@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/grant_repository_linux_test.go

@@ -0,0 +1,469 @@
+//go:build linux
+
+package helper
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"golang.org/x/sys/unix"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func rootGrantFixture(t *testing.T) (string, Inventory, Record) {
+	t.Helper()
+	if os.Geteuid() != 0 {
+		t.Skip("requires disposable Linux root VM")
+	}
+	dir, err := os.MkdirTemp("/run", "s3-grants-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { os.RemoveAll(dir) })
+	store, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+	if c != "" {
+		t.Fatal(c)
+	}
+	g := store.Grants[0]
+	record := Record{Schema: 2, Inventory: g.Inventory, Enabled: true, Lifecycle: &Lifecycle{Schema: 2, Epoch: g.LastValidated.Epoch, Phase: "running", Binding: Binding{Entered: 1, Boot: "fixture-boot", Install: grantRef('7')}}}
+	if err := writeProtected(dir, "approval.json", record); err != nil {
+		t.Fatal(err)
+	}
+	return dir, g.Inventory, record
+}
+func openRootGrantRepository(t *testing.T, dir string, i Inventory) *FileGrantRepository {
+	t.Helper()
+	r, c := OpenFileGrantRepository(dir, i)
+	if c != "" {
+		t.Fatal(c)
+	}
+	t.Cleanup(func() { r.Close() })
+	return r
+}
+func diskGrantSnapshot(t *testing.T, r *FileGrantRepository) (GrantPolicy, GrantStore) {
+	t.Helper()
+	var p GrantPolicy
+	var s GrantStore
+	if c := r.Transact(func(policy GrantPolicy, store *GrantStore) (bool, Code) { p = policy; s = *store; return false, "" }); c != "" {
+		t.Fatal(c)
+	}
+	return p, s
+}
+func insertDiskGrant(t *testing.T, r *FileGrantRepository) Grant {
+	t.Helper()
+	var g Grant
+	code := r.Transact(func(p GrantPolicy, s *GrantStore) (bool, Code) {
+		fixture, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+		if c != "" {
+			t.Fatal(c)
+		}
+		g = fixture.Grants[0]
+		g.Inventory = p.Inventory
+		g.ApprovalBinding = p.ApprovalBinding
+		g.CapabilityDigest = p.CapabilityDigest
+		g.LastValidated.Epoch = p.Epoch
+		s.Grants = append(s.Grants, g)
+		s.Revision++
+		return true, ""
+	})
+	if code != "" {
+		t.Fatal(code)
+	}
+	return g
+}
+func TestGrantDiskDurabilityPermissionsAndSingleOwner(t *testing.T) {
+	dir, i, _ := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	if other, c := OpenFileGrantRepository(dir, i); c != ErrBusy || other != nil {
+		t.Fatal("multiple ordering owners", c)
+	}
+	g := insertDiskGrant(t, r)
+	p, s := diskGrantSnapshot(t, r)
+	if p.ApprovalBinding == "" || s.Grants[0].ID != g.ID || s.Revision != 2 {
+		t.Fatal("disk snapshot")
+	}
+	info, err := os.Stat(filepath.Join(dir, "grants.json"))
+	if err != nil || info.Mode().Perm() != 0600 {
+		t.Fatal("private snapshot", err)
+	}
+	if err := r.Close(); err != nil {
+		t.Fatal(err)
+	}
+	reopened := openRootGrantRepository(t, dir, i)
+	if _, code := NewGrantAuthority(reopened, nil, nil, nil); code != "" {
+		t.Fatal(code)
+	}
+	_, s = diskGrantSnapshot(t, reopened)
+	if s.Grants[0].State != GrantSuspended || s.Grants[0].Revision != g.Revision+1 || s.Revision != 3 {
+		t.Fatal("restart restored active record")
+	}
+}
+func TestGrantDiskRefusesUntrustedArtifacts(t *testing.T) {
+	for _, kind := range []string{"file-symlink", "parent-symlink", "writable-parent", "file-mode", "owner", "hardlink", "oversize", "bad-schema", "duplicate", "fifo", "policy-symlink", "policy-mode", "lock-symlink"} {
+		t.Run(kind, func(t *testing.T) {
+			dir, i, _ := rootGrantFixture(t)
+			name := filepath.Join(dir, "grants.json")
+			snapshot := []byte(`{"grantSchema":1,"storeRevision":1,"grants":[]}`)
+			if err := os.WriteFile(name, snapshot, 0600); err != nil {
+				t.Fatal(err)
+			}
+			switch kind {
+			case "file-symlink":
+				os.Remove(name)
+				os.Symlink("approval.json", name)
+			case "parent-symlink":
+				link := dir + "-link"
+				if err := os.Symlink(dir, link); err != nil {
+					t.Fatal(err)
+				}
+				t.Cleanup(func() { os.Remove(link) })
+				dir = link
+			case "writable-parent":
+				os.Chmod(dir, 0777)
+			case "file-mode":
+				os.Chmod(name, 0644)
+			case "owner":
+				os.Chown(name, 1001, 1001)
+			case "hardlink":
+				os.Link(name, filepath.Join(dir, "alias"))
+			case "oversize":
+				os.WriteFile(name, bytes.Repeat([]byte{' '}, MaxGrantStoreBytes+1), 0600)
+			case "bad-schema":
+				os.WriteFile(name, []byte(`{"grantSchema":99,"storeRevision":1,"grants":[]}`), 0600)
+			case "duplicate":
+				os.WriteFile(name, []byte(`{"grantSchema":1,"grantSchema":1,"storeRevision":1,"grants":[]}`), 0600)
+			case "fifo":
+				os.Remove(name)
+				if err := makeGrantFIFO(name); err != nil {
+					t.Fatal(err)
+				}
+			case "policy-symlink":
+				os.Remove(filepath.Join(dir, "approval.json"))
+				os.Symlink("grants.json", filepath.Join(dir, "approval.json"))
+			case "policy-mode":
+				os.Chmod(filepath.Join(dir, "approval.json"), 0666)
+			case "lock-symlink":
+				os.Symlink("approval.json", filepath.Join(dir, "grants.lock"))
+			}
+			r, code := OpenFileGrantRepository(dir, i)
+			if code == "" {
+				defer r.Close()
+				code = r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
+					t.Fatal("untrusted disk reached mutation")
+					return false, ""
+				})
+			}
+			if code == "" {
+				t.Fatal("accepted", kind)
+			}
+		})
+	}
+}
+func TestGrantDiskFsyncRenameCrashGaps(t *testing.T) {
+	for _, stage := range []string{"write", "file-sync", "rename", "after-rename", "directory-sync"} {
+		t.Run(stage, func(t *testing.T) {
+			dir, i, _ := rootGrantFixture(t)
+			r := openRootGrantRepository(t, dir, i)
+			g := insertDiskGrant(t, r)
+			r.fault = func(where string) error {
+				if where == stage {
+					return errors.New("fixture disk failure")
+				}
+				return nil
+			}
+			code := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
+				s.Grants[0].State = GrantRevoked
+				s.Grants[0].Reason = ErrRevoked
+				s.Grants[0].RevokedAt = g.CreatedAt + 1
+				s.Grants[0].Revision++
+				s.Revision++
+				return true, ""
+			})
+			want := ErrUnavailable
+			if stage == "after-rename" || stage == "directory-sync" {
+				want = ErrCommitUncertain
+			}
+			if code != want {
+				t.Fatal(code, want)
+			}
+			if code := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) { t.Fatal("failed owner continued"); return false, "" }); code != ErrFenced {
+				t.Fatal(code)
+			}
+			r.Close()
+			reopened := openRootGrantRepository(t, dir, i)
+			if _, code := NewGrantAuthority(reopened, nil, nil, nil); code != "" {
+				t.Fatal(code)
+			}
+			_, snapshot := diskGrantSnapshot(t, reopened)
+			expected := GrantSuspended
+			if want == ErrCommitUncertain {
+				expected = GrantRevoked
+			}
+			if snapshot.Grants[0].State != expected {
+				t.Fatal(snapshot.Grants[0].State, expected)
+			}
+			// Reconsent cannot reuse the old grant ID or undo its revocation.
+		})
+	}
+}
+func TestGrantDiskReplayAndImmutableTombstones(t *testing.T) {
+	dir, i, _ := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	g := insertDiskGrant(t, r)
+	old, err := os.ReadFile(filepath.Join(dir, "grants.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
+		s.Grants[0].State = GrantRevoked
+		s.Grants[0].Reason = ErrRevoked
+		s.Grants[0].RevokedAt = g.CreatedAt + 1
+		s.Grants[0].Revision++
+		s.Revision++
+		return true, ""
+	}); code != "" {
+		t.Fatal(code)
+	}
+	if code := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
+		s.Grants = s.Grants[:0]
+		s.Revision++
+		return true, ""
+	}); code != ErrDenied {
+		t.Fatal("tombstone dropped", code)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "grants.json"), old, 0600); err != nil {
+		t.Fatal(err)
+	}
+	if code := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) { t.Fatal("replayed disk authority"); return false, "" }); code != ErrStale {
+		t.Fatal(code)
+	}
+}
+func TestGrantDiskTwoSnapshotCrashAndPolicyLocks(t *testing.T) {
+	dir, i, record := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	insertDiskGrant(t, r)
+	// approval and grants are NOT multi-file atomic. Crash after either changes
+	// always reconciles active grants before exposing the new owner.
+	record.Lifecycle.Epoch = grantRef('9')
+	if err := writeProtected(dir, "approval.json", record); err != nil {
+		t.Fatal(err)
+	}
+	r.Close()
+	r = openRootGrantRepository(t, dir, i)
+	if _, c := NewGrantAuthority(r, nil, nil, nil); c != "" {
+		t.Fatal(c)
+	}
+	p, s := diskGrantSnapshot(t, r)
+	if p.Epoch != record.Lifecycle.Epoch || s.Grants[0].State != GrantSuspended {
+		t.Fatal("two snapshot crash restored authority")
+	}
+	held := holdGrantTestLock(t, dir, "policy.lock")
+	if c := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
+		t.Fatal("blocked lock entered callback")
+		return false, ""
+	}); c != ErrBusy {
+		t.Fatal(c)
+	}
+	held.Close()
+	held = holdGrantTestLock(t, dir, "grants.lock")
+	if c := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
+		t.Fatal("blocked grant lock entered callback")
+		return false, ""
+	}); c != ErrBusy {
+		t.Fatal(c)
+	}
+	held.Close()
+}
+func TestGrantDiskQIsSeparateDurableBoundedArtifact(t *testing.T) {
+	dir, i, _ := rootGrantFixture(t)
+	r := openRootGrantRepository(t, dir, i)
+	g := insertDiskGrant(t, r)
+	p, _ := diskGrantSnapshot(t, r)
+	key := GrantDrainKey{p.Epoch, g.ID, g.Revision}
+	if c := r.SaveQuiescence(completeGrantProof(key)); c != ErrStale {
+		t.Fatal("Q before R", c)
+	}
+	if c := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
+		s.Grants[0].State = GrantRevoked
+		s.Grants[0].Reason = ErrRevoked
+		s.Grants[0].RevokedAt = g.CreatedAt + 1
+		s.Grants[0].Revision++
+		s.Revision++
+		return true, ""
+	}); c != "" {
+		t.Fatal(c)
+	}
+	key.Revision++
+	q := completeGrantProof(key)
+	if c := r.SaveQuiescence(q); c != "" {
+		t.Fatal(c)
+	}
+	name := filepath.Join(dir, "grant-q-"+g.ID+".json")
+	info, err := os.Stat(name)
+	if err != nil || info.Mode().Perm() != 0600 {
+		t.Fatal("Q artifact", err)
+	}
+	q.RelayClosed = false
+	if c := r.SaveQuiescence(q); c != ErrInvalid {
+		t.Fatal("incomplete durable Q", c)
+	}
+	r.fault = func(stage string) error {
+		if stage == "directory-sync" {
+			return errors.New("fixture Q failure")
+		}
+		return nil
+	}
+	if c := r.SaveQuiescence(completeGrantProof(key)); c != ErrCommitUncertain {
+		t.Fatal("Q directory fsync", c)
+	}
+}
+func makeGrantFIFO(name string) error { return unix.Mkfifo(name, 0600) }
+func holdGrantTestLock(t *testing.T, dir, name string) *os.File {
+	t.Helper()
+	f, err := os.OpenFile(filepath.Join(dir, name), os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = unix.Flock(int(f.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { f.Close() })
+	return f
+}
+
+func TestGrantDiskRealCrashRecovery(t *testing.T) {
+	for _, stage := range []string{"file-sync", "rename", "after-rename", "directory-sync"} {
+		t.Run(stage, func(t *testing.T) {
+			dir, i, _ := rootGrantFixture(t)
+			r := openRootGrantRepository(t, dir, i)
+			insertDiskGrant(t, r)
+			r.Close()
+			exe, err := os.Executable()
+			if err != nil {
+				t.Fatal(err)
+			}
+			cmd := exec.Command(exe, "-test.run=^TestGrantDiskCrashSubprocess$")
+			cmd.Env = append(os.Environ(), "S3_CRASH_DIR="+dir, "S3_CRASH_STAGE="+stage)
+			output, err := cmd.CombinedOutput()
+			var exit *exec.ExitError
+			if !errors.As(err, &exit) || exit.ExitCode() != 73 {
+				t.Fatalf("crash fixture: %s %v", output, err)
+			}
+			reopened := openRootGrantRepository(t, dir, i)
+			if _, c := NewGrantAuthority(reopened, nil, nil, nil); c != "" {
+				t.Fatal(c)
+			}
+			_, s := diskGrantSnapshot(t, reopened)
+			want := GrantSuspended
+			if stage == "after-rename" || stage == "directory-sync" {
+				want = GrantRevoked
+			}
+			if s.Grants[0].State != want {
+				t.Fatal(s.Grants[0].State, want)
+			}
+			leftovers, err := filepath.Glob(filepath.Join(dir, ".grant-transition-*"))
+			if err != nil || len(leftovers) != 0 {
+				t.Fatal("unbounded orphan temps", leftovers, err)
+			}
+		})
+	}
+}
+func TestGrantDiskCrashSubprocess(t *testing.T) {
+	dir := os.Getenv("S3_CRASH_DIR")
+	if dir == "" {
+		t.Skip("subprocess only")
+	}
+	s, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
+	if c != "" {
+		t.Fatal(c)
+	}
+	r, c := OpenFileGrantRepository(dir, s.Grants[0].Inventory)
+	if c != "" {
+		t.Fatal(c)
+	}
+	r.fault = func(stage string) error {
+		if stage == os.Getenv("S3_CRASH_STAGE") {
+			os.Exit(73)
+		}
+		return nil
+	}
+	c = r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
+		g := &s.Grants[0]
+		g.State = GrantRevoked
+		g.Reason = ErrRevoked
+		g.RevokedAt = g.CreatedAt + 1
+		g.Revision++
+		s.Revision++
+		return true, ""
+	})
+	t.Fatal("did not crash", c)
+}
+
+func TestGrantDiskNonrootProcess(t *testing.T) {
+	i := Inventory{Package: "Fixture", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: grantRef('a'), RegistryDigest: grantRef('b')}
+	if os.Getenv("S3_NONROOT") == "yes" {
+		if os.Geteuid() == 0 {
+			t.Fatal("fixture not dropped")
+		}
+		if r, c := OpenFileGrantRepository("/run", i); c != ErrDenied || r != nil {
+			t.Fatal("nonroot authority", c)
+		}
+		return
+	}
+	if os.Geteuid() != 0 {
+		t.Skip("requires disposable Linux root VM")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	cmd := exec.Command(exe, "-test.run=^TestGrantDiskNonrootProcess$")
+	cmd.Env = append(os.Environ(), "S3_NONROOT=yes")
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 1001, Gid: 1001}}
+	if output, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("nonroot fixture: %s %v", output, err)
+	}
+}
+
+func TestGrantDiskAuthorityEndToEnd(t *testing.T) {
+	dir, i, _ := rootGrantFixture(t)
+	repository := openRootGrantRepository(t, dir, i)
+	fixture, _, p, _, _, v, carriers, now := grantAuthorityFixture(t)
+	authority, code := NewGrantAuthority(repository, p, v, fixture.cohort)
+	if code != "" {
+		t.Fatal(code)
+	}
+	authority.now = func() time.Time { return now }
+	intent := prepareGrant(t, authority, carriers, ScopePersonal)
+	_, initial := diskGrantSnapshot(t, repository)
+	grant, code := authority.Confirm(context.Background(), carriers, intent.ID, intent.SummaryDigest, initial.Revision)
+	if code != "" {
+		t.Fatal(code)
+	}
+	admission := admissionFor(t, p, carriers, grant)
+	if code := authority.WithGrantAdmission(admission, func(Grant, NativeActor) Code { return "" }); code != "" {
+		t.Fatal(code)
+	}
+	result, code := authority.Revoke(context.Background(), carriers, grant.ID, 1, initial.Revision+1)
+	if code != "" || !result.Revoked || !result.Drained {
+		t.Fatal(result, code)
+	}
+	if code := authority.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("revoked disk admitted"); return "" }); code != ErrRevoked {
+		t.Fatal(code)
+	}
+	repository.Close()
+	repository = openRootGrantRepository(t, dir, i)
+	_, code = NewGrantAuthority(repository, p, v, fixture.cohort)
+	if code != "" {
+		t.Fatal(code)
+	}
+	_, s := diskGrantSnapshot(t, repository)
+	if len(s.Grants) != 1 || s.Grants[0].State != GrantRevoked || s.Grants[0].Revision != 2 {
+		t.Fatal("R lost after reopen")
+	}
+}

package/templates/native-go/backend/internal/helper/grant_rpc.go

@@ -0,0 +1,147 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+)
+
+// Private root-helper -> sole root-supervisor control. Session carriers exist
+// only in this bounded frame; they are never echoed, logged or retained.
+type grantCarriers struct {
+	Cookie        string `json:"cookie"`
+	SynoToken     string `json:"synoToken"`
+	ClientAddress string `json:"clientAddress"`
+}
+type supervisorGrantRequest struct {
+	Epoch    string          `json:"epoch"`
+	Method   string          `json:"method"`
+	Carriers grantCarriers   `json:"carriers"`
+	Args     json.RawMessage `json:"args"`
+}
+type grantPrepareArgs struct {
+	CandidateID string    `json:"candidateId"`
+	ScopeKind   ScopeKind `json:"scopeKind"`
+	Actions     []Action  `json:"actions"`
+}
+type grantConfirmArgs struct {
+	IntentID      string `json:"intentId"`
+	SummaryDigest string `json:"summaryDigest"`
+	StoreRevision uint64 `json:"storeRevision"`
+}
+type grantRevokeArgs struct {
+	GrantID       string `json:"grantId"`
+	GrantRevision uint64 `json:"grantRevision"`
+	StoreRevision uint64 `json:"storeRevision"`
+}
+type supervisorGrantResponse struct {
+	Nonce    string           `json:"nonce"`
+	Code     Code             `json:"code"`
+	Intent   *Intent          `json:"intent,omitempty"`
+	Grant    *Grant           `json:"grant,omitempty"`
+	Files    *readOnlyResult  `json:"files,omitempty"`
+	Mutation *MutationReceipt `json:"mutation,omitempty"`
+	Revoke   *RevokeResult    `json:"revoke,omitempty"`
+}
+
+func (s *supervisorGrants) dispatch(ctx context.Context, peer operationPeer, nonce string, raw []byte) supervisorGrantResponse {
+	res := supervisorGrantResponse{Nonce: nonce}
+	if s == nil || !s.cohort.peerAllowed(peer) {
+		res.Code = ErrDenied
+		return res
+	}
+	if !allReferences(nonce) {
+		res.Code = ErrInvalid
+		return res
+	}
+	var req supervisorGrantRequest
+	if res.Code = decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); res.Code != "" {
+		return res
+	}
+	if req.Epoch != s.cohort.epoch {
+		res.Code = ErrStale
+		return res
+	}
+	if len(req.Carriers.Cookie) > 4096 || len(req.Carriers.SynoToken) > 4096 || len(req.Carriers.ClientAddress) > 256 {
+		res.Code = ErrLimit
+		return res
+	}
+	// Validate method-specific shape before burning a bounded RPC nonce.
+	var prepare grantPrepareArgs
+	var confirm grantConfirmArgs
+	var revoke grantRevokeArgs
+	var data DataRequest
+	var dst any
+	switch req.Method {
+	case "prepare":
+		dst = &prepare
+	case "confirm":
+		dst = &confirm
+	case "revoke":
+		dst = &revoke
+	case "operation.start", "operation.chunk", "operation.result", "operation.commit":
+		dst = &data
+	default:
+		res.Code = ErrUnsupported
+		return res
+	}
+	if res.Code = decodeDataObject(bytes.NewReader(req.Args), dst, MaxControlBytes); res.Code != "" {
+		return res
+	}
+	if s.rpcNonces[nonce] || s.streamRPCNonces[nonce] {
+		res.Code = ErrReplay
+		return res
+	}
+	stream := data.Op == ActionReadStream || data.Op == ActionWriteStream || data.Op == ActionPublish
+	if stream {
+		if res.Code = validateOperationRequest(data, s.services.writes); res.Code != "" {
+			return res
+		}
+	}
+	full := len(s.rpcNonces) >= MaxReplayEntries
+	if stream {
+		full = len(s.streamRPCNonces) >= MaxStreamReplayEntries
+	}
+	if full {
+		res.Code = ErrBusy
+		return res
+	}
+	if stream {
+		s.streamRPCNonces[nonce] = true
+	} else {
+		s.rpcNonces[nonce] = true
+	}
+	carriers := SessionCarriers{req.Carriers.Cookie, req.Carriers.SynoToken, req.Carriers.ClientAddress}
+	switch req.Method {
+	case "prepare":
+		value, code := s.authority.Prepare(ctx, carriers, prepare.CandidateID, prepare.ScopeKind, prepare.Actions)
+		res.Code = code
+		if code == "" {
+			res.Intent = &value
+		}
+	case "confirm":
+		value, code := s.authority.Confirm(ctx, carriers, confirm.IntentID, confirm.SummaryDigest, confirm.StoreRevision)
+		res.Code = code
+		if code == "" {
+			res.Grant = &value
+		}
+	case "revoke":
+		value, code := s.authority.Revoke(ctx, carriers, revoke.GrantID, revoke.GrantRevision, revoke.StoreRevision)
+		res.Code = code
+		res.Revoke = &value
+	case "operation.start":
+		res.Code = s.start(ctx, peer, carriers, data)
+	case "operation.chunk":
+		res.Code = s.chunk(ctx, peer, carriers, data)
+	case "operation.commit":
+		res.Code = s.writeControl(ctx, peer, carriers, data, true)
+	case "operation.result":
+		if !data.Op.ReadOnly() {
+			res.Mutation, res.Code = s.writeResult(ctx, peer, carriers, data)
+		} else {
+			res.Files, res.Code = s.result(ctx, peer, carriers, data)
+		}
+	}
+	res.Code = safeGrantCode(res.Code)
+	return res
+}

package/templates/native-go/backend/internal/helper/grant_rpc_test.go

@@ -0,0 +1,51 @@
+package helper
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+func grantRPC(t *testing.T, method string, epoch string, carriers SessionCarriers, args any) []byte {
+	t.Helper()
+	raw, _ := json.Marshal(args)
+	b, _ := json.Marshal(supervisorGrantRequest{Epoch: epoch, Method: method, Carriers: grantCarriers{carriers.Cookie, carriers.SynoToken, carriers.ClientAddress}, Args: raw})
+	return b
+}
+func TestGrantRPCExactPeerAndStrictControls(t *testing.T) {
+	s, r, c, carriers, g, _ := grantCohortFixture(t)
+	valid := grantRPC(t, "revoke", c.epoch, carriers, grantRevokeArgs{g.ID, g.Revision, r.store.Revision})
+	for _, peer := range []operationPeer{{41, 0}, {42, 1}} {
+		if res := s.dispatch(context.Background(), peer, grantRef('a'), valid); res.Code != ErrDenied {
+			t.Fatal(res)
+		}
+	}
+	for _, b := range [][]byte{bytes.Replace(valid, []byte(`"method":"revoke"`), []byte(`"method":"revoke","method":"prepare"`), 1), append(valid, valid...), bytes.Replace(valid, []byte(`"grantId"`), []byte(`"callerUID"`), 1)} {
+		if res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('b'), b); res.Code != ErrInvalid {
+			t.Fatal(res)
+		}
+	}
+	if res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('c'), grantRPC(t, "revoke", grantRef('f'), carriers, grantRevokeArgs{g.ID, g.Revision, r.store.Revision})); res.Code != ErrStale {
+		t.Fatal(res)
+	}
+	res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('d'), valid)
+	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained || r.q.Cohort == nil {
+		t.Fatal(res)
+	}
+	if res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('d'), valid); res.Code != ErrReplay {
+		t.Fatal(res)
+	}
+}
+func TestGrantRPCPrepareConfirmAndFence(t *testing.T) {
+	s, r, c, carriers, _, _ := grantCohortFixture(t)
+	res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('a'), grantRPC(t, "prepare", c.epoch, carriers, grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}))
+	if res.Code != "" || res.Intent == nil {
+		t.Fatal(res)
+	}
+	c.gate.fence("observer")
+	res = s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('b'), grantRPC(t, "confirm", c.epoch, carriers, grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, r.store.Revision}))
+	if res.Code != ErrFenced {
+		t.Fatal(res)
+	}
+}