@synopackageland/cli 0.3.10 → 0.4.1

package/templates/native-go/backend/internal/api/registry_test.go

@@ -0,0 +1,329 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// fakeAuth returns a fixed outcome and counts how often it was consulted, so
+// tests can prove each request authenticates at most once.
+type fakeAuth struct {
+	user  string
+	admin bool
+	err   error
+	calls int
+}
+
+func (f *fakeAuth) Authenticate(*http.Request) (Identity, error) {
+	f.calls++
+	if f.err != nil {
+		return Identity{}, f.err
+	}
+	return Identity{User: f.user, Admin: f.admin}, nil
+}
+
+func post(t *testing.T, srv http.Handler, body string, mutate ...func(*http.Request)) (*httptest.ResponseRecorder, envelope) {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, "http://nas.local/webman/3rdparty/App/cgi/api.cgi", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	for _, m := range mutate {
+		m(req)
+	}
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, req)
+	var env envelope
+	if err := json.Unmarshal(rec.Body.Bytes(), &env); err != nil {
+		t.Fatalf("response is not JSON: %q", rec.Body.String())
+	}
+	return rec, env
+}
+
+type envelope struct {
+	Success bool            `json:"success"`
+	Data    json.RawMessage `json:"data"`
+	Error   *struct {
+		Code string `json:"code"`
+	} `json:"error"`
+}
+
+func countingRoutes(counter *int) []Route {
+	h := func(_ context.Context, c Caller, _ json.RawMessage) (any, error) {
+		*counter++
+		return map[string]string{"user": c.User()}, nil
+	}
+	return []Route{
+		User("demo.user", h),
+		Admin("demo.admin", h),
+	}
+}
+
+func newTestServer(t *testing.T, auth Authenticator, routes ...Route) *Server {
+	t.Helper()
+	srv, err := NewServer(auth, routes...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return srv
+}
+
+func TestUserRouteRunsForAuthenticatedUserWithVerifiedCaller(t *testing.T) {
+	var executed int
+	auth := &fakeAuth{user: "alice"}
+	srv := newTestServer(t, auth, countingRoutes(&executed)...)
+
+	rec, env := post(t, srv, `{"method":"demo.user"}`)
+
+	if rec.Code != http.StatusOK || !env.Success {
+		t.Fatalf("got %d %s", rec.Code, rec.Body.String())
+	}
+	if string(env.Data) != `{"user":"alice"}` {
+		t.Fatalf("data = %s", env.Data)
+	}
+	if executed != 1 || auth.calls != 1 {
+		t.Fatalf("executed=%d auth=%d, want 1/1", executed, auth.calls)
+	}
+}
+
+func TestEveryProtectedRouteRefusesMissingInvalidAndUnavailableAuth(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		code string
+	}{
+		{"missing session", ErrNoSession, "session_required"},
+		{"invalid session", ErrNoSession, "session_required"},
+		{"auth unavailable", errors.New("authenticate.cgi crashed"), "auth_unavailable"},
+	}
+	for _, method := range []string{"demo.user", "demo.admin"} {
+		for _, tc := range cases {
+			t.Run(method+"/"+tc.name, func(t *testing.T) {
+				var executed int
+				auth := &fakeAuth{err: tc.err}
+				srv := newTestServer(t, auth, countingRoutes(&executed)...)
+
+				rec, env := post(t, srv, `{"method":"`+method+`"}`)
+
+				if rec.Code != http.StatusOK || env.Success || env.Error.Code != tc.code {
+					t.Fatalf("got %d %s", rec.Code, rec.Body.String())
+				}
+				if executed != 0 || auth.calls != 1 {
+					t.Fatalf("executed=%d auth=%d, want 0/1", executed, auth.calls)
+				}
+			})
+		}
+	}
+}
+
+func TestAdminRouteRefusesNonAdminWithoutExecuting(t *testing.T) {
+	var executed int
+	srv := newTestServer(t, &fakeAuth{user: "bob"}, countingRoutes(&executed)...)
+
+	rec, env := post(t, srv, `{"method":"demo.admin"}`)
+
+	if rec.Code != http.StatusOK || env.Error.Code != "admin_required" || executed != 0 {
+		t.Fatalf("got %d %s executed=%d", rec.Code, rec.Body.String(), executed)
+	}
+}
+
+func TestAdminRouteRunsForAdmin(t *testing.T) {
+	var executed int
+	srv := newTestServer(t, &fakeAuth{user: "root-admin", admin: true}, countingRoutes(&executed)...)
+
+	rec, _ := post(t, srv, `{"method":"demo.admin"}`)
+
+	if rec.Code != http.StatusOK || executed != 1 {
+		t.Fatalf("got %d executed=%d", rec.Code, executed)
+	}
+}
+
+func TestUnknownMethodNeedsSessionThenIsNotFound(t *testing.T) {
+	var executed int
+	srv := newTestServer(t, &fakeAuth{err: ErrNoSession}, countingRoutes(&executed)...)
+	_, env := post(t, srv, `{"method":"demo.missing"}`)
+	if env.Error == nil || env.Error.Code != "session_required" {
+		t.Fatalf("anonymous unknown method: got %+v, want session_required (no route probing)", env.Error)
+	}
+
+	srv = newTestServer(t, &fakeAuth{user: "alice", admin: true}, countingRoutes(&executed)...)
+	rec, env := post(t, srv, `{"method":"demo.missing"}`)
+	if rec.Code != http.StatusOK || env.Error.Code != "unknown_method" || executed != 0 {
+		t.Fatalf("got %d %s executed=%d", rec.Code, rec.Body.String(), executed)
+	}
+}
+
+func TestPublicRouteIsExplicitAndSkipsAuthentication(t *testing.T) {
+	var executed int
+	auth := &fakeAuth{err: ErrNoSession}
+	srv := newTestServer(t, auth, Public("demo.ping", func(_ context.Context, c Caller, _ json.RawMessage) (any, error) {
+		executed++
+		if c.Authenticated() {
+			t.Error("public handler received an authenticated caller")
+		}
+		return "pong", nil
+	}))
+
+	rec, _ := post(t, srv, `{"method":"demo.ping"}`)
+
+	if rec.Code != http.StatusOK || executed != 1 || auth.calls != 0 {
+		t.Fatalf("got %d executed=%d auth=%d", rec.Code, executed, auth.calls)
+	}
+}
+
+func TestTransportGuardsRunBeforeAuthenticationAndDispatch(t *testing.T) {
+	cases := []struct {
+		name   string
+		body   string
+		mutate func(*http.Request)
+		code   string
+	}{
+		{"GET", `{"method":"demo.user"}`, func(r *http.Request) { r.Method = http.MethodGet }, "method_not_allowed"},
+		{"form post", `{"method":"demo.user"}`, func(r *http.Request) { r.Header.Set("Content-Type", "text/plain") }, "json_required"},
+		{"cross-site fetch", `{"method":"demo.user"}`, func(r *http.Request) { r.Header.Set("Sec-Fetch-Site", "cross-site") }, "cross_origin"},
+		{"foreign origin", `{"method":"demo.user"}`, func(r *http.Request) { r.Header.Set("Origin", "https://evil.example") }, "cross_origin"},
+		{"oversized body", `{"method":"demo.user","params":"` + strings.Repeat("x", MaxRequestBytes) + `"}`, nil, "request_too_large"},
+		{"malformed JSON", `{"method":`, nil, "bad_request"},
+		{"unknown field", `{"method":"demo.user","user":"admin"}`, nil, "bad_request"},
+		{"trailing data", `{"method":"demo.user"}{}`, nil, "bad_request"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var executed int
+			auth := &fakeAuth{user: "alice", admin: true}
+			srv := newTestServer(t, auth, countingRoutes(&executed)...)
+			mutate := []func(*http.Request){}
+			if tc.mutate != nil {
+				mutate = append(mutate, tc.mutate)
+			}
+
+			rec, env := post(t, srv, tc.body, mutate...)
+
+			if rec.Code != http.StatusOK || env.Error == nil || env.Error.Code != tc.code {
+				t.Fatalf("got %d %s", rec.Code, rec.Body.String())
+			}
+			if executed != 0 || auth.calls != 0 {
+				t.Fatalf("executed=%d auth=%d, want 0/0", executed, auth.calls)
+			}
+		})
+	}
+}
+
+// countingReader records how much of the request body the server consumed.
+type countingReader struct {
+	r    io.Reader
+	read int
+}
+
+func (c *countingReader) Read(p []byte) (int, error) {
+	n, err := c.r.Read(p)
+	c.read += n
+	return n, err
+}
+
+// DSM's CGI gateway cuts the reply short when a CGI exits without reading
+// its stdin, so every refusal still consumes the request body.
+func TestRefusalsConsumeTheWholeRequestBody(t *testing.T) {
+	cases := map[string]func(*http.Request){
+		"form post":  func(r *http.Request) { r.Header.Set("Content-Type", "text/plain") },
+		"cross-site": func(r *http.Request) { r.Header.Set("Sec-Fetch-Site", "cross-site") },
+		"GET":        func(r *http.Request) { r.Method = http.MethodGet },
+		"oversized":  func(*http.Request) {},
+	}
+	for name, mutate := range cases {
+		t.Run(name, func(t *testing.T) {
+			var executed int
+			srv := newTestServer(t, &fakeAuth{user: "alice"}, countingRoutes(&executed)...)
+			body := `{"method":"demo.user"}`
+			if name == "oversized" {
+				body = `{"method":"demo.user","params":"` + strings.Repeat("x", 2*MaxRequestBytes) + `"}`
+			}
+			reader := &countingReader{r: strings.NewReader(body)}
+			req := httptest.NewRequest(http.MethodPost, "http://nas.local/api.cgi", reader)
+			req.Header.Set("Content-Type", "application/json")
+			mutate(req)
+			srv.ServeHTTP(httptest.NewRecorder(), req)
+			if reader.read != len(body) {
+				t.Fatalf("read %d of %d body bytes", reader.read, len(body))
+			}
+		})
+	}
+}
+
+func TestSameOriginRequestIsAccepted(t *testing.T) {
+	var executed int
+	srv := newTestServer(t, &fakeAuth{user: "alice"}, countingRoutes(&executed)...)
+	rec, _ := post(t, srv, `{"method":"demo.user"}`, func(r *http.Request) {
+		r.Header.Set("Origin", "http://nas.local")
+		r.Header.Set("Sec-Fetch-Site", "same-origin")
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestResponsesAreUncachedJSON(t *testing.T) {
+	var executed int
+	srv := newTestServer(t, &fakeAuth{err: ErrNoSession}, countingRoutes(&executed)...)
+	rec, _ := post(t, srv, `{"method":"demo.user"}`)
+	if got := rec.Header().Get("Cache-Control"); got != "no-store" {
+		t.Errorf("Cache-Control = %q", got)
+	}
+	if got := rec.Header().Get("Content-Type"); got != "application/json" {
+		t.Errorf("Content-Type = %q", got)
+	}
+}
+
+func TestHandlerErrorsKeepTheirCodeButInternalErrorsAreHidden(t *testing.T) {
+	srv := newTestServer(t, &fakeAuth{user: "alice"},
+		User("demo.invalid", func(context.Context, Caller, json.RawMessage) (any, error) {
+			return nil, BadRequest("text must not be empty")
+		}),
+		User("demo.crash", func(context.Context, Caller, json.RawMessage) (any, error) {
+			return nil, errors.New("disk path /secret/xyz failed")
+		}),
+		User("demo.panic", func(context.Context, Caller, json.RawMessage) (any, error) {
+			panic("boom")
+		}),
+	)
+
+	rec, env := post(t, srv, `{"method":"demo.invalid"}`)
+	if rec.Code != http.StatusOK || env.Error.Code != "bad_request" || !strings.Contains(rec.Body.String(), "text must not be empty") {
+		t.Fatalf("got %d %s", rec.Code, rec.Body.String())
+	}
+	for _, method := range []string{"demo.crash", "demo.panic"} {
+		rec, env = post(t, srv, `{"method":"`+method+`"}`)
+		if rec.Code != http.StatusOK || env.Error.Code != "internal" || strings.Contains(rec.Body.String(), "secret") || strings.Contains(rec.Body.String(), "boom") {
+			t.Fatalf("%s: got %d %s", method, rec.Code, rec.Body.String())
+		}
+	}
+}
+
+func TestRegistryRefusesUnusableRoutes(t *testing.T) {
+	h := func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil }
+	cases := map[string][]Route{
+		"zero route (no policy)": {{}},
+		"nil handler":            {User("demo.nil", nil)},
+		"bad method name":        {User("Demo Method", h)},
+		"duplicate method":       {User("demo.x", h), Admin("demo.x", h)},
+	}
+	for name, routes := range cases {
+		if _, err := NewServer(&fakeAuth{}, routes...); err == nil {
+			t.Errorf("%s: NewServer accepted it", name)
+		}
+	}
+	if _, err := NewServer(nil, User("demo.x", h)); err == nil {
+		t.Error("NewServer accepted a nil authenticator")
+	}
+}
+
+func TestZeroCallerIsNotAuthenticated(t *testing.T) {
+	var c Caller
+	if c.Authenticated() || c.Admin() || c.User() != "" {
+		t.Fatal("a Caller built outside the server must carry no authority")
+	}
+}

package/templates/native-go/backend/internal/api/server.go

@@ -0,0 +1,159 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"mime"
+	"net/http"
+	"net/url"
+)
+
+// MaxRequestBytes bounds the request body the CGI reads (CONTENT_LENGTH is
+// caller-controlled).
+const MaxRequestBytes = 1 << 20
+
+// ErrNoSession means the request carries no valid DSM session.
+var ErrNoSession = errors.New("no valid DSM session")
+
+// Authenticator verifies the DSM session behind a request.
+type Authenticator interface {
+	Authenticate(r *http.Request) (Identity, error)
+}
+
+// Server is the http.Handler behind the package CGI.
+type Server struct {
+	auth   Authenticator
+	routes map[string]Route
+}
+
+// NewServer refuses an empty authenticator and any route that is not usable,
+// so a mistake fails at startup instead of opening a route.
+func NewServer(auth Authenticator, routes ...Route) (*Server, error) {
+	if auth == nil {
+		return nil, errors.New("api.NewServer needs an Authenticator")
+	}
+	registry, err := buildRegistry(routes)
+	if err != nil {
+		return nil, err
+	}
+	return &Server{auth: auth, routes: registry}, nil
+}
+
+type request struct {
+	Method string          `json:"method"`
+	Params json.RawMessage `json:"params"`
+}
+
+func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// DSM's CGI gateway cuts the reply short if the CGI exits with request
+	// bytes unread, so drain whatever the handling below did not consume.
+	defer io.Copy(io.Discard, r.Body)
+	defer func() {
+		if p := recover(); p != nil {
+			log.Printf("handler panic: %v", p)
+			writeError(w, internalError)
+		}
+	}()
+	req, apiErr := readRequest(w, r)
+	if apiErr != nil {
+		writeError(w, apiErr)
+		return
+	}
+	caller, route, apiErr := s.authorize(r, req.Method)
+	if apiErr != nil {
+		writeError(w, apiErr)
+		return
+	}
+	if route.binary != nil {
+		serveBoundedRead(w, r, caller, req.Params, route.binary)
+		return
+	}
+	data, err := route.handler(r.Context(), caller, req.Params)
+	if err != nil {
+		writeError(w, asError(err))
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"success": true, "data": data})
+}
+
+// authorize is the single access decision. Public routes skip authentication;
+// everything else, including unknown methods, authenticates exactly once
+// first, so anonymous callers cannot probe which methods exist.
+func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Error) {
+	route, known := s.routes[method]
+	if known && route.policy == policyPublic {
+		return Caller{}, route, nil
+	}
+	identity, err := s.auth.Authenticate(r)
+	if errors.Is(err, ErrNoSession) {
+		return Caller{}, Route{}, &Error{"session_required", "sign in to DSM again"}
+	}
+	if err != nil {
+		log.Printf("authentication unavailable: %v", err)
+		return Caller{}, Route{}, &Error{"auth_unavailable", "DSM authentication is unavailable"}
+	}
+	if !known {
+		return Caller{}, Route{}, &Error{"unknown_method", "unknown method"}
+	}
+	caller := Caller{identity: identity, authenticated: true}
+	if route.policy == policyAdmin && !caller.Admin() {
+		return Caller{}, Route{}, &Error{"admin_required", "this action needs a DSM administrator"}
+	}
+	return caller, route, nil
+}
+
+func readRequest(w http.ResponseWriter, r *http.Request) (request, *Error) {
+	var req request
+	if r.Method != http.MethodPost {
+		return req, &Error{"method_not_allowed", "use POST"}
+	}
+	if mediaType, _, err := mime.ParseMediaType(r.Header.Get("Content-Type")); err != nil || mediaType != "application/json" {
+		return req, &Error{"json_required", "send Content-Type: application/json"}
+	}
+	if !sameOrigin(r) {
+		return req, &Error{"cross_origin", "cross-origin request refused"}
+	}
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, MaxRequestBytes))
+	if err != nil {
+		return req, &Error{"request_too_large", "request body too large"}
+	}
+	dec := json.NewDecoder(bytes.NewReader(body))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&req); err != nil || dec.More() || req.Method == "" {
+		return req, BadRequest(`body must be {"method": "...", "params": {...}}`)
+	}
+	return req, nil
+}
+
+// sameOrigin refuses browser requests another site initiated. The JSON
+// content type already forces a CORS preflight, which DSM never answers; these
+// checks add an explicit refusal when the browser reports the origin.
+func sameOrigin(r *http.Request) bool {
+	if site := r.Header.Get("Sec-Fetch-Site"); site != "" && site != "same-origin" {
+		return false
+	}
+	if origin := r.Header.Get("Origin"); origin != "" {
+		u, err := url.Parse(origin)
+		return err == nil && u.Host == r.Host
+	}
+	return true
+}
+
+func writeJSON(w http.ResponseWriter, status int, body any) {
+	h := w.Header()
+	h.Set("Content-Type", "application/json")
+	h.Set("Cache-Control", "no-store")
+	h.Set("X-Content-Type-Options", "nosniff")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(body)
+}
+
+func writeError(w http.ResponseWriter, e *Error) {
+	writeJSON(w, http.StatusOK, map[string]any{
+		"success": false,
+		"error":   map[string]string{"code": e.Code, "message": e.Message},
+	})
+}

package/templates/native-go/backend/internal/app/nas_cgi_artifact_test.go

@@ -0,0 +1,121 @@
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// The NIC-free VM points this at the actual unpacked, generated arm64 SPK CGI.
+// The VM's DSM authenticate.cgi oracle is a fixture, never a shipped adapter.
+func TestS8FinalCGIArtifactRefusal(t *testing.T) {
+	binary := os.Getenv("M2_S8_CGI_ARTIFACT")
+	if binary == "" {
+		t.Skip("requires final generated SPK in disposable Linux VM")
+	}
+
+	helperBinary := os.Getenv("M2_S8_HELPER_ARTIFACT")
+	if helperBinary != "" {
+		run := func(action string) {
+			t.Helper()
+			if b, err := exec.Command(helperBinary, action).CombinedOutput(); err != nil {
+				t.Fatalf("%s: %s %v", action, b, err)
+			}
+		}
+		state := func(want string) {
+			t.Helper()
+			for n := 0; n < 100; n++ {
+				b, err := exec.Command(helperBinary, "diagnose").Output()
+				var out map[string]any
+				json.Unmarshal(b, &out)
+				if err == nil && out["state"] == want {
+					t.Log("final generated helper state", want)
+					return
+				}
+				time.Sleep(20 * time.Millisecond)
+			}
+			t.Fatal("helper state did not become", want)
+		}
+		run("enable")
+		state("ready")
+		t.Cleanup(func() { exec.Command(helperBinary, "disable").Run() })
+		hook := os.Getenv("M2_S8_PREUPGRADE_HOOK")
+		if hook != "" {
+			if exec.Command("/bin/sh", hook).Run() == nil {
+				t.Fatal("generated preupgrade admitted a ready helper")
+			}
+		}
+		defer func() {
+			run("teardown")
+			state("stopped")
+			if hook != "" {
+				if b, err := exec.Command("/bin/sh", hook).CombinedOutput(); err != nil {
+					t.Fatal("generated preupgrade after teardown", string(b), err)
+				}
+			}
+			run("recover")
+			state("ready")
+			run("disable")
+			state("not-enabled")
+			if exec.Command(helperBinary, "recover").Run() == nil {
+				t.Fatal("disabled helper recovered without approval")
+			}
+		}()
+	}
+	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.unknown", "nas.files.read.binary"}
+	for _, user := range []string{"normal1", "normal2", "admin", "", "expired"} {
+		for _, method := range methods {
+			params := `{"user":"admin","path":"/volume1/secret"}`
+			if method == "nas.files.read.binary" {
+				params = sampleParams[method]
+			}
+			body := fmt.Sprintf(`{"method":%q,"params":%s}`, method, params)
+			cmd := exec.Command(binary)
+			if uidText := os.Getenv("M2_S8_CGI_PACKAGE_UID"); uidText != "" {
+				uid, err := strconv.ParseUint(uidText, 10, 32)
+				if err != nil {
+					t.Fatal(err)
+				}
+				cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uint32(uid), Gid: uint32(uid)}}
+			}
+			cmd.Env = []string{"GATEWAY_INTERFACE=CGI/1.1", "REQUEST_METHOD=POST", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_NAME=localhost", "SERVER_PORT=80", "SCRIPT_NAME=/api.cgi", "CONTENT_TYPE=application/json", fmt.Sprintf("CONTENT_LENGTH=%d", len(body)), "REMOTE_ADDR=127.0.0.1"}
+			if user != "" {
+				cmd.Env = append(cmd.Env, "HTTP_COOKIE=fixture="+user)
+			}
+			cmd.Stdin = strings.NewReader(body)
+			b, err := cmd.Output()
+			if err != nil {
+				t.Fatal(method, err)
+			}
+			parts := bytes.SplitN(b, []byte("\r\n\r\n"), 2)
+			if len(parts) != 2 {
+				t.Fatal("not CGI", string(b))
+			}
+			var result map[string]any
+			if err = json.Unmarshal(parts[1], &result); err != nil {
+				t.Fatal(err, string(b))
+			}
+			want := "unknown_method"
+			if method == "nas.files.read.binary" {
+				want = "unsupported"
+			}
+			if user == "" || user == "expired" {
+				want = "session_required"
+			}
+			e, ok := result["error"].(map[string]any)
+			if !ok || e["code"] != want || result["success"] != false || result["data"] != nil {
+				t.Fatalf("%s %s: %s", user, method, parts[1])
+			}
+			if bytes.Contains(b, []byte("volume1")) || bytes.Contains(b, []byte("fixture=")) {
+				t.Fatal("metadata leaked")
+			}
+		}
+	}
+}

package/templates/native-go/backend/internal/app/nas_refusal_test.go

@@ -0,0 +1,46 @@
+package app
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"dsmapp/internal/helper"
+)
+
+// These are unavailable wire methods, not public grant/file routes. CGI names
+// are never used as S1 actors. Test both administrators and ordinary sessions.
+func TestS8NASWireRefusalHasNoDataEffects(t *testing.T) {
+	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.future-method"}
+	for _, auth := range []stubAuth{alice, bob, nobody} {
+		cfg := testConfig(t)
+		cfg.HelperInventory = helper.Inventory{Package: cfg.PackageID, Version: cfg.Version, Protocol: 2, PayloadDigest: strings.Repeat("a", 64), RegistryDigest: strings.Repeat("b", 64)}
+		for _, method := range methods {
+			code, out := call(t, cfg, auth, method, `{"user":"admin","path":"/volume1/private","nativeProof":true}`)
+			want := "unknown_method"
+			if auth.err != nil {
+				want = "session_required"
+			}
+			if code != want || out["success"] != false || out["data"] != nil {
+				t.Fatalf("%s: %s %v", method, code, out)
+			}
+			b, _ := json.Marshal(out)
+			if strings.Contains(string(b), "volume1") || strings.Contains(string(b), "nativeProof") {
+				t.Fatal("request metadata leaked", string(b))
+			}
+		}
+		code, out := call(t, cfg, auth, "nas.files.read.binary", sampleParams["nas.files.read.binary"])
+		want := "unsupported"
+		if auth.err != nil {
+			want = "session_required"
+		}
+		if code != want || out["data"] != nil {
+			t.Fatal(code, out)
+		}
+		entries, err := os.ReadDir(cfg.DataDir)
+		if err != nil || len(entries) != 0 {
+			t.Fatal("NAS refusal changed package data", entries, err)
+		}
+	}
+}

package/templates/native-go/backend/internal/app/root_none.go

@@ -0,0 +1,9 @@
+package app
+
+import "dsmapp/internal/api"
+
+// rootRoutes is empty: this package declares privilege: none and never runs
+// anything as root. `synopkgland init -t native-go --privilege root` creates
+// root.go instead, which reads the results of administrator-approved root
+// operations.
+func (Config) rootRoutes() []api.Route { return nil }