@synopackageland/cli 0.4.0 → 0.5.0

package/dist/templates/native-go/backend/internal/dsmprobe/protocol.go

@@ -0,0 +1,179 @@
+// Package dsmprobe defines a bounded, non-secret observation protocol. It is
+// private to the helper/probe; neither browser nor package RPC exposes it.
+package dsmprobe
+
+import (
+	"bytes"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+)
+
+const MaxRequestBytes = 4096
+const MaxResponseBytes = 32768
+const Protocol = 1
+
+var ErrInvalid = errors.New("invalid probe request")
+
+type Request struct {
+	Version         int      `json:"version"`
+	Nonce           string   `json:"nonce"`
+	Kind            string   `json:"kind"`
+	Username        string   `json:"username"`
+	UID             uint32   `json:"uid"`
+	GID             uint32   `json:"gid"`
+	Groups          []uint32 `json:"groups"`
+	ExpectedRuntime string   `json:"expectedRuntime"`
+}
+type LibraryEvidence struct {
+	Name    string   `json:"name"`
+	SHA256  string   `json:"sha256"`
+	Exports []string `json:"exports"`
+}
+type Runtime struct {
+	VersionDigest string            `json:"versionDigest"`
+	Architecture  string            `json:"architecture"`
+	DSMBuild      string            `json:"dsmBuild"`
+	Kernel        string            `json:"kernel"`
+	BootRef       string            `json:"bootRef"`
+	Fingerprint   string            `json:"fingerprint"`
+	Libraries     []LibraryEvidence `json:"libraries"`
+	ACLModule     bool              `json:"aclModule"`
+}
+type Identity struct {
+	UID         uint32   `json:"uid"`
+	GID         uint32   `json:"gid"`
+	Groups      []uint32 `json:"groups"`
+	NoNewPrivs  bool     `json:"noNewPrivs"`
+	NonDumpable bool     `json:"nonDumpable"`
+}
+type Account struct {
+	Username    string   `json:"username"`
+	UID         uint32   `json:"uid"`
+	GID         uint32   `json:"gid"`
+	Groups      []uint32 `json:"groups"`
+	Home        string   `json:"home"`
+	NativeKnown bool     `json:"nativeKnown"`
+	Local       bool     `json:"local"`
+	Enabled     bool     `json:"enabled"`
+	GroupsKnown bool     `json:"groupsKnown"`
+}
+type Home struct {
+	HomesPath   string `json:"homesPath"`
+	StatusKnown bool   `json:"statusKnown"`
+	Enabled     bool   `json:"enabled"`
+	Existing    bool   `json:"existing"`
+	Device      uint64 `json:"device"`
+	Inode       uint64 `json:"inode"`
+	Owner       uint32 `json:"owner"`
+}
+type Share struct {
+	Name            string `json:"name"`
+	Path            string `json:"path"`
+	NativeKnown     bool   `json:"nativeKnown"`
+	Available       bool   `json:"available"`
+	VolumeKnown     bool   `json:"volumeKnown"`
+	PermissionKnown bool   `json:"permissionKnown"`
+	ReadAllowed     bool   `json:"readAllowed"`
+}
+type ACLSample struct {
+	Attempted         bool     `json:"attempted"`
+	FilesystemSupport int64    `json:"filesystemSupport"`
+	ObjectSupport     int64    `json:"objectSupport"`
+	SupportErrno      []uint32 `json:"supportErrno"`
+	CheckResult       int64    `json:"checkResult"`
+	CheckErrno        uint32   `json:"checkErrno"`
+	Mask              uint32   `json:"mask"`
+	Certified         bool     `json:"certified"`
+}
+type Response struct {
+	Version  int       `json:"version"`
+	Nonce    string    `json:"nonce"`
+	Status   string    `json:"status"`
+	Runtime  Runtime   `json:"runtime"`
+	Identity Identity  `json:"identity"`
+	Account  Account   `json:"account"`
+	Home     Home      `json:"home"`
+	Share    Share     `json:"share"`
+	ACL      ACLSample `json:"acl"`
+}
+
+func DigestValid(s string) bool {
+	b, e := hex.DecodeString(s)
+	return e == nil && len(b) == 32 && len(s) == 64
+}
+func (r Request) Validate() error {
+	if r.Version != Protocol || !DigestValid(r.Nonce) || r.Groups == nil || len(r.Groups) > 512 {
+		return ErrInvalid
+	}
+	for i, g := range r.Groups {
+		if i > 0 && r.Groups[i-1] >= g {
+			return ErrInvalid
+		}
+	}
+	if r.Kind == "runtime" {
+		if r.Username != "" || r.ExpectedRuntime != "" {
+			return ErrInvalid
+		}
+		return nil
+	}
+	if (r.Username != "normal3" && r.Username != "admin") || r.UID == 0 {
+		return ErrInvalid
+	}
+	switch r.Kind {
+	case "metadata":
+		if r.ExpectedRuntime != "" {
+			return ErrInvalid
+		}
+	case "acl":
+		if !DigestValid(r.ExpectedRuntime) {
+			return ErrInvalid
+		}
+	default:
+		return ErrInvalid
+	}
+	return nil
+}
+func DecodeRequest(b []byte) (Request, error) {
+	var out Request
+	if len(b) > MaxRequestBytes {
+		return out, ErrInvalid
+	}
+	d := json.NewDecoder(bytes.NewReader(b))
+	token, e := d.Token()
+	if e != nil || token != json.Delim('{') {
+		return out, ErrInvalid
+	}
+	allowed := map[string]bool{"version": true, "nonce": true, "kind": true, "username": true, "uid": true, "gid": true, "groups": true, "expectedRuntime": true}
+	raw := map[string]json.RawMessage{}
+	for d.More() {
+		t, e := d.Token()
+		if e != nil {
+			return out, ErrInvalid
+		}
+		k, ok := t.(string)
+		if !ok || !allowed[k] {
+			return out, ErrInvalid
+		}
+		if _, ok := raw[k]; ok {
+			return out, ErrInvalid
+		}
+		var v json.RawMessage
+		if d.Decode(&v) != nil {
+			return out, ErrInvalid
+		}
+		raw[k] = v
+	}
+	if t, e := d.Token(); e != nil || t != json.Delim('}') {
+		return out, ErrInvalid
+	}
+	if _, e = d.Token(); e != io.EOF {
+		return out, ErrInvalid
+	}
+	data, _ := json.Marshal(raw)
+	if json.Unmarshal(data, &out) != nil {
+		return Request{}, ErrInvalid
+	}
+	return out, out.Validate()
+}

package/dist/templates/native-go/backend/internal/dsmprobe/protocol_test.go

@@ -0,0 +1,29 @@
+package dsmprobe
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestRequestRejectsUnknownDuplicateAndOversized(t *testing.T) {
+	for _, s := range []string{`{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","kind":"acl"}`, `{"version":1,"nonce":"` + strings.Repeat("a", 64) + `","username":"normal3","uid":1217,"gid":100,"groups":[100],"kind":"metadata","allow":true}`, strings.Repeat(" ", MaxRequestBytes+1)} {
+		if _, e := DecodeRequest([]byte(s)); e == nil {
+			t.Fatal("invalid request accepted")
+		}
+	}
+}
+func TestRequestRestrictsFixtureAndNeverCarriesSession(t *testing.T) {
+	r := Request{Version: 1, Nonce: strings.Repeat("a", 64), Kind: "metadata", Username: "normal3", UID: 1217, GID: 100, Groups: []uint32{100}}
+	if r.Validate() != nil {
+		t.Fatal("valid fixture refused")
+	}
+	r.Username = "normal1"
+	if r.Validate() == nil {
+		t.Fatal("reserved account accepted")
+	}
+	r.Username = "normal3"
+	r.Kind = "acl"
+	if r.Validate() == nil {
+		t.Fatal("ACL without runtime fingerprint accepted")
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/browse_test.go

@@ -0,0 +1,67 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+)
+
+// browseServer answers the session check and both List methods, and records
+// the folder_path DSM was asked to list ("" for the share roots).
+func browseServer(t *testing.T, user string, listed *[]string) *Client {
+	return fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		switch r.Form.Get("method") {
+		case "get":
+			fmt.Fprintf(w, `{"success":true,"data":{"username":%q}}`, user)
+		case "list_share":
+			*listed = append(*listed, "")
+			fmt.Fprint(w, `{"success":true,"data":{"shares":[{"path":"/share","name":"share","isdir":true}],"total":1,"offset":0}}`)
+		case "list":
+			*listed = append(*listed, r.Form.Get("folder_path"))
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/share/a.txt","name":"a.txt","isdir":false,"additional":{"size":3}}],"total":1,"offset":0}}`)
+		}
+	})
+}
+
+func TestBrowseListsShareRootsAndFoldersThroughCurrentSession(t *testing.T) {
+	var listed []string
+	s, _ := fileService(t, browseServer(t, "alice", &listed))
+	roots, err := s.Browse(context.Background(), alice(t), sessionRequest(), "", 0)
+	if err != nil || len(roots.Shares) != 1 || roots.Shares[0].Path != "/share" {
+		t.Fatalf("%+v %v", roots, err)
+	}
+	page, err := s.Browse(context.Background(), alice(t), sessionRequest(), "/share", 0)
+	if err != nil || len(page.Files) != 1 || page.Files[0].Name != "a.txt" {
+		t.Fatalf("%+v %v", page, err)
+	}
+	if len(listed) != 2 || listed[0] != "" || listed[1] != "/share" {
+		t.Fatalf("listed %q", listed)
+	}
+}
+
+func TestBrowseRefusesAnotherUsersSessionBeforeListing(t *testing.T) {
+	var listed []string
+	s, _ := fileService(t, browseServer(t, "mallory", &listed))
+	if _, err := s.Browse(context.Background(), alice(t), sessionRequest(), "/share", 0); err == nil {
+		t.Fatal("a session that resolves to another user must be refused")
+	}
+	if len(listed) != 0 {
+		t.Fatalf("listed %q", listed)
+	}
+}
+
+func TestBrowseRefusesBadPathsAndOnNilService(t *testing.T) {
+	var listed []string
+	s, _ := fileService(t, browseServer(t, "alice", &listed))
+	for _, folder := range []string{"share", "/share/../etc"} {
+		if _, err := s.Browse(context.Background(), alice(t), sessionRequest(), folder, 0); err == nil {
+			t.Errorf("%q must be refused", folder)
+		}
+	}
+	var nilService *Service
+	if _, err := nilService.Browse(context.Background(), alice(t), sessionRequest(), "", 0); err == nil {
+		t.Fatal("nil service must refuse")
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/client.go

@@ -0,0 +1,251 @@
+package filestation
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+const MaxBytes = 512 * 1024
+const maxMetadata = 1024 * 1024
+const PageSize = 100
+
+// Client has no cookie jar or credentials. The destination is startup-owned,
+// literal loopback only; proxies, redirects and automatic retries are disabled.
+type Client struct {
+	endpoint string
+	http     *http.Client
+}
+
+func NewClient(base string) (*Client, error) {
+	u, e := url.Parse(base)
+	if e != nil || u.Scheme != "http" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (u.Path != "" && u.Path != "/") || net.ParseIP(u.Hostname()) == nil || !net.ParseIP(u.Hostname()).IsLoopback() {
+		return nil, fail("unavailable")
+	}
+	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, ResponseHeaderTimeout: 10 * time.Second, MaxResponseHeaderBytes: 32 * 1024, DisableCompression: true}
+	return &Client{endpoint: strings.TrimRight(base, "/") + "/webapi/entry.cgi", http: &http.Client{Transport: tr, Timeout: 15 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}, nil
+}
+func fail(code string) error {
+	return &api.Error{Code: code, Message: "File Station operation refused"}
+}
+func wireError(code int) error {
+	switch code {
+	case 106, 107, 119:
+		return fail("session_required")
+	case 105, 403, 407:
+		return fail("denied")
+	case 408:
+		return fail("not_found")
+	case 414, 1805:
+		return fail("conflict")
+	case 400:
+		return fail("invalid-request")
+	default:
+		return fail("unavailable")
+	}
+}
+func fields(family, method, version string) url.Values {
+	return url.Values{"api": {family}, "method": {method}, "version": {version}}
+}
+func array(s string) string { b, _ := json.Marshal([]string{s}); return string(b) }
+func validPath(p string) bool {
+	return len(p) > 1 && len(p) <= 4096 && strings.HasPrefix(p, "/") && path.Clean(p) == p && !strings.ContainsAny(p, "\x00\r\n\\,\"")
+}
+func (c *Client) send(ctx context.Context, original *http.Request, body io.Reader, contentType string) (*http.Response, error) {
+	if c == nil || original == nil {
+		return nil, fail("unavailable")
+	}
+	cookies := original.CookiesNamed("id")
+	token := original.Header.Get("X-SYNO-TOKEN")
+	if len(cookies) != 1 || cookies[0].Value == "" || len(cookies[0].Value) > 4096 || len(token) > 4096 || strings.ContainsAny(token, "\r\n\x00") {
+		return nil, fail("session_required")
+	}
+	method, endpoint := http.MethodPost, c.endpoint
+	if contentType == "" {
+		method = http.MethodGet
+		encoded, err := io.ReadAll(body)
+		if err != nil {
+			return nil, fail("unavailable")
+		}
+		endpoint += "?" + string(encoded)
+		body = nil
+	}
+	req, e := http.NewRequestWithContext(ctx, method, endpoint, body)
+	if e != nil {
+		return nil, fail("unavailable")
+	}
+	req.Header.Set("Content-Type", contentType)
+	req.AddCookie(cookies[0])
+	req.Header.Set("X-SYNO-TOKEN", token)
+	// Never forward caller Host, Authorization, forwarding headers or URLs.
+	resp, e := c.http.Do(req)
+	if e != nil {
+		if ctx.Err() != nil {
+			return nil, fail("canceled")
+		}
+		return nil, fail("unavailable")
+	}
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		return nil, fail("unavailable")
+	}
+	return resp, nil
+}
+func (c *Client) form(ctx context.Context, r *http.Request, v url.Values) (*http.Response, error) {
+	if r == nil {
+		return nil, fail("unavailable")
+	}
+	v.Set("SynoToken", r.Header.Get("X-SYNO-TOKEN"))
+	return c.send(ctx, r, strings.NewReader(v.Encode()), "application/x-www-form-urlencoded")
+}
+func decode(resp *http.Response, into any) error {
+	defer resp.Body.Close()
+	b, e := io.ReadAll(io.LimitReader(resp.Body, maxMetadata+1))
+	if e != nil || len(b) > maxMetadata {
+		return fail("unavailable")
+	}
+	var envelope struct {
+		Success *bool           `json:"success"`
+		Data    json.RawMessage `json:"data"`
+		Error   struct {
+			Code int `json:"code"`
+		} `json:"error"`
+	}
+	if json.Unmarshal(b, &envelope) != nil || envelope.Success == nil {
+		return fail("unavailable")
+	}
+	if !*envelope.Success {
+		return wireError(envelope.Error.Code)
+	}
+	if into != nil && json.Unmarshal(envelope.Data, into) != nil {
+		return fail("unavailable")
+	}
+	return nil
+}
+func (c *Client) call(ctx context.Context, r *http.Request, v url.Values, into any) error {
+	resp, e := c.form(ctx, r, v)
+	if e != nil {
+		return e
+	}
+	return decode(resp, into)
+}
+
+// Verify checks that loopback WebAPI resolves the same user as authenticate.cgi.
+// Failure (including DSM IP-bound sessions) never falls back to admin credentials.
+func (c *Client) Verify(ctx context.Context, r *http.Request, user string) error {
+	var d struct {
+		Username string `json:"username"`
+	}
+	if e := c.call(ctx, r, fields("SYNO.Core.NormalUser", "get", "1"), &d); e != nil {
+		return e
+	}
+	if user == "" || d.Username != user {
+		return fail("session_required")
+	}
+	return nil
+}
+
+type Entry struct {
+	Path       string `json:"path"`
+	Name       string `json:"name"`
+	IsDir      bool   `json:"isdir"`
+	Additional struct {
+		Size int64 `json:"size"`
+	} `json:"additional"`
+}
+type Page struct {
+	Files  []Entry `json:"files"`
+	Shares []Entry `json:"shares,omitempty"`
+	Total  int     `json:"total"`
+	Offset int     `json:"offset"`
+}
+
+func (c *Client) page(ctx context.Context, r *http.Request, p string, offset int) (Page, error) {
+	var d Page
+	if offset < 0 || offset > 1000000 || (p != "" && !validPath(p)) {
+		return d, fail("invalid-request")
+	}
+	method := "list"
+	if p == "" {
+		method = "list_share"
+	}
+	v := fields("SYNO.FileStation.List", method, "2")
+	v.Set("offset", strconv.Itoa(offset))
+	v.Set("limit", strconv.Itoa(PageSize))
+	v.Set("additional", `["size"]`)
+	if p != "" {
+		v.Set("folder_path", p)
+	}
+	e := c.call(ctx, r, v, &d)
+	if len(d.Files) > PageSize || len(d.Shares) > PageSize {
+		return Page{}, fail("unavailable")
+	}
+	return d, e
+}
+func (c *Client) Discover(ctx context.Context, r *http.Request, offset int) (Page, error) {
+	return c.page(ctx, r, "", offset)
+}
+func (c *Client) List(ctx context.Context, r *http.Request, p string, offset int) (Page, error) {
+	return c.page(ctx, r, p, offset)
+}
+func (c *Client) Stat(ctx context.Context, r *http.Request, p string) (Entry, error) {
+	var d Page
+	if !validPath(p) {
+		return Entry{}, fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.List", "getinfo", "2")
+	v.Set("path", array(p))
+	v.Set("additional", `["size"]`)
+	if e := c.call(ctx, r, v, &d); e != nil {
+		return Entry{}, e
+	}
+	if len(d.Files) != 1 || d.Files[0].Path != p || d.Files[0].Name == "" {
+		return Entry{}, fail("not_found")
+	}
+	return d.Files[0], nil
+}
+func (c *Client) Read(ctx context.Context, r *http.Request, p string) ([]byte, error) {
+	if !validPath(p) {
+		return nil, fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.Download", "download", "2")
+	v.Set("path", array(p))
+	v.Set("mode", "download")
+	resp, e := c.send(ctx, r, strings.NewReader(v.Encode()), "")
+	if e != nil {
+		return nil, e
+	}
+	// DSM error envelopes must never be returned as successful file content.
+	// A real JSON file remains downloadable when attachment disposition is set.
+	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
+	if disposition != "attachment" {
+		e = decode(resp, nil)
+		if e == nil {
+			e = fail("unavailable")
+		}
+		return nil, e
+	}
+	defer resp.Body.Close()
+	b, e := io.ReadAll(io.LimitReader(resp.Body, MaxBytes+1))
+	if e != nil {
+		return nil, fail("read_failed")
+	}
+	if len(b) > MaxBytes {
+		return nil, fail("limit-exceeded")
+	}
+	if resp.ContentLength >= 0 && resp.ContentLength != int64(len(b)) {
+		return nil, fail("read_failed")
+	}
+	return bytes.Clone(b), nil
+}

package/dist/templates/native-go/backend/internal/filestation/client_test.go

@@ -0,0 +1,155 @@
+package filestation
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func fakeClient(t *testing.T, h http.HandlerFunc) *Client {
+	t.Helper()
+	s := httptest.NewServer(h)
+	t.Cleanup(s.Close)
+	c, err := NewClient(s.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+func sessionRequest() *http.Request {
+	r := httptest.NewRequest("POST", "http://package/api", nil)
+	r.AddCookie(&http.Cookie{Name: "id", Value: "test-session"})
+	r.Header.Set("X-SYNO-TOKEN", "test-token")
+	return r
+}
+func TestReadOperationsUseOnlyCurrentSession(t *testing.T) {
+	calls := 0
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		if (r.Method != "GET" && r.URL.RawQuery != "") || r.Header.Get("X-SYNO-TOKEN") != "test-token" || r.Header.Get("Cookie") != "id=test-session" {
+			t.Error("incorrect session transport")
+		}
+		r.ParseForm()
+		if r.Form.Get("_sid") != "" || (r.Method != "GET" && r.Form.Get("SynoToken") != "test-token") {
+			t.Error("incorrect form carriers")
+		}
+		switch r.Form.Get("method") {
+		case "get":
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+		case "list_share":
+			fmt.Fprint(w, `{"success":true,"data":{"shares":[{"path":"/home","name":"home","isdir":true}],"total":1}}`)
+		case "list":
+			if r.Form.Get("folder_path") != "/home" || r.Form.Get("limit") != "100" {
+				t.Error("list fields")
+			}
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/a","name":"a","isdir":false}],"total":1}}`)
+		case "getinfo":
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/a","name":"a","isdir":false,"additional":{"size":3}}]}}`)
+		case "download":
+			if r.Form.Get("path") != `["/home/a"]` {
+				t.Error("download path")
+			}
+			w.Header().Set("Content-Type", "application/octet-stream")
+			w.Header().Set("Content-Disposition", `attachment; filename="a"`)
+			fmt.Fprint(w, "abc")
+		default:
+			t.Error("unexpected method")
+		}
+	})
+	r := sessionRequest()
+	if err := c.Verify(context.Background(), r, "alice"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := c.Discover(context.Background(), r, 0); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := c.List(context.Background(), r, "/home", 0); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := c.Stat(context.Background(), r, "/home/a"); err != nil {
+		t.Fatal(err)
+	}
+	b, err := c.Read(context.Background(), r, "/home/a")
+	if err != nil || string(b) != "abc" {
+		t.Fatal(err)
+	}
+	if calls != 5 {
+		t.Fatal(calls)
+	}
+}
+func TestRefusalAndBoundedErrors(t *testing.T) {
+	for _, tt := range []struct{ body, want string }{
+		{`{"success":false,"error":{"code":119,"secret":"test-session"}}`, "session_required"},
+		{`{"success":false,"error":{"code":407}}`, "denied"},
+		{`{"success":false,"error":{"code":408}}`, "not_found"},
+		{`{"success":false,"error":{"code":1805}}`, "conflict"},
+		{`{"success":false,"error":{"code":9999}}`, "unavailable"},
+		{`{"data":{}}`, "unavailable"}, {`not json`, "unavailable"},
+	} {
+		t.Run(tt.want+tt.body, func(t *testing.T) {
+			c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, tt.body) })
+			_, err := c.List(context.Background(), sessionRequest(), "/home", 0)
+			if err == nil || !strings.Contains(err.Error(), tt.want) || strings.Contains(err.Error(), "test-session") {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+func TestNoSessionRedirectOrRemoteDestination(t *testing.T) {
+	for _, url := range []string{"https://example.com", "http://localhost:5000", "http://127.0.0.1:5000/evil", "http://user@127.0.0.1:5000", "http://127.0.0.1:5000?x=y"} {
+		if _, err := NewClient(url); err == nil {
+			t.Fatal("accepted", url)
+		}
+	}
+	calls := 0
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		http.Redirect(w, r, "http://127.0.0.1:1/leak", 302)
+	})
+	if _, err := c.List(context.Background(), httptest.NewRequest("POST", "/", nil), "/home", 0); err == nil || calls != 0 {
+		t.Fatal("missing session sent")
+	}
+	if _, err := c.List(context.Background(), sessionRequest(), "/home", 0); err == nil || calls != 1 {
+		t.Fatal("redirect accepted")
+	}
+}
+func TestDownloadDoesNotTurnErrorsIntoFileBytes(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{"success": false, "error": map[string]int{"code": 407}})
+	})
+	if b, err := c.Read(context.Background(), sessionRequest(), "/home/a"); err == nil || len(b) != 0 {
+		t.Fatal("error bytes escaped")
+	}
+}
+
+func TestBoundariesCancellationAndIdentityMismatch(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("method") == "download" {
+			w.Header().Set("Content-Disposition", `attachment; filename="large"`)
+			fmt.Fprint(w, strings.Repeat("x", MaxBytes+1))
+			return
+		}
+		fmt.Fprint(w, `{"success":true,"data":{"username":"someone-else"}}`)
+	})
+	if e := c.Verify(context.Background(), sessionRequest(), "alice"); e == nil {
+		t.Fatal("identity mismatch admitted")
+	}
+	if b, e := c.Read(context.Background(), sessionRequest(), "/home/large"); e == nil || len(b) != 0 {
+		t.Fatal("oversized read escaped")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, e := c.List(ctx, sessionRequest(), "/home", 0); e == nil {
+		t.Fatal("canceled request succeeded")
+	}
+	r := sessionRequest()
+	r.AddCookie(&http.Cookie{Name: "id", Value: "other"})
+	if _, e := c.List(context.Background(), r, "/home", 0); e == nil {
+		t.Fatal("ambiguous session accepted")
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/doc.go

@@ -0,0 +1,4 @@
+// Package filestation implements interactive NAS operations using the current
+// DSM user's session. It never opens NAS data paths or retains credentials.
+// Folder selections are not background grants or filesystem confinement.
+package filestation