@synopackageland/cli 0.3.9 → 0.4.0

package/dist/templates/native-go-better-auth/node/package.json

@@ -0,0 +1 @@
+{"name":"native-dsm-better-auth","private":true,"type":"module","scripts":{"build":"node build.mjs","test":"node --test test/*.test.mjs"},"dependencies":{"better-auth":"1.7.7","@better-auth/memory-adapter":"1.7.7"},"devDependencies":{"esbuild":"0.25.12"},"engines":{"node":">=22"}}

package/dist/templates/native-go-better-auth/node/test/auth.test.mjs

@@ -0,0 +1,31 @@
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import {makeApp} from '../app.mjs';
+const p1={name:'normal1',uid:'1001',gid:'100'},p2={name:'normal2',uid:'1002',gid:'100'};
+const state=()=>({secret:'fixture-secret-'.repeat(4),db:{user:[],session:[],account:[],verification:[]},bindings:{}});
+const cookie=r=>r.cookies.map(v=>v.split(';')[0]).join('; ');
+test('single-use native tickets bind Better Auth to a freshly authenticated principal',async()=>{
+ const store=state(),app=makeApp({packageID:'Alpha',store,ticket:'one',principal:p1});
+ const login=await app.handle('login','one');assert.equal(login.status,200);assert.equal(login.body.user,'normal1');
+ const repeated=await app.handle('login','one');assert.equal(repeated.status,401);
+ const session=cookie(login);assert.ok(session);
+ const fresh=makeApp({packageID:'Alpha',store,ticket:'two',principal:p1});
+ assert.equal((await fresh.handle('current','two',session)).status,200);
+ const crossed=makeApp({packageID:'Alpha',store,ticket:'three',principal:p2});
+ assert.equal((await crossed.handle('current','three',session)).body.error,'principal_mismatch');
+});
+test('store survives a CGI restart and refuses expired or foreign-package sessions',async()=>{
+ const store=state(),a=makeApp({packageID:'Alpha',store,ticket:'one',principal:p1});
+ const login=await a.handle('login','one'),session=cookie(login);
+ const restored=JSON.parse(JSON.stringify(store));
+ assert.equal((await makeApp({packageID:'Alpha',store:restored,ticket:'two',principal:p1}).handle('current','two',session)).status,200);
+ assert.equal((await makeApp({packageID:'Beta',store:restored,ticket:'three',principal:p1}).handle('current','three',session)).status,401);
+ restored.db.session[0].expiresAt=new Date(0).toISOString();
+ assert.equal((await makeApp({packageID:'Alpha',store:restored,ticket:'four',principal:p1}).handle('current','four',session)).status,401);
+});
+test('logout revokes app session and does not create a verified placeholder identity',async()=>{
+ const store=state();const login=await makeApp({packageID:'Alpha',store,ticket:'one',principal:p1}).handle('login','one');const session=cookie(login);
+ assert.equal(store.db.user[0].emailVerified,false);
+ assert.equal((await makeApp({packageID:'Alpha',store,ticket:'two',principal:p1}).handle('logout','two',session)).status,200);
+ assert.equal((await makeApp({packageID:'Alpha',store,ticket:'three',principal:p1}).handle('current','three',session)).status,401);
+});

package/dist/templates/native-go-integration/backend/internal/app/identity_none.go

@@ -0,0 +1,6 @@
+package app
+
+import "dsmapp/internal/api"
+
+// The Go-only integration has no Node process, dependency or identity route.
+func (cfg Config) identityRoutes() []api.Route { return nil }

package/dist/templates/native-go-integration/backend/internal/app/personal.go

@@ -0,0 +1,203 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"os/user"
+	"syscall"
+	"unicode/utf8"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/helper"
+)
+
+// This example stores one synthetic note per authenticated local account in
+// package-owned data. It is not a shared-folder grant or a NAS file gateway.
+// The client may send an opaque ID, never a user name, UID or filesystem path.
+var personalLookup = user.Lookup
+var integrationHealth = func(ctx context.Context, cfg Config) helper.State {
+	return helper.NewClient(cfg.HelperInventory).Status(ctx)
+}
+
+func (cfg Config) integrationRoutes() []api.Route {
+	if cfg.HelperInventory.Protocol != 1 {
+		return nil
+	}
+	return append([]api.Route{api.User("personal.list", cfg.personalList), api.User("personal.read", cfg.personalRead), api.User("personal.write", cfg.personalWrite)}, cfg.identityRoutes()...)
+}
+func (cfg Config) personalID(ctx context.Context, caller api.Caller) (string, error) {
+	if !caller.Authenticated() {
+		return "", &api.Error{Code: "session_required", Message: "Sign in to DSM again"}
+	}
+	if integrationHealth(ctx, cfg).State != "ready" {
+		return "", &api.Error{Code: "integration_unavailable", Message: "Ask an administrator to activate or recover integration"}
+	}
+	// Re-resolve the authenticated name on every request. No browser-supplied
+	// identity is used; directory users and account lifecycle need M2 validation.
+	u, err := personalLookup(caller.User())
+	if err != nil || u.Username != caller.User() || u.Uid == "" || u.Gid == "" {
+		return "", &api.Error{Code: "identity_unavailable", Message: "Local account identity is unavailable"}
+	}
+	digest := sha256.Sum256([]byte(cfg.PackageID + "\x00" + caller.User() + "\x00" + u.Uid + "\x00" + u.Gid))
+	return hex.EncodeToString(digest[:]), nil
+}
+func (cfg Config) personalList(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	id, err := cfg.personalID(ctx, caller)
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{"items": []map[string]string{{"id": id, "name": "My sample note"}}, "scope": "package-owned synthetic data"}, nil
+}
+func (cfg Config) personalRead(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+	var in struct {
+		ID string `json:"id"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	id, err := cfg.personalID(ctx, caller)
+	if err != nil {
+		return nil, err
+	}
+	if in.ID != id {
+		return nil, personalDenied()
+	}
+	text, err := cfg.personalFile(id, nil)
+	if err != nil {
+		return nil, personalUnavailable()
+	}
+	if text == nil {
+		return map[string]string{"id": id, "text": "Private synthetic sample for " + caller.User()}, nil
+	}
+	return map[string]string{"id": id, "text": *text}, nil
+}
+func (cfg Config) personalWrite(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+	var in struct {
+		ID   string `json:"id"`
+		Text string `json:"text"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if len(in.Text) > 4096 || !utf8.ValidString(in.Text) {
+		return nil, api.BadRequest("text must be valid UTF-8, at most 4096 bytes")
+	}
+	id, err := cfg.personalID(ctx, caller)
+	if err != nil {
+		return nil, err
+	}
+	if in.ID != id {
+		return nil, personalDenied()
+	}
+	if _, err := cfg.personalFile(id, &in.Text); err != nil {
+		return nil, personalUnavailable()
+	}
+	return map[string]string{"id": id, "text": in.Text}, nil
+}
+func personalDenied() error {
+	return &api.Error{Code: "access_denied", Message: "This sample belongs to another account"}
+}
+func personalUnavailable() error {
+	return &api.Error{Code: "personal_unavailable", Message: "Sample storage is unavailable; ask an administrator to check package data"}
+}
+
+// Root confines every lookup to package data; no paths come from the client.
+// O_NOFOLLOW rejects final symlinks. Shared/exclusive flock covers reads/writes
+// across separate CGI processes; a write is bounded and fsynced before success.
+func (cfg Config) personalFile(id string, text *string) (*string, error) {
+	root, err := os.OpenRoot(cfg.DataDir)
+	if err != nil {
+		return nil, err
+	}
+	defer root.Close()
+	if err = root.Mkdir("personal", 0700); err != nil && !errors.Is(err, fs.ErrExist) {
+		return nil, err
+	}
+	info, err := root.Lstat("personal")
+	if err != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
+		return nil, errors.New("unsafe directory")
+	}
+	dir, err := root.OpenRoot("personal")
+	if err != nil {
+		return nil, err
+	}
+	defer dir.Close()
+	lock, err := dir.OpenFile(id+".lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return nil, err
+	}
+	defer lock.Close()
+	if err = personalRegular(lock); err != nil {
+		return nil, err
+	}
+	mode := syscall.LOCK_SH
+	if text != nil {
+		mode = syscall.LOCK_EX
+	}
+	if err = syscall.Flock(int(lock.Fd()), mode); err != nil {
+		return nil, err
+	}
+	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
+	flags := os.O_RDONLY | syscall.O_NOFOLLOW
+	if text != nil {
+		flags = os.O_CREATE | os.O_RDWR | syscall.O_NOFOLLOW
+	}
+	file, err := dir.OpenFile(id+".json", flags, 0600)
+	if text == nil && errors.Is(err, fs.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	if err = personalRegular(file); err != nil {
+		return nil, err
+	}
+	if text != nil {
+		bytes, err := json.Marshal(map[string]string{"text": *text})
+		if err != nil {
+			return nil, err
+		}
+		if err = file.Truncate(0); err != nil {
+			return nil, err
+		}
+		if _, err = file.Write(bytes); err != nil {
+			return nil, err
+		}
+		if err = file.Sync(); err != nil {
+			return nil, err
+		}
+		return text, nil
+	}
+	bytes, err := io.ReadAll(io.LimitReader(file, 32769))
+	if err != nil || len(bytes) > 32768 {
+		return nil, errors.New("oversized note")
+	}
+	var note struct {
+		Text string `json:"text"`
+	}
+	if err = json.Unmarshal(bytes, &note); err != nil {
+		return nil, err
+	}
+	return &note.Text, nil
+}
+func personalRegular(f *os.File) error {
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	st, ok := info.Sys().(*syscall.Stat_t)
+	if !ok || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 || st.Uid != uint32(os.Getuid()) || st.Nlink != 1 {
+		return errors.New("unsafe file")
+	}
+	return nil
+}

package/dist/templates/native-go-integration/backend/internal/app/personal_test.go

@@ -0,0 +1,119 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/helper"
+	"encoding/json"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func personalFixture(t *testing.T) Config {
+	oldLookup, oldHealth := personalLookup, integrationHealth
+	personalLookup = func(name string) (*user.User, error) {
+		return &user.User{Username: name, Uid: map[string]string{"normal1": "1001", "normal2": "1002", "alice": "1000"}[name], Gid: "100"}, nil
+	}
+	integrationHealth = func(context.Context, Config) helper.State { return helper.State{State: "ready"} }
+	t.Cleanup(func() { personalLookup, integrationHealth = oldLookup, oldHealth })
+	cfg := testConfig(t)
+	cfg.HelperInventory = helper.Inventory{Package: cfg.PackageID, Protocol: 1}
+	return cfg
+}
+func personalCall(t *testing.T, cfg Config, name, method, params string) (string, map[string]any) {
+	return call(t, cfg, stubAuth{identity: api.Identity{User: name}}, method, params)
+}
+func personalHandle(t *testing.T, cfg Config, name string) string {
+	code, out := personalCall(t, cfg, name, "personal.list", `{}`)
+	if code != "" {
+		t.Fatal(code, out)
+	}
+	return out["data"].(map[string]any)["items"].([]any)[0].(map[string]any)["id"].(string)
+}
+func TestPersonalUsersReadWriteAndMutuallyRefuse(t *testing.T) {
+	cfg := personalFixture(t)
+	first, second := personalHandle(t, cfg, "normal1"), personalHandle(t, cfg, "normal2")
+	if first == second {
+		t.Fatal("handles must bind caller")
+	}
+	for _, pair := range [][2]string{{"normal1", first}, {"normal2", second}} {
+		data, _ := json.Marshal(map[string]string{"id": pair[1], "text": "Private " + pair[0]})
+		code, out := personalCall(t, cfg, pair[0], "personal.write", string(data))
+		if code != "" {
+			t.Fatal(code, out)
+		}
+		code, out = personalCall(t, cfg, pair[0], "personal.read", `{"id":"`+pair[1]+`"}`)
+		if code != "" || out["data"].(map[string]any)["text"] != "Private "+pair[0] {
+			t.Fatal(code, out)
+		}
+	}
+	for _, pair := range [][2]string{{"normal1", second}, {"normal2", first}} {
+		for _, method := range []string{"personal.read", "personal.write"} {
+			params := `{"id":"` + pair[1] + `"`
+			if method == "personal.write" {
+				params += `,"text":"attack"`
+			}
+			params += `}`
+			code, _ := personalCall(t, cfg, pair[0], method, params)
+			if code != "access_denied" {
+				t.Fatal(method, code)
+			}
+		}
+	}
+	// Administrator privilege also gives no authority over another user's note.
+	if code, _ := call(t, cfg, alice, "personal.read", `{"id":"`+first+`"}`); code != "access_denied" {
+		t.Fatal(code)
+	}
+}
+func TestPersonalRejectsForgedIdentityAndPaths(t *testing.T) {
+	cfg := personalFixture(t)
+	id := personalHandle(t, cfg, "normal1")
+	for _, params := range []string{`{"user":"normal2"}`, `{"path":"../normal2"}`, `{"id":"` + id + `","user":"normal2"}`} {
+		if code, _ := personalCall(t, cfg, "normal1", "personal.list", params); code != "bad_request" {
+			t.Fatal(code)
+		}
+	}
+	for _, id := range []string{"../normal2", "/etc/passwd", "", "unknown"} {
+		if code, _ := personalCall(t, cfg, "normal1", "personal.read", `{"id":"`+id+`"}`); code != "access_denied" {
+			t.Fatal(code)
+		}
+	}
+	if code, _ := call(t, cfg, nobody, "personal.list", `{}`); code != "session_required" {
+		t.Fatal(code)
+	}
+	integrationHealth = func(context.Context, Config) helper.State { return helper.State{State: "stopped"} }
+	if code, _ := personalCall(t, cfg, "normal1", "personal.list", `{}`); code != "integration_unavailable" {
+		t.Fatal(code)
+	}
+}
+func TestPersonalRefusesSymlinkAndOversizedData(t *testing.T) {
+	cfg := personalFixture(t)
+	id := personalHandle(t, cfg, "normal1")
+	outside := filepath.Join(t.TempDir(), "victim")
+	os.WriteFile(outside, []byte("unchanged"), 0600)
+	os.Mkdir(filepath.Join(cfg.DataDir, "personal"), 0700)
+	if err := os.Symlink(outside, filepath.Join(cfg.DataDir, "personal", id+".json")); err != nil {
+		t.Fatal(err)
+	}
+	for _, method := range []string{"personal.read", "personal.write"} {
+		params := `{"id":"` + id + `"`
+		if method == "personal.write" {
+			params += `,"text":"attack"`
+		}
+		params += `}`
+		if code, _ := personalCall(t, cfg, "normal1", method, params); code != "personal_unavailable" {
+			t.Fatal(method, code)
+		}
+	}
+	b, _ := os.ReadFile(outside)
+	if string(b) != "unchanged" {
+		t.Fatal("escaped")
+	}
+	data, _ := json.Marshal(map[string]string{"id": id, "text": strings.Repeat("x", 4097)})
+	if code, _ := personalCall(t, cfg, "normal1", "personal.write", string(data)); code != "bad_request" {
+		t.Fatal(code)
+	}
+}

package/dist/templates/native-go-root/backend/internal/app/root.go

@@ -0,0 +1,107 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"syscall"
+
+	"dsmapp/internal/api"
+)
+
+// Root operations (root/<name>.sh) run as DSM Task Scheduler tasks that a DSM
+// administrator approved in the package window. Each one writes its standard
+// output to /run/synopkgland-<package>/<name>.out, a root-owned folder this
+// package can read but not write. This package never runs anything as root
+// itself; it only reads those results.
+
+var rootOpName = regexp.MustCompile(`^[a-z][a-z0-9_]{0,31}$`)
+
+const maxRootOutput = 64 << 10
+
+// rootRunDir and rootOwner are variables only so tests can point them at a
+// temporary folder owned by the test user.
+var (
+	rootRunDir = "/run"
+	rootOwner  = uint32(0)
+)
+
+func (cfg Config) rootRoutes() []api.Route {
+	return []api.Route{
+		api.Admin("root.output", cfg.rootOutput),
+	}
+}
+
+type rootResult struct {
+	Op        string  `json:"op"`
+	Output    *string `json:"output"`
+	Modified  int64   `json:"modified"`
+	Truncated bool    `json:"truncated,omitempty"`
+}
+
+func (cfg Config) rootOutput(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	var in struct {
+		Op string `json:"op"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if !rootOpName.MatchString(in.Op) {
+		return nil, api.BadRequest("op must be the name of a root operation")
+	}
+	dir := filepath.Join(rootRunDir, "synopkgland-"+cfg.PackageID)
+	if err := requireRootOwned(dir, true); err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return rootResult{Op: in.Op}, nil
+		}
+		return nil, err
+	}
+	file, err := os.OpenFile(filepath.Join(dir, in.Op+".out"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if errors.Is(err, fs.ErrNotExist) {
+		return rootResult{Op: in.Op}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	info, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if err := requireRootOwnedInfo(info, false); err != nil {
+		return nil, err
+	}
+	data, err := io.ReadAll(io.LimitReader(file, maxRootOutput+1))
+	if err != nil {
+		return nil, err
+	}
+	text := string(data[:min(len(data), maxRootOutput)])
+	return rootResult{Op: in.Op, Output: &text, Modified: info.ModTime().Unix(), Truncated: len(data) > maxRootOutput}, nil
+}
+
+// requireRootOwned refuses anything the package account, or anyone but root,
+// could have put there: symlinks, other owners, group- or world-writable.
+func requireRootOwned(path string, dir bool) error {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return err
+	}
+	return requireRootOwnedInfo(info, dir)
+}
+
+func requireRootOwnedInfo(info fs.FileInfo, dir bool) error {
+	st, ok := info.Sys().(*syscall.Stat_t)
+	wantType := info.Mode().IsRegular()
+	if dir {
+		wantType = info.IsDir()
+	}
+	if !ok || !wantType || st.Uid != rootOwner || info.Mode().Perm()&0o022 != 0 {
+		return errors.New("root output is not a root-owned " + map[bool]string{true: "folder", false: "file"}[dir])
+	}
+	return nil
+}

package/dist/templates/native-go-root/backend/internal/app/root_test.go

@@ -0,0 +1,124 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func init() { sampleParams["root.output"] = `{"op":"whoami"}` }
+
+// rootFixture points the reader at a temporary run folder owned by the test
+// user, standing in for root's /run/synopkgland-<package>.
+func rootFixture(t *testing.T) (Config, string) {
+	t.Helper()
+	base := t.TempDir()
+	rootRunDir, rootOwner = base, uint32(os.Getuid())
+	t.Cleanup(func() { rootRunDir, rootOwner = "/run", 0 })
+	cfg := testConfig(t)
+	return cfg, filepath.Join(base, "synopkgland-"+cfg.PackageID)
+}
+
+func writeResult(t *testing.T, dir, name, text string) {
+	t.Helper()
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, name), []byte(text), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRootOutputIsForAdministratorsOnly(t *testing.T) {
+	cfg, dir := rootFixture(t)
+	writeResult(t, dir, "whoami.out", `{"euid":0}`)
+	if code, _ := call(t, cfg, bob, "root.output", `{"op":"whoami"}`); code != "admin_required" {
+		t.Fatalf("non-admin: %q", code)
+	}
+	if code, _ := call(t, cfg, nobody, "root.output", `{"op":"whoami"}`); code != "session_required" {
+		t.Fatalf("no session: %q", code)
+	}
+}
+
+func TestRootOutputIsEmptyBeforeTheFirstRun(t *testing.T) {
+	cfg, _ := rootFixture(t)
+	code, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`)
+	data := out["data"].(map[string]any)
+	if code != "" || data["output"] != nil || data["modified"] != float64(0) {
+		t.Fatalf("%q %v", code, out)
+	}
+}
+
+func TestRootOutputReturnsTheLatestResult(t *testing.T) {
+	cfg, dir := rootFixture(t)
+	writeResult(t, dir, "whoami.out", "{\"euid\":0}\n")
+	code, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`)
+	data := out["data"].(map[string]any)
+	if code != "" || data["output"] != "{\"euid\":0}\n" || data["modified"].(float64) <= 0 || data["truncated"] != nil {
+		t.Fatalf("%q %v", code, out)
+	}
+}
+
+func TestRootOutputOnlyReadsOperationNames(t *testing.T) {
+	cfg, dir := rootFixture(t)
+	writeResult(t, dir, "whoami.out", "x")
+	for _, op := range []string{"", "../whoami", "Whoami", "who/ami", "whoami.out", strings.Repeat("a", 33)} {
+		if code, _ := call(t, cfg, alice, "root.output", `{"op":"`+op+`"}`); code != "bad_request" {
+			t.Errorf("op %q: %q", op, code)
+		}
+	}
+}
+
+func TestRootOutputRefusesAnythingTheRootTaskDidNotWrite(t *testing.T) {
+	cases := map[string]func(t *testing.T, dir string){
+		"symlinked result": func(t *testing.T, dir string) {
+			writeResult(t, dir, "elsewhere", "x")
+			if err := os.Symlink(filepath.Join(dir, "elsewhere"), filepath.Join(dir, "whoami.out")); err != nil {
+				t.Fatal(err)
+			}
+		},
+		"symlinked folder": func(t *testing.T, dir string) {
+			real := dir + "-real"
+			writeResult(t, real, "whoami.out", "x")
+			if err := os.Symlink(real, dir); err != nil {
+				t.Fatal(err)
+			}
+		},
+		"writable folder": func(t *testing.T, dir string) {
+			writeResult(t, dir, "whoami.out", "x")
+			if err := os.Chmod(dir, 0o777); err != nil {
+				t.Fatal(err)
+			}
+		},
+		"writable result": func(t *testing.T, dir string) {
+			writeResult(t, dir, "whoami.out", "x")
+			if err := os.Chmod(filepath.Join(dir, "whoami.out"), 0o666); err != nil {
+				t.Fatal(err)
+			}
+		},
+		"another owner": func(t *testing.T, dir string) {
+			writeResult(t, dir, "whoami.out", "x")
+			rootOwner = uint32(os.Getuid()) + 1
+		},
+	}
+	for name, arrange := range cases {
+		t.Run(name, func(t *testing.T) {
+			cfg, dir := rootFixture(t)
+			arrange(t, dir)
+			if code, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`); code != "internal" {
+				t.Fatalf("%q %v", code, out)
+			}
+		})
+	}
+}
+
+func TestRootOutputIsBounded(t *testing.T) {
+	cfg, dir := rootFixture(t)
+	writeResult(t, dir, "whoami.out", strings.Repeat("x", maxRootOutput+10))
+	_, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`)
+	data := out["data"].(map[string]any)
+	if len(data["output"].(string)) != maxRootOutput || data["truncated"] != true {
+		t.Fatalf("not bounded: %d %v", len(data["output"].(string)), data["truncated"])
+	}
+}

package/dist/templates/native-go-root/root/whoami.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+# A root operation: runs as root only when a DSM administrator clicks Run in
+# the package window, after approving this exact text with their password.
+# Its standard output is the result the window shows. Keep root operations
+# small and fixed; every change needs the administrator's approval again.
+printf '{"euid":%s}\n' "$(id -u)"