@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/nas_shipped_refusal_linux_test.go

@@ -0,0 +1,97 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+// Use fixture authority only as a canary for mutation. The services under test
+// are the exact shipped assembly: no native/consent/operation/output adapter.
+func TestS8ShippedAssemblyRefusesWithoutNativeActorOrChildren(t *testing.T) {
+	for _, user := range []string{"normal1", "normal2", "admin"} {
+		s, repo, cohort, _, grant, children := grantCohortFixture(t)
+		services := supervisorGrantAdapters(Client{})
+		if services.native != nil || services.consent != nil || services.operations != nil || services.output != nil {
+			t.Fatal("production installed an adapter")
+		}
+		s.services = services
+		s.authority.native = services.native
+		s.authority.consent = services.consent
+		before, _ := json.Marshal(repo.store)
+		commits := repo.commits
+		carriers := SessionCarriers{Cookie: user, SynoToken: "untrusted", ClientAddress: "127.0.0.1"}
+		if _, code := services.native.Resolve(context.Background(), carriers); code != ErrUnavailable {
+			t.Fatal("missing native actor", code)
+		}
+		for _, kind := range []ScopeKind{ScopePersonal, ScopeShared} {
+			if anchors, code := services.native.Discover(context.Background(), carriers, nil, kind, 1); code != ErrUnavailable || len(anchors) != 0 {
+				t.Fatal("native discovery", code, anchors)
+			}
+		}
+		cases := []struct {
+			method string
+			args   any
+		}{
+			{"prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}},
+			{"prepare", grantPrepareArgs{grantRef('c'), ScopeShared, []Action{ActionRead}}},
+			{"confirm", grantConfirmArgs{grantRef('c'), grantRef('d'), repo.store.Revision}},
+		}
+		for n, c := range cases {
+			res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef(byte('a'+n)), grantRPC(t, c.method, cohort.epoch, carriers, c.args))
+			want := ErrUnavailable
+			if c.method == "confirm" {
+				want = ErrReplay
+			} // No known intent; retain the safe replay distinction.
+			if res.Code != want || res.Grant != nil || res.Intent != nil || res.Files != nil {
+				t.Fatal(user, c.method, res)
+			}
+		}
+		for n, action := range []Action{ActionStat, ActionList, ActionRead, ActionReadStream, ActionCreate, ActionWriteStream, ActionPublish} {
+			req := grantControl(t, grant, '1', byte('1'+n), '3', 1)
+			req.Op = action
+			args := any(ReadArgs{Segments: []string{"fixture"}, MaxBytes: 1})
+			switch action {
+			case ActionStat:
+				args = StatArgs{Segments: []string{"fixture"}}
+			case ActionList:
+				args = ListArgs{Segments: []string{"fixture"}, Limit: 1}
+			case ActionCreate:
+				args = CreateArgs{Segments: []string{"fixture"}, Bytes: 1, Exclusive: true}
+			case ActionWriteStream:
+				args = WriteStreamArgs{Segments: []string{"fixture"}, MaxBytes: 1}
+			case ActionPublish:
+				args = PublishArgs{StageID: grantRef('c'), NoOverwrite: true}
+			}
+			req.Args, _ = json.Marshal(args)
+			// Implemented reads require a native actor; staged writes remain unsupported.
+			// Neither failure may bootstrap a child or mutate authority.
+			res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef(byte('1'+n)), grantRPC(t, "operation.start", cohort.epoch, carriers, req))
+			if (action.ReadOnly() && res.Code != ErrUnavailable) || (!action.ReadOnly() && res.Code != ErrUnsupported) || res.Files != nil || res.Grant != nil {
+				t.Fatal(user, action, res)
+			}
+		}
+		after, _ := json.Marshal(repo.store)
+		if string(before) != string(after) || repo.commits != commits || len(*children) != 0 || len(cohort.operations) != 0 {
+			t.Fatal("refusal mutated grant or started child")
+		}
+	}
+}
+
+func TestS1RShippedModeStillRefusesUncertifiedDSMAdapters(t *testing.T) {
+	i := Inventory{Package: "Fixture", Version: "1.0.0-0001", Protocol: DataProtocol, PayloadDigest: grantRef('a'), RegistryDigest: grantRef('b'), DataAccess: "relaxed"}
+	services := supervisorGrantAdapters(NewClient(i))
+	if services.native == nil || services.native.relaxed == nil {
+		t.Fatal("relaxed policy was not selected")
+	}
+	if actor, code := services.native.Resolve(context.Background(), SessionCarriers{}); code != ErrUnavailable || actor.valid {
+		t.Fatal("unproved adapter minted actor", code)
+	}
+	if services.consent != nil || services.operations != nil || services.output != nil || services.writes.Create || services.writes.Stream || services.writes.Publish {
+		t.Fatal("relaxed mode enabled uncertified data/write capability")
+	}
+	i.DataAccess = ""
+	if supervisorGrantAdapters(NewClient(i)).native != nil {
+		t.Fatal("default policy silently enabled relaxed")
+	}
+}

package/templates/native-go/backend/internal/helper/native_discovery.go

@@ -0,0 +1,79 @@
+package helper
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+// Discover returns bounded metadata only. Fresh native checks bracket discovery;
+// no result is returned if the actor changed while the adapter was running.
+// This is not a cursor/intent/grant store or a filesystem resolver.
+func (p *NativeProvider) Discover(ctx context.Context, carriers SessionCarriers, adapter NativeDiscoveryAdapter, kind ScopeKind, limit int) ([]DiscoveryAnchor, Code) {
+	if kind != ScopePersonal && kind != ScopeShared {
+		return nil, ErrUnsupported
+	}
+	if limit < 1 || limit > MaxPageEntries {
+		return nil, ErrLimit
+	}
+	if adapter == nil {
+		return nil, ErrUnavailable
+	}
+	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
+	defer cancel()
+	actor, c := p.Resolve(ctx, carriers)
+	if c != "" {
+		return nil, c
+	}
+	observation, c := adapter.DiscoverAnchors(ctx, actor, kind, limit)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return nil, c
+	}
+	current, c := p.Revalidate(ctx, carriers, actor)
+	if c != "" {
+		return nil, c
+	}
+	if observation.Principal != current.Principal() || observation.SessionRef != current.SessionRef() {
+		return nil, ErrDenied
+	}
+	if !nativeFresh(observation.CheckedAt, p.now()) {
+		return nil, ErrStale
+	}
+	if observation.Anchors == nil {
+		return nil, ErrUnavailable
+	}
+	if len(observation.Anchors) > limit {
+		return nil, ErrLimit
+	}
+	if kind == ScopePersonal && len(observation.Anchors) > 1 {
+		return nil, ErrUnavailable
+	}
+	seen := make(map[string]bool, len(observation.Anchors))
+	for _, anchor := range observation.Anchors {
+		if anchor.Kind != kind || (kind == ScopePersonal && anchor.Owner != current.Principal()) || (kind == ScopeShared && anchor.Owner != (Principal{})) {
+			return nil, ErrDenied
+		}
+		if !anchor.LocalFilesystem {
+			return nil, ErrUnsupported
+		}
+		if !digestPattern.MatchString(anchor.Ref) || seen[anchor.Ref] || !nativeDisplayName(anchor.DisplayName) {
+			return nil, ErrUnavailable
+		}
+		seen[anchor.Ref] = true
+	}
+	encoded, err := json.Marshal(observation.Anchors)
+	if err != nil {
+		return nil, ErrUnavailable
+	}
+	if len(encoded) > MaxMetadataBytes {
+		return nil, ErrLimit
+	}
+	return slices.Clone(observation.Anchors), ""
+}
+
+func nativeDisplayName(name string) bool {
+	return name != "" && len(name) <= MaxSegmentBytes && utf8.ValidString(name) && !strings.ContainsAny(name, "/\\") && !strings.ContainsFunc(name, unicode.IsControl)
+}

package/templates/native-go/backend/internal/helper/native_identity.go

@@ -0,0 +1,89 @@
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// S1 contracts are staged: no provider is installed in the helper or CGI.
+// Implementations are trusted root-side adapters, never package-supplied claims.
+// They must obey ctx and return only closed safe codes, not native diagnostics.
+
+// SessionCarriers are transient secrets, not identity. The transport must derive
+// ClientAddress from its trusted peer/proxy policy. Never persist or log these.
+type SessionCarriers struct {
+	Cookie        string `json:"-"`
+	SynoToken     string `json:"-"`
+	ClientAddress string `json:"-"`
+}
+
+// NativeSessionValidator must revalidate the native session on EVERY call.
+// AccountInstanceRef must prove that this session belongs to the current account
+// incarnation; a username from authenticate.cgi alone cannot supply that proof.
+type NativeSessionValidator interface {
+	ValidateSession(context.Context, SessionCarriers) (NativeSession, Code)
+}
+
+type NativeSession struct {
+	Username           string
+	SessionRef         string // opaque server-side session binding, not a cookie hash
+	AccountInstanceRef string // proven incarnation, never a name/UID fingerprint
+	CheckedAt          time.Time
+}
+
+// LocalAccountProvider resolves a validated native username against the current
+// LOCAL account database. It must prove existence, enabled status, incarnation,
+// complete groups and current admin role in a coherent fresh observation.
+// Unknown incarnation is represented by an empty InstanceRef, not an invented ID.
+type LocalAccountProvider interface {
+	LookupLocalAccount(context.Context, string) (LocalAccount, Code)
+}
+
+type LocalAccount struct {
+	Principal Principal
+	Username  string
+	Enabled   bool
+	UID       uint32
+	GID       uint32
+	Groups    []uint32 // complete supplementary groups; nil means unknown
+	Admin     bool     // current native role, not UID==0 or a caller flag
+	CheckedAt time.Time
+}
+
+// NativeActor is an in-memory, read-only snapshot minted only by NativeProvider.
+// IdentityBasis distinguishes strict S1 from an explicit managed enrollment;
+// neither consumer nor serializer may reinterpret the latter as incarnation.
+// Zero values and serialized/restored snapshots are never admission authority.
+// S2 must revalidate before admitting work and own invalidation/cancel ordering.
+type NativeActor struct {
+	managed    *managedPilot
+	relaxed    *relaxedProvider
+	account    LocalAccount
+	sessionRef string
+	valid      bool
+}
+
+// NativeDiscoveryAdapter only discovers actor-visible local share anchors or
+// this actor's own home. It must enforce native visibility before returning any
+// metadata, never run discovery as admin on behalf of an ordinary actor, and
+// never open data files. Discovery is neither a grant nor an ACL/scope proof.
+type NativeDiscoveryAdapter interface {
+	DiscoverAnchors(context.Context, NativeActor, ScopeKind, int) (DiscoveryObservation, Code)
+}
+
+type DiscoveryObservation struct {
+	Principal  Principal
+	SessionRef string
+	CheckedAt  time.Time
+	Anchors    []DiscoveryAnchor // explicit empty slice means no visible anchors
+}
+
+// An anchor is a display candidate, not an absolute path or bearer authority.
+// Personal Owner must equal the actor; shared discovery carries no grant issuer.
+type DiscoveryAnchor struct {
+	Ref             string    `json:"ref"`
+	DisplayName     string    `json:"displayName"`
+	Kind            ScopeKind `json:"kind"`
+	Owner           Principal `json:"owner"`
+	LocalFilesystem bool      `json:"localFilesystem"`
+}

package/templates/native-go/backend/internal/helper/native_provider.go

@@ -0,0 +1,159 @@
+package helper
+
+import (
+	"context"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+type NativeProvider struct {
+	managed  *managedPilot
+	relaxed  *relaxedProvider
+	sessions NativeSessionValidator
+	accounts LocalAccountProvider
+	now      func() time.Time
+}
+
+func NewNativeProvider(s NativeSessionValidator, a LocalAccountProvider) *NativeProvider {
+	return &NativeProvider{sessions: s, accounts: a, now: time.Now}
+}
+
+func (a NativeActor) Principal() Principal { return a.account.Principal }
+func (a NativeActor) Username() string     { return a.account.Username }
+func (a NativeActor) SessionRef() string   { return a.sessionRef }
+func (a NativeActor) UID() uint32          { return a.account.UID }
+func (a NativeActor) GID() uint32          { return a.account.GID }
+func (a NativeActor) Groups() []uint32     { return slices.Clone(a.account.Groups) }
+func (a NativeActor) Admin() bool          { return a.valid && a.account.Admin }
+
+// Resolve performs fresh observations; it never caches sessions or credentials.
+// Success is only an identity snapshot, not file/grant/lifecycle admission.
+func (p *NativeProvider) Resolve(ctx context.Context, carriers SessionCarriers) (NativeActor, Code) {
+	if p != nil && p.relaxed != nil {
+		if p.now == nil {
+			return NativeActor{}, ErrUnavailable
+		}
+		return p.relaxed.resolve(ctx, carriers, func() time.Time { return p.now() })
+	}
+	if p != nil && p.managed != nil {
+		return p.managed.resolve(ctx, carriers)
+	}
+	if p == nil || p.sessions == nil || p.accounts == nil || p.now == nil {
+		return NativeActor{}, ErrUnavailable
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	if c := nativeContextCode(ctx); c != "" {
+		return NativeActor{}, c
+	}
+	if carriers.Cookie == "" {
+		return NativeActor{}, ErrDenied
+	}
+	s, c := p.sessions.ValidateSession(ctx, carriers)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return NativeActor{}, c
+	}
+	if s.Username == "" || !utf8.ValidString(s.Username) || strings.ContainsAny(s.Username, "\x00\r\n") || !digestPattern.MatchString(s.SessionRef) {
+		return NativeActor{}, ErrUnavailable
+	}
+	if s.AccountInstanceRef == "" {
+		return NativeActor{}, ErrSuspended
+	}
+	if !digestPattern.MatchString(s.AccountInstanceRef) {
+		return NativeActor{}, ErrUnavailable
+	}
+	if !nativeFresh(s.CheckedAt, p.now()) {
+		return NativeActor{}, ErrStale
+	}
+	a, c := p.accounts.LookupLocalAccount(ctx, s.Username)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return NativeActor{}, c
+	}
+	if a.Principal.Kind != "local" {
+		return NativeActor{}, ErrUnsupported
+	}
+	if !a.Enabled || a.Username != s.Username {
+		return NativeActor{}, ErrDenied
+	}
+	if a.Principal.InstanceRef == "" {
+		return NativeActor{}, ErrSuspended
+	}
+	if !digestPattern.MatchString(a.Principal.SubjectRef) || !digestPattern.MatchString(a.Principal.InstanceRef) || a.Groups == nil {
+		return NativeActor{}, ErrUnavailable
+	}
+	if a.Principal.InstanceRef != s.AccountInstanceRef {
+		return NativeActor{}, ErrSuspended
+	}
+	now := p.now()
+	if !nativeFresh(s.CheckedAt, now) || !nativeFresh(a.CheckedAt, now) {
+		return NativeActor{}, ErrStale
+	}
+	// Group order and duplicates do not change the credential set. Own the slice
+	// so neither a provider nor a consumer can mutate the admitted snapshot.
+	a.Groups = slices.Clone(a.Groups)
+	slices.Sort(a.Groups)
+	a.Groups = slices.Compact(a.Groups)
+	// Carry the oldest subject observation into later chunk deadlines. A newer
+	// account lookup must not extend an older native-session proof.
+	if s.CheckedAt.Before(a.CheckedAt) {
+		a.CheckedAt = s.CheckedAt
+	}
+	return NativeActor{account: a, sessionRef: s.SessionRef, valid: true}, ""
+}
+
+// Revalidate refuses old in-flight credentials after any identity/role change.
+// A caller may Resolve a new snapshot after stale; it must redo ACL/admission.
+// Suspension requires new consent, not replacement of the old grant's owner.
+func (p *NativeProvider) Revalidate(ctx context.Context, carriers SessionCarriers, old NativeActor) (NativeActor, Code) {
+	if !old.valid {
+		return NativeActor{}, ErrDenied
+	}
+	if p != nil && p.relaxed != nil {
+		if p.now == nil {
+			return NativeActor{}, ErrUnavailable
+		}
+		return p.relaxed.revalidate(ctx, carriers, old, func() time.Time { return p.now() })
+	}
+	if p == nil || old.managed != p.managed {
+		return NativeActor{}, ErrSuspended
+	}
+	current, c := p.Resolve(ctx, carriers)
+	if c != "" {
+		return NativeActor{}, c
+	}
+	a, b := old.account, current.account
+	if a.Principal != b.Principal || a.Username != b.Username || a.UID != b.UID || a.GID != b.GID {
+		return NativeActor{}, ErrSuspended
+	}
+	if old.sessionRef != current.sessionRef || a.Admin != b.Admin || !slices.Equal(a.Groups, b.Groups) {
+		return NativeActor{}, ErrStale
+	}
+	return current, ""
+}
+
+func nativeFresh(checkedAt, now time.Time) bool {
+	return !checkedAt.IsZero() && !now.IsZero() && !checkedAt.After(now) && now.Sub(checkedAt) <= NativeProofFreshness
+}
+
+func nativeContextCode(ctx context.Context) Code {
+	switch ctx.Err() {
+	case context.Canceled:
+		return ErrCanceled
+	case context.DeadlineExceeded:
+		return ErrTimeout
+	default:
+		return ""
+	}
+}
+
+func nativeObservationCode(ctx context.Context, code Code) Code {
+	if c := nativeContextCode(ctx); c != "" {
+		return c
+	}
+	if code != "" && !code.Valid() {
+		return ErrUnavailable
+	}
+	return code
+}