@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/app/background_schedule_test.go

@@ -0,0 +1,62 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/background"
+	"fmt"
+	"testing"
+)
+
+func TestBackgroundScheduleRoutesConsentOwnerAndAdmin(t *testing.T) {
+	e := ordinaryEnv(t)
+	id := ownerSubmit(t, e, bob, "copy")
+	ctx := context.Background()
+	_, _ = e.store.Claim(ctx)
+	_ = e.store.Finish(ctx, id, background.Outcome{State: background.StateSucceeded, Result: &background.Result{Bytes: 5}})
+	params := fmt.Sprintf(`{"key":"s","jobId":%q,"intervalSeconds":3600,"consent":true}`, id)
+	if code, _ := e.call(carol, "bg.schedules.create", params); code != "not_found" {
+		t.Fatal(code)
+	}
+	for _, p := range []string{fmt.Sprintf(`{"key":"s","jobId":%q,"intervalSeconds":3600}`, id), fmt.Sprintf(`{"key":"s","jobId":%q,"intervalSeconds":3600,"consent":true,"owner":"carol"}`, id)} {
+		if code, _ := e.call(bob, "bg.schedules.create", p); code != "bad_request" {
+			t.Fatal(code)
+		}
+	}
+	code, out := e.call(bob, "bg.schedules.create", params)
+	if code != "" {
+		t.Fatalf("create %s %v", code, out)
+	}
+	sid := data(out)["schedule"].(map[string]any)["id"].(string)
+	_, out = e.call(carol, "bg.schedules.list", `{}`)
+	if len(data(out)["schedules"].([]any)) != 0 {
+		t.Fatal("list leak")
+	}
+	_, out = e.call(alice, "bg.schedules.list", `{}`)
+	if len(data(out)["schedules"].([]any)) != 1 {
+		t.Fatal("admin list")
+	}
+	for _, m := range []string{"bg.schedules.disable", "bg.schedules.delete"} {
+		if code, _ := e.call(carol, m, fmt.Sprintf(`{"id":%q}`, sid)); code != "not_found" {
+			t.Fatal(code)
+		}
+	}
+	if code, _ := e.call(bob, "bg.schedules.enable", fmt.Sprintf(`{"id":%q,"consent":true}`, sid)); code != "unsupported" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(alice, "bg.schedules.disable", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(alice, "bg.schedules.enable", fmt.Sprintf(`{"id":%q}`, sid)); code != "bad_request" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(alice, "bg.schedules.enable", fmt.Sprintf(`{"id":%q,"consent":true}`, sid)); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(bob, "bg.schedules.delete", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {
+		t.Fatal(code)
+	}
+	// No scheduling route calls File Station, uses a root grant or stores a session.
+	if e.files.calls != 1 {
+		t.Fatalf("schedule read File Station %d", e.files.calls)
+	}
+}

package/dist/templates/native-go/backend/internal/app/background_test.go

@@ -0,0 +1,346 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"dsmapp/internal/filestation"
+)
+
+type fakeFiles struct {
+	data   []byte
+	err    error
+	calls  int
+	folder string
+	rel    string
+	offset int
+	page   filestation.Page
+}
+
+func (f *fakeFiles) Browse(_ context.Context, _ api.Caller, _ *http.Request, folder string, offset int) (filestation.Page, error) {
+	f.calls++
+	f.folder, f.offset = folder, offset
+	return f.page, f.err
+}
+
+func (f *fakeFiles) ReadFile(_ context.Context, _ api.Caller, _ *http.Request, folder, rel string) ([]byte, error) {
+	f.calls++
+	f.folder, f.rel = folder, rel
+	return f.data, f.err
+}
+
+type bgEnv struct {
+	t     *testing.T
+	store *background.Store
+	files *fakeFiles
+	srv   map[string]*api.Server
+}
+
+func newBgEnv(t *testing.T) *bgEnv {
+	lookupSubmitterUID = func(string) string { return "1024" }
+	t.Cleanup(func() { lookupSubmitterUID = osLookupUID })
+	store := background.NewStore(filepath.Join(t.TempDir(), "background"))
+	files := &fakeFiles{data: []byte("hello")}
+	return &bgEnv{t: t, store: store, files: files, srv: map[string]*api.Server{}}
+}
+
+func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map[string]any) {
+	e.t.Helper()
+	srv, err := api.NewServer(auth, newBackgroundRoutes(e.store, e.files)...)
+	if err != nil {
+		e.t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(`{"method":"`+method+`","params":`+params+`}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, req)
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		e.t.Fatalf("not JSON: %s", rec.Body.String())
+	}
+	code := ""
+	if er, ok := out["error"].(map[string]any); ok {
+		code, _ = er["code"].(string)
+	}
+	return code, out
+}
+
+func (e *bgEnv) enable() {
+	e.t.Helper()
+	if code, out := e.call(alice, "bg.mode.set", `{"enabled":true}`); code != "" {
+		e.t.Fatalf("%s %v", code, out)
+	}
+}
+
+func data(out map[string]any) map[string]any { return out["data"].(map[string]any) }
+
+var bgSample = map[string]string{
+	"bg.schedules.list":    `{}`,
+	"bg.schedules.create":  `{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}`,
+	"bg.schedules.disable": `{"id":"missing"}`,
+	"bg.schedules.delete":  `{"id":"missing"}`,
+	"bg.schedules.enable":  `{"id":"missing","consent":true}`,
+	"bg.status":            `{}`,
+	"bg.users.set":         `{"allowOrdinaryUsers":true}`,
+	"bg.jobs.purge":        `{"owner":{"user":"bob","uid":"1025"}}`,
+	"bg.mode.set":          `{"enabled":true}`,
+	"bg.browse":            `{"folder":"/share","offset":0}`,
+	"bg.jobs.submit":       `{"key":"k1","folder":"/share","relative":"a.txt"}`,
+	"bg.jobs.list":         `{}`,
+	"bg.jobs.get":          `{"id":"` + strings.Repeat("a", 32) + `"}`,
+	"bg.jobs.cancel":       `{"id":"` + strings.Repeat("a", 32) + `"}`,
+	"bg.jobs.result":       `{"id":"` + strings.Repeat("a", 32) + `"}`,
+}
+
+func TestBackgroundRoutesAreAdminOnlyByUnsupportedForOrdinaryUsers(t *testing.T) {
+	e := newBgEnv(t)
+	routes := newBackgroundRoutes(e.store, e.files)
+	if len(routes) != len(bgSample) {
+		t.Fatalf("%d routes, %d samples", len(routes), len(bgSample))
+	}
+	for _, r := range routes {
+		if r.Public() {
+			t.Errorf("%s must not be public", r.Method())
+		}
+		params, ok := bgSample[r.Method()]
+		if !ok {
+			t.Fatalf("no sample for %s", r.Method())
+		}
+		if code, _ := e.call(bob, r.Method(), params); code != "unsupported" {
+			t.Errorf("%s as an ordinary user: %q", r.Method(), code)
+		}
+		if code, _ := e.call(nobody, r.Method(), params); code != "session_required" {
+			t.Errorf("%s without a session: %q", r.Method(), code)
+		}
+	}
+	if e.files.calls != 0 {
+		t.Fatal("an ordinary user must not trigger a NAS read")
+	}
+}
+
+func TestBackgroundStatusReportsModeLimitsAndWorker(t *testing.T) {
+	e := newBgEnv(t)
+	code, out := e.call(alice, "bg.status", `{}`)
+	d := data(out)
+	if code != "" || d["enabled"] != false || d["algorithm"] != "sha256-v1" || d["worker"] != nil {
+		t.Fatalf("%s %v", code, out)
+	}
+	limits := d["limits"].(map[string]any)
+	if limits["maxInputBytes"].(float64) != 512*1024 || limits["maxQueued"].(float64) != 16 || limits["maxTotalBytes"].(float64) != 16<<20 || limits["jobTimeoutSeconds"].(float64) != 60 {
+		t.Fatalf("limits: %v", limits)
+	}
+	if err := e.store.Heartbeat(context.Background(), background.WorkerInfo{PID: 9, UID: 255853, Username: "pkg"}); err != nil {
+		t.Fatal(err)
+	}
+	_, out = e.call(alice, "bg.status", `{}`)
+	w := data(out)["worker"].(map[string]any)
+	if w["alive"] != true || w["uid"].(float64) != 255853 {
+		t.Fatalf("worker: %v", w)
+	}
+}
+
+func TestBackgroundSubmitRefusedWhileOffAndDoesNotReadNAS(t *testing.T) {
+	e := newBgEnv(t)
+	code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"])
+	if code != "disabled" || e.files.calls != 0 {
+		t.Fatalf("%q, NAS reads %d", code, e.files.calls)
+	}
+}
+
+func TestBackgroundSubmitImportsSelectedFileAndIsIdempotent(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	params := `{"key":"k1","folder":"/share","relative":"docs/a.txt"}`
+	code, out := e.call(alice, "bg.jobs.submit", params)
+	job := data(out)["job"].(map[string]any)
+	if code != "" || job["state"] != "queued" || job["name"] != "a.txt" || data(out)["duplicate"] != false {
+		t.Fatalf("%s %v", code, out)
+	}
+	if e.files.folder != "/share" || e.files.rel != "docs/a.txt" {
+		t.Fatalf("adapter saw %q %q", e.files.folder, e.files.rel)
+	}
+	submitter := job["submitter"].(map[string]any)
+	if submitter["user"] != "alice" || submitter["uid"] != "1024" {
+		t.Fatalf("submitter: %v", submitter)
+	}
+	_, again := e.call(alice, "bg.jobs.submit", params)
+	if data(again)["duplicate"] != true || data(again)["job"].(map[string]any)["id"] != job["id"] {
+		t.Fatalf("duplicate: %v", again)
+	}
+	e.files.data = []byte("other")
+	if code, _ := e.call(alice, "bg.jobs.submit", params); code != "conflict" {
+		t.Fatalf("same key with different bytes: %q", code)
+	}
+}
+
+func TestBackgroundSubmitPassesAdapterRefusalsThrough(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	e.files.err = &api.Error{Code: "limit-exceeded", Message: "x"}
+	if code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"]); code != "limit-exceeded" {
+		t.Fatalf("%q", code)
+	}
+	if jobs, _ := e.store.List(context.Background()); len(jobs) != 0 {
+		t.Fatal("a failed import must never enter the queue")
+	}
+}
+
+func TestBackgroundSubmitValidatesParams(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	for _, p := range []string{
+		`{}`, `{"key":"k","folder":"/share","relative":"a","extra":1}`, `{"key":"bad key","folder":"/share","relative":"a"}`,
+		`{"key":"k","folder":"/share","relative":""}`,
+	} {
+		if code, _ := e.call(alice, "bg.jobs.submit", p); code != "bad_request" {
+			t.Errorf("%s: %q", p, code)
+		}
+	}
+}
+
+func TestBackgroundQueueFullAndQuotaErrorsHaveStableCodes(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	for i := 0; i < background.MaxQueued; i++ {
+		lookupSubmitterUID = func(string) string { return fmt.Sprint(1024 + i/2) }
+		key := "k" + string(rune('a'+i))
+		if code, _ := e.call(alice, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`); code != "" {
+			t.Fatalf("%d: %q", i, code)
+		}
+	}
+	lookupSubmitterUID = func(string) string { return "9999" }
+	if code, _ := e.call(alice, "bg.jobs.submit", `{"key":"more","folder":"/share","relative":"a.txt"}`); code != "queue-full" {
+		t.Fatalf("%q", code)
+	}
+}
+
+func TestBackgroundListGetCancelAndResult(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	id := data(out)["job"].(map[string]any)["id"].(string)
+	idp := `{"id":"` + id + `"}`
+
+	if _, out = e.call(alice, "bg.jobs.list", `{}`); len(data(out)["jobs"].([]any)) != 1 {
+		t.Fatalf("%v", out)
+	}
+	if code, out := e.call(alice, "bg.jobs.get", idp); code != "" || data(out)["job"].(map[string]any)["id"] != id {
+		t.Fatalf("%s %v", code, out)
+	}
+	if code, _ := e.call(alice, "bg.jobs.result", idp); code != "not_ready" {
+		t.Fatalf("result of a queued job: %q", code)
+	}
+	ctx := context.Background()
+	if _, err := e.store.Claim(ctx); err != nil {
+		t.Fatal(err)
+	}
+	sum := "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+	if err := e.store.Finish(ctx, id, background.Outcome{State: background.StateSucceeded, Result: &background.Result{SHA256: sum, Bytes: 5}}); err != nil {
+		t.Fatal(err)
+	}
+	code, out := e.call(alice, "bg.jobs.result", idp)
+	res := data(out)["result"].(map[string]any)
+	if code != "" || res["sha256"] != sum || res["bytes"].(float64) != 5 || res["worker"] != "sha256-v1" || res["jobId"] != id {
+		t.Fatalf("%s %v", code, out)
+	}
+	if code, _ := e.call(alice, "bg.jobs.cancel", idp); code != "conflict" {
+		t.Fatalf("cancel after completion: %q", code)
+	}
+	for _, m := range []string{"bg.jobs.get", "bg.jobs.cancel", "bg.jobs.result"} {
+		if code, _ := e.call(alice, m, `{"id":"`+strings.Repeat("0", 32)+`"}`); code != "not_found" {
+			t.Fatalf("%s unknown id: %q", m, code)
+		}
+	}
+}
+
+func TestBackgroundCancelQueuedJob(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	id := data(out)["job"].(map[string]any)["id"].(string)
+	code, out := e.call(alice, "bg.jobs.cancel", `{"id":"`+id+`"}`)
+	if code != "" || data(out)["job"].(map[string]any)["state"] != "canceled" {
+		t.Fatalf("%s %v", code, out)
+	}
+}
+
+func TestBackgroundModeOffCancelsQueuedWork(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
+	id := data(out)["job"].(map[string]any)["id"].(string)
+	if code, _ := e.call(alice, "bg.mode.set", `{"enabled":false}`); code != "" {
+		t.Fatal(code)
+	}
+	_, out = e.call(alice, "bg.jobs.get", `{"id":"`+id+`"}`)
+	if job := data(out)["job"].(map[string]any); job["state"] != "canceled" || job["errorCode"] != "disabled" {
+		t.Fatalf("%v", job)
+	}
+}
+
+func TestBackgroundWorkerAliveExpires(t *testing.T) {
+	if workerAlive(background.WorkerInfo{At: time.Now().Add(-time.Minute)}, time.Now()) || !workerAlive(background.WorkerInfo{At: time.Now()}, time.Now()) {
+		t.Fatal("a stale heartbeat is not alive")
+	}
+}
+
+func TestBackgroundBrowseListsThroughTheCallersSession(t *testing.T) {
+	e := newBgEnv(t)
+	e.files.page = filestation.Page{Files: []filestation.Entry{{Name: "a.txt", Path: "/share/a.txt"}}, Total: 1}
+	code, out := e.call(alice, "bg.browse", `{"folder":"/share","offset":100}`)
+	if code != "" {
+		t.Fatalf("%s %v", code, out)
+	}
+	if e.files.folder != "/share" || e.files.offset != 100 {
+		t.Fatalf("browsed %q at %d", e.files.folder, e.files.offset)
+	}
+	files := data(out)["files"].([]any)
+	if len(files) != 1 || files[0].(map[string]any)["path"] != "/share/a.txt" {
+		t.Fatalf("page %v", out)
+	}
+}
+
+func TestBackgroundBrowseWithoutFolderListsTheShares(t *testing.T) {
+	e := newBgEnv(t)
+	if code, out := e.call(alice, "bg.browse", `{}`); code != "" {
+		t.Fatalf("%s %v", code, out)
+	}
+	if e.files.folder != "" || e.files.offset != 0 {
+		t.Fatalf("browsed %q at %d", e.files.folder, e.files.offset)
+	}
+}
+
+func TestBackgroundBrowseValidatesParamsAndPassesRefusalsThrough(t *testing.T) {
+	e := newBgEnv(t)
+	for _, params := range []string{`{"offset":-1}`, `{"folder":"/share","extra":1}`, `{"offset":"1"}`} {
+		if code, _ := e.call(alice, "bg.browse", params); code != "bad_request" {
+			t.Errorf("%s: %q", params, code)
+		}
+	}
+	if e.files.calls != 0 {
+		t.Fatal("invalid params must not reach the NAS")
+	}
+	e.files.err = &api.Error{Code: "denied", Message: "no"}
+	if code, _ := e.call(alice, "bg.browse", `{"folder":"/share"}`); code != "denied" {
+		t.Fatalf("got %q", code)
+	}
+}
+
+func TestBackgroundListWithoutJobsIsAnEmptyArray(t *testing.T) {
+	e := newBgEnv(t)
+	e.enable()
+	_, out := e.call(alice, "bg.jobs.list", `{}`)
+	jobs, ok := data(out)["jobs"].([]any)
+	if !ok || len(jobs) != 0 {
+		t.Fatalf("jobs must be [] not null: %v", out)
+	}
+}

package/dist/templates/native-go/backend/internal/app/integration_state.go

@@ -0,0 +1,16 @@
+package app
+
+import (
+	"context"
+
+	"dsmapp/internal/helper"
+)
+
+// integrationState is the helper's trusted health, or, for an integration
+// built without a helper, a fixed package-only state: there is nothing to approve.
+func (cfg Config) integrationState(ctx context.Context) helper.State {
+	if cfg.PackageIntegration {
+		return helper.State{State: "ready", Reason: "package-only", PackageRunning: "running", Scheduler: "not-required"}
+	}
+	return helper.NewClient(cfg.HelperInventory).Status(ctx)
+}

package/dist/templates/native-go/backend/internal/app/migrations.go

@@ -0,0 +1,41 @@
+package app
+
+import (
+	"os"
+
+	"dsmapp/internal/datamigrate"
+)
+
+// Migrations returns this app's schema migrations. The template ships one
+// empty example; replace it with your own steps. Versions start at 1 and never
+// change meaning. Every step must be idempotent: a crash between Apply and the
+// recorded version, or two CGI requests racing on the first run after an
+// upgrade, can run one step twice. A failed step stops the run with the
+// previous version still recorded, and the next run resumes from there; the
+// utility itself never deletes or rewrites data.
+func Migrations() []datamigrate.Migration {
+	return []datamigrate.Migration{
+		{
+			Version: 1,
+			Name:    "example",
+			Apply: func(datamigrate.Context) error {
+				// Nothing to do yet. Read ctx.DataDir, rewrite files with a
+				// temporary file + rename, and keep the step idempotent.
+				return nil
+			},
+		},
+	}
+}
+
+// Migrate applies Migrations to the package's persistent var directory. The
+// CGI calls it once per request; the recorded data-version makes that a cheap
+// no-op. SYNOPKG_OLD_PKGVER is set when DSM starts the app from a lifecycle
+// script; in a plain CGI request the version of the last successful run is
+// used instead.
+func Migrate(cfg Config) error {
+	_, err := datamigrate.Run(cfg.DataDir, datamigrate.Info{
+		OldPkgVer: os.Getenv("SYNOPKG_OLD_PKGVER"),
+		NewPkgVer: cfg.Version,
+	}, Migrations())
+	return err
+}

package/dist/templates/native-go/backend/internal/app/migrations_test.go

@@ -0,0 +1,41 @@
+package app
+
+import (
+	"testing"
+
+	"dsmapp/internal/datamigrate"
+)
+
+func TestMigrationsAreOrderedUniqueAndValid(t *testing.T) {
+	migrations := Migrations()
+	if len(migrations) == 0 {
+		t.Fatal("the template must ship one example migration")
+	}
+	for i, migration := range migrations {
+		if migration.Version < 1 || migration.Apply == nil || migration.Name == "" {
+			t.Fatalf("migration %d is invalid: %+v", i, migration)
+		}
+		if i > 0 && migrations[i-1].Version >= migration.Version {
+			t.Fatalf("migrations are not strictly version-ascending: %+v", migrations)
+		}
+	}
+}
+
+func TestMigrateRecordsTheSchemaAndPackageVersion(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("SYNOPKG_OLD_PKGVER", "0.1.0-0001")
+	cfg := Config{DataDir: dir, Version: "0.2.0-0002"}
+	if err := Migrate(cfg); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+	state, err := datamigrate.Load(dir)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if state.Schema != 1 || state.PackageVersion != "0.2.0-0002" {
+		t.Fatalf("recorded state = %+v", state)
+	}
+	if err := Migrate(cfg); err != nil {
+		t.Fatalf("second Migrate must be a no-op: %v", err)
+	}
+}

package/dist/templates/native-go/backend/internal/app/nas_cgi_artifact_test.go

@@ -0,0 +1,129 @@
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+// The NIC-free VM points this at the actual unpacked, generated arm64 SPK CGI.
+// The VM's DSM authenticate.cgi oracle is a fixture, never a shipped adapter.
+func TestS8FinalCGIArtifactRefusal(t *testing.T) {
+	binary := os.Getenv("M2_S8_CGI_ARTIFACT")
+	if binary == "" {
+		t.Skip("requires final generated SPK in disposable Linux VM")
+	}
+
+	helperBinary := os.Getenv("M2_S8_HELPER_ARTIFACT")
+	if helperBinary != "" {
+		run := func(action string) {
+			t.Helper()
+			if b, err := exec.Command(helperBinary, action).CombinedOutput(); err != nil {
+				t.Fatalf("%s: %s %v", action, b, err)
+			}
+		}
+		state := func(want string) {
+			t.Helper()
+			for n := 0; n < 100; n++ {
+				b, err := exec.Command(helperBinary, "diagnose").Output()
+				var out map[string]any
+				json.Unmarshal(b, &out)
+				if err == nil && out["state"] == want {
+					t.Log("final generated helper state", want)
+					return
+				}
+				time.Sleep(20 * time.Millisecond)
+			}
+			t.Fatal("helper state did not become", want)
+		}
+		run("enable")
+		state("ready")
+		t.Cleanup(func() { exec.Command(helperBinary, "disable").Run() })
+		hook := os.Getenv("M2_S8_PREUPGRADE_HOOK")
+		if hook != "" {
+			if exec.Command("/bin/sh", hook).Run() == nil {
+				t.Fatal("generated preupgrade admitted a ready helper")
+			}
+		}
+		defer func() {
+			run("teardown")
+			state("stopped")
+			if hook != "" {
+				if b, err := exec.Command("/bin/sh", hook).CombinedOutput(); err != nil {
+					t.Fatal("generated preupgrade after teardown", string(b), err)
+				}
+			}
+			run("recover")
+			state("ready")
+			run("disable")
+			state("not-enabled")
+			if exec.Command(helperBinary, "recover").Run() == nil {
+				t.Fatal("disabled helper recovered without approval")
+			}
+		}()
+	}
+	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.unknown", "nas.files.read.binary"}
+	for _, user := range []string{"normal1", "normal2", "admin", "", "expired"} {
+		for _, method := range methods {
+			params := `{"user":"admin","path":"/volume1/secret"}`
+			if method == "nas.files.read.binary" {
+				params = sampleParams[method]
+			}
+			body := fmt.Sprintf(`{"method":%q,"params":%s}`, method, params)
+			cmd := exec.Command(binary)
+			if uidText := os.Getenv("M2_S8_CGI_PACKAGE_UID"); uidText != "" {
+				uid, err := strconv.ParseUint(uidText, 10, 32)
+				if err != nil {
+					t.Fatal(err)
+				}
+				cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uint32(uid), Gid: uint32(uid)}}
+			}
+			cmd.Env = []string{"GATEWAY_INTERFACE=CGI/1.1", "REQUEST_METHOD=POST", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_NAME=localhost", "SERVER_PORT=80", "SCRIPT_NAME=/api.cgi", "CONTENT_TYPE=application/json", fmt.Sprintf("CONTENT_LENGTH=%d", len(body)), "REMOTE_ADDR=127.0.0.1"}
+			if user != "" {
+				cmd.Env = append(cmd.Env, "HTTP_COOKIE=fixture="+user)
+			}
+			cmd.Stdin = strings.NewReader(body)
+			b, err := cmd.Output()
+			if err != nil {
+				t.Fatal(method, err)
+			}
+			parts := bytes.SplitN(b, []byte("\r\n\r\n"), 2)
+			if len(parts) != 2 {
+				t.Fatal("not CGI", string(b))
+			}
+			var result map[string]any
+			if err = json.Unmarshal(parts[1], &result); err != nil {
+				t.Fatal(err, string(b))
+			}
+			want := "unknown_method"
+			// Protocol 2 now installs the interactive File Station adapter. This
+			// historical fixture has only a fixture cookie, never a real DSM id cookie.
+			switch method {
+			case "nas.discovery", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.create":
+				want = "session_required"
+			case "nas.files.publish":
+				want = "unsupported"
+			}
+			if method == "nas.files.read.binary" {
+				want = "unsupported"
+			}
+			if user == "" || user == "expired" {
+				want = "session_required"
+			}
+			e, ok := result["error"].(map[string]any)
+			if !ok || e["code"] != want || result["success"] != false || result["data"] != nil {
+				t.Fatalf("%s %s: %s", user, method, parts[1])
+			}
+			if bytes.Contains(b, []byte("volume1")) || bytes.Contains(b, []byte("fixture=")) {
+				t.Fatal("metadata leaked")
+			}
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/app/nas_refusal_test.go

@@ -0,0 +1,46 @@
+package app
+
+import (
+	"encoding/json"
+	"os"
+	"strings"
+	"testing"
+
+	"dsmapp/internal/helper"
+)
+
+// These are unavailable wire methods, not public grant/file routes. CGI names
+// are never used as S1 actors. Test both administrators and ordinary sessions.
+func TestS8NASWireRefusalHasNoDataEffects(t *testing.T) {
+	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.future-method"}
+	for _, auth := range []stubAuth{alice, bob, nobody} {
+		cfg := testConfig(t)
+		cfg.HelperInventory = helper.Inventory{Package: cfg.PackageID, Version: cfg.Version, Protocol: 2, PayloadDigest: strings.Repeat("a", 64), RegistryDigest: strings.Repeat("b", 64)}
+		for _, method := range methods {
+			code, out := call(t, cfg, auth, method, `{"user":"admin","path":"/volume1/private","nativeProof":true}`)
+			want := "unknown_method"
+			if auth.err != nil {
+				want = "session_required"
+			}
+			if code != want || out["success"] != false || out["data"] != nil {
+				t.Fatalf("%s: %s %v", method, code, out)
+			}
+			b, _ := json.Marshal(out)
+			if strings.Contains(string(b), "volume1") || strings.Contains(string(b), "nativeProof") {
+				t.Fatal("request metadata leaked", string(b))
+			}
+		}
+		code, out := call(t, cfg, auth, "nas.files.read.binary", sampleParams["nas.files.read.binary"])
+		want := "unsupported"
+		if auth.err != nil {
+			want = "session_required"
+		}
+		if code != want || out["data"] != nil {
+			t.Fatal(code, out)
+		}
+		entries, err := os.ReadDir(cfg.DataDir)
+		if err != nil || len(entries) != 0 {
+			t.Fatal("NAS refusal changed package data", entries, err)
+		}
+	}
+}