@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/api/registry.go

@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/http"
 	"regexp"
 )
 
@@ -29,20 +30,37 @@ type Handler func(ctx context.Context, caller Caller, params json.RawMessage) (a
 // Route binds a method name to its handler and access policy. Its fields are
 // private: build routes with User, Admin or Public.
 type Route struct {
-	method  string
-	policy  policy
-	handler Handler
+	method         string
+	policy         policy
+	handler        Handler
+	binary         BinaryReadHandler
+	requestHandler RequestHandler
 }
 
 // User declares an operation any signed-in DSM user may call.
-func User(method string, h Handler) Route { return Route{method, policyUser, h} }
+func User(method string, h Handler) Route {
+	return Route{method: method, policy: policyUser, handler: h}
+}
+
+// RequestHandler receives the original request after the normal transport and
+// authentication guards. Credentials must remain request-scoped.
+type RequestHandler func(context.Context, Caller, *http.Request, json.RawMessage) (any, error)
+
+// UserRequest declares a session-aware operation for a signed-in DSM user.
+func UserRequest(method string, h RequestHandler) Route {
+	return Route{method: method, policy: policyUser, requestHandler: h}
+}
 
 // Admin declares an operation only members of DSM's administrators group may call.
-func Admin(method string, h Handler) Route { return Route{method, policyAdmin, h} }
+func Admin(method string, h Handler) Route {
+	return Route{method: method, policy: policyAdmin, handler: h}
+}
 
 // Public declares an operation that runs WITHOUT a DSM session. Use it only for
 // data that is safe to show anyone who can reach the NAS's DSM port.
-func Public(method string, h Handler) Route { return Route{method, policyPublic, h} }
+func Public(method string, h Handler) Route {
+	return Route{method: method, policy: policyPublic, handler: h}
+}
 
 // Identity is what an Authenticator established about the requester.
 type Identity struct {
@@ -73,7 +91,10 @@ func buildRegistry(routes []Route) (map[string]Route, error) {
 		if !methodName.MatchString(r.method) {
 			return nil, fmt.Errorf("route %q: method must look like \"area.action\" (lowercase)", r.method)
 		}
-		if r.handler == nil {
+		if r.binary != nil && (r.method != "nas.files.read.binary" || r.policy != policyUser || r.handler != nil || r.requestHandler != nil) {
+			return nil, errors.New("binary read must use the fixed authenticated route")
+		}
+		if r.handler == nil && r.binary == nil && r.requestHandler == nil {
 			return nil, fmt.Errorf("route %q has no handler", r.method)
 		}
 		if _, dup := registry[r.method]; dup {

package/dist/templates/native-go/backend/internal/api/server.go

@@ -67,7 +67,17 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		writeError(w, apiErr)
 		return
 	}
-	data, err := route.handler(r.Context(), caller, req.Params)
+	if route.binary != nil {
+		serveBoundedRead(w, r, caller, req.Params, route.binary)
+		return
+	}
+	var data any
+	var err error
+	if route.requestHandler != nil {
+		data, err = route.requestHandler(r.Context(), caller, r, req.Params)
+	} else {
+		data, err = route.handler(r.Context(), caller, req.Params)
+	}
 	if err != nil {
 		writeError(w, asError(err))
 		return

package/dist/templates/native-go/backend/internal/app/background.go

@@ -0,0 +1,270 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log"
+	"net/http"
+	"os/user"
+	"path"
+	"path/filepath"
+	"time"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"dsmapp/internal/filestation"
+)
+
+// workerFresh is how recent the worker heartbeat must be to count as running.
+const workerFresh = 15 * time.Second
+
+// lookupSubmitterUID resolves the authenticated DSM username on every request.
+// Unknown UIDs fail closed for owners and submission.
+var lookupSubmitterUID = osLookupUID
+
+func osLookupUID(name string) string {
+	u, err := user.Lookup(name)
+	if err != nil {
+		return ""
+	}
+	return u.Uid
+}
+
+type backgroundFiles interface {
+	Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (filestation.Page, error)
+	ReadFile(ctx context.Context, c api.Caller, r *http.Request, folder, rel string) ([]byte, error)
+}
+
+type backgroundAPI struct {
+	store *background.Store
+	files backgroundFiles
+}
+
+// BackgroundRoutes is the production assembly of the opt-in background jobs
+// API. `synopkgland init --background` wires it in through background.go's
+// replacement of background_none.go; nothing else references it.
+func BackgroundRoutes(dataDir string) []api.Route {
+	return newBackgroundRoutes(background.NewStore(filepath.Join(dataDir, "background")), filestation.Local(dataDir))
+}
+
+// Every request authenticates against DSM afresh. Owner routes are opt-in for
+// ordinary users; configuration and owner cleanup remain administrator-only.
+func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.Route {
+	b := backgroundAPI{store: store, files: files}
+	return []api.Route{
+		api.UserRequest("bg.status", b.owner(b.status)),
+		api.UserRequest("bg.schedules.list", b.owner(b.schedules)),
+		api.UserRequest("bg.schedules.create", b.owner(b.createSchedule)),
+		api.UserRequest("bg.schedules.disable", b.owner(b.disableSchedule)),
+		api.UserRequest("bg.schedules.delete", b.owner(b.deleteSchedule)),
+		api.UserRequest("bg.schedules.enable", b.admin(b.enableSchedule)),
+		api.UserRequest("bg.mode.set", b.admin(b.setMode)),
+		api.UserRequest("bg.users.set", b.admin(b.setUsers)),
+		api.UserRequest("bg.jobs.purge", b.admin(b.purge)),
+		api.UserRequest("bg.browse", b.owner(b.browse)),
+		api.UserRequest("bg.jobs.submit", b.owner(b.submit)),
+		api.UserRequest("bg.jobs.list", b.owner(b.list)),
+		api.UserRequest("bg.jobs.get", b.owner(b.get)),
+		api.UserRequest("bg.jobs.cancel", b.owner(b.cancel)),
+		api.UserRequest("bg.jobs.result", b.owner(b.result)),
+	}
+}
+
+type backgroundHandler func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error)
+
+func (backgroundAPI) admin(h backgroundHandler) api.RequestHandler {
+	return func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+		if !c.Admin() {
+			return nil, &api.Error{Code: "unsupported", Message: "background jobs need a DSM administrator"}
+		}
+		return h(ctx, c, r, params)
+	}
+}
+
+type idParams struct {
+	ID string `json:"id"`
+}
+
+type jobView struct {
+	Job background.Job `json:"job"`
+}
+
+func (b backgroundAPI) status(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	st, err := b.store.StatusFor(ctx, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	var worker map[string]any
+	if st.Worker != nil {
+		worker = map[string]any{"pid": st.Worker.PID, "uid": st.Worker.UID, "username": st.Worker.Username,
+			"revision": st.Worker.Revision, "at": st.Worker.At, "alive": workerAlive(*st.Worker, time.Now())}
+	}
+	return map[string]any{
+		"owner": accessFrom(ctx).Owner, "supported": true, "enabled": st.Enabled, "admin": accessFrom(ctx).Admin, "allowOrdinaryUsers": st.AllowOrdinaryUsers, "algorithm": st.Algorithm, "revision": st.Revision,
+		"queued": st.Queued, "running": st.Running, "worker": worker,
+		"limits": map[string]any{"maxInputBytes": background.MaxInputBytes, "maxQueued": background.MaxQueued,
+			"maxSchedules": background.MaxSchedules, "intervalSeconds": []int{3600, 86400, 604800}, "maxTotalBytes": background.MaxTotalBytes, "maxOwnerPending": background.MaxOwnerPending, "maxOwnerBytes": background.MaxOwnerBytes, "jobTimeoutSeconds": int(background.JobTimeout / time.Second)},
+	}, nil
+}
+
+func workerAlive(w background.WorkerInfo, now time.Time) bool {
+	return now.Sub(w.At) <= workerFresh
+}
+
+func (b backgroundAPI) setMode(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Enabled *bool `json:"enabled"`
+	}
+	if err := decodeParams(params, &in); err != nil || in.Enabled == nil {
+		return nil, api.BadRequest("enabled must be true or false")
+	}
+	if err := b.store.SetEnabled(ctx, *in.Enabled); err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]bool{"enabled": *in.Enabled}, nil
+}
+
+// browse lists what the caller's own File Station session can see, so
+// the panel can pick a file instead of typing a path. It grants nothing:
+// submit still reads through the same session.
+func (b backgroundAPI) browse(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Folder string `json:"folder"`
+		Offset int    `json:"offset"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if in.Offset < 0 {
+		return nil, api.BadRequest("offset must not be negative")
+	}
+	return b.files.Browse(ctx, c, r, in.Folder, in.Offset)
+}
+
+func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Key      string `json:"key"`
+		Folder   string `json:"folder"`
+		Relative string `json:"relative"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if in.Key == "" || in.Folder == "" || in.Relative == "" {
+		return nil, api.BadRequest("key, folder and relative are required")
+	}
+	// Refuse before touching the NAS when the mode is off.
+	if st, err := b.store.Status(ctx); err != nil {
+		return nil, backgroundError(err)
+	} else if !st.Enabled {
+		return nil, backgroundError(background.ErrDisabled)
+	}
+	access := accessFrom(ctx)
+	if !access.Owner.Valid() {
+		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
+	}
+	data, err := b.files.ReadFile(ctx, c, r, in.Folder, in.Relative)
+	if err != nil {
+		return nil, err
+	}
+	job, duplicate, err := b.store.Submit(ctx, background.SubmitRequest{
+		Key: in.Key, Name: path.Base(in.Relative), Data: data, Submitter: access.Owner, Admin: access.Admin,
+	})
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"job": job, "duplicate": duplicate}, nil
+}
+
+func (b backgroundAPI) list(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	jobs, err := b.store.ListFor(ctx, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	newestFirst := make([]background.Job, len(jobs))
+	for i, j := range jobs {
+		newestFirst[len(jobs)-1-i] = j
+	}
+	return map[string]any{"jobs": newestFirst}, nil
+}
+
+func (b backgroundAPI) get(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	job, err := b.store.GetFor(ctx, in.ID, accessFrom(ctx))
+	return jobOrError(job, err)
+}
+
+func (b backgroundAPI) cancel(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	job, err := b.store.CancelFor(ctx, in.ID, accessFrom(ctx))
+	return jobOrError(job, err)
+}
+
+func jobOrError(job background.Job, err error) (any, error) {
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return jobView{Job: job}, nil
+}
+
+func (b backgroundAPI) result(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	job, err := b.store.GetFor(ctx, in.ID, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	if job.State != background.StateSucceeded || job.Result == nil {
+		return nil, &api.Error{Code: "not_ready", Message: "the job has no result"}
+	}
+	return map[string]any{"job": job, "result": map[string]any{
+		"jobId": job.ID, "worker": job.Worker, "workerRevision": job.WorkerRevision, "algorithm": "sha256",
+		"sha256": job.Result.SHA256, "bytes": job.Result.Bytes, "inputDigest": job.InputDigest, "name": job.Name,
+	}}, nil
+}
+
+func backgroundError(err error) error {
+	switch {
+	case errors.Is(err, background.ErrScheduleFull):
+		return &api.Error{Code: "schedule-full", Message: "the schedule limit has been reached"}
+	case errors.Is(err, background.ErrInputUnavailable):
+		return &api.Error{Code: "input-unavailable", Message: "import the private copy again"}
+	case errors.Is(err, background.ErrOrdinaryDisabled):
+		return &api.Error{Code: "unsupported", Message: "ordinary background users are disabled"}
+	case errors.Is(err, background.ErrOwnerQueueFull):
+		return &api.Error{Code: "owner-queue-full", Message: "your pending job limit has been reached"}
+	case errors.Is(err, background.ErrOwnerQuota):
+		return &api.Error{Code: "owner-quota-exceeded", Message: "your background storage limit has been reached"}
+	case errors.Is(err, background.ErrDisabled):
+		return &api.Error{Code: "disabled", Message: "background mode is off"}
+	case errors.Is(err, background.ErrInvalid):
+		return api.BadRequest("invalid background request")
+	case errors.Is(err, background.ErrTooLarge):
+		return &api.Error{Code: "limit-exceeded", Message: "the file is larger than the background limit"}
+	case errors.Is(err, background.ErrQueueFull):
+		return &api.Error{Code: "queue-full", Message: "the background queue is full"}
+	case errors.Is(err, background.ErrQuota):
+		return &api.Error{Code: "quota-exceeded", Message: "the background spool is full"}
+	case errors.Is(err, background.ErrKeyConflict), errors.Is(err, background.ErrNotCancelable):
+		return &api.Error{Code: "conflict", Message: "the request conflicts with the job's current state"}
+	case errors.Is(err, background.ErrNotFound):
+		return &api.Error{Code: "not_found", Message: "job not found"}
+	}
+	log.Printf("background spool error: %v", err)
+	return &api.Error{Code: "unavailable", Message: "the background spool is unavailable"}
+}

package/dist/templates/native-go/backend/internal/app/background_none.go

@@ -0,0 +1,8 @@
+package app
+
+import "dsmapp/internal/api"
+
+// backgroundRoutes is empty: this package did not opt in to background jobs.
+// `synopkgland init --background` replaces this file with background_on.go,
+// which serves BackgroundRoutes for the package-user worker unit.
+func (Config) backgroundRoutes() []api.Route { return nil }

package/dist/templates/native-go/backend/internal/app/background_owner.go

@@ -0,0 +1,59 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"net/http"
+)
+
+type backgroundAccessKey struct{}
+
+func accessFrom(ctx context.Context) background.Access {
+	return ctx.Value(backgroundAccessKey{}).(background.Access)
+}
+func (b backgroundAPI) owner(h backgroundHandler) api.RequestHandler {
+	return func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+		access := background.Access{Admin: c.Admin()}
+		if !c.Admin() {
+			st, err := b.store.Status(ctx)
+			if err != nil {
+				return nil, backgroundError(err)
+			}
+			if !st.AllowOrdinaryUsers {
+				return nil, &api.Error{Code: "unsupported", Message: "ordinary background users are disabled"}
+			}
+		}
+		access.Owner = background.Submitter{User: c.User(), UID: lookupSubmitterUID(c.User())}
+		if !access.Admin && !access.Owner.Valid() {
+			return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
+		}
+		return h(context.WithValue(ctx, backgroundAccessKey{}, access), c, r, params)
+	}
+}
+func (b backgroundAPI) setUsers(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Allow *bool `json:"allowOrdinaryUsers"`
+	}
+	if err := decodeParams(params, &in); err != nil || in.Allow == nil {
+		return nil, api.BadRequest("allowOrdinaryUsers must be true or false")
+	}
+	if err := b.store.SetOrdinaryUsers(ctx, *in.Allow); err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]bool{"allowOrdinaryUsers": *in.Allow}, nil
+}
+func (b backgroundAPI) purge(ctx context.Context, c api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Owner *background.Submitter `json:"owner"`
+	}
+	if err := decodeParams(params, &in); err != nil || in.Owner == nil {
+		return nil, api.BadRequest("exact owner is required")
+	}
+	audit, err := b.store.PurgeOwner(ctx, *in.Owner, c.User())
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return audit, nil
+}

package/dist/templates/native-go/backend/internal/app/background_owner_test.go

@@ -0,0 +1,145 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"strings"
+	"testing"
+)
+
+func ordinaryEnv(t *testing.T) *bgEnv {
+	e := newBgEnv(t)
+	lookupSubmitterUID = func(name string) string {
+		switch name {
+		case "alice":
+			return "1024"
+		case "bob":
+			return "1025"
+		case "carol":
+			return "1026"
+		}
+		return ""
+	}
+	e.enable()
+	if code, out := e.call(alice, "bg.users.set", `{"allowOrdinaryUsers":true}`); code != "" {
+		t.Fatalf("enable ordinary users: %s %v", code, out)
+	}
+	return e
+}
+
+var carol = stubAuth{identity: api.Identity{User: "carol"}}
+
+func ownerSubmit(t *testing.T, e *bgEnv, a api.Authenticator, key string) string {
+	t.Helper()
+	code, out := e.call(a, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`)
+	if code != "" {
+		t.Fatalf("submit %s: %s %v", key, code, out)
+	}
+	return data(out)["job"].(map[string]any)["id"].(string)
+}
+func TestBackgroundOwnersAreIsolatedIncludingKeysAndCounts(t *testing.T) {
+	e := ordinaryEnv(t)
+	a := ownerSubmit(t, e, alice, "same")
+	b := ownerSubmit(t, e, bob, "same")
+	c := ownerSubmit(t, e, carol, "same")
+	if a == b || b == c {
+		t.Fatal("idempotency key leaked across owners")
+	}
+	for _, auth := range []api.Authenticator{bob, carol} {
+		code, out := e.call(auth, "bg.jobs.list", `{}`)
+		if code != "" || len(data(out)["jobs"].([]any)) != 1 {
+			t.Fatalf("list: %s %v", code, out)
+		}
+		_, out = e.call(auth, "bg.status", `{}`)
+		if data(out)["queued"] != float64(1) || data(out)["admin"] != false {
+			t.Fatalf("status leaks: %v", out)
+		}
+	}
+	for _, method := range []string{"bg.jobs.get", "bg.jobs.cancel", "bg.jobs.result"} {
+		for _, id := range []string{a, c, strings.Repeat("0", 32)} {
+			if code, out := e.call(bob, method, `{"id":"`+id+`"}`); code != "not_found" {
+				t.Fatalf("%s %s: %s %v", method, id, code, out)
+			}
+		}
+	}
+	_, out := e.call(alice, "bg.jobs.list", `{}`)
+	if len(data(out)["jobs"].([]any)) != 3 {
+		t.Fatal("admin must see all")
+	}
+	if code, _ := e.call(alice, "bg.jobs.cancel", `{"id":"`+b+`"}`); code != "" {
+		t.Fatal(code)
+	}
+}
+func TestBackgroundOwnerResultAndUIDChangeFailClosed(t *testing.T) {
+	e := ordinaryEnv(t)
+	id := ownerSubmit(t, e, bob, "one")
+	ctx := context.Background()
+	_, _ = e.store.Claim(ctx)
+	if err := e.store.Finish(ctx, id, background.Outcome{State: background.StateSucceeded, Result: &background.Result{SHA256: "digest", Bytes: 5}}); err != nil {
+		t.Fatal(err)
+	}
+	if code, _ := e.call(bob, "bg.jobs.result", `{"id":"`+id+`"}`); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(carol, "bg.jobs.result", `{"id":"`+id+`"}`); code != "not_found" {
+		t.Fatal(code)
+	}
+	lookupSubmitterUID = func(string) string { return "2000" }
+	_, out := e.call(bob, "bg.jobs.list", `{}`)
+	if len(data(out)["jobs"].([]any)) != 0 {
+		t.Fatal("same name with new UID saw old jobs")
+	}
+	if code, _ := e.call(bob, "bg.jobs.get", `{"id":"`+id+`"}`); code != "not_found" {
+		t.Fatal(code)
+	}
+	lookupSubmitterUID = func(string) string { return "" }
+	if code, _ := e.call(bob, "bg.jobs.list", `{}`); code != "identity_unavailable" {
+		t.Fatal(code)
+	}
+}
+func TestBackgroundOrdinaryGateAndPersonalQuota(t *testing.T) {
+	e := ordinaryEnv(t)
+	for _, method := range []string{"bg.mode.set", "bg.users.set", "bg.jobs.purge"} {
+		if code, _ := e.call(bob, method, `{}`); code != "unsupported" {
+			t.Fatalf("%s: %s", method, code)
+		}
+	}
+	ownerSubmit(t, e, bob, "one")
+	ownerSubmit(t, e, bob, "two")
+	if code, _ := e.call(bob, "bg.jobs.submit", `{"key":"three","folder":"/share","relative":"a.txt"}`); code != "owner-queue-full" {
+		t.Fatal(code)
+	}
+	ownerSubmit(t, e, carol, "one")
+	if code, _ := e.call(alice, "bg.users.set", `{"allowOrdinaryUsers":false}`); code != "" {
+		t.Fatal(code)
+	}
+	before := e.files.calls
+	for _, method := range []string{"bg.status", "bg.browse", "bg.jobs.submit", "bg.jobs.list", "bg.jobs.result"} {
+		if code, _ := e.call(bob, method, bgSample[method]); code != "unsupported" {
+			t.Fatalf("closed gate %s: %s", method, code)
+		}
+	}
+	if e.files.calls != before {
+		t.Fatal("closed gate touched NAS")
+	}
+	if code, _ := e.call(alice, "bg.users.set", `{"allowOrdinaryUsers":true,"owner":"bob"}`); code != "bad_request" {
+		t.Fatal(code)
+	}
+}
+func TestBackgroundPurgeRequiresAdminAndExactOwner(t *testing.T) {
+	e := ordinaryEnv(t)
+	id := ownerSubmit(t, e, bob, "one")
+	ownerSubmit(t, e, carol, "one")
+	code, out := e.call(alice, "bg.jobs.purge", `{"owner":{"user":"bob","uid":"1025"}}`)
+	if code != "" || data(out)["removed"] != float64(1) {
+		t.Fatalf("purge: %s %v", code, out)
+	}
+	if code, _ := e.call(alice, "bg.jobs.get", `{"id":"`+id+`"}`); code != "not_found" {
+		t.Fatal(code)
+	}
+	_, out = e.call(alice, "bg.jobs.list", `{}`)
+	if len(data(out)["jobs"].([]any)) != 1 {
+		t.Fatal("purge touched another owner")
+	}
+}

package/dist/templates/native-go/backend/internal/app/background_schedule.go

@@ -0,0 +1,74 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"net/http"
+)
+
+func (b backgroundAPI) schedules(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	if err := decodeParams(p, &struct{}{}); err != nil {
+		return nil, err
+	}
+	list, err := b.store.Schedules(ctx, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedules": list}, nil
+}
+func (b backgroundAPI) createSchedule(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in background.ScheduleRequest
+	if err := decodeParams(p, &in); err != nil {
+		return nil, err
+	}
+	if st, err := b.store.Status(ctx); err != nil {
+		return nil, backgroundError(err)
+	} else if !st.Enabled {
+		return nil, backgroundError(background.ErrDisabled)
+	}
+	if !accessFrom(ctx).Owner.Valid() {
+		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
+	}
+	sc, dup, err := b.store.CreateSchedule(ctx, in, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedule": sc, "duplicate": dup}, nil
+}
+func (b backgroundAPI) disableSchedule(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(p, &in); err != nil {
+		return nil, err
+	}
+	sc, err := b.store.SetSchedule(ctx, in.ID, false, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedule": sc}, nil
+}
+func (b backgroundAPI) enableSchedule(ctx context.Context, c api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in struct {
+		ID      string `json:"id"`
+		Consent bool   `json:"consent"`
+	}
+	if err := decodeParams(p, &in); err != nil || !in.Consent {
+		return nil, api.BadRequest("explicit consent is required")
+	}
+	sc, err := b.store.SetSchedule(ctx, in.ID, true, background.Access{Admin: true, Owner: background.Submitter{User: c.User(), UID: lookupSubmitterUID(c.User())}})
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedule": sc}, nil
+}
+func (b backgroundAPI) deleteSchedule(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(p, &in); err != nil {
+		return nil, err
+	}
+	if err := b.store.DeleteSchedule(ctx, in.ID, accessFrom(ctx)); err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]bool{"deleted": true}, nil
+}