@synopackageland/cli 0.3.10 → 0.4.0

package/templates/native-go/backend/internal/app/routes_test.go

@@ -0,0 +1,167 @@
+package app
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"dsmapp/internal/api"
+)
+
+type stubAuth struct {
+	identity api.Identity
+	err      error
+}
+
+func (s stubAuth) Authenticate(*http.Request) (api.Identity, error) { return s.identity, s.err }
+
+func testConfig(t *testing.T) Config {
+	return Config{PackageID: "HelloGo", Version: "0.1.0-0001", DataDir: t.TempDir()}
+}
+
+// call returns the envelope's error code ("" on success) and the envelope.
+func call(t *testing.T, cfg Config, auth api.Authenticator, method, params string) (string, map[string]any) {
+	t.Helper()
+	srv, err := api.NewServer(auth, Routes(cfg)...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := `{"method":"` + method + `","params":` + params + `}`
+	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, req)
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatalf("not JSON: %s", rec.Body.String())
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("HTTP %d: DSM replaces non-200 CGI bodies", rec.Code)
+	}
+	code := ""
+	if e, ok := out["error"].(map[string]any); ok {
+		code, _ = e["code"].(string)
+	}
+	return code, out
+}
+
+var (
+	alice  = stubAuth{identity: api.Identity{User: "alice", Admin: true}}
+	bob    = stubAuth{identity: api.Identity{User: "bob"}}
+	nobody = stubAuth{err: api.ErrNoSession}
+)
+
+// sampleParams holds valid params for every route, so the denial test below
+// proves the refusal came from the policy and not from bad input.
+var sampleParams = map[string]string{
+	"integration.status": `{}`,
+	"app.status":         `{}`,
+	"greeting.get":       `{}`,
+	"greeting.set":       `{"text":"Hi"}`,
+}
+
+func TestIntegrationStatusIsReadableByOrdinaryUsers(t *testing.T) {
+	code, out := call(t, testConfig(t), bob, "integration.status", `{}`)
+	if code != "" || out["data"].(map[string]any)["state"] != "not-enabled" {
+		t.Fatalf("%s: %v", code, out)
+	}
+	code, _ = call(t, testConfig(t), bob, "integration.status", `{"state":"ready"}`)
+	if code != "bad_request" {
+		t.Fatal("browser cannot supply readiness")
+	}
+}
+
+func TestEveryRouteHasSampleParamsAndNoneIsPublic(t *testing.T) {
+	routes := Routes(testConfig(t))
+	if len(routes) != len(sampleParams) {
+		t.Fatalf("%d routes but %d sample params: add the new route to sampleParams", len(routes), len(sampleParams))
+	}
+	for _, r := range routes {
+		if _, ok := sampleParams[r.Method()]; !ok {
+			t.Errorf("route %s has no sample params", r.Method())
+		}
+		if r.Public() {
+			t.Errorf("route %s is public; this template ships none", r.Method())
+		}
+	}
+}
+
+func TestEveryRouteRefusesCallersWithoutASessionAndChangesNothing(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, nobody, r.Method(), sampleParams[r.Method()])
+		if code != "session_required" {
+			t.Errorf("%s: %q, want session_required", r.Method(), code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func TestEveryAdminRouteRefusesOrdinaryUsersAndChangesNothing(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		if !r.AdminOnly() {
+			continue
+		}
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, bob, r.Method(), sampleParams[r.Method()])
+		if code != "admin_required" {
+			t.Errorf("%s: %q, want admin_required", r.Method(), code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func TestEveryRouteSucceedsForAnAdmin(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		code, out := call(t, testConfig(t), alice, r.Method(), sampleParams[r.Method()])
+		if code != "" {
+			t.Errorf("%s: %q %v", r.Method(), code, out)
+		}
+	}
+}
+
+func TestStatusReportsPackageAndCaller(t *testing.T) {
+	code, out := call(t, testConfig(t), bob, "app.status", `{}`)
+	data := out["data"].(map[string]any)
+	if code != "" || data["package"] != "HelloGo" || data["version"] != "0.1.0-0001" || data["user"] != "bob" || data["admin"] != false {
+		t.Fatalf("got %q %v", code, out)
+	}
+}
+
+func TestGreetingDefaultsAndAdminCanChangeIt(t *testing.T) {
+	cfg := testConfig(t)
+	_, out := call(t, cfg, bob, "greeting.get", `{}`)
+	if got := out["data"].(map[string]any)["text"]; got != "Hello" {
+		t.Fatalf("default greeting = %v", got)
+	}
+	if code, out := call(t, cfg, alice, "greeting.set", `{"text":"Hi from DSM"}`); code != "" {
+		t.Fatalf("set: %q %v", code, out)
+	}
+	_, out = call(t, cfg, bob, "greeting.get", `{}`)
+	data := out["data"].(map[string]any)
+	if data["text"] != "Hi from DSM" || data["updated_by"] != "alice" {
+		t.Fatalf("after set: %v", data)
+	}
+}
+
+func TestGreetingSetValidatesText(t *testing.T) {
+	for _, params := range []string{`{}`, `{"text":""}`, `{"text":"` + strings.Repeat("x", 201) + `"}`, `{"text":7}`, `{"text":"ok","extra":1}`} {
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, alice, "greeting.set", params)
+		if code != "bad_request" {
+			t.Errorf("%s: %q, want bad_request", params, code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func assertDataDirEmpty(t *testing.T, cfg Config) {
+	t.Helper()
+	entries, err := os.ReadDir(cfg.DataDir)
+	if err != nil || len(entries) != 0 {
+		t.Fatalf("data dir changed: %v %v", entries, err)
+	}
+}

package/templates/native-go/backend/internal/dsm/auth.go

@@ -0,0 +1,118 @@
+// Package dsm verifies the DSM login behind a package CGI request.
+//
+// DSM runs a package's CGI as the package account and forwards the browser's
+// cookies. This package hands only the session carriers (cookie, SynoToken,
+// client address) to DSM's own authenticate.cgi, which prints the signed-in
+// user name, then reads administrators membership from DSM's group file. It
+// never parses the session cookie or trusts a user name from the request.
+package dsm
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"os/exec"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+// AuthenticateCGI is DSM's session check for third-party CGIs.
+const AuthenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
+
+// Authenticator implements api.Authenticator against DSM.
+type Authenticator struct {
+	GroupFile  string
+	AdminGroup string
+	Timeout    time.Duration
+	run        func(ctx context.Context, path string, env []string) ([]byte, error)
+}
+
+func NewAuthenticator() *Authenticator {
+	return &Authenticator{
+		GroupFile:  "/etc/group",
+		AdminGroup: "administrators",
+		Timeout:    10 * time.Second,
+		run:        runCGI,
+	}
+}
+
+var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,64}$`)
+
+func (a *Authenticator) Authenticate(r *http.Request) (api.Identity, error) {
+	cookie := r.Header.Get("Cookie")
+	if cookie == "" {
+		return api.Identity{}, api.ErrNoSession
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), a.Timeout)
+	defer cancel()
+	out, err := a.run(ctx, AuthenticateCGI, sessionEnv(r, cookie))
+	var exit interface{ ExitCode() int }
+	if errors.As(err, &exit) {
+		return api.Identity{}, api.ErrNoSession
+	}
+	if err != nil {
+		return api.Identity{}, fmt.Errorf("run %s: %w", AuthenticateCGI, err)
+	}
+	user := strings.TrimSpace(string(out))
+	if !userName.MatchString(user) {
+		return api.Identity{}, api.ErrNoSession
+	}
+	admin, err := a.isMember(user)
+	if err != nil {
+		return api.Identity{}, err
+	}
+	return api.Identity{User: user, Admin: admin}, nil
+}
+
+// sessionEnv is the complete environment authenticate.cgi sees: nothing from
+// this process and no request header besides the session carriers.
+func sessionEnv(r *http.Request, cookie string) []string {
+	token := r.Header.Get("X-SYNO-TOKEN")
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	return []string{
+		"REQUEST_METHOD=GET",
+		"HTTP_COOKIE=" + cookie,
+		"HTTP_X_SYNO_TOKEN=" + token,
+		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
+		"REMOTE_ADDR=" + host,
+	}
+}
+
+func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path)
+	cmd.Env = env
+	return cmd.Output()
+}
+
+// isMember reads the group file fresh on every request, so removing someone
+// from administrators takes effect immediately.
+func (a *Authenticator) isMember(user string) (bool, error) {
+	f, err := os.Open(a.GroupFile)
+	if err != nil {
+		return false, fmt.Errorf("read groups: %w", err)
+	}
+	defer f.Close()
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Split(scanner.Text(), ":")
+		if len(fields) == 4 && fields[0] == a.AdminGroup {
+			return slices.Contains(strings.Split(fields[3], ","), user), nil
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return false, fmt.Errorf("read groups: %w", err)
+	}
+	return false, nil
+}

package/templates/native-go/backend/internal/dsm/auth_test.go

@@ -0,0 +1,139 @@
+package dsm
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"dsmapp/internal/api"
+)
+
+const groupFile = `root:x:0:
+users:x:100:
+administrators:x:101:admin,alice
+http:x:1023:
+`
+
+type fakeRunner struct {
+	out  string
+	err  error
+	env  []string
+	path string
+}
+
+func (f *fakeRunner) run(_ context.Context, path string, env []string) ([]byte, error) {
+	f.path, f.env = path, env
+	return []byte(f.out), f.err
+}
+
+func newTestAuth(t *testing.T, runner *fakeRunner) *Authenticator {
+	t.Helper()
+	groups := filepath.Join(t.TempDir(), "group")
+	if err := os.WriteFile(groups, []byte(groupFile), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	a := NewAuthenticator()
+	a.GroupFile = groups
+	a.run = runner.run
+	return a
+}
+
+func sessionRequest() *http.Request {
+	r := httptest.NewRequest(http.MethodPost, "/webman/3rdparty/App/cgi/api.cgi", nil)
+	r.RemoteAddr = "192.0.2.7:51234"
+	r.Header.Set("Cookie", "id=abc; did=xyz")
+	r.Header.Set("X-SYNO-TOKEN", "tok+en/=")
+	r.Header.Set("User-Agent", "should-not-pass")
+	return r
+}
+
+func TestAdminUserIsResolvedFromAuthenticateCGIAndGroupFile(t *testing.T) {
+	runner := &fakeRunner{out: "alice\n"}
+	id, err := newTestAuth(t, runner).Authenticate(sessionRequest())
+	if err != nil || id.User != "alice" || !id.Admin {
+		t.Fatalf("got %+v, %v", id, err)
+	}
+	if runner.path != AuthenticateCGI {
+		t.Errorf("ran %q", runner.path)
+	}
+}
+
+func TestOrdinaryUserIsNotAdmin(t *testing.T) {
+	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
+	if err != nil || id.User != "bob" || id.Admin {
+		t.Fatalf("got %+v, %v", id, err)
+	}
+}
+
+func TestOnlySessionCarriersReachAuthenticateCGI(t *testing.T) {
+	runner := &fakeRunner{out: "alice"}
+	if _, err := newTestAuth(t, runner).Authenticate(sessionRequest()); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"HTTP_COOKIE=id=abc; did=xyz",
+		"HTTP_X_SYNO_TOKEN=tok+en/=",
+		"QUERY_STRING=SynoToken=tok%2Ben%2F%3D",
+		"REMOTE_ADDR=192.0.2.7",
+		"REQUEST_METHOD=GET",
+	}
+	got := slices.Clone(runner.env)
+	slices.Sort(got)
+	if !slices.Equal(got, want) {
+		t.Fatalf("env = %q\nwant  %q", got, want)
+	}
+}
+
+func TestMissingCookieNeverRunsAuthenticateCGI(t *testing.T) {
+	runner := &fakeRunner{out: "alice"}
+	r := sessionRequest()
+	r.Header.Del("Cookie")
+	_, err := newTestAuth(t, runner).Authenticate(r)
+	if !errors.Is(err, api.ErrNoSession) || runner.path != "" {
+		t.Fatalf("err=%v ran=%q", err, runner.path)
+	}
+}
+
+func TestRejectedOrMalformedSessionsAreNoSession(t *testing.T) {
+	for name, runner := range map[string]*fakeRunner{
+		"exit status":   {err: &exitError{}},
+		"empty output":  {out: "\n"},
+		"two lines":     {out: "alice\nadmin\n"},
+		"html output":   {out: "<html>login</html>"},
+		"overlong name": {out: strings.Repeat("a", 200)},
+		"space in name": {out: "alice admin"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := newTestAuth(t, runner).Authenticate(sessionRequest())
+			if !errors.Is(err, api.ErrNoSession) {
+				t.Fatalf("err = %v", err)
+			}
+		})
+	}
+}
+
+func TestBrokenAuthenticatorIsUnavailableNotNoSession(t *testing.T) {
+	_, err := newTestAuth(t, &fakeRunner{err: errors.New("exec: not found")}).Authenticate(sessionRequest())
+	if err == nil || errors.Is(err, api.ErrNoSession) {
+		t.Fatalf("err = %v", err)
+	}
+}
+
+func TestUnreadableGroupFileFailsClosed(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: "alice"})
+	a.GroupFile = filepath.Join(t.TempDir(), "missing")
+	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, api.ErrNoSession) {
+		t.Fatalf("err = %v, want unavailable", err)
+	}
+}
+
+type exitError struct{}
+
+func (*exitError) Error() string { return "exit status 1" }
+func (*exitError) ExitCode() int { return 1 }

package/templates/native-go/backend/internal/helper/control.go

@@ -0,0 +1,219 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+// Process identity rejects reboot/PID reuse and executable replacement.
+// Linux Stop authenticates the owning supervisor socket; only that parent signals its child.
+type Process struct {
+	Inventory Inventory `json:"inventory"`
+	Mode      string    `json:"mode,omitempty"` // must be supervised; old unsupervised records fail closed
+	PID       int       `json:"pid"`
+	Boot      string    `json:"boot"`
+	Start     string    `json:"start"`
+	Device    uint64    `json:"device"`
+	Inode     uint64    `json:"inode"`
+}
+
+type Processes interface {
+	Stop(Process) error
+	Start(Inventory) error
+}
+type Controller struct {
+	Client
+	Processes Processes
+}
+
+func waitHealthy(ctx context.Context, probe func(context.Context) bool) error {
+	for ctx.Err() == nil {
+		if probe(ctx) {
+			return nil
+		}
+		timer := time.NewTimer(20 * time.Millisecond)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return ctx.Err()
+		case <-timer.C:
+		}
+	}
+	return ctx.Err()
+}
+
+func writeProtected(dir, name string, value any) error {
+	b, err := json.Marshal(value)
+	if err != nil {
+		return err
+	}
+	f, err := os.CreateTemp(dir, ".transition-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(f.Name())
+	mode := fs.FileMode(0644)
+	if name == "process.json" {
+		mode = 0600
+	}
+	if err := f.Chmod(mode); err != nil {
+		f.Close()
+		return err
+	}
+	if _, err := f.Write(b); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(f.Name(), filepath.Join(dir, name)); err != nil {
+		return err
+	}
+	d, err := os.Open(dir)
+	if err != nil {
+		return err
+	}
+	defer d.Close()
+	return d.Sync()
+}
+
+func writeProcess(dir string, p Process) error { return writeProtected(dir, "process.json", p) }
+
+func readProcess(dir string, owner uint32) (Process, error) {
+	var p Process
+	if err := protected(dir, owner, true); err != nil {
+		return p, err
+	}
+	path := filepath.Join(dir, "process.json")
+	if err := protected(path, owner, false); err != nil {
+		return p, err
+	}
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return p, err
+	}
+	defer f.Close()
+	d := json.NewDecoder(io.LimitReader(f, 4097))
+	d.DisallowUnknownFields()
+	if d.Decode(&p) != nil || d.Decode(new(any)) != io.EOF || !p.Inventory.Valid() || p.Mode != "supervised" || p.PID <= 1 || p.Boot == "" || p.Start == "" || p.Inode == 0 {
+		return p, errTrust
+	}
+	return p, nil
+}
+
+// Control is called only by the verified root executable from a fixed DSM
+// task. Package hooks and CGI handlers never call this function.
+func (c Controller) Control(ctx context.Context, action string) error {
+	if ctx.Err() != nil {
+		return ctx.Err()
+	}
+	if action != "enable" && action != "recover" && action != "teardown" && action != "disable" {
+		return errors.New("unsupported lifecycle action")
+	}
+	if !c.Expected.Valid() || c.Processes == nil {
+		return errTrust
+	}
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if err := protected(f.Name(), c.Owner, false); err != nil {
+		return err
+	}
+	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+		return errors.New("lifecycle busy")
+	}
+	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	if action == "recover" && (err != nil || !r.Enabled) {
+		return errors.New("explicit enable approval required")
+	}
+	if err != nil {
+		r = Record{Inventory: c.Expected}
+	}
+	if action == "disable" {
+		r.Enabled = false
+	}
+	// Publish the durable gate first. A crashed/failed disable still refuses
+	// requests and exposes required cleanup; never report cleanup as successful.
+	r.Residual = true
+	if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+		return err
+	}
+	if err := c.teardown(); err != nil {
+		return err
+	}
+	if action == "enable" || action == "recover" {
+		r = Record{Inventory: c.Expected, Enabled: true, Residual: true}
+		if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+			return err
+		}
+		if err := c.Processes.Start(c.Expected); err != nil {
+			return err
+		}
+	}
+	r.Residual = false
+	return writeProtected(c.StateDir, "approval.json", r)
+}
+
+func (c Controller) teardown() error {
+	p, err := readProcess(c.RunDir, c.Owner)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	if err == nil {
+		if p.Inventory.Package != c.Expected.Package {
+			return errTrust
+		}
+		if err := c.Processes.Stop(p); err != nil {
+			return err
+		}
+	}
+	for _, name := range []string{"helper.sock", "supervisor.sock"} {
+		path := filepath.Join(c.RunDir, name)
+		st, e := os.Lstat(path)
+		if e == nil {
+			s, ok := st.Sys().(*syscall.Stat_t)
+			if !ok || s.Uid != c.Owner || st.Mode()&os.ModeSocket == 0 || st.Mode().Perm()&0002 != 0 {
+				return errTrust
+			}
+			conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
+			if err == nil {
+				conn.Close()
+				return errors.New("unidentified live socket")
+			}
+			if !errors.Is(err, syscall.ECONNREFUSED) && !errors.Is(err, fs.ErrNotExist) {
+				return err
+			}
+			if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+				return err
+			}
+		} else if !errors.Is(e, fs.ErrNotExist) {
+			return e
+		}
+	}
+	if err == nil {
+		return os.Remove(filepath.Join(c.RunDir, "process.json"))
+	}
+	return nil
+}