@synopackageland/cli 0.4.1 → 0.5.0

package/dist/templates/native-go/backend/internal/filestation/sdk_session_test.go

@@ -0,0 +1,183 @@
+//go:build synopkgland_sdk_workers
+
+package filestation
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/helper/jobcontract"
+	"fmt"
+	"golang.org/x/sys/unix"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+type sdkAuth struct {
+	identity api.Identity
+	err      error
+}
+
+func (a sdkAuth) Authenticate(*http.Request) (api.Identity, error) { return a.identity, a.err }
+func TestSDKSessionIdentityFreshAndMatched(t *testing.T) {
+	var calls atomic.Int32
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+	})
+	s := NewService(c, NewGrantRepository(t.TempDir()))
+	s.lookupUID = func(string) (string, error) { return "1000", nil }
+	a := sdkAuth{identity: api.Identity{User: "alice", Admin: true}}
+	for range 2 {
+		id, e := s.CheckSession(context.Background(), a, sessionRequest())
+		if e != nil || id.User != "alice" || id.UID != "1000" || !id.Admin {
+			t.Fatalf("missing verified identity: %v", e)
+		}
+	}
+	if calls.Load() != 2 {
+		t.Fatal("session cached")
+	}
+	a.identity.User = "bob"
+	if _, e := s.CheckSession(context.Background(), a, sessionRequest()); e == nil {
+		t.Fatal("mismatched session accepted")
+	}
+	a.identity.User = "alice"
+	s.lookupUID = func(string) (string, error) { return "0", nil }
+	if _, e := s.CheckSession(context.Background(), a, sessionRequest()); e == nil {
+		t.Fatal("root identity accepted")
+	}
+	a.err = api.ErrNoSession
+	if _, e := s.CheckSession(context.Background(), a, sessionRequest()); e == nil {
+		t.Fatal("expired session accepted")
+	}
+}
+func TestSDKJobUsesSelectionAndFileStation(t *testing.T) {
+	var calls atomic.Int32
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls.Add(1)
+		r.ParseForm()
+		if r.Form.Get("api") != "SYNO.FileStation.List" {
+			t.Error("unexpected API")
+		}
+		fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/item","name":"item","isdir":false,"additional":{"size":7}}]}}`)
+	})
+	repo := NewGrantRepository(t.TempDir())
+	s := NewService(c, repo)
+	ctx := context.Background()
+	id := SessionIdentity{User: "alice", UID: "1000"}
+	g, e := repo.Confirm(ctx, id.User, id.UID, "/home", false)
+	if e != nil {
+		t.Fatal(e)
+	}
+	if e = s.JobSelection(ctx, id, g.ID); e != nil {
+		t.Fatal(e)
+	}
+	step := jobcontract.Step{Action: jobcontract.Stat, Segments: []string{"item"}}
+	result, e := s.JobStep(ctx, sessionRequest(), id, g.ID, step)
+	if e != nil || result.Entries != 1 || result.CompletedSteps != 1 {
+		t.Fatalf("step failed: %v", e)
+	}
+	for _, other := range []SessionIdentity{{User: "bob", UID: "1000", Admin: true}, {User: "alice", UID: "1001"}} {
+		if _, e = s.JobStep(ctx, sessionRequest(), other, g.ID, step); e == nil {
+			t.Fatal("foreign selection accepted")
+		}
+	}
+	step.Segments = []string{"..", "item"}
+	if _, e = s.JobStep(ctx, sessionRequest(), id, g.ID, step); e == nil {
+		t.Fatal("traversal accepted")
+	}
+	step.Action = jobcontract.ReadStream
+	step.Segments = []string{"item"}
+	if _, e = s.JobStep(ctx, sessionRequest(), id, g.ID, step); e == nil {
+		t.Fatal("stream accepted")
+	}
+	if calls.Load() != 1 {
+		t.Fatal("refused input reached File Station")
+	}
+	if e = repo.Revoke(ctx, id.User, id.UID, g.ID); e != nil {
+		t.Fatal(e)
+	}
+	if e = s.JobSelection(ctx, id, g.ID); e == nil {
+		t.Fatal("revoked selection accepted")
+	}
+}
+
+func TestSDKJobReadUsesBoundedDownloadAndSafeCounters(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		if r.Form.Get("method") == "getinfo" {
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/item","name":"item","additional":{"size":3}}]}}`)
+			return
+		}
+		if r.Method != "GET" || r.URL.Query().Has("SynoToken") {
+			t.Error("credential URL or non-GET download")
+		}
+		w.Header().Set("Content-Disposition", `attachment; filename="item"`)
+		fmt.Fprint(w, "abc")
+	})
+	repo := NewGrantRepository(t.TempDir())
+	s := NewService(c, repo)
+	id := SessionIdentity{User: "alice", UID: "1000"}
+	g, e := repo.Confirm(context.Background(), id.User, id.UID, "/home", false)
+	if e != nil {
+		t.Fatal(e)
+	}
+	n := uint64(3)
+	step := jobcontract.Step{Action: jobcontract.Read, Segments: []string{"item"}, MaxBytes: &n}
+	result, e := s.JobStep(context.Background(), sessionRequest(), id, g.ID, step)
+	if e != nil || result.BytesRead != 3 || result.CompletedSteps != 1 {
+		t.Fatal("download", e)
+	}
+	n = 2
+	if _, e = s.JobStep(context.Background(), sessionRequest(), id, g.ID, step); e == nil {
+		t.Fatal("oversized read")
+	}
+}
+
+func TestSDKJobSelectionNeverCreatesPackageFiles(t *testing.T) {
+	dir := t.TempDir()
+	s := NewService(nil, NewGrantRepository(dir))
+	_ = s.JobSelection(context.Background(), SessionIdentity{User: "alice", UID: "1000"}, strings.Repeat("a", 64))
+	files, e := os.ReadDir(dir)
+	if e != nil {
+		t.Fatal(e)
+	}
+	if len(files) != 0 {
+		t.Fatal("privileged job reader created package metadata")
+	}
+}
+func TestSDKJobSelectionRefusesSpecialMetadataFiles(t *testing.T) {
+	for _, name := range []string{"session-selections.lock", "session-selections.json"} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			repo := NewGrantRepository(dir)
+			id := SessionIdentity{User: "alice", UID: "1000"}
+			g, e := repo.Confirm(context.Background(), id.User, id.UID, "/home", false)
+			if e != nil {
+				t.Fatal(e)
+			}
+			target := filepath.Join(dir, name)
+			if e = os.Remove(target); e != nil {
+				t.Fatal(e)
+			}
+			if e = unix.Mkfifo(target, 0600); e != nil {
+				t.Fatal(e)
+			}
+			s := NewService(nil, repo)
+			done := make(chan error, 1)
+			go func() { done <- s.JobSelection(context.Background(), id, g.ID) }()
+			select {
+			case e := <-done:
+				if e == nil {
+					t.Fatal("special file accepted")
+				}
+			case <-time.After(time.Second):
+				t.Fatal("special file blocked root reader")
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/service.go

@@ -0,0 +1,254 @@
+package filestation
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os/user"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+type Service struct {
+	client     *Client
+	repository *GrantRepository
+	lookupUID  func(string) (string, error)
+}
+
+func NewService(client *Client, repository *GrantRepository) *Service {
+	return &Service{client: client, repository: repository, lookupUID: func(name string) (string, error) {
+		u, e := user.Lookup(name)
+		if e != nil {
+			return "", e
+		}
+		return u.Uid, nil
+	}}
+}
+
+// Local is the production assembly. DSM's HTTP loopback port is fixed here,
+// never selected from Host, request params or a browser-supplied URL.
+func Local(dataDir string) *Service {
+	c, e := NewClient("http://127.0.0.1:5000")
+	if e != nil {
+		return nil
+	}
+	return NewService(c, NewGrantRepository(dataDir))
+}
+func (s *Service) Routes() []api.Route {
+	if s == nil {
+		return nil
+	}
+	routes := []api.Route{}
+	for _, name := range []string{"nas.session.status", "nas.discovery", "nas.grants.confirm", "nas.grants.list", "nas.grants.revoke", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.create", "nas.files.write", "nas.files.stream", "nas.files.publish"} {
+		method := name
+		routes = append(routes, api.UserRequest(method, func(ctx context.Context, c api.Caller, r *http.Request, p json.RawMessage) (any, error) {
+			return s.handle(ctx, c, r, method, p)
+		}))
+	}
+	return routes
+}
+func strict(p json.RawMessage, dst any) error {
+	d := json.NewDecoder(bytes.NewReader(p))
+	d.DisallowUnknownFields()
+	if d.Decode(dst) != nil || d.Decode(new(any)) != io.EOF {
+		return fail("invalid-request")
+	}
+	return nil
+}
+func (s *Service) handle(ctx context.Context, c api.Caller, r *http.Request, method string, p json.RawMessage) (any, error) {
+	if !c.Authenticated() {
+		return nil, fail("session_required")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	if method == "nas.session.status" {
+		if e := strict(p, &struct{}{}); e != nil {
+			return nil, e
+		}
+		return map[string]string{"interactive": "session-required", "background": "unavailable", "mode": "filestation-session", "validation": "local-only"}, nil
+	}
+	if method == "nas.files.stream" || method == "nas.files.publish" {
+		return nil, fail("unsupported")
+	}
+	if s.client == nil || s.repository == nil {
+		return nil, fail("unavailable")
+	}
+	uid, e := s.verifiedUID(ctx, c, r)
+	if e != nil {
+		return nil, e
+	}
+	switch method {
+	case "nas.discovery":
+		var in struct {
+			Folder string `json:"folder"`
+			Offset int    `json:"offset"`
+		}
+		if e := strict(p, &in); e != nil {
+			return nil, e
+		}
+		return s.discover(ctx, r, in.Folder, in.Offset)
+	case "nas.grants.confirm":
+		var in struct {
+			Folder   string `json:"folder"`
+			Writable bool   `json:"writable"`
+		}
+		if e := strict(p, &in); e != nil {
+			return nil, e
+		}
+		item, e := s.client.Stat(ctx, r, in.Folder)
+		if e != nil {
+			return nil, e
+		}
+		if !item.IsDir {
+			return nil, fail("invalid-request")
+		}
+		return s.repository.Confirm(ctx, c.User(), uid, in.Folder, in.Writable)
+	case "nas.grants.list":
+		if e := strict(p, &struct{}{}); e != nil {
+			return nil, e
+		}
+		return s.repository.List(ctx, c.User(), uid)
+	case "nas.grants.revoke":
+		var in struct {
+			ID string `json:"grantId"`
+		}
+		if e := strict(p, &in); e != nil {
+			return nil, e
+		}
+		e := s.repository.Revoke(ctx, c.User(), uid, in.ID)
+		return map[string]bool{"revoked": e == nil}, e
+	}
+	var in struct {
+		ID       string `json:"grantId"`
+		Relative string `json:"relative"`
+		Name     string `json:"name"`
+		Offset   int    `json:"offset"`
+		Data     []byte `json:"data"`
+	}
+	if e := strict(p, &in); e != nil {
+		return nil, e
+	}
+	write := method == "nas.files.create" || method == "nas.files.write"
+	if len(in.Data) > MaxBytes {
+		return nil, fail("limit-exceeded")
+	}
+	var result any
+	e = s.repository.WithGrant(ctx, c.User(), uid, in.ID, write, func(g Selection) error {
+		target, e := relative(g.Folder, in.Relative)
+		if e != nil {
+			return e
+		}
+		switch method {
+		case "nas.files.list":
+			result, e = s.client.List(ctx, r, target, in.Offset)
+		case "nas.files.stat":
+			result, e = s.client.Stat(ctx, r, target)
+		case "nas.files.read":
+			var b []byte
+			b, e = s.readRegularFile(ctx, r, target)
+			result = map[string]any{"data": b, "bytes": len(b)}
+		case "nas.files.create":
+			e = s.client.Create(ctx, r, target, in.Name)
+			result = map[string]bool{"created": e == nil}
+		case "nas.files.write":
+			e = s.client.Write(ctx, r, target, in.Name, in.Data)
+			result = map[string]bool{"written": e == nil}
+		default:
+			return fail("unsupported")
+		}
+		return e
+	})
+	return result, e
+}
+
+// verifiedUID proves the request's DSM session belongs to the caller and
+// returns the caller's UID.
+func (s *Service) verifiedUID(ctx context.Context, c api.Caller, r *http.Request) (string, error) {
+	if e := s.client.Verify(ctx, r, c.User()); e != nil {
+		return "", e
+	}
+	uid, e := s.lookupUID(c.User())
+	if e != nil || uid == "" {
+		return "", fail("auth_unavailable")
+	}
+	return uid, nil
+}
+
+// readRegularFile avoids downloading a folder as an archive. DSM still enforces
+// its current permissions on the subsequent download, not this metadata observation.
+func (s *Service) readRegularFile(ctx context.Context, r *http.Request, target string) ([]byte, error) {
+	item, e := s.client.Stat(ctx, r, target)
+	if e != nil {
+		return nil, e
+	}
+	if item.IsDir {
+		return nil, fail("invalid-request")
+	}
+	if item.Additional.Size > MaxBytes {
+		return nil, fail("limit-exceeded")
+	}
+	return s.client.Read(ctx, r, target)
+}
+
+// discover lists the share roots for an empty folder, else one folder's page.
+func (s *Service) discover(ctx context.Context, r *http.Request, folder string, offset int) (Page, error) {
+	if folder == "" {
+		return s.client.Discover(ctx, r, offset)
+	}
+	return s.client.List(ctx, r, folder, offset)
+}
+
+// Browse lists share roots (empty folder) or one folder through the caller's
+// own DSM session, so File Station's current permissions decide what is
+// visible. It is read-only metadata and stores no grant; background jobs use it
+// to let an administrator pick the file that ReadFile will then import.
+func (s *Service) Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (Page, error) {
+	if !c.Authenticated() {
+		return Page{}, fail("session_required")
+	}
+	if s == nil || s.client == nil {
+		return Page{}, fail("unavailable")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	if _, e := s.verifiedUID(ctx, c, r); e != nil {
+		return Page{}, e
+	}
+	return s.discover(ctx, r, folder, offset)
+}
+
+// ReadFile reads one regular file below a folder the caller names, through the
+// caller's own DSM session, up to MaxBytes. It is the single-file import used by
+// package-private background jobs; the bytes never pass through the browser.
+// The request itself is the consent, so no grant is stored.
+func (s *Service) ReadFile(ctx context.Context, c api.Caller, r *http.Request, folder, rel string) ([]byte, error) {
+	if !c.Authenticated() {
+		return nil, fail("session_required")
+	}
+	if s == nil || s.client == nil {
+		return nil, fail("unavailable")
+	}
+	if rel == "" {
+		return nil, fail("invalid-request")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	if _, e := s.verifiedUID(ctx, c, r); e != nil {
+		return nil, e
+	}
+	item, e := s.client.Stat(ctx, r, folder)
+	if e != nil {
+		return nil, e
+	}
+	if !item.IsDir {
+		return nil, fail("invalid-request")
+	}
+	target, e := relative(folder, rel)
+	if e != nil {
+		return nil, e
+	}
+	return s.readRegularFile(ctx, r, target)
+}

package/dist/templates/native-go/backend/internal/filestation/service_test.go

@@ -0,0 +1,94 @@
+package filestation
+
+import (
+	"bytes"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+type testAuth struct{ user string }
+
+func (a testAuth) Authenticate(*http.Request) (api.Identity, error) {
+	if a.user == "" {
+		return api.Identity{}, api.ErrNoSession
+	}
+	return api.Identity{User: a.user}, nil
+}
+func invoke(t *testing.T, s *Service, user, method, params string) map[string]any {
+	t.Helper()
+	server, e := api.NewServer(testAuth{user}, s.Routes()...)
+	if e != nil {
+		t.Fatal(e)
+	}
+	r := sessionRequest()
+	r.Body = http.NoBody
+	b := []byte(fmt.Sprintf(`{"method":%q,"params":%s}`, method, params))
+	r.Body = ioNop(b)
+	r.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	server.ServeHTTP(w, r)
+	var out map[string]any
+	if json.Unmarshal(w.Body.Bytes(), &out) != nil {
+		t.Fatal(w.Body.String())
+	}
+	return out
+}
+func ioNop(b []byte) io.ReadCloser { return io.NopCloser(bytes.NewReader(b)) }
+func TestInteractiveRoutesIsolationAndFreshACL(t *testing.T) {
+	denied := false
+	writes := 0
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		switch r.Form.Get("method") {
+		case "get":
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+		case "getinfo":
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home","name":"home","isdir":true}]}}`)
+		case "list":
+			if denied {
+				fmt.Fprint(w, `{"success":false,"error":{"code":407}}`)
+			} else {
+				fmt.Fprint(w, `{"success":true,"data":{"files":[],"total":0}}`)
+			}
+		default:
+			writes++
+			fmt.Fprint(w, `{"success":true}`)
+		}
+	})
+	s := NewService(c, NewGrantRepository(t.TempDir()))
+	s.lookupUID = func(string) (string, error) { return "1000", nil }
+	out := invoke(t, s, "alice", "nas.grants.confirm", `{"folder":"/home","writable":false}`)
+	if out["success"] != true {
+		t.Fatal(out)
+	}
+	id := out["data"].(map[string]any)["grantId"].(string)
+	p := fmt.Sprintf(`{"grantId":%q}`, id)
+	if out = invoke(t, s, "alice", "nas.files.list", p); out["success"] != true {
+		t.Fatal(out)
+	}
+	denied = true
+	if out = invoke(t, s, "alice", "nas.files.list", p); out["error"].(map[string]any)["code"] != "denied" {
+		t.Fatal(out)
+	}
+	if out = invoke(t, s, "bob", "nas.files.list", p); out["success"] != false {
+		t.Fatal(out)
+	}
+	if out = invoke(t, s, "", "nas.files.list", p); out["success"] != false {
+		t.Fatal(out)
+	}
+	if out = invoke(t, s, "alice", "nas.files.create", fmt.Sprintf(`{"grantId":%q,"name":"x"}`, id)); out["success"] != false || writes != 0 {
+		t.Fatal(out)
+	}
+	if out = invoke(t, s, "alice", "nas.grants.revoke", p); out["success"] != true {
+		t.Fatal(out)
+	}
+	if out = invoke(t, s, "alice", "nas.files.list", p); out["success"] != false {
+		t.Fatal(out)
+	}
+
+}