@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go-better-auth/backend/internal/app/identity_test.go

@@ -0,0 +1,113 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestIdentityCGIBindsFreshCallerAndPersistsStore(t *testing.T) {
+	cfg := personalFixture(t)
+	old := identityRun
+	t.Cleanup(func() { identityRun = old })
+	tickets := map[string]bool{}
+	identityRun = func(_ context.Context, cfg Config, input []byte) ([]byte, error) {
+		var in struct {
+			Ticket    string
+			Principal map[string]string
+			Store     map[string]any
+		}
+		if err := json.Unmarshal(input, &in); err != nil {
+			t.Fatal(err)
+		}
+		if len(in.Ticket) != 64 || tickets[in.Ticket] || in.Principal["name"] != "normal1" || in.Principal["uid"] != "1001" {
+			t.Fatal("not fresh native caller", in)
+		}
+		tickets[in.Ticket] = true
+		return []byte(`{"store":{"marker":"saved"},"result":{"ok":true,"user":"normal1","cookie":"session=fixture"}}`), nil
+	}
+	for i := 0; i < 2; i++ {
+		code, out := personalCall(t, cfg, "normal1", "identity.login", `{}`)
+		if code != "" || out["data"].(map[string]any)["user"] != "normal1" {
+			t.Fatal(code, out)
+		}
+	}
+	if len(tickets) != 2 {
+		t.Fatal(tickets)
+	}
+	data, _ := os.ReadFile(filepath.Join(cfg.DataDir, "identity/store.json"))
+	if !strings.Contains(string(data), "saved") {
+		t.Fatal(string(data))
+	}
+	for _, params := range []string{`{"user":"normal2"}`, `{"ticket":"forged"}`, `{"path":"/etc/passwd"}`} {
+		if code, _ := personalCall(t, cfg, "normal1", "identity.login", params); code != "bad_request" {
+			t.Fatal(code)
+		}
+	}
+	if code, _ := call(t, cfg, stubAuth{err: api.ErrNoSession}, "identity.login", `{}`); code != "session_required" {
+		t.Fatal(code)
+	}
+}
+func TestIdentityRefusesSymlinkStore(t *testing.T) {
+	cfg := personalFixture(t)
+	os.Mkdir(filepath.Join(cfg.DataDir, "identity"), 0700)
+	outside := filepath.Join(t.TempDir(), "victim")
+	os.WriteFile(outside, []byte("unchanged"), 0600)
+	os.Symlink(outside, filepath.Join(cfg.DataDir, "identity/store.json"))
+	if code, _ := personalCall(t, cfg, "normal1", "identity.login", `{}`); code != "identity_unavailable" {
+		t.Fatal(code)
+	}
+	b, _ := os.ReadFile(outside)
+	if string(b) != "unchanged" {
+		t.Fatal("escaped")
+	}
+}
+
+func TestIdentityRealBundledNodeRoundTrip(t *testing.T) {
+	bundle := os.Getenv("M1B_NODE_FIXTURE_BUNDLE")
+	node := os.Getenv("M1B_NODE_FIXTURE_EXECUTABLE")
+	if bundle == "" || node == "" {
+		t.Skip("artifact runner provides the selected Node bundle")
+	}
+	cfg := personalFixture(t)
+	old := identityRun
+	t.Cleanup(func() { identityRun = old })
+	identityRun = func(ctx context.Context, _ Config, input []byte) ([]byte, error) {
+		cmd := exec.CommandContext(ctx, node, bundle)
+		cmd.Env = []string{"NODE_ENV=production", "PATH=/usr/bin:/bin"}
+		cmd.Stdin = bytes.NewReader(input)
+		var out limitedIdentityOutput
+		cmd.Stdout = &out
+		if err := cmd.Run(); err != nil {
+			return nil, err
+		}
+		return out.Bytes(), nil
+	}
+	code, out := personalCall(t, cfg, "normal1", "identity.login", `{}`)
+	if code != "" {
+		t.Fatal(code, out)
+	}
+	cookie := out["data"].(map[string]any)["cookie"].(string)
+	if cookie == "" {
+		t.Fatal("no app session")
+	}
+	params, _ := json.Marshal(map[string]string{"cookie": cookie})
+	if code, _ := personalCall(t, cfg, "normal1", "identity.current", string(params)); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := personalCall(t, cfg, "normal2", "identity.current", string(params)); code != "identity_refused" {
+		t.Fatal("cross-user session accepted", code)
+	}
+	if code, _ := personalCall(t, cfg, "normal1", "identity.logout", string(params)); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := personalCall(t, cfg, "normal1", "identity.current", string(params)); code != "identity_refused" {
+		t.Fatal("logout not durable", code)
+	}
+}

package/templates/native-go-better-auth/node/app.mjs

@@ -0,0 +1,72 @@
+import {betterAuth} from 'better-auth';
+import {createAuthEndpoint, APIError} from 'better-auth/api';
+import {setSessionCookie} from 'better-auth/cookies';
+import {memoryAdapter} from '@better-auth/memory-adapter';
+import {randomBytes, createHash, timingSafeEqual} from 'node:crypto';
+import {fileURLToPath} from 'node:url';
+import {realpathSync} from 'node:fs';
+
+// A ticket arrives only through the trusted CGI's stdin, never through a
+// public HTTP listener. One Node process handles one request. Every operation
+// consumes the fresh native ticket; an app session alone carries no NAS rights.
+export function makeApp({packageID,store,ticket,principal}) {
+ const origin=`https://${packageID.toLowerCase()}.invalid`;
+ const prefix=`spl${createHash('sha256').update(packageID).digest('hex').slice(0,16)}`;
+ store.secret ||= randomBytes(32).toString('hex');
+ store.db ||= {user:[],session:[],account:[],verification:[]};
+ store.bindings ||= {};
+ // Hydrate dates after a CGI restart. This JSON snapshot adapter is a bounded
+ // example; production DB migration and account lifecycle policy belong to M2.
+ for(const rows of Object.values(store.db)) for(const row of rows) for(const key of ['createdAt','updatedAt','expiresAt']) if(row[key]) row[key]=new Date(row[key]);
+ let available=true;
+ function consume(value){
+  if(!available||typeof value!=='string'||!ticket||value.length!==ticket.length||!timingSafeEqual(Buffer.from(value),Buffer.from(ticket))) throw new APIError('UNAUTHORIZED',{message:'native_ticket_required'});
+  available=false;
+  if(!principal?.name||!/^\d+$/.test(principal.uid)||!/^\d+$/.test(principal.gid)) throw new APIError('UNAUTHORIZED',{message:'native_identity_invalid'});
+  return principal;
+ }
+ const key=p=>JSON.stringify([packageID,p.name,p.uid,p.gid]);
+ const auth=betterAuth({baseURL:origin,basePath:'/api/auth',secret:store.secret,database:memoryAdapter(store.db),
+  session:{expiresIn:60,updateAge:0,disableSessionRefresh:true,cookieCache:{enabled:false}},
+  advanced:{cookiePrefix:prefix,useSecureCookies:true},trustedOrigins:[origin],
+  plugins:[{id:'spl-dsm-native',endpoints:{nativeLogin:createAuthEndpoint('/native-login',{method:'POST'},async ctx=>{
+   const p=consume(ctx.request?.headers.get('x-native-ticket'));
+   let user=store.db.user.find(u=>u.id===store.bindings[key(p)]);
+   if(!user){user=await ctx.context.internalAdapter.createUser({name:p.name,email:`${createHash('sha256').update(key(p)).digest('hex')}@identity.invalid`,emailVerified:false});store.bindings[key(p)]=user.id;}
+   const session=await ctx.context.internalAdapter.createSession(user.id);
+   await setSessionCookie(ctx,{session,user});
+   return ctx.json({user:p.name});
+  })}}],
+ });
+ return {async handle(method,value,cookie=''){
+  const headers=new Headers({'content-type':'application/json',origin,'x-native-ticket':value||'',cookie});
+  if(method==='login'){
+   const r=await auth.handler(new Request(`${origin}/api/auth/native-login`,{method:'POST',headers,body:'{}'}));
+   return {status:r.status,cookies:r.headers.getSetCookie(),body:await r.json()};
+  }
+  let native;try{native=consume(value)}catch{return {status:401,cookies:[],body:{error:'native_ticket_required'}}}
+  const session=await auth.api.getSession({headers});
+  if(!session)return {status:401,cookies:[],body:{error:'app_session_required'}};
+  if(store.bindings[key(native)]!==session.user.id)return {status:403,cookies:[],body:{error:'principal_mismatch'}};
+  if(method==='current')return {status:200,cookies:[],body:{user:native.name,expiresAt:session.session.expiresAt}};
+  if(method==='logout'){
+   const r=await auth.handler(new Request(`${origin}/api/auth/sign-out`,{method:'POST',headers,body:'{}'}));
+   return {status:r.status,cookies:r.headers.getSetCookie(),body:await r.json()};
+  }
+  return {status:400,cookies:[],body:{error:'invalid_method'}};
+ }};
+}
+export async function run(input){
+ const {packageID,store,ticket,principal,method,cookie}=input;
+ if(!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(packageID)||!['login','current','logout'].includes(method))throw Error('invalid_input');
+ const app=makeApp({packageID,store,ticket,principal});
+ const response=await app.handle(method,ticket,cookie);
+ if(response.status!==200)return {store,result:{ok:false,error:response.body.error||response.body.message||'identity_refused'}};
+ return {store,result:{ok:true,user:principal.name,cookie:response.cookies.map(v=>v.split(';')[0]).join('; '),expiresAt:response.body.expiresAt}};
+}
+if(process.argv[1] && realpathSync(process.argv[1])===fileURLToPath(import.meta.url)){
+ try {
+  let body='';for await(const chunk of process.stdin){body+=chunk;if(Buffer.byteLength(body)>1048576)throw Error('oversized')}
+  process.stdout.write(JSON.stringify(await run(JSON.parse(body))));
+ }catch{process.stderr.write('identity_refused\n');process.exitCode=1}
+}

package/templates/native-go-better-auth/node/build.mjs

@@ -0,0 +1,4 @@
+import {build} from 'esbuild';
+import {writeThirdPartyNotices} from './third-party-notices.mjs';
+await build({entryPoints:['app.mjs'],bundle:true,platform:'node',format:'esm',target:'node22',outfile:'dist/app.mjs',banner:{js:"import {createRequire} from 'node:module'; const require = createRequire(import.meta.url);"}});
+writeThirdPartyNotices(process.cwd(), 'dist/LICENSES');