString(w, "<html></html>") }), cgiRequest(t), strings.NewReader(""), &out)
-	if !strings.Contains(out.String(), "Content-Type: text/html; charset=utf-8\r\n") {
-		t.Fatalf("got %q", out.String())
-	}
-}
-
-// flushRecorder notes how many bytes were out when the handler was still running.
-type flushRecorder struct {
-	bytes.Buffer
-	atFlush int
-}
-
-func TestCGIFlushSendsWhatIsBufferedAtOnce(t *testing.T) {
-	var out flushRecorder
-	serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		io.WriteString(w, "data: one\n\n")
-		w.(http.Flusher).Flush()
-		out.atFlush = out.Len()
-		io.WriteString(w, "data: two\n\n")
-	}), cgiRequest(t), strings.NewReader(""), &out)
-	if !strings.HasSuffix(out.String(), "data: one\n\ndata: two\n\n") || out.atFlush < len("data: one\n\n") {
-		t.Fatalf("flushed %d bytes before the handler ended; total %q", out.atFlush, out.String())
-	}
-}
-
-// After a hijack stdin and stdout belong to the handler. What it writes first is an HTTP/1.1 status line;
-// DSM's CGI interface wants "Status:" instead.
-func TestCGIHijackTurnsTheStatusLineIntoACGIHeaderAndPassesBytesBothWays(t *testing.T) {
-	in, inW := io.Pipe()
-	outR, out := io.Pipe()
-	done := make(chan error, 1)
-	go func() {
-		done <- serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			conn, brw, err := w.(http.Hijacker).Hijack()
-			if err != nil {
-				t.Error(err)
-				return
-			}
-			defer conn.Close()
-			io.WriteString(brw, "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n")
-			brw.Flush()
-			buf := make([]byte, 16)
-			n, _ := brw.Read(buf)
-			io.WriteString(conn, "got:"+string(buf[:n]))
-		}), cgiRequest(t), in, out)
-		out.Close()
-	}()
-	r := bufio.NewReader(outR)
-	for _, want := range []string{"Status: 101 Switching Protocols", "Upgrade: websocket", "Connection: Upgrade", ""} {
-		if line, _ := r.ReadString('\n'); strings.TrimRight(line, "\r\n") != want {
-			t.Fatalf("header line %q, want %q", line, want)
-		}
-	}
-	io.WriteString(inW, "ping")
-	rest, _ := io.ReadAll(r)
-	if string(rest) != "got:ping" {
-		t.Fatalf("after the header block: %q (nothing, not even a second status, may follow the handler's bytes)", rest)
-	}
-	if err := <-done; err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestCGIReplyCannotBeWrittenAfterAHijack(t *testing.T) {
-	var out bytes.Buffer
-	serveCGI(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if _, _, err := w.(http.Hijacker).Hijack(); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := w.Write([]byte("late")); err == nil {
-			t.Error("Write after Hijack succeeded")
-		}
-	}), cgiRequest(t), strings.NewReader(""), &out)
-	if out.Len() != 0 {
-		t.Fatalf("output after a bare hijack: %q", out.String())
-	}
-}
-
-// The whole chain as DSM runs it: a WebSocket upgrade enters through the CGI environment and the container's
-// bytes come back on stdout.
-func TestWebSocketThroughTheCGIEnvironment(t *testing.T) {
-	up := newUpstream(t, wsEchoHandler)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	req := httptest.NewRequest("GET", base+"/ws", nil)
-	req.Host = "nas.example:5001"
-	req.Header.Set("Cookie", "id=abc")
-	req.Header.Set("Connection", "Upgrade")
-	req.Header.Set("Upgrade", "websocket")
-	req.Header.Set("Origin", "https://nas.example:5001")
-	in, inW := io.Pipe()
-	outR, out := io.Pipe()
-	done := make(chan error, 1)
-	go func() { done <- serveCGI(g, req, in, out); out.Close() }()
-	r := bufio.NewReader(outR)
-	if line, _ := r.ReadString('\n'); strings.TrimSpace(line) != "Status: 101 Switching Protocols" {
-		t.Fatalf("first line %q", line)
-	}
-	for line, _ := r.ReadString('\n'); strings.TrimSpace(line) != ""; line, _ = r.ReadString('\n') {
-	}
-	io.WriteString(inW, "hello")
-	got := make([]byte, len("echo:hello"))
-	if _, err := io.ReadFull(r, got); err != nil || string(got) != "echo:hello" {
-		t.Fatalf("echo = %q, %v", got, err)
-	}
-	inW.Close() // DSM closes stdin when the browser goes away
-	io.Copy(io.Discard, r)
-	if err := <-done; err != nil {
-		t.Fatal(err)
-	}
-}

package/assets/go/gateway/csrf.go

@@ -1,73 +0,0 @@
-package main
-
-// CSRF defence for state-changing requests. DSM issues a SynoToken only when
-// "Enhance CSRF protection" (enable_syno_token in synoinfo.conf) is on; when it
-// is off, DSM hands every session the same placeholder and validates nothing,
-// so the token alone proves nothing. The gateway therefore needs evidence that
-// the browser itself made the request from the gateway's own origin, and it
-// never stores or trusts a token value of its own.
-
-import (
-	"net/http"
-	"net/url"
-	"strings"
-)
-
-const maxTokenLen = 256
-
-// wellFormedToken accepts any printable ASCII value of sane length. Whether the
-// value is the right one is DSM's call (authenticate.cgi gets it on every
-// request); the gateway only refuses requests that carry nothing usable.
-func wellFormedToken(token string) bool {
-	if token == "" || len(token) > maxTokenLen {
-		return false
-	}
-	for i := 0; i < len(token); i++ {
-		if token[i] < 0x20 || token[i] > 0x7e {
-			return false
-		}
-	}
-	return true
-}
-
-// sameOrigin reports whether the browser says the request came from the page's
-// own origin. Sec-Fetch-Site, when present, must say same-origin; Origin, when
-// present, must be the request's own host. At least one must be present: a
-// browser sends Origin on every cross-origin and every non-GET request, so a
-// state-changing request with neither is not from a browser that can be trusted
-// to scope it (browsers without either, such as IE 11, are refused).
-func sameOrigin(r *http.Request) bool {
-	site := r.Header.Get("Sec-Fetch-Site")
-	origin := r.Header.Get("Origin")
-	if site == "" && origin == "" {
-		return false
-	}
-	if site != "" && site != "same-origin" {
-		return false
-	}
-	return origin == "" || originMatchesHost(origin, r.Host)
-}
-
-// originMatchesHost compares an Origin header (scheme://host[:port], no path)
-// with the Host the request was addressed to. The scheme only decides which
-// port is the default, because a CGI does not reliably learn whether the
-// connection was TLS.
-func originMatchesHost(origin, host string) bool {
-	u, err := url.Parse(origin)
-	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") || (u.Path != "" && u.Path != "/") || u.User != nil || u.RawQuery != "" || u.Fragment != "" {
-		return false
-	}
-	return withDefaultPort(u.Host, u.Scheme) == withDefaultPort(host, u.Scheme)
-}
-
-func withDefaultPort(host, scheme string) string {
-	host = strings.ToLower(host)
-	i := strings.LastIndex(host, ":")
-	if i >= 0 && !strings.Contains(host[i:], "]") {
-		return host
-	}
-	if scheme == "https" {
-		return host + ":443"
-	}
-	return host + ":80"
-}

package/assets/go/gateway/csrf_test.go

@@ -1,155 +0,0 @@
-package main
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-// browserPost is what a browser sends for a same-origin fetch to the gateway
-// (httptest requests are addressed to example.com).
-func browserPost(token string) map[string]string {
-	return map[string]string{
-		"Cookie":         "id=abc",
-		"X-SYNO-TOKEN":   token,
-		"Origin":         "http://example.com",
-		"Sec-Fetch-Site": "same-origin",
-	}
-}
-
-func with(hdr map[string]string, kv ...string) map[string]string {
-	out := map[string]string{}
-	for k, v := range hdr {
-		out[k] = v
-	}
-	for i := 0; i < len(kv); i += 2 {
-		if kv[i+1] == "" {
-			delete(out, kv[i])
-		} else {
-			out[kv[i]] = kv[i+1]
-		}
-	}
-	return out
-}
-
-func csrfGateway(t *testing.T) (http.Handler, *upstream) {
-	t.Helper()
-	up := newUpstream(t, hello)
-	return newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up), up
-}
-
-func TestSameOriginStateChangeReachesContainer(t *testing.T) {
-	g, up := csrfGateway(t)
-	cases := map[string]map[string]string{
-		"origin and fetch metadata":                           browserPost("tok"),
-		"origin only (no fetch metadata, e.g. Safari < 16.4)": with(browserPost("tok"), "Sec-Fetch-Site", ""),
-		"fetch metadata only":                                 with(browserPost("tok"), "Origin", ""),
-		"host case and default port":                          with(browserPost("tok"), "Origin", "http://EXAMPLE.com:80"),
-	}
-	for name, hdr := range cases {
-		if w := do(g, "POST", base+"/save", hdr, "x"); w.Code != 200 {
-			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
-		}
-	}
-	if up.hits.Load() != int32(len(cases)) {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-func TestCrossSiteStateChangeIsRefusedBeforeTheContainer(t *testing.T) {
-	g, up := csrfGateway(t)
-	cases := map[string]map[string]string{
-		"foreign origin":                with(browserPost("tok"), "Origin", "https://evil.example", "Sec-Fetch-Site", ""),
-		"foreign origin, claims same":   with(browserPost("tok"), "Origin", "https://evil.example"),
-		"origin null":                   with(browserPost("tok"), "Origin", "null", "Sec-Fetch-Site", ""),
-		"origin is not a URL":           with(browserPost("tok"), "Origin", "::::", "Sec-Fetch-Site", ""),
-		"origin has a path":             with(browserPost("tok"), "Origin", "http://example.com/x", "Sec-Fetch-Site", ""),
-		"same host other port":          with(browserPost("tok"), "Origin", "http://example.com:5001", "Sec-Fetch-Site", ""),
-		"sub-domain of the host":        with(browserPost("tok"), "Origin", "http://evil.example.com", "Sec-Fetch-Site", ""),
-		"fetch metadata cross-site":     with(browserPost("tok"), "Sec-Fetch-Site", "cross-site"),
-		"fetch metadata same-site":      with(browserPost("tok"), "Sec-Fetch-Site", "same-site"),
-		"fetch metadata none":           with(browserPost("tok"), "Sec-Fetch-Site", "none"),
-		"fetch metadata unknown":        with(browserPost("tok"), "Sec-Fetch-Site", "whatever"),
-		"fetch cross-site, origin same": with(browserPost("tok"), "Sec-Fetch-Site", "cross-site", "Origin", "http://example.com"),
-	}
-	for name, hdr := range cases {
-		w := do(g, "POST", base+"/save", hdr, "x")
-		if !refusedAsForbidden(w, "cross_site_blocked") {
-			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-func TestStateChangeWithoutAnyOriginEvidenceIsRefused(t *testing.T) {
-	g, up := csrfGateway(t)
-	hdr := with(browserPost("tok"), "Origin", "", "Sec-Fetch-Site", "")
-	w := do(g, "POST", base+"/save", hdr, "x")
-	if !refusedAsForbidden(w, "cross_site_blocked") || up.hits.Load() != 0 {
-		t.Fatalf("%d %q hits=%d", w.Code, w.Body.String(), up.hits.Load())
-	}
-}
-
-func TestStateChangeNeedsAWellFormedToken(t *testing.T) {
-	g, up := csrfGateway(t)
-	for name, token := range map[string]string{
-		"missing":       "",
-		"too long":      strings.Repeat("a", 257),
-		"control bytes": "to\x01ken",
-		"non ASCII":     "tök",
-	} {
-		hdr := with(browserPost("tok"), "X-SYNO-TOKEN", "")
-		if token != "" {
-			hdr["X-SYNO-TOKEN"] = token
-		}
-		w := do(g, "POST", base+"/save", hdr, "x")
-		if !refusedAsForbidden(w, "token_required") {
-			t.Errorf("%s: %d %q", name, w.Code, w.Body.String())
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-func TestSafeRequestsIgnoreOriginEvidence(t *testing.T) {
-	g, _ := csrfGateway(t)
-	hdr := map[string]string{"Cookie": "id=abc", "Origin": "https://evil.example", "Sec-Fetch-Site": "cross-site"}
-	for _, method := range []string{"GET", "HEAD"} {
-		if w := do(g, method, base+"/", hdr, ""); w.Code != 200 {
-			t.Errorf("%s: %d", method, w.Code)
-		}
-	}
-}
-
-func TestOriginMatchIgnoresDefaultPortsOnly(t *testing.T) {
-	cases := []struct {
-		origin, host string
-		want         bool
-	}{
-		{"http://nas.local:5000", "nas.local:5000", true},
-		{"https://nas.local:5001", "nas.local:5001", true},
-		{"https://nas.local", "nas.local:443", true},
-		{"http://nas.local", "nas.local", true},
-		{"https://nas.local:5001", "nas.local:5000", false},
-		{"http://[::1]:5000", "[::1]:5000", true},
-		{"http://nas.local", "nas.local:5000", false},
-		{"", "nas.local", false},
-	}
-	for _, c := range cases {
-		if got := originMatchesHost(c.origin, c.host); got != c.want {
-			t.Errorf("originMatchesHost(%q, %q) = %v", c.origin, c.host, got)
-		}
-	}
-}
-
-// refusedAsForbidden: the gateway means 403, but DSM would replace a 403 body, so it sends 401
-// with the intended status and the reason in headers.
-func refusedAsForbidden(w *httptest.ResponseRecorder, code string) bool {
-	h := w.Header()
-	return w.Code == http.StatusUnauthorized && h.Get("X-Synopkgland-Status") == "403" &&
-		h.Get("X-Synopkgland-Error") == code && strings.Contains(w.Body.String(), code)
-}

package/assets/go/gateway/directory.go

@@ -1,108 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os/exec"
-	"regexp"
-	"strconv"
-	"strings"
-	"time"
-)
-
-const maxDirectoryOutput = 64 << 10
-const maxDirectoryGroups = 256
-
-// DSM's dynamic /usr/bin/id uses libc NSS; os/user in the static CGI does not.
-// A fixed executable, a single validated username argument and a clean locale
-// environment keep the browser's credentials and process environment out of NSS.
-// No SDK cache: query once per authenticated request, with a two-second limit.
-type directoryLookup struct {
-	timeout time.Duration
-	run     func(context.Context, string, []string, []string) ([]byte, error)
-}
-
-func (d directoryLookup) groups(ctx context.Context, user string) ([]string, error) {
-	if !userName.MatchString(user) || strings.HasPrefix(user, "-") {
-		return nil, errors.New("invalid directory account")
-	}
-	ctx, cancel := context.WithTimeout(ctx, d.timeout)
-	defer cancel()
-	out, err := d.run(ctx, "/usr/bin/id", []string{user}, []string{"LC_ALL=C"})
-	if ctx.Err() != nil {
-		return nil, fmt.Errorf("directory groups: %w", ctx.Err())
-	}
-	if err != nil {
-		return nil, errors.New("directory group lookup failed")
-	}
-	return parseDirectoryGroups(out)
-}
-
-// Bounded stdout also bounds memory if a directory returns an excessive list.
-// Never include command output in errors: it is not a diagnostic credential path.
-type directoryOutput struct{ data []byte }
-
-func (b *directoryOutput) Write(p []byte) (int, error) {
-	if len(p) > maxDirectoryOutput-len(b.data) {
-		return 0, errors.New("directory output exceeds limit")
-	}
-	b.data = append(b.data, p...)
-	return len(p), nil
-}
-func runDirectoryCommand(ctx context.Context, path string, args, env []string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, path, args...)
-	cmd.Env = env
-	cmd.WaitDelay = 100 * time.Millisecond
-	var out directoryOutput
-	cmd.Stdout = &out
-	err := cmd.Run()
-	return out.data, err
-}
-
-var directoryIDLine = regexp.MustCompile(`^uid=([0-9]+)\(([^()\r\n]+)\) gid=([0-9]+)\(([^()\r\n]+)\) groups=([^\r\n]+)\n?$`)
-var directoryGroupEntry = regexp.MustCompile(`^([0-9]+)\(([^()\r\n]+)\)$`)
-
-// Parse full id output, not id -Gn: the latter loses boundaries when AD group
-// names contain spaces (for example VT-NAS\Domain Users). Require every gid to
-// resolve to a bounded valid name, and require the primary group in the list.
-// Unresolved numeric gids, partial/malformed output and ambiguous delimiters deny.
-func parseDirectoryGroups(out []byte) ([]string, error) {
-	invalid := errors.New("incomplete or invalid directory groups")
-	if len(out) > maxDirectoryOutput {
-		return nil, invalid
-	}
-	m := directoryIDLine.FindStringSubmatch(string(out))
-	if m == nil || !validDirectoryID(m[1]) || !validDirectoryID(m[3]) || !userName.MatchString(m[2]) || !groupName.MatchString(m[4]) {
-		return nil, invalid
-	}
-	entries := strings.Split(m[5], ",")
-	if len(entries) > maxDirectoryGroups {
-		return nil, invalid
-	}
-	groups := make([]string, 0, len(entries))
-	seen := map[string]bool{}
-	primary := false
-	for _, entry := range entries {
-		g := directoryGroupEntry.FindStringSubmatch(entry)
-		if g == nil || !validDirectoryID(g[1]) || !groupName.MatchString(g[2]) || seen[g[1]] {
-			return nil, invalid
-		}
-		seen[g[1]] = true
-		if g[1] == m[3] {
-			if g[2] != m[4] {
-				return nil, invalid
-			}
-			primary = true
-		}
-		groups = append(groups, g[2])
-	}
-	if !primary {
-		return nil, invalid
-	}
-	return groups, nil
-}
-func validDirectoryID(value string) bool {
-	n, err := strconv.ParseUint(value, 10, 32)
-	return err == nil && n < 1<<32-1 && strconv.FormatUint(n, 10) == value
-}

package/assets/go/gateway/directory_test.go

@@ -1,202 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"net/http/httptest"
-	"os"
-	"slices"
-	"strings"
-	"testing"
-	"time"
-)
-
-const directoryID = `uid=2969567732(VT-NAS\Administrator) gid=2969567745(VT-NAS\Domain Users) groups=2969567745(VT-NAS\Domain Users),2969567751(VT-NAS\Enterprise Admins)`
-
-func TestDirectoryIdentityUsesNSSIncludingPrimaryAndSupplementaryGroups(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: `VT-NAS\Administrator`})
-	var gotUser string
-	a.directoryGroups = func(ctx context.Context, user string) ([]string, error) {
-		gotUser = user
-		if _, ok := ctx.Deadline(); !ok {
-			t.Fatal("missing deadline")
-		}
-		return parseDirectoryGroups([]byte(directoryID))
-	}
-	id, err := a.Authenticate(sessionRequest())
-	if err != nil || gotUser != `VT-NAS\Administrator` || !slices.Equal(id.Groups, []string{`VT-NAS\Domain Users`, `VT-NAS\Enterprise Admins`}) {
-		t.Fatalf("id=%+v user=%q err=%v", id, gotUser, err)
-	}
-}
-
-func TestLocalIdentityNeverNeedsDirectoryLookup(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: "alice"})
-	a.directoryGroups = func(context.Context, string) ([]string, error) {
-		t.Fatal("directory lookup for local account")
-		return nil, nil
-	}
-	id, err := a.Authenticate(sessionRequest())
-	if err != nil || !slices.Contains(id.Groups, "staff") {
-		t.Fatalf("id=%+v err=%v", id, err)
-	}
-}
-
-func TestDirectoryFailureCannotFallBackToLocalMemberLists(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: `OTHER\alice`})
-	if err := os.WriteFile(a.groupFile, []byte("staff:x:1030:OTHER\\alice\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	a.directoryGroups = func(context.Context, string) ([]string, error) { return nil, errors.New("directory unavailable") }
-	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, errNoSession) {
-		t.Fatalf("err=%v", err)
-	}
-}
-
-func TestDirectoryMembershipAndSessionAreRecheckedEachRequest(t *testing.T) {
-	runner := &fakeRunner{out: `VT-NAS\Administrator`}
-	a := newTestAuth(t, runner)
-	calls := 0
-	a.directoryGroups = func(context.Context, string) ([]string, error) {
-		calls++
-		if calls == 1 {
-			return []string{`VT-NAS\Domain Users`}, nil
-		}
-		return []string{`VT-NAS\Other`}, nil
-	}
-	id, _ := a.Authenticate(sessionRequest())
-	if !slices.Contains(id.Groups, `VT-NAS\Domain Users`) {
-		t.Fatal(id)
-	}
-	id, _ = a.Authenticate(sessionRequest())
-	if slices.Contains(id.Groups, `VT-NAS\Domain Users`) || calls != 2 {
-		t.Fatal(id, calls)
-	}
-	runner.err = &exitError{}
-	if _, err := a.Authenticate(sessionRequest()); !errors.Is(err, errNoSession) || calls != 2 {
-		t.Fatal(err, calls)
-	}
-}
-
-func TestNSSParserPreservesQualifiedNamesAndFailsClosed(t *testing.T) {
-	for _, text := range []string{directoryID + "\n", `uid=123(alice@example.test) gid=200(staff@example.test) groups=200(staff@example.test),201(Domain Users@example.test)`} {
-		groups, err := parseDirectoryGroups([]byte(text))
-		if err != nil || len(groups) != 2 {
-			t.Fatalf("groups=%q err=%v", groups, err)
-		}
-	}
-	for _, text := range []string{"", "100 101", `uid=1(alice) gid=2(staff) groups=2`, `uid=1(alice) gid=2(staff) groups=3(ops)`, `uid=1(alice) gid=2(staff) groups=2(staff),3`, `uid=1(alice) gid=2(staff) groups=2(staff),3(bad(name))`, directoryID + "\n" + directoryID, `uid=1(alice) gid=2(staff) groups=2(staff),2(ops)`} {
-		if _, err := parseDirectoryGroups([]byte(text)); err == nil {
-			t.Fatalf("accepted %q", text)
-		}
-	}
-}
-
-func TestDirectoryCommandIsBoundedAndHasNoSessionEnvironment(t *testing.T) {
-	var gotPath string
-	var gotArgs, gotEnv []string
-	lookup := directoryLookup{timeout: 20 * time.Millisecond, run: func(ctx context.Context, path string, args, env []string) ([]byte, error) {
-		gotPath, gotArgs, gotEnv = path, args, env
-		if _, ok := ctx.Deadline(); !ok {
-			t.Fatal("missing deadline")
-		}
-		return []byte(directoryID), nil
-	}}
-	if _, err := lookup.groups(context.Background(), `VT-NAS\Administrator`); err != nil {
-		t.Fatal(err)
-	}
-	if gotPath != "/usr/bin/id" || !slices.Equal(gotArgs, []string{`VT-NAS\Administrator`}) || !slices.Equal(gotEnv, []string{"LC_ALL=C"}) {
-		t.Fatal(gotPath, gotArgs, gotEnv)
-	}
-	for _, user := range []string{"", "-G", "--help", "alice\nadmin", "alice;id"} {
-		gotPath = ""
-		if _, err := lookup.groups(context.Background(), user); err == nil || gotPath != "" {
-			t.Fatal(user, err, gotPath)
-		}
-	}
-	lookup.run = func(ctx context.Context, _ string, _, _ []string) ([]byte, error) {
-		<-ctx.Done()
-		return nil, ctx.Err()
-	}
-	if _, err := lookup.groups(context.Background(), "alice"); !errors.Is(err, context.DeadlineExceeded) {
-		t.Fatal(err)
-	}
-}
-
-func TestDirectoryRulesKeepTheDomainAndExactCase(t *testing.T) {
-	for _, name := range []string{`VT-NAS\Domain Users`, `Domain Users@example.test`, `DOMAIN\staff`, `staff@example.test`} {
-		cfg := config{Upstream: "127.0.0.1:1", Access: accessGroups, Groups: []string{name}}
-		g, err := newGateway(cfg, &fakeAuth{})
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !g.permits(identity{Groups: []string{name}}) {
-			t.Fatal(name)
-		}
-		for _, other := range []string{"Domain Users", "staff", `OTHER\Domain Users`, `VT-NAS\domain users`} {
-			if other != name && g.permits(identity{Groups: []string{other}}) {
-				t.Fatal(name, other)
-			}
-		}
-	}
-	g := &gateway{cfg: config{Access: accessAdmins}}
-	if g.permits(identity{Groups: []string{`DOMAIN\administrators`}}) {
-		t.Fatal("domain group became a local administrator")
-	}
-}
-
-func TestDirectoryLookupFailureNeverReachesUpstream(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: `DOMAIN\alice`})
-	a.directoryGroups = func(context.Context, string) ([]string, error) { return nil, errors.New("offline") }
-	g, err := newGateway(config{Upstream: "127.0.0.1:1", Access: accessGroups, Groups: []string{`DOMAIN\staff`}}, a)
-	if err != nil {
-		t.Fatal(err)
-	}
-	w := httptest.NewRecorder()
-	g.ServeHTTP(w, sessionRequest())
-	if w.Header().Get("X-Synopkgland-Error") != "auth_unavailable" {
-		t.Fatal(w.Code, w.Body.String())
-	}
-}
-
-func TestDirectoryIdentitySupportsQualifiedAccountLength(t *testing.T) {
-	user := "DOMAIN\\" + strings.Repeat("a", 100)
-	a := newTestAuth(t, &fakeRunner{out: user})
-	a.directoryGroups = func(context.Context, string) ([]string, error) { return []string{`DOMAIN\staff`}, nil }
-	id, err := a.Authenticate(sessionRequest())
-	if err != nil || id.User != user {
-		t.Fatal(id, err)
-	}
-}
-
-func TestNSSParserBoundsIDsGroupsAndOutput(t *testing.T) {
-	base := `uid=1(alice) gid=2(staff) groups=2(staff)`
-	for _, text := range []string{strings.Replace(base, "uid=1", "uid=4294967295", 1), strings.Replace(base, "gid=2", "gid=4294967296", 1), base + strings.Repeat(",3(ops)", 256), base + strings.Repeat(" ", maxDirectoryOutput), strings.Replace(base, "2(staff)", "02(staff)", -1)} {
-		if _, err := parseDirectoryGroups([]byte(text)); err == nil {
-			t.Fatal("accepted out-of-bounds output")
-		}
-	}
-	var output directoryOutput
-	if _, err := output.Write(make([]byte, maxDirectoryOutput)); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := output.Write([]byte{1}); err == nil || len(output.data) != maxDirectoryOutput {
-		t.Fatal("output not bounded")
-	}
-}
-
-func TestNSSNonzeroExitAndCancellationDiscardEvenValidGroups(t *testing.T) {
-	for _, cancelled := range []bool{false, true} {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
-		d := directoryLookup{timeout: time.Second, run: func(context.Context, string, []string, []string) ([]byte, error) {
-			if cancelled {
-				cancel()
-				return []byte(directoryID), nil
-			}
-			return []byte(directoryID), errors.New("exit 1")
-		}}
-		if groups, err := d.groups(ctx, `VT-NAS\Administrator`); err == nil || len(groups) != 0 {
-			t.Fatal(groups, err)
-		}
-	}
-}