@synopackageland/cli 0.4.1 → 0.5.0

package/dist/templates/native-go/backend/internal/helper/sdk_session_test.go

@@ -0,0 +1,475 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/filestation"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os/user"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+type sessionFilesFake struct {
+	mu                     sync.Mutex
+	denied, revoked, admin bool
+	calls                  int
+	block                  chan struct{}
+	uid                    string
+}
+
+func (f *sessionFilesFake) CheckSession(ctx context.Context, _ api.Authenticator, r *http.Request) (filestation.SessionIdentity, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.denied || ctx.Err() != nil {
+		return filestation.SessionIdentity{}, api.ErrNoSession
+	}
+	c, _ := r.Cookie("id")
+	if c == nil {
+		return filestation.SessionIdentity{}, api.ErrNoSession
+	}
+	name := "alice"
+	uid := "1000"
+	if strings.HasPrefix(c.Value, "bob") {
+		name = "bob"
+		uid = "1001"
+	}
+	if f.uid != "" {
+		uid = f.uid
+	}
+	return filestation.SessionIdentity{User: name, UID: uid, Admin: f.admin}, nil
+}
+func (f *sessionFilesFake) JobSelection(context.Context, filestation.SessionIdentity, string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.revoked {
+		return &api.Error{Code: "denied"}
+	}
+	return nil
+}
+func (f *sessionFilesFake) JobStep(ctx context.Context, _ *http.Request, _ filestation.SessionIdentity, _ string, _ jobcontract.Step) (jobcontract.Result, error) {
+	f.mu.Lock()
+	f.calls++
+	block := f.block
+	f.mu.Unlock()
+	if block != nil {
+		select {
+		case <-ctx.Done():
+			return jobcontract.Result{}, &api.Error{Code: "canceled"}
+		case <-block:
+		}
+	}
+	return jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}, nil
+}
+func sessionFixture(t *testing.T) (*sdkJobTestFixture, *sessionFilesFake, *time.Duration) {
+	t.Helper()
+	f := sdkJobFixture(t)
+	files := &sessionFilesFake{}
+	now := time.Duration(0)
+	f.o.attachNow = func() time.Duration { return now }
+	s, c := newSDKSessionJobs(f.o, files, nil)
+	if c != "" {
+		t.Fatal(c)
+	}
+	f.o.session = s
+	f.carriers = SessionCarriers{Cookie: "id=alice-session", ClientAddress: "127.0.0.1"}
+	return f, files, &now
+}
+func sessionCall(f *sdkJobTestFixture, method string, args any) sdkWireResponse {
+	raw, _ := json.Marshal(args)
+	n, _ := sdkRandomRef()
+	wire, _ := json.Marshal(sdkWireRequest{Inventory: f.c.inventory, Nonce: n, Method: method, Carriers: grantCarriers{Cookie: f.carriers.Cookie, SynoToken: f.carriers.SynoToken, ClientAddress: f.carriers.ClientAddress}, Args: raw})
+	return f.o.dispatchSDK(context.Background(), operationPeer{42, 0}, wire)
+}
+func sessionSubmit(t *testing.T, f *sdkJobTestFixture) sdkAttachReceipt {
+	t.Helper()
+	r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{Worker: f.r.Control.Binding.Worker, Parent: jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, Input: f.r.Input})
+	if r.Code != "" {
+		t.Fatal("prepare", r.Code)
+	}
+	var p sdkPrepared
+	if json.Unmarshal(r.Data, &p) != nil {
+		t.Fatal("prepare decode")
+	}
+	r = sessionCall(f, "jobs.submit", sdkSubmitArgs{IntentID: p.IntentID, SummaryDigest: p.SummaryDigest})
+	if r.Code != "" {
+		t.Fatal("submit", r.Code)
+	}
+	var receipt sdkAttachReceipt
+	if json.Unmarshal(r.Data, &receipt) != nil {
+		t.Fatal("receipt")
+	}
+	return receipt
+}
+func TestSDKSessionJobsCompleteWithoutNativeProof(t *testing.T) {
+	f, files, now := sessionFixture(t)
+	f.native.sessionCode = ErrUnavailable
+	a := sessionSubmit(t, f)
+	if a.TTLMS != 6000 || a.RenewAfterMS != 2000 {
+		t.Fatal("lease changed")
+	}
+	for range 100 {
+		if c := f.o.poll(context.Background()); c != "" {
+			t.Fatal(c)
+		}
+		if f.o.session.jobs[a.JobID].terminal {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	j := f.o.session.jobs[a.JobID]
+	if j.receipt.Job.State != jobcontract.Succeeded || !j.receipt.Job.Drained {
+		t.Fatal("no successful terminal", j.receipt.Job.State)
+	}
+	if j.carriers.Cookie != "" {
+		t.Fatal("credential retained")
+	}
+	*now += time.Second
+	r := sessionCall(f, "jobs.result", sdkResultArgs{JobID: a.JobID})
+	if r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	f.carriers.Cookie = "id=bob-session"
+	r = sessionCall(f, "jobs.result", sdkResultArgs{JobID: a.JobID})
+	if r.Code != ErrDenied {
+		t.Fatal("foreign result", r.Code)
+	}
+	files.mu.Lock()
+	files.denied = true
+	files.mu.Unlock()
+	if r = sessionCall(f, "jobs.status", sdkStatusArgs{}); r.Code == "" {
+		t.Fatal("expired identity accepted")
+	}
+	if len(f.children) != 0 {
+		t.Fatal("native/POSIX child used")
+	}
+}
+func TestSDKSessionAttachBindingsAndExpiry(t *testing.T) {
+	f, _, now := sessionFixture(t)
+	a := sessionSubmit(t, f)
+	for _, cookie := range []string{"id=bob-session", "id=alice-other-session"} {
+		*now += time.Second
+		f.carriers.Cookie = cookie
+		if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrDenied {
+			t.Fatal("foreign attach", r.Code)
+		}
+	}
+	f.carriers.Cookie = "id=alice-session"
+	*now = 6 * time.Second
+	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrExpired {
+		t.Fatal("late renew", r.Code)
+	}
+	if !f.o.session.jobs[a.JobID].receipt.Job.CancelRequested || f.journal.cancels == 0 {
+		t.Fatal("no durable cancel")
+	}
+}
+func TestSDKSessionAdminAndOwnerCancel(t *testing.T) {
+	f, files, now := sessionFixture(t)
+	a := sessionSubmit(t, f)
+	f.carriers.Cookie = "id=bob-session"
+	if r := sessionCall(f, "jobs.admin.status", sdkStatusArgs{}); r.Code != ErrDenied {
+		t.Fatal("nonadmin", r.Code)
+	}
+	if r := sessionCall(f, "jobs.cancel", sdkCancelArgs{a.JobID, a.Revision}); r.Code != ErrDenied {
+		t.Fatal("foreign cancel", r.Code)
+	}
+	files.mu.Lock()
+	files.admin = true
+	files.mu.Unlock()
+	*now += time.Second
+	r := sessionCall(f, "jobs.admin.status", sdkStatusArgs{})
+	if r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	for _, private := range []string{"progress", "knownEffects", "alice", "input", "session", "scope"} {
+		if strings.Contains(string(r.Data), private) {
+			t.Fatal("admin data leak", private)
+		}
+	}
+	if r = sessionCall(f, "jobs.admin.cancel", sdkCancelArgs{a.JobID, f.o.session.revision}); r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	files.mu.Lock()
+	files.admin = false
+	files.mu.Unlock()
+	if r = sessionCall(f, "jobs.admin.cancel", sdkCancelArgs{a.JobID, f.o.session.revision}); r.Code != ErrDenied {
+		t.Fatal("stale admin", r.Code)
+	}
+}
+func TestSDKSessionRejectsStreamsRevokedAndReplay(t *testing.T) {
+	f, files, _ := sessionFixture(t)
+	in := f.r.Input
+	size := uint64(1024)
+	in.Steps = []jobcontract.Step{{Action: jobcontract.ReadStream, Segments: []string{"x"}, MaxBytes: &size}}
+	if r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, in}); r.Code != ErrUnsupported {
+		t.Fatal("stream", r.Code)
+	}
+	r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, f.r.Input})
+	if r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	var p sdkPrepared
+	json.Unmarshal(r.Data, &p)
+	files.mu.Lock()
+	files.revoked = true
+	files.mu.Unlock()
+	if r = sessionCall(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}); r.Code != ErrDenied {
+		t.Fatal("revoked submit", r.Code)
+	}
+	if r = sessionCall(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}); r.Code != ErrReplay {
+		t.Fatal("replay", r.Code)
+	}
+	if len(f.journal.intents) != 0 {
+		t.Fatal("refused job reserved")
+	}
+}
+
+func TestSDKSessionJournalFormatAndNoCredentialPersistence(t *testing.T) {
+	f, _, _ := sessionFixture(t)
+	a := sessionSubmit(t, f)
+	i := f.journal.intents[a.JobID]
+	raw, c := encodeSDKJournal(sdkJournalRecord{Schema: 1, Intent: i, State: "pending"})
+	if c != "" {
+		t.Fatal("invalid reserved record", c)
+	}
+	if strings.Contains(string(raw), "alice-session") || strings.Contains(string(raw), f.o.session.jobs[a.JobID].session) {
+		t.Fatal("credential or keyed session binding persisted")
+	}
+	for range 100 {
+		if c = f.o.poll(context.Background()); c != "" {
+			t.Fatal(c)
+		}
+		if f.o.session.jobs[a.JobID].terminal {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	r := f.journal.receipts[a.JobID]
+	if _, c = encodeSDKJournal(sdkJournalRecord{Schema: 1, Intent: i, State: "finished", Receipt: &r}); c != "" {
+		t.Fatal("invalid completion record", c)
+	}
+}
+func TestSDKSessionCancelInFlightKeepsRemoteQUnknown(t *testing.T) {
+	f, files, now := sessionFixture(t)
+	files.block = make(chan struct{})
+	a := sessionSubmit(t, f)
+	if c := f.o.poll(context.Background()); c != "" {
+		t.Fatal(c)
+	}
+	*now = 6 * time.Second
+	if c := f.o.poll(context.Background()); c != "" {
+		t.Fatal(c)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if c := f.o.session.shutdown(ctx); c != "" {
+		t.Fatal(c)
+	}
+	j := f.o.session.jobs[a.JobID]
+	if !j.terminal || !j.receipt.Job.CancelRequested || j.receipt.Job.Drained || !j.receipt.Job.EffectsUnknown || j.carriers.Cookie != "" || j.done != nil {
+		t.Fatal("in-flight cancellation claimed remote Q")
+	}
+	if _, ok := f.journal.receipts[a.JobID]; ok {
+		t.Fatal("persisted false Q")
+	}
+}
+func TestSDKSessionRechecksAfterDurabilityAndSelectionWait(t *testing.T) {
+	f, files, now := sessionFixture(t)
+	f.journal.afterReserve = func() { *now = 30 * time.Second }
+	r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, f.r.Input})
+	if r.Code != "" {
+		t.Fatal(r.Code)
+	}
+	var p sdkPrepared
+	json.Unmarshal(r.Data, &p)
+	r = sessionCall(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest})
+	if r.Code != ErrExpired {
+		t.Fatal("expired after journal", r.Code)
+	}
+	files.mu.Lock()
+	defer files.mu.Unlock()
+	if files.calls != 0 {
+		t.Fatal("expired plan ran")
+	}
+}
+func TestSDKSessionUIDChangeAndAdminSessionHaveNoOwnerBypass(t *testing.T) {
+	f, files, now := sessionFixture(t)
+	a := sessionSubmit(t, f)
+	files.mu.Lock()
+	files.uid = "1002"
+	files.mu.Unlock()
+	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrDenied {
+		t.Fatal("UID changed", r.Code)
+	}
+	files.mu.Lock()
+	files.uid = ""
+	files.admin = true
+	files.mu.Unlock()
+	f.carriers.Cookie = "id=bob-session"
+	*now += time.Second
+	if r := sessionCall(f, "jobs.cancel", sdkCancelArgs{a.JobID, a.Revision}); r.Code != ErrDenied {
+		t.Fatal("admin bypassed owner route", r.Code)
+	}
+}
+func TestSDKSessionLeaseRollbackAndTotalDeadline(t *testing.T) {
+	for _, kind := range []string{"rollback", "total"} {
+		t.Run(kind, func(t *testing.T) {
+			f, _, now := sessionFixture(t)
+			a := sessionSubmit(t, f)
+			if kind == "rollback" {
+				*now = -time.Nanosecond
+			} else {
+				for n := 1; n < 60; n++ {
+					*now = time.Duration(n) * 2 * time.Second
+					if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != "" {
+						t.Fatal(r.Code)
+					}
+				}
+				*now = 120 * time.Second
+			}
+			if c := f.o.poll(context.Background()); c != "" {
+				t.Fatal(c)
+			}
+			if !f.o.session.jobs[a.JobID].terminal {
+				t.Fatal("deadline extended")
+			}
+		})
+	}
+}
+func TestSDKSessionJournalFailureClosesCredentialsAndAdmission(t *testing.T) {
+	f, _, _ := sessionFixture(t)
+	a := sessionSubmit(t, f)
+	f.journal.cancelCode = ErrUnavailable
+	if r := sessionCall(f, "jobs.cancel", sdkCancelArgs{a.JobID, a.Revision}); r.Code != ErrCleanupRequired {
+		t.Fatal(r.Code)
+	}
+	j := f.o.session.jobs[a.JobID]
+	if !j.terminal || j.carriers.Cookie != "" || j.receipt.Job.Drained {
+		t.Fatal("failed cancel left admission open")
+	}
+	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrExpired {
+		t.Fatal(r.Code)
+	}
+}
+
+// Exercise the real M2 transport, NSS lookup and selection repository through
+// the fixed supervisor wire. Only DSM authenticate.cgi/WebAPI are local fakes.
+type sessionHTTPAuth struct{ user string }
+
+func (a sessionHTTPAuth) Authenticate(r *http.Request) (api.Identity, error) {
+	c, e := r.Cookie("id")
+	if e != nil || c.Value != "alice-session" {
+		return api.Identity{}, api.ErrNoSession
+	}
+	return api.Identity{User: a.user}, nil
+}
+func TestSDKSessionWireToFileStation(t *testing.T) {
+	native, e := user.Current()
+	if e != nil {
+		t.Fatal(e)
+	}
+	if native.Uid == "0" {
+		native, e = user.Lookup("nobody")
+		if e != nil {
+			t.Skip("requires an NSS non-root fixture")
+		}
+	}
+	var gets, stats atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cookie, e := r.Cookie("id")
+		if e != nil || cookie.Value != "alice-session" || r.Header.Get("Authorization") != "" {
+			t.Error("incorrect session transport")
+			return
+		}
+		r.ParseForm()
+		switch r.Form.Get("api") {
+		case "SYNO.Core.NormalUser":
+			gets.Add(1)
+			json.NewEncoder(w).Encode(map[string]any{"success": true, "data": map[string]string{"username": native.Username}})
+		case "SYNO.FileStation.List":
+			stats.Add(1)
+			if r.Form.Get("path") != `["/sdk-session-fixture/fixture"]` {
+				t.Error("wrong selection path")
+			}
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/sdk-session-fixture/fixture","name":"fixture","isdir":false}]}}`)
+		default:
+			t.Error("unexpected API")
+		}
+	}))
+	defer server.Close()
+	client, e := filestation.NewClient(server.URL)
+	if e != nil {
+		t.Fatal(e)
+	}
+	repo := filestation.NewGrantRepository(t.TempDir())
+	g, e := repo.Confirm(context.Background(), native.Username, native.Uid, "/sdk-session-fixture", false)
+	if e != nil {
+		t.Fatal(e)
+	}
+	f, _, _ := sessionFixture(t)
+	f.g.ID = g.ID
+	var c Code
+	f.o.session, c = newSDKSessionJobs(f.o, filestation.NewService(client, repo), sessionHTTPAuth{native.Username})
+	if c != "" {
+		t.Fatal(c)
+	}
+	a := sessionSubmit(t, f)
+	for range 500 {
+		if c = f.o.poll(context.Background()); c != "" {
+			t.Fatal(c)
+		}
+		if f.o.session.jobs[a.JobID].terminal {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	j := f.o.session.jobs[a.JobID]
+	if j.receipt.Job.State != jobcontract.Succeeded || stats.Load() != 1 || gets.Load() < 4 {
+		t.Fatal("wire did not complete File Station plan", j.receipt.Job.State, gets.Load(), stats.Load())
+	}
+	raw, _ := json.Marshal(f.journal.intents[a.JobID])
+	if strings.Contains(string(raw), "alice-session") {
+		t.Fatal("credential in journal")
+	}
+}
+func TestSDKSessionRetainedHistoryKeepsKnownEffectsAcrossReopen(t *testing.T) {
+	f, _, _ := sessionFixture(t)
+	a := sessionSubmit(t, f)
+	for range 100 {
+		if c := f.o.poll(context.Background()); c != "" {
+			t.Fatal(c)
+		}
+		if f.o.session.jobs[a.JobID].terminal {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	receipt := f.journal.receipts[a.JobID]
+	if receipt.Result == nil || receipt.Result.CompletedSteps != 1 {
+		t.Fatal("fixture persisted no result", receipt.Result)
+	}
+	journal := &sdkMemoryJournal{sdkJobTestJournal: *f.journal, records: []sdkJournalRecord{{Schema: 1, Intent: f.journal.intents[a.JobID], State: "finished", Receipt: &receipt}}}
+	f.o.services.Journal = journal
+	reopened, c := newSDKSessionJobs(f.o, &sessionFilesFake{}, nil)
+	if c != "" {
+		t.Fatal(c)
+	}
+	page, c := reopened.page(filestation.SessionIdentity{User: "alice", UID: "1000"}, "", "", false)
+	if c != "" {
+		t.Fatal(c)
+	}
+	raw, _ := json.Marshal(page)
+	var decoded sdkJobPage
+	if json.Unmarshal(raw, &decoded) != nil || len(decoded.Items) != 1 || decoded.Items[0].KnownEffects != *receipt.Result {
+		t.Fatalf("known effects lost across reopen: %s want %+v", raw, *receipt.Result)
+	}
+}

package/dist/templates/native-go/backend/internal/helper/sdk_supervisor_frame.go

@@ -0,0 +1,78 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"net"
+	"time"
+)
+
+type supervisorRequest struct {
+	Process Process         `json:"process"`
+	Op      string          `json:"op"`
+	Nonce   string          `json:"nonce"`
+	Data    json.RawMessage `json:"data,omitempty"`
+}
+
+// Legacy M1 requests do not half-close; grant controls MUST half-close. Count
+// the entire v2 frame (including whitespace), reject duplicates and trailing
+// frames, and bound both time and memory. The outer process binds this socket.
+func decodeSupervisorRequest(reader io.Reader) (supervisorRequest, Code) {
+	var req supervisorRequest
+	limited := &io.LimitedReader{R: reader, N: MaxControlBytes + 1}
+	d := json.NewDecoder(limited)
+	var raw json.RawMessage
+	if d.Decode(&raw) != nil {
+		return req, ErrInvalid
+	}
+	if code := decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); code != "" {
+		return req, code
+	}
+	if req.Op == "grants" || req.Op == "jobs" {
+		rest, err := io.ReadAll(io.MultiReader(d.Buffered(), limited))
+		if err != nil {
+			return req, ErrInvalid
+		}
+		if limited.N <= 0 {
+			return req, ErrLimit
+		}
+		if len(bytes.TrimSpace(rest)) != 0 {
+			return req, ErrInvalid
+		}
+	} else if d.InputOffset() > 4096 || len(req.Data) > 0 {
+		return req, ErrInvalid
+	}
+	if !allReferences(req.Nonce) || (req.Op != "admit" && req.Op != "stop" && req.Op != "grants" && req.Op != "jobs") {
+		return req, ErrInvalid
+	}
+	return req, ""
+}
+
+const supervisorAttestationWait = time.Second
+const supervisorFrameBudget = 100 * time.Millisecond
+
+// The caller sends no frame bytes until its full post-connect hash succeeds.
+// Separate the bounded wait for that computation from the fixed frame budget.
+func receiveSupervisorRequest(conn net.Conn) (supervisorRequest, Code) {
+	firstDeadline := time.Now().Add(supervisorAttestationWait)
+	if err := conn.SetReadDeadline(firstDeadline); err != nil {
+		return supervisorRequest{}, ErrInvalid
+	}
+	reader := bufio.NewReader(conn)
+	if _, err := reader.Peek(1); err != nil || !time.Now().Before(firstDeadline) {
+		return supervisorRequest{}, ErrInvalid
+	}
+	frameDeadline := time.Now().Add(supervisorFrameBudget)
+	if err := conn.SetDeadline(frameDeadline); err != nil {
+		return supervisorRequest{}, ErrInvalid
+	}
+	req, code := decodeSupervisorRequest(reader)
+	if !time.Now().Before(frameDeadline) {
+		return supervisorRequest{}, ErrInvalid
+	}
+	return req, code
+}