@synopackageland/cli 0.34.0 → 0.36.0

package/assets/go/route-audit/main.go

@@ -2,26 +2,436 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"go/ast"
 	"go/parser"
 	"go/token"
+	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
+	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 )
 
 type input struct {
 	Dir         string
+	Roots       []string
+	Arches      []string
 	Permissions map[string]string
 	SDK         map[string]map[string]string
 }
 
 type result struct {
-	Problems  []string `json:"problems"`
-	EntryGate bool     `json:"entryGate"`
+	Problems   []string    `json:"problems"`
+	EntryGate  bool        `json:"entryGate"`
+	HTTPRoutes []httpRoute `json:"httpRoutes"`
+}
+
+type httpRoute struct {
+	Prefix string `json:"prefix"`
+	Method string `json:"method"`
+}
+
+const sdkModule = "github.com/synopackageland/syno-pkg-land-sdk"
+
+// Resolve target build constraints without running any application code.
+func shippedFiles(in input) (map[string]string, error) {
+	files := map[string]string{}
+	if _, err := os.Stat(filepath.Join(in.Dir, "go.mod")); os.IsNotExist(err) {
+		matches, err := filepath.Glob(filepath.Join(in.Dir, "*.go"))
+		for _, path := range matches {
+			if !strings.HasSuffix(path, "_test.go") {
+				files[path] = "fixture"
+			}
+		}
+		return files, err
+	}
+	roots, arches := in.Roots, in.Arches
+	if len(roots) == 0 {
+		roots = []string{"."}
+	}
+	if len(arches) == 0 {
+		arches = []string{"amd64", "arm64", "arm"}
+	}
+	for _, arch := range arches {
+		cmd := exec.Command("go", append([]string{"list", "-e", "-mod=readonly", "-deps", "-json"}, roots...)...)
+		cmd.Dir = in.Dir
+		cmd.Env = append(os.Environ(), "GOOS=linux", "GOARCH="+arch, "GOARM=7", "CGO_ENABLED=0", "GOWORK=off", "GOFLAGS=")
+		raw, err := cmd.Output()
+		if err != nil {
+			return nil, fmt.Errorf("cannot resolve shipped Go import graph")
+		}
+		d := json.NewDecoder(bytes.NewReader(raw))
+		for {
+			var p struct {
+				Dir, ImportPath string
+				GoFiles         []string
+				Standard        bool
+				DepOnly         bool
+				Error           *struct{ Err string }
+				Module          *struct {
+					Main    bool
+					Replace *struct{ Dir string }
+				}
+			}
+			err := d.Decode(&p)
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				return nil, err
+			}
+			if !p.DepOnly && p.Error != nil {
+				return nil, fmt.Errorf("cannot resolve a configured shipped Go root")
+			}
+			if p.Standard || p.ImportPath == sdkModule || strings.HasPrefix(p.ImportPath, sdkModule+"/") {
+				continue
+			}
+			if p.Module == nil || !p.Module.Main && p.Module.Replace == nil {
+				continue
+			}
+			for _, name := range p.GoFiles {
+				files[filepath.Join(p.Dir, name)] = p.ImportPath
+			}
+		}
+	}
+	if len(files) == 0 {
+		return nil, fmt.Errorf("shipped Go roots contain no auditable source")
+	}
+	return files, nil
+}
+
+func stringLiteral(expr ast.Expr) string {
+	if v, ok := expr.(*ast.BasicLit); ok && v.Kind == token.STRING {
+		s, _ := strconv.Unquote(v.Value)
+		return s
+	}
+	return ""
+}
+
+type source struct {
+	file      *ast.File
+	path, pkg string
+	imports   map[string]string
+}
+
+// Follow the handler argument through local declarations and factories. A
+// boundary never exempts an entire directory, file, or any listener primitive.
+func boundaryHandlers(sources []source) map[ast.Node]bool {
+	decls := map[string][]ast.Node{}
+	owners := map[ast.Node]source{}
+	for _, s := range sources {
+		ast.Inspect(s.file, func(n ast.Node) bool {
+			if n != nil {
+				owners[n] = s
+			}
+			return true
+		})
+		for _, decl := range s.file.Decls {
+			switch d := decl.(type) {
+			case *ast.FuncDecl:
+				key := s.pkg + "." + d.Name.Name
+				if d.Recv != nil {
+					t := d.Recv.List[0].Type
+					if v, ok := t.(*ast.StarExpr); ok {
+						t = v.X
+					}
+					if v, ok := t.(*ast.Ident); ok {
+						key = s.pkg + "." + v.Name
+					}
+				}
+				decls[key] = append(decls[key], d)
+			case *ast.GenDecl:
+				for _, spec := range d.Specs {
+					switch v := spec.(type) {
+					case *ast.TypeSpec:
+						decls[s.pkg+"."+v.Name.Name] = append(decls[s.pkg+"."+v.Name.Name], v)
+					case *ast.ValueSpec:
+						for _, name := range v.Names {
+							decls[s.pkg+"."+name.Name] = append(decls[s.pkg+"."+name.Name], v)
+						}
+					}
+				}
+			}
+		}
+	}
+	safe, visited := map[ast.Node]bool{}, map[ast.Node]bool{}
+	var mark func(ast.Node)
+	mark = func(root ast.Node) {
+		if root == nil || visited[root] {
+			return
+		}
+		visited[root] = true
+		s := owners[root]
+		ast.Inspect(root, func(n ast.Node) bool {
+			if n == nil {
+				return false
+			}
+			safe[n] = true
+			key := ""
+			switch v := n.(type) {
+			case *ast.Ident:
+				key = s.pkg + "." + v.Name
+				if v.Obj != nil {
+					// A parameter or receiver carries a value built elsewhere.
+					// Following its type would admit every method of that type,
+					// such as an App Config whose method value is the handler.
+					if _, param := v.Obj.Decl.(*ast.Field); param {
+						return true
+					}
+					if d, ok := v.Obj.Decl.(ast.Node); ok {
+						mark(d)
+					}
+				}
+			case *ast.SelectorExpr:
+				if id, ok := v.X.(*ast.Ident); ok {
+					key = s.imports[id.Name] + "." + v.Sel.Name
+				}
+			}
+			for _, decl := range decls[key] {
+				mark(decl)
+			}
+			return true
+		})
+	}
+	for _, s := range sources {
+		ast.Inspect(s.file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if ok && len(call.Args) == 2 {
+				if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
+					if id, ok := sel.X.(*ast.Ident); ok && s.imports[id.Name] == sdkModule+"/api" && sel.Sel.Name == "HandleIntegration" {
+						mark(call.Args[1])
+					}
+				}
+			}
+			if !ok || len(call.Args) != 3 {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok {
+				return true
+			}
+			id, ok := sel.X.(*ast.Ident)
+			if ok && (s.imports[id.Name] == sdkModule+"/api" && sel.Sel.Name == "HandleHTTP" ||
+				s.imports[id.Name] == sdkModule+"/ipc" && (sel.Sel.Name == "ServeUnix" || sel.Sel.Name == "StartUnix")) {
+				mark(call.Args[2])
+			}
+			return true
+		})
+	}
+	return safe
+}
+
+// A handler admitted to a private/raw boundary cannot also be installed as
+// the CGI root. SDK server construction ends this search because it gates
+// its registered routes before invoking their handlers.
+func reusesBoundary(expr ast.Node, owner source, sources []source, safe map[ast.Node]bool, seen map[ast.Node]bool) bool {
+	if expr == nil || seen[expr] {
+		return false
+	}
+	seen[expr] = true
+	imports := owner.imports
+	if call, ok := expr.(*ast.CallExpr); ok {
+		if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
+			if id, ok := sel.X.(*ast.Ident); ok && imports[id.Name] == sdkModule+"/api" {
+				switch sel.Sel.Name {
+				case "NewServerWithPermissions":
+					return false
+				case "WithRequestDeadline", "WithDescription":
+					return len(call.Args) > 0 && reusesBoundary(call.Args[0], owner, sources, safe, seen)
+				}
+			}
+		}
+	}
+	found := false
+	ast.Inspect(expr, func(n ast.Node) bool {
+		if n == nil || found {
+			return false
+		}
+		if n != expr {
+			if _, ok := n.(*ast.CallExpr); ok {
+				found = reusesBoundary(n, owner, sources, safe, seen)
+				return false
+			}
+		}
+		targetPackage, targetName := "", ""
+		if id, ok := n.(*ast.Ident); ok {
+			if id.Obj != nil {
+				if decl, ok := id.Obj.Decl.(ast.Node); ok {
+					found = safe[decl] || reusesBoundary(decl, owner, sources, safe, seen)
+				}
+			} else {
+				targetPackage, targetName = owner.pkg, id.Name
+			}
+		}
+		if selector, ok := n.(*ast.SelectorExpr); ok {
+			if pkg, ok := selector.X.(*ast.Ident); ok {
+				targetPackage, targetName = imports[pkg.Name], selector.Sel.Name
+			}
+		}
+		if targetPackage != "" {
+			for _, candidate := range sources {
+				if candidate.pkg != targetPackage {
+					continue
+				}
+				for _, decl := range candidate.file.Decls {
+					var target ast.Node
+					switch d := decl.(type) {
+					case *ast.FuncDecl:
+						if d.Recv == nil && d.Name.Name == targetName {
+							target = d
+						}
+					case *ast.GenDecl:
+						for _, spec := range d.Specs {
+							switch v := spec.(type) {
+							case *ast.TypeSpec:
+								if v.Name.Name == targetName {
+									target = v
+								}
+							case *ast.ValueSpec:
+								for _, name := range v.Names {
+									if name.Name == targetName {
+										target = v
+									}
+								}
+							}
+						}
+					}
+					if target != nil && (safe[target] || reusesBoundary(target, candidate, sources, safe, seen)) {
+						found = true
+					}
+				}
+			}
+		}
+		return !found
+	})
+	return found
+}
+
+// Resolve declared receiver types without executing the App or requiring a
+// successful type check (the audit also runs while projects are being edited).
+func receiverType(expr ast.Node, src source, sources []source, seen map[ast.Node]bool) string {
+	if expr == nil || seen[expr] {
+		return ""
+	}
+	seen[expr] = true
+	follow := func(n ast.Node) string { return receiverType(n, src, sources, seen) }
+	find := func(pkg, name string) (ast.Node, source) {
+		for _, s := range sources {
+			if s.pkg != pkg {
+				continue
+			}
+			for _, decl := range s.file.Decls {
+				if fn, ok := decl.(*ast.FuncDecl); ok && fn.Recv == nil && fn.Name.Name == name {
+					return fn, s
+				}
+				if gen, ok := decl.(*ast.GenDecl); ok {
+					for _, spec := range gen.Specs {
+						if typ, ok := spec.(*ast.TypeSpec); ok && typ.Name.Name == name {
+							return typ, s
+						}
+						if value, ok := spec.(*ast.ValueSpec); ok {
+							for _, id := range value.Names {
+								if id.Name == name {
+									return id, s
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+		return nil, src
+	}
+	switch v := expr.(type) {
+	case *ast.ParenExpr:
+		return follow(v.X)
+	case *ast.StarExpr:
+		return follow(v.X)
+	case *ast.UnaryExpr:
+		return follow(v.X)
+	case *ast.CompositeLit:
+		return follow(v.Type)
+	case *ast.SelectorExpr:
+		if id, ok := v.X.(*ast.Ident); ok && src.imports[id.Name] != "" {
+			return src.imports[id.Name] + "." + v.Sel.Name
+		}
+		typ := follow(v.X)
+		if dot := strings.LastIndex(typ, "."); dot > 0 {
+			decl, owner := find(typ[:dot], typ[dot+1:])
+			if d, ok := decl.(*ast.TypeSpec); ok {
+				if st, ok := d.Type.(*ast.StructType); ok {
+					for _, field := range st.Fields.List {
+						for _, name := range field.Names {
+							if name.Name == v.Sel.Name {
+								return receiverType(field.Type, owner, sources, seen)
+							}
+						}
+					}
+				}
+			}
+		}
+	case *ast.Ident:
+		if v.Obj != nil {
+			switch d := v.Obj.Decl.(type) {
+			case *ast.Field:
+				return follow(d.Type)
+			case *ast.ValueSpec:
+				if d.Type != nil {
+					return follow(d.Type)
+				}
+				for i, name := range d.Names {
+					if name.Name == v.Name && i < len(d.Values) {
+						return follow(d.Values[i])
+					}
+				}
+			case *ast.AssignStmt:
+				for i, lhs := range d.Lhs {
+					if id, ok := lhs.(*ast.Ident); ok && id.Name == v.Name && i < len(d.Rhs) {
+						return follow(d.Rhs[i])
+					}
+				}
+			case *ast.TypeSpec:
+				if _, ok := d.Type.(*ast.StructType); ok {
+					return src.pkg + "." + d.Name.Name
+				}
+				return follow(d.Type)
+			}
+		} else {
+			decl, owner := find(src.pkg, v.Name)
+			return receiverType(decl, owner, sources, seen)
+		}
+	case *ast.TypeSpec:
+		if _, ok := v.Type.(*ast.StructType); ok {
+			return src.pkg + "." + v.Name.Name
+		}
+		return follow(v.Type)
+	case *ast.FuncDecl:
+		if v.Type.Results != nil && len(v.Type.Results.List) > 0 {
+			return follow(v.Type.Results.List[0].Type)
+		}
+	case *ast.CallExpr:
+		if id, ok := v.Fun.(*ast.Ident); ok && id.Name == "new" && len(v.Args) == 1 {
+			return follow(v.Args[0])
+		}
+		pkg, name := src.pkg, ""
+		switch fun := v.Fun.(type) {
+		case *ast.Ident:
+			name = fun.Name
+		case *ast.SelectorExpr:
+			if id, ok := fun.X.(*ast.Ident); ok {
+				pkg, name = src.imports[id.Name], fun.Sel.Name
+			}
+		}
+		decl, owner := find(pkg, name)
+		return receiverType(decl, owner, sources, seen)
+	}
+	return ""
 }
 
 func main() {
@@ -30,7 +440,7 @@ func main() {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
-	out := result{Problems: []string{}}
+	out := result{Problems: []string{}, HTTPRoutes: []httpRoute{}}
 	sdk := map[string]bool{}
 	for _, group := range in.SDK {
 		for method := range group {
@@ -38,50 +448,55 @@ func main() {
 		}
 	}
 	set := token.NewFileSet()
-	err := filepath.WalkDir(in.Dir, func(path string, d os.DirEntry, err error) error {
+	files, err := shippedFiles(in)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	var sources []source
+	for path, pkg := range files {
+		file, err := parser.ParseFile(set, path, nil, 0)
 		if err != nil {
-			return err
+			fmt.Fprintln(os.Stderr, "invalid shipped Go source")
+			os.Exit(1)
 		}
-		if d.IsDir() {
-			if path != in.Dir && (strings.HasPrefix(d.Name(), ".") || d.Name() == "vendor" || d.Name() == "node_modules") {
-				return filepath.SkipDir
-			}
-			return nil
-		}
-		if d.Type()&os.ModeSymlink != 0 {
-			target, err := os.Stat(path)
-			if err == nil && target.IsDir() {
-				shown, _ := filepath.Rel(in.Dir, path)
-				out.Problems = append(out.Problems, filepath.ToSlash(shown)+":0: Go source directories cannot be symlinks")
-				return nil
+		imports := map[string]string{}
+		for _, spec := range file.Imports {
+			module, _ := strconv.Unquote(spec.Path.Value)
+			alias := filepath.Base(module)
+			if spec.Name != nil {
+				alias = spec.Name.Name
 			}
+			imports[alias] = module
 		}
-		if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
-			return nil
-		}
+		sources = append(sources, source{file, path, pkg, imports})
+	}
+	safe := boundaryHandlers(sources)
+	for _, src := range sources {
+		path, file, imports := src.path, src.file, src.imports
 		shown, _ := filepath.Rel(in.Dir, path)
 		problem := func(pos token.Pos, message string) {
 			out.Problems = append(out.Problems, fmt.Sprintf("%s:%d: %s", filepath.ToSlash(shown), set.Position(pos).Line, message))
 		}
-		if d.Type()&os.ModeSymlink != 0 {
+		d, err := os.Lstat(path)
+		if err != nil || d.Mode()&os.ModeSymlink != 0 {
 			problem(token.NoPos, "Go source symlinks cannot be audited")
-			return nil
+			continue
 		}
-		file, err := parser.ParseFile(set, path, nil, 0)
-		if err != nil {
-			return fmt.Errorf("%s: invalid Go source", shown)
+		for dir := filepath.Dir(path); dir != filepath.Dir(dir); dir = filepath.Dir(dir) {
+			info, err := os.Lstat(dir)
+			if err == nil && info.Mode()&os.ModeSymlink != 0 {
+				problem(token.NoPos, "Go source directories cannot be symlinks")
+				break
+			}
+			if dir == in.Dir {
+				break
+			}
 		}
-		imports := map[string]string{}
 		for _, spec := range file.Imports {
-			module, _ := strconv.Unquote(spec.Path.Value)
-			alias := filepath.Base(module)
-			if spec.Name != nil {
-				alias = spec.Name.Name
-			}
-			if alias == "." {
+			if spec.Name != nil && spec.Name.Name == "." {
 				problem(spec.Pos(), "dot imports cannot be audited")
 			}
-			imports[alias] = module
 		}
 		constants := map[string]string{}
 		direct := map[*ast.SelectorExpr]bool{}
@@ -108,25 +523,47 @@ func main() {
 			}
 		}
 		ast.Inspect(file, func(n ast.Node) bool {
-			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" {
-				problem(fn.Pos(), "custom ServeHTTP bypasses the SDK registry; use api.HandleRequest, HandleResponse or HandleStream")
+			if fn, ok := n.(*ast.FuncDecl); ok && fn.Recv != nil && fn.Name.Name == "ServeHTTP" && !safe[n] {
+				problem(fn.Pos(), "unregistered ServeHTTP; use api.HandleHTTP, api.HandleIntegration or ipc.ServeUnix")
 			}
 			selector, ok := n.(*ast.SelectorExpr)
 			if !ok {
 				return true
 			}
+			if selector.Sel.Name == "ServeHTTP" && !safe[n] {
+				problem(selector.Pos(), "unregistered ServeHTTP dispatch")
+			}
+			receiver := receiverType(selector.X, src, sources, map[ast.Node]bool{})
+			if receiver == "net.ListenConfig" && (selector.Sel.Name == "Listen" || selector.Sel.Name == "ListenPacket") ||
+				receiver == "net/http.Server" && (selector.Sel.Name == "Serve" || selector.Sel.Name == "ServeTLS" ||
+					selector.Sel.Name == "ListenAndServe" || selector.Sel.Name == "ListenAndServeTLS") {
+				problem(selector.Pos(), "custom listener outside SDK boundaries: "+selector.Sel.Name)
+			}
 			pkg, ok := selector.X.(*ast.Ident)
 			if !ok {
 				return true
 			}
 			module := imports[pkg.Name]
 			name := selector.Sel.Name
+			if module == "net" && (name == "Listen" || name == "ListenTCP" || name == "ListenUnix" ||
+				name == "ListenPacket" || name == "ListenUDP" || name == "ListenIP" || name == "ListenUnixgram" ||
+				name == "FileListener" || name == "FilePacketConn") ||
+				module == "crypto/tls" && name == "Listen" ||
+				(module == "syscall" || module == "golang.org/x/sys/unix") && (name == "Bind" || name == "Listen" || name == "Socket") {
+				problem(selector.Pos(), "custom listener outside SDK boundaries: "+name)
+			}
+			if module == sdkModule+"/ipc" && !direct[selector] {
+				switch name {
+				case "ServeUnix", "StartUnix", "ServePeerUnix", "DialUnix", "DialPeerUnix", "ReserveLoopback", "ProbeLoopback":
+					problem(selector.Pos(), "IPC constructor aliases cannot be audited")
+				}
+			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/idgateway" && (name == "NewFront" || name == "Build" || name == "Run") {
 				problem(selector.Pos(), "gateway listeners must use identity_gateway in the manifest; upstream_auth_paths never exempts SDK RPC or custom HTTP handlers")
 			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/api" {
 				switch name {
-				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch":
+				case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP", "HandleIntegration":
 					if !direct[selector] {
 						problem(selector.Pos(), "route constructor aliases cannot be audited; register methods directly")
 					}
@@ -134,8 +571,20 @@ func main() {
 			}
 			if module == "net/http" {
 				switch name {
-				case "Handle", "HandleFunc", "HandlerFunc", "NewServeMux", "Server", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
+				case "Handle", "HandleFunc", "Serve", "ServeTLS", "ListenAndServe", "ListenAndServeTLS":
 					problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+				case "HandlerFunc", "NewServeMux", "ServeMux", "FileServer", "FileServerFS", "StripPrefix", "TimeoutHandler", "NotFoundHandler", "RedirectHandler":
+					if !safe[n] {
+						problem(selector.Pos(), "HTTP handler outside the SDK registry: "+name)
+					}
+				}
+			}
+			if module == "net/http/httputil" && (name == "ReverseProxy" || name == "NewSingleHostReverseProxy") && !safe[n] {
+				problem(selector.Pos(), "HTTP proxy outside the SDK registry")
+			}
+			if module == "net/http/cgi" && name == "Serve" {
+				if !direct[selector] {
+					problem(selector.Pos(), "CGI constructor aliases cannot be audited")
 				}
 			}
 			return true
@@ -149,11 +598,34 @@ func main() {
 			if !ok {
 				return true
 			}
+			// An in-process administrator call names one fixed route that
+			// already requires DSM administrators; the SDK verifies the account.
+			if selector.Sel.Name == "InvokeAsAdministrator" {
+				method := ""
+				if len(call.Args) == 4 {
+					switch arg := call.Args[2].(type) {
+					case *ast.BasicLit:
+						if arg.Kind == token.STRING {
+							method, _ = strconv.Unquote(arg.Value)
+						}
+					case *ast.Ident:
+						method = constants[arg.Name]
+					}
+				}
+				if method == "" {
+					problem(call.Pos(), "dynamic InvokeAsAdministrator method cannot be audited; name a literal method")
+				} else if in.Permissions[method] != "administrators" {
+					problem(call.Pos(), "InvokeAsAdministrator requires a method declared administrators in permissions.json: "+method)
+				}
+			}
 			pkg, ok := selector.X.(*ast.Ident)
 			if !ok {
 				return true
 			}
 			module := imports[pkg.Name]
+			if module == "net/http/cgi" && selector.Sel.Name == "Serve" && len(call.Args) > 0 && reusesBoundary(call.Args[0], src, sources, safe, map[ast.Node]bool{}) {
+				problem(call.Pos(), "private or raw HTTP handler reused outside its SDK boundary")
+			}
 			if module == "github.com/synopackageland/syno-pkg-land-sdk/dsm" && selector.Sel.Name == "NewEntryGate" {
 				out.EntryGate = true
 			}
@@ -161,13 +633,17 @@ func main() {
 				return true
 			}
 			switch selector.Sel.Name {
-			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch":
+			case "Handle", "HandleRequest", "HandleResponse", "HandleStream", "HandleRequestBatch", "HandleHTTP", "HandleIntegration":
 			default:
 				return true
 			}
 			method := ""
-			if len(call.Args) > 0 {
-				switch arg := call.Args[0].(type) {
+			index := 0
+			if selector.Sel.Name == "HandleHTTP" {
+				index = 1
+			}
+			if len(call.Args) > index {
+				switch arg := call.Args[index].(type) {
 				case *ast.BasicLit:
 					if arg.Kind == token.STRING {
 						method, _ = strconv.Unquote(arg.Value)
@@ -181,14 +657,42 @@ func main() {
 			} else if _, declared := in.Permissions[method]; !declared && !sdk[method] {
 				problem(call.Pos(), "registered method missing from permissions.json: "+method)
 			}
+			// Only HandleIntegration skips the DSM session; the permission
+			// value and the constructor must agree in both directions.
+			if (selector.Sel.Name == "HandleIntegration") != (in.Permissions[method] == "integration") {
+				problem(call.Pos(), "the integration permission requires api.HandleIntegration, and api.HandleIntegration requires the integration permission")
+			}
+			if selector.Sel.Name == "HandleIntegration" && method != "" {
+				out.HTTPRoutes = append(out.HTTPRoutes, httpRoute{"?method=" + method, method})
+			}
+			if selector.Sel.Name == "HandleHTTP" {
+				prefix := ""
+				if len(call.Args) > 0 {
+					prefix = stringLiteral(call.Args[0])
+				}
+				if !regexp.MustCompile(`^/([A-Za-z0-9_-]+/)+$`).MatchString(prefix) {
+					problem(call.Pos(), "HTTP prefix must be a fixed literal full-segment path ending in /")
+				}
+				for _, reserved := range []string{"/_sso/", "/_spl/", "/api/", "/api.cgi/", "/rpc/", "/webman/", "/cgi/"} {
+					if strings.HasPrefix(prefix, reserved) || strings.HasPrefix(reserved, prefix) {
+						problem(call.Pos(), "HTTP prefix overlaps a reserved path")
+					}
+				}
+				if sdk[method] || in.Permissions[method] != "authenticated" && in.Permissions[method] != "administrators" {
+					problem(call.Pos(), "HTTP routes require an explicit App authenticated or administrators permission")
+				}
+				for _, other := range out.HTTPRoutes {
+					if strings.HasPrefix(prefix, other.Prefix) || strings.HasPrefix(other.Prefix, prefix) {
+						problem(call.Pos(), "HTTP prefixes must not overlap")
+					}
+				}
+				out.HTTPRoutes = append(out.HTTPRoutes, httpRoute{prefix, method})
+			}
 			return true
 		})
-		return nil
-	})
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(1)
 	}
+	sort.Strings(out.Problems)
+	sort.Slice(out.HTTPRoutes, func(i, j int) bool { return out.HTTPRoutes[i].Prefix < out.HTTPRoutes[j].Prefix })
 	if err := json.NewEncoder(os.Stdout).Encode(out); err != nil {
 		os.Exit(1)
 	}