@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/helper/write_operation_linux.go

@@ -0,0 +1,245 @@
+package helper
+
+import (
+	"context"
+	"io"
+	"net"
+	"os"
+	"time"
+)
+
+type linuxWriteOperation struct {
+	*linuxOperation
+	writeWork      writeWork
+	receipt        MutationReceipt
+	resultCode     Code
+	ready          bool
+	resultReleased bool
+}
+
+func startLinuxWriteOperation(c Client, binary string, a NativeActor, b operationBinding, pin *pinnedReadOnlyRoot, w writeWork, input net.Conn) (operationProcess, error) {
+	if w.validate() != "" || pin == nil || pin.path != w.RootPath {
+		return nil, ErrDenied
+	}
+	w.Segments = append([]string{}, w.Segments...)
+	return startLinuxOperationWork(c, binary, a, b, input, pin, nil, &w)
+}
+func (p *linuxWriteOperation) idle() (bool, error) {
+	idle, e := p.linuxOperation.idle()
+	if p.result != nil && p.result.Mutation != nil {
+		p.receipt = *p.result.Mutation
+		p.resultCode = p.result.Code
+		p.ready = true
+		p.result = nil
+	}
+	return idle, e
+}
+func (p *linuxWriteOperation) mutationResult() (MutationReceipt, Code, bool) {
+	idle, e := p.idle()
+	if e != nil {
+		return p.receipt, ErrCleanupRequired, false
+	}
+	return p.receipt, p.resultCode, p.ready && idle
+}
+func (p *linuxWriteOperation) chunk(n uint32) error { return p.chunkWithActor(n, NativeActor{}) }
+func (p *linuxWriteOperation) chunkWithActor(n uint32, a NativeActor) error {
+	if !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) {
+		return ErrStale
+	}
+	return p.beginWrite(a, n, false)
+}
+func (p *linuxWriteOperation) commitWithActor(a NativeActor) error { return p.beginWrite(a, 0, true) }
+func (p *linuxWriteOperation) beginWrite(a NativeActor, n uint32, commit bool) error {
+	idle, e := p.idle()
+	if e != nil {
+		return e
+	}
+	if !idle || p.closed || !p.ready || p.resultCode != "" || p.finishSent || !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) || !commit && (n == 0 || n > MaxChunkBytes) {
+		return errTrust
+	}
+	p.proofDeadline = a.account.CheckedAt.Add(NativeProofFreshness)
+	p.sequence++
+	lease := operationLease{Token: p.token, Sequence: p.sequence, Bytes: n, SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef(), ProofDeadline: p.proofDeadline.UnixNano(), Commit: commit}
+	info, e := openOperationFDInfo(p.process.Pid)
+	if e != nil {
+		return e
+	}
+	done := make(chan operationRelayOutcome, 1)
+	p.pending = done
+	p.ready = false
+	control, data, input := p.control, p.data, p.output
+	boot, w := p.bootstrap, p.writeWork
+	sequence, mounts, deadline := p.sequence, p.mountSequence, p.proofDeadline
+	previous := p.receipt
+	results := make(chan readOnlyPacketOutcome, 1)
+	p.resultPending = results
+	// One outstanding lease. Read only the admitted bytes from the fixed binary
+	// input, then hand them to the actor. No bytes or file descriptors enter JSON.
+	go func() {
+		var e error
+		if !commit {
+			e = input.SetReadDeadline(deadline)
+			buffer := make([]byte, n)
+			if e == nil {
+				_, e = io.ReadFull(input, buffer)
+			}
+			if e == nil {
+				e = writeOperationPacket(control, lease)
+			}
+			if e == nil {
+				var written int
+				written, e = data.Write(buffer)
+				if e == nil && written != len(buffer) {
+					e = io.ErrShortWrite
+				}
+			}
+		} else {
+			e = writeOperationPacket(control, lease)
+		}
+		outcome := readOnlyPacketOutcome{}
+		if e == nil {
+			outcome = receiveWriteProof(control, info, boot, w, p.process.Pid, mounts, sequence, time.Until(deadline))
+			e = outcome.err
+			if e == nil {
+				m := outcome.result.Mutation
+				upper := previous.BytesWritten + uint64(n)
+				if commit {
+					upper = previous.BytesWritten
+				}
+				if m.BytesWritten < previous.BytesWritten || m.BytesWritten > upper || outcome.result.Code == "" && m.BytesWritten != upper || !commit && (m.Published || m.Committed) {
+					e = errTrust
+				}
+			}
+		}
+		if closeErr := info.Close(); e == nil {
+			e = closeErr
+		}
+		outcome.err = e
+		results <- outcome
+		done <- operationRelayOutcome{err: e, mountSequence: outcome.mountSequence}
+	}()
+	if commit {
+		p.finishSent = true
+	}
+	return nil
+}
+func receiveWriteProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w writeWork, pid int, mounts, sequence uint64, timeout time.Duration) readOnlyPacketOutcome {
+	deadline := time.Now().Add(timeout)
+	for {
+		var packet readOnlyPacket
+		cred, e := readOperationPacketBound(control, &packet, MaxControlBytes, time.Until(deadline))
+		if e != nil {
+			return readOnlyPacketOutcome{err: e}
+		}
+		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		if packet.Result != nil {
+			r := packet.Result
+			m := r.Mutation
+			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != sequence || m == nil || m.EffectsUnknown || m.BytesWritten > w.MaxBytes || m.Committed && !m.Published || m.Published && !m.Created || r.Bytes != 0 || r.Entry != nil || r.List != nil || r.Code != "" && !r.Code.Valid() {
+				return readOnlyPacketOutcome{err: errTrust}
+			}
+			return readOnlyPacketOutcome{result: r, mountSequence: mounts}
+		}
+		if packet.MountFD == nil || packet.ChunkSequence != 0 || packet.MountSequence != mounts+1 || mounts >= maxReadOnlyMountQueries {
+			return readOnlyPacketOutcome{err: errTrust}
+		}
+		mounts++
+		id, c := operationFDInfoMount(info, *packet.MountFD)
+		if e := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: mounts, Mount: id, Code: c}); e != nil {
+			return readOnlyPacketOutcome{err: e}
+		}
+	}
+}
+func operationWriteChild(ctx context.Context, control *net.UnixConn, boot operationBootstrap) error {
+	w := *boot.Write
+	witness := os.NewFile(6, "write-root-witness")
+	if witness == nil {
+		return errTrust
+	}
+	defer witness.Close()
+	input := os.NewFile(5, "write-input")
+	if input == nil {
+		return errTrust
+	}
+	defer input.Close()
+	operationMountIDFallback = operationMountIDProxy(control, boot)
+	pin := &pinnedReadOnlyRoot{path: w.RootPath, file: witness}
+	x, c := openActorWriteTransfer(ctx, pin, w, operationReadOnlyACL)
+	receipt := MutationReceipt{}
+	if x != nil {
+		defer x.Close()
+		receipt = x.Receipt()
+	}
+	send := func(sequence uint64, r MutationReceipt, c Code) error {
+		return writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, ChunkSequence: sequence, Result: &readOnlyResult{Code: c, Mutation: &r}}, MaxControlBytes)
+	}
+	if e := send(0, receipt, c); e != nil {
+		return e
+	}
+	if c != "" {
+		return awaitReadOnlyFinish(control, boot.Token)
+	}
+	var sequence, total uint64
+	for {
+		var lease operationLease
+		timeout := BoundedTimeout
+		if w.Staged {
+			timeout = StreamIdleTimeout
+		}
+		if deadline, ok := ctx.Deadline(); ok && time.Until(deadline) < timeout {
+			timeout = time.Until(deadline)
+		}
+		if _, e := readOperationPacketBound(control, &lease, MaxHealthBytes, timeout); e != nil {
+			return e
+		}
+		if lease.Token != boot.Token || lease.Sequence != sequence+1 || lease.SubjectRef != boot.SubjectRef || lease.SessionRef != boot.SessionRef || lease.ProofDeadline == 0 {
+			return errTrust
+		}
+		proofDeadline := time.Unix(0, lease.ProofDeadline)
+		if !time.Now().Before(proofDeadline) || time.Until(proofDeadline) > NativeProofFreshness {
+			return ErrStale
+		}
+		proofCtx, cancel := context.WithDeadline(ctx, proofDeadline)
+		sequence++
+		var r MutationReceipt
+		if lease.Commit {
+			if lease.Bytes != 0 {
+				cancel()
+				return errTrust
+			}
+			r, c = x.Commit(proofCtx)
+		} else {
+			if lease.Bytes == 0 || lease.Bytes > MaxChunkBytes || total+uint64(lease.Bytes) > w.MaxBytes {
+				cancel()
+				return errTrust
+			}
+			b := make([]byte, lease.Bytes)
+			input.SetReadDeadline(proofDeadline)
+			if _, e := io.ReadFull(input, b); e != nil {
+				cancel()
+				return e
+			}
+			total += uint64(lease.Bytes)
+			r, c = x.WriteChunk(proofCtx, b)
+		}
+		cancel()
+		if e := send(sequence, r, c); e != nil {
+			return e
+		}
+		// Retain lifetime/FDs until parent acknowledges or drains; receipt available
+		// even for partial effects. No named file is automatically cleaned up.
+		if lease.Commit || c != "" {
+			return awaitReadOnlyFinish(control, boot.Token)
+		}
+	}
+}
+
+func (p *linuxWriteOperation) releaseWriteResult() error {
+	if p.resultReleased {
+		return nil
+	}
+	p.resultReleased = true
+	return writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
+}

package/templates/native-go/backend/internal/helper/write_test.go

@@ -0,0 +1,53 @@
+package helper
+
+import "testing"
+
+func TestWriteGatesDefaultDenyAndPublishIsIndependent(t *testing.T) {
+	for _, tc := range []struct {
+		gates   writeGates
+		action  Action
+		allowed bool
+	}{
+		{writeGates{}, ActionCreate, false}, {writeGates{}, ActionWriteStream, false},
+		{writeGates{Create: true}, ActionCreate, true}, {writeGates{Create: true}, ActionWriteStream, false},
+		{writeGates{Stream: true}, ActionWriteStream, false}, {writeGates{Create: true, Stream: true}, ActionWriteStream, false},
+		{writeGates{Create: true, Stream: true, Publish: true}, ActionWriteStream, true},
+		{writeGates{Publish: true}, ActionPublish, false}, {writeGates{Create: true, Publish: true}, ActionPublish, true},
+	} {
+		if tc.gates.allows(tc.action) != tc.allowed {
+			t.Fatal(tc)
+		}
+	}
+}
+func TestWriteWorkRejectsPathsLimitsAndUngatedStage(t *testing.T) {
+	valid := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: MaxBoundedBytes}
+	if c := valid.validate(); c != "" {
+		t.Fatal(c)
+	}
+	for _, kind := range []string{"root", "escape", "zero", "limit", "action", "stage"} {
+		w := valid
+		switch kind {
+		case "root":
+			w.RootPath = "/"
+		case "escape":
+			w.Segments = []string{"..", "file"}
+		case "zero":
+			w.MaxBytes = 0
+		case "limit":
+			w.MaxBytes++
+		case "action":
+			w.Action = ActionRead
+		case "stage":
+			w.Staged = true
+		}
+		if c := w.validate(); c == "" {
+			t.Fatal("accepted", kind)
+		}
+	}
+}
+
+func TestWriteProofPacketDoesNotBecomeReadMetadata(t *testing.T) {
+	if (readOnlyResult{Mutation: &MutationReceipt{Created: true}}).validFor(readOnlyWork{Action: ActionRead, MaxBytes: 10}) {
+		t.Fatal("write receipt accepted as read metadata")
+	}
+}

package/templates/native-go/dsm-package.yaml

@@ -0,0 +1,58 @@
+# Standalone native DSM package: an unsigned SPK that runs as its own package
+# `synopkgland build-spk` reads this file.
+schema: 1
+
+# INFO.package: letters and digits, starting with a letter. It also names the
+# DSM app (SYNO.SDS.<package>) and the CGI URL /webman/3rdparty/<package>/.
+package: __PACKAGE__
+version: 0.1.0
+# Increase for every SPK you hand out with the same version (INFO 0.1.0-0001).
+build: 1
+displayname: __DISPLAY_NAME__
+description: A native DSM package with a Go backend and a DSM window UI.
+maintainer: Your Name
+os_min_ver: "7.2-64570"
+
+# One SPK per architecture. Supported: x86_64, aarch64.
+arches: [x86_64, aarch64]
+
+backend:
+  # Build the Go module in ./backend (package ./cmd/app) as the CGI.
+  go:
+    dir: backend
+    main: ./cmd/app
+  # Or ship a CGI executable you already have (remove `go:` above). Each file
+  # must be a static Linux ELF for its arch; it then owns authentication itself.
+  # binary:
+  #   x86_64: prebuilt/api-x86_64
+  #   aarch64: prebuilt/api-aarch64
+
+ui:
+  # Static files served at /webman/3rdparty/<package>/app/. app.js and app.css
+  # are required; anything else (images, chunks) is copied as is.
+  dir: ui
+
+# UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
+# fr, es and it (DSM's other languages fall back to English). build-spk checks
+# that every language has the en.json keys and placeholders, and that the keys
+# listed in the glossary use Synology's own DSM wording.
+i18n:
+  messages: i18n/messages
+  glossary: i18n/glossary.json
+  # Package Center text per language (INFO displayname_<lang>/description_<lang>).
+  # English comes from displayname/description above.
+  info:
+    zh-TW: { description: 以 Go 後端與 DSM 視窗介面打造的原生 DSM 套件。 }
+    zh-CN: { description: 以 Go 后端与 DSM 窗口界面构建的原生 DSM 套件。 }
+    ja: { description: Go バックエンドと DSM ウィンドウ UI を備えたネイティブ DSM パッケージ。 }
+    ko: { description: Go 백엔드와 DSM 창 UI를 갖춘 네이티브 DSM 패키지. }
+    de: { description: Ein natives DSM-Paket mit Go-Backend und DSM-Fenster-Oberfläche. }
+    fr: { description: Un paquet DSM natif avec un backend Go et une interface en fenêtre DSM. }
+    es: { description: Un paquete nativo de DSM con backend en Go e interfaz en ventana de DSM. }
+    it: { description: Un pacchetto DSM nativo con backend Go e interfaccia in una finestra DSM. }
+
+# none: everything runs as the package account.
+# root: also fixed root operations, one root/<name>.sh each, that run only
+#       after a DSM administrator approves them in the package window.
+#       See README.md "Root access" before using it.
+privilege: __PRIVILEGE__

package/templates/native-go/gitignore

@@ -0,0 +1 @@
+dist/