@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_rpc_contract.go

@@ -0,0 +1,70 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"time"
+)
+
+// Strict, fixed public arguments. No identity/role, epoch, approval or arbitrary
+// handler fields; the root owner constructs the execution binding.
+type sdkPrepareArgs struct {
+	Worker jobcontract.RevisionRef `json:"worker"`
+	Parent jobcontract.RevisionRef `json:"parent"`
+	Input  jobcontract.Input       `json:"input"`
+}
+type sdkSubmitArgs struct {
+	IntentID      string `json:"intentId"`
+	SummaryDigest string `json:"summaryDigest"`
+}
+type sdkStatusArgs struct {
+	Cursor string `json:"cursor,omitempty"`
+}
+type sdkLookupArgs struct {
+	IntentID string `json:"intentId"`
+}
+type sdkResultArgs struct {
+	JobID string `json:"jobId"`
+}
+type sdkCancelArgs struct {
+	JobID    string `json:"jobId"`
+	Revision uint64 `json:"revision"`
+}
+type sdkRevokeArgs struct {
+	JobID              string `json:"jobId"`
+	Revision           uint64 `json:"revision"`
+	DelegationRevision uint64 `json:"delegationRevision"`
+	StoreRevision      uint64 `json:"storeRevision"`
+}
+type sdkAttachArgs struct {
+	JobID    string `json:"jobId"`
+	AttachID string `json:"attachId"`
+}
+type sdkPrepared struct {
+	IntentID      string `json:"intentId"`
+	JobID         string `json:"jobId"`
+	SummaryDigest string `json:"summaryDigest"`
+	ExpiresAt     int64  `json:"expiresAt"`
+}
+type sdkInteractivePending struct {
+	request sdkJobRequest
+	expires time.Duration
+}
+
+// Package CGI -> owned helper -> sole supervisor. Carriers are bounded,
+// transient, and independently verified by the root native authority.
+type sdkWireRequest struct {
+	Inventory Inventory       `json:"inventory"`
+	Nonce     string          `json:"nonce"`
+	Method    string          `json:"method"`
+	Carriers  grantCarriers   `json:"carriers"`
+	Args      json.RawMessage `json:"args"`
+}
+type sdkWireResponse struct {
+	Inventory Inventory       `json:"inventory"`
+	Nonce     string          `json:"nonce"`
+	Code      Code            `json:"code,omitempty"`
+	Data      json.RawMessage `json:"data,omitempty"`
+}

package/templates/native-go/backend/internal/helper/sdk_rpc_test.go

@@ -0,0 +1,135 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func sdkTestRPC(f *sdkJobTestFixture, method string, args any) sdkWireResponse {
+	raw, _ := json.Marshal(args)
+	nonce, _ := sdkRandomRef()
+	r := sdkWireRequest{f.c.inventory, nonce, method, grantCarriers{f.carriers.Cookie, f.carriers.SynoToken, f.carriers.ClientAddress}, raw}
+	b, _ := json.Marshal(r)
+	return f.o.dispatchSDK(context.Background(), operationPeer{42, 0}, b)
+}
+func prepareSDKTest(t *testing.T, f *sdkJobTestFixture) sdkPrepared {
+	t.Helper()
+	res := sdkTestRPC(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, f.r.Control.Binding.ParentGrant, f.r.Input})
+	if res.Code != "" {
+		t.Fatal(res.Code)
+	}
+	var p sdkPrepared
+	if json.Unmarshal(res.Data, &p) != nil || !allReferences(p.JobID, p.IntentID, p.SummaryDigest) {
+		t.Fatal(string(res.Data))
+	}
+	return p
+}
+func TestSDKRPCIssuedIntentSubmitAttachAndReplay(t *testing.T) {
+	f := sdkJobFixture(t)
+	p := prepareSDKTest(t, f)
+	if len(f.children) != 0 {
+		t.Fatal("prepare dispatched")
+	}
+	r := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest})
+	if r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	var attach sdkAttachReceipt
+	if json.Unmarshal(r.Data, &attach) != nil || attach.JobID != p.JobID || !allReferences(attach.AttachID) || attach.TTLMS != 6000 || attach.RenewAfterMS != 2000 {
+		t.Fatal(string(r.Data))
+	}
+	if len(f.children) != 1 {
+		t.Fatal("submit did not use fixed launcher")
+	}
+	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}).Code; c != ErrReplay {
+		t.Fatal(c)
+	}
+	if c := sdkTestRPC(f, "jobs.attach", sdkAttachArgs{p.JobID, attach.AttachID}).Code; c != "" {
+		t.Fatal(c)
+	}
+}
+func TestSDKRPCRejectsCallerAuthorityAndUnknownMethods(t *testing.T) {
+	f := sdkJobFixture(t)
+	for _, args := range []string{`{"cursor":"","actor":{}}`, `{"cursor":"","roles":["admin"]}`, `{"cursor":"","epoch":"a"}`, `{"cursor":"","approval":"a"}`, `{"cursor":"","executable":"/bin/sh"}`, `{"cursor":"","cursor":""}`, `{"Cursor":""}`, `{"cursor":null}`} {
+		if c := sdkTestRPC(f, "jobs.status", json.RawMessage(args)).Code; c != ErrInvalid {
+			t.Fatal(args, c)
+		}
+	}
+	for _, method := range []string{"jobs.background.prepare", "jobs.exec", "jobs.resume", "jobs.confirm"} {
+		if c := sdkTestRPC(f, method, struct{}{}).Code; c != ErrUnsupported {
+			t.Fatal(method, c)
+		}
+	}
+	if len(f.children) != 0 {
+		t.Fatal("untrusted public args spawned")
+	}
+}
+func TestSDKRPCRejectsWrongPeerInventorySessionAndSummary(t *testing.T) {
+	f := sdkJobFixture(t)
+	p := prepareSDKTest(t, f)
+	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, grantRef('f')}).Code; c != ErrDenied {
+		t.Fatal(c)
+	}
+	f.native.session.SessionRef = grantRef('e')
+	f.native.app.SessionRef = grantRef('e')
+	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}).Code; c != ErrDenied {
+		t.Fatal(c)
+	}
+	args, _ := json.Marshal(sdkStatusArgs{})
+	req := sdkWireRequest{f.c.inventory, grantRef('a'), "jobs.status", grantCarriers{}, args}
+	raw, _ := json.Marshal(req)
+	if c := f.o.dispatchSDK(context.Background(), operationPeer{43, 0}, raw).Code; c != ErrDenied {
+		t.Fatal(c)
+	}
+	req.Inventory.Version = "2.0.0-0001"
+	raw, _ = json.Marshal(req)
+	if c := f.o.dispatchSDK(context.Background(), operationPeer{42, 0}, raw).Code; c != ErrIncompatible {
+		t.Fatal(c)
+	}
+}
+func TestSDKRPCAdminRoleAndDisplayRedaction(t *testing.T) {
+	f := sdkJobFixture(t)
+	f.native.groups.Admin = false
+	if c := sdkTestRPC(f, "jobs.admin.status", sdkStatusArgs{}).Code; c != ErrDenied {
+		t.Fatal(c)
+	}
+	p := prepareSDKTest(t, f)
+	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}).Code; c != "" {
+		t.Fatal(c)
+	}
+	r := sdkTestRPC(f, "jobs.status", sdkStatusArgs{})
+	if r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	for _, secret := range []string{"sessionRef", "approvalBinding", "ticket", "fixture", "username"} {
+		if strings.Contains(string(r.Data), secret) {
+			t.Fatal("leak", secret)
+		}
+	}
+	var page sdkJobPage
+	json.Unmarshal(r.Data, &page)
+	if len(page.Items) != 1 || page.Items[0].Mode != jobcontract.Interactive {
+		t.Fatal(string(r.Data))
+	}
+	if c := sdkTestRPC(f, "jobs.cancel", sdkCancelArgs{p.JobID, page.Revision}).Code; c != "" {
+		t.Fatal(c)
+	}
+}
+func TestSDKRPCSharedIntentCapAndOtherConsentCannotConsume(t *testing.T) {
+	f := sdkJobFixture(t)
+	p := prepareSDKTest(t, f)
+	if _, c := f.s.authority.Confirm(context.Background(), f.carriers, p.IntentID, p.SummaryDigest, 1); c != ErrUnsupported {
+		t.Fatal(c)
+	}
+	for i := 1; i < MaxLiveIntents; i++ {
+		prepareSDKTest(t, f)
+	}
+	if c := sdkTestRPC(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, f.r.Control.Binding.ParentGrant, f.r.Input}).Code; c != ErrBusy {
+		t.Fatal(c)
+	}
+}

package/templates/native-go/backend/internal/helper/sdk_server_linux.go

@@ -0,0 +1,152 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"time"
+)
+
+func serveLinux(c Client) error {
+	r, err := readRecord(c.StateDir, 0)
+	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	// Only the supervisor writes process.json.
+	// The package group can connect; ordinary users reach only the authenticated
+	// CGI status route. SO_PEERCRED also checks the package's current numeric UID.
+	u, err := user.Lookup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	uid, err := strconv.ParseUint(u.Uid, 10, 32)
+	if err != nil {
+		return err
+	}
+	group, err := user.LookupGroup(c.Expected.Package)
+	if err != nil {
+		return err
+	}
+	gid, err := strconv.Atoi(group.Gid)
+	if err != nil {
+		return err
+	}
+	socket := filepath.Join(c.RunDir, "helper.sock")
+	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
+	if err != nil {
+		return err
+	}
+	l.SetUnlinkOnClose(false)
+	defer l.Close()
+	if err := os.Chown(socket, 0, gid); err != nil {
+		return err
+	}
+	if err := os.Chmod(socket, 0660); err != nil {
+		return err
+	}
+	// Bound concurrency and each frame's size/time. No privileged mutations are
+	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	slots := make(chan struct{}, 8)
+	for {
+		conn, err := l.AcceptUnix()
+		if err != nil {
+			return err
+		}
+		select {
+		case slots <- struct{}{}:
+		default:
+			conn.Close()
+			continue
+		}
+		go func() {
+			defer func() { conn.Close(); <-slots }()
+			peer, err := peerUID(conn)
+			if err != nil || (peer != 0 && peer != uint32(uid)) {
+				return
+			}
+			conn.SetDeadline(time.Now().Add(time.Second))
+			var raw json.RawMessage
+			d := json.NewDecoder(io.LimitReader(conn, MaxControlBytes+1))
+			if d.Decode(&raw) != nil || len(raw) > MaxControlBytes {
+				return
+			}
+			var kind struct {
+				Method string `json:"method"`
+			}
+			if json.Unmarshal(raw, &kind) != nil {
+				return
+			}
+			if kind.Method != "" {
+				// SDK frames half-close after their bounded body. EOF is only
+				// framing; attach TTL, not this short connection, owns liveness.
+				rest, err := io.ReadAll(io.LimitReader(io.MultiReader(d.Buffered(), conn), MaxControlBytes+1))
+				if err != nil || d.InputOffset()+int64(len(rest)) > MaxControlBytes || len(bytes.TrimSpace(rest)) != 0 {
+					return
+				}
+				conn.SetDeadline(time.Now().Add(3 * time.Second))
+				json.NewEncoder(conn).Encode(forwardSDKJobs(c, raw))
+				return
+			}
+			if len(raw) > 4096 {
+				return
+			}
+			var req Request
+			health := json.NewDecoder(bytes.NewReader(raw))
+			health.DisallowUnknownFields()
+			if health.Decode(&req) != nil {
+				return
+			}
+			r, err := readRecord(c.StateDir, 0)
+			readiness := "fenced"
+			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {
+				readiness = parentReadiness(c)
+			}
+			res := Respond(c.Expected, readiness != "ready", req)
+			if readiness != "ready" {
+				res.Error = readiness
+			}
+			json.NewEncoder(conn).Encode(res)
+		}()
+	}
+}
+
+// No lifecycle mutations: only the exact owned child can request admission.
+func parentReadiness(c Client) string {
+	p, err := readProcess(c.RunDir, 0)
+	if err != nil || p.PID != os.Getppid() {
+		return "fenced"
+	}
+	actual, err := inspectSupervisor(p.PID, c.Expected)
+	if err != nil || actual != p {
+		return "fenced"
+	}
+	conn, err := net.DialTimeout("unix", filepath.Join(c.RunDir, "supervisor.sock"), 100*time.Millisecond)
+	if err != nil {
+		return "fenced"
+	}
+	defer conn.Close()
+	peer, err := peerCredentials(conn.(*net.UnixConn))
+	if err != nil || peer.Uid != 0 || int(peer.Pid) != p.PID {
+		return "fenced"
+	}
+	conn.SetDeadline(time.Now().Add(200 * time.Millisecond))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return "fenced"
+	}
+	req := supervisorRequest{Process: p, Op: "admit", Nonce: hex.EncodeToString(nonce[:])}
+	if json.NewEncoder(conn).Encode(req) != nil {
+		return "fenced"
+	}
+	res, err := decodeSupervisorReply(conn, c.Expected, req.Nonce)
+	return supervisorReadiness(res, err)
+}