@synopackageland/cli 0.4.1 → 0.5.0

package/templates/_gateway/gateway_test.go

@@ -0,0 +1,676 @@
+package main
+
+import (
+	"bufio"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+const base = "/webman/3rdparty/App/cgi/gateway.cgi"
+
+type fakeAuth struct {
+	id    identity
+	err   error
+	calls int
+}
+
+func (f *fakeAuth) Authenticate(*http.Request) (identity, error) {
+	f.calls++
+	return f.id, f.err
+}
+
+// upstream records what reached the container.
+type upstream struct {
+	*httptest.Server
+	hits    atomic.Int32
+	request atomic.Pointer[http.Request]
+	body    atomic.Pointer[string]
+}
+
+func newUpstream(t *testing.T, handler http.HandlerFunc) *upstream {
+	t.Helper()
+	u := &upstream{}
+	u.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		u.hits.Add(1)
+		u.request.Store(r)
+		b, _ := io.ReadAll(r.Body)
+		s := string(b)
+		u.body.Store(&s)
+		handler(w, r)
+	}))
+	t.Cleanup(u.Close)
+	return u
+}
+
+func hello(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "text/plain")
+	io.WriteString(w, "container says hi: "+r.URL.RequestURI())
+}
+
+func newTestGateway(t *testing.T, cfg config, auth authenticator, up *upstream) http.Handler {
+	t.Helper()
+	cfg.Upstream = up.Listener.Addr().String()
+	g, err := newGateway(cfg, auth)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return g
+}
+
+func do(h http.Handler, method, target string, hdr map[string]string, body string) *httptest.ResponseRecorder {
+	r := httptest.NewRequest(method, target, strings.NewReader(body))
+	r.RemoteAddr = "192.0.2.7:51234"
+	for k, v := range hdr {
+		r.Header.Set(k, v)
+	}
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	return w
+}
+
+var signedIn = map[string]string{"Cookie": "id=abc"}
+
+func TestSignedInUserReachesContainer(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{id: identity{User: "alice"}}
+	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/index.html?x=1", signedIn, "")
+	if w.Code != 200 || w.Body.String() != "container says hi: /index.html?x=1" {
+		t.Fatalf("%d %q", w.Code, w.Body.String())
+	}
+}
+
+func TestAnonymousRequestIsRejectedAndNeverReachesContainer(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{err: errNoSession}
+	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", nil, "")
+	if w.Code != 401 || up.hits.Load() != 0 {
+		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
+	}
+	if !strings.Contains(w.Body.String(), "session_required") {
+		t.Errorf("body %q", w.Body.String())
+	}
+}
+
+func TestExpiredSessionIsRejected(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{err: errNoSession}
+	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", signedIn, "")
+	if w.Code != 401 || up.hits.Load() != 0 {
+		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
+	}
+}
+
+func TestAuthenticatorFailureFailsClosed(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{err: errors.New("authenticate.cgi missing")}
+	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", signedIn, "")
+	if w.Code != 520 || up.hits.Load() != 0 {
+		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
+	}
+	if got := w.Header().Get("X-Synopkgland-Error"); got != "auth_unavailable" {
+		t.Errorf("X-Synopkgland-Error = %q", got)
+	}
+}
+
+func TestForgedIdentityHeadersDoNotAuthenticate(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{err: errNoSession}
+	forged := map[string]string{
+		"X-Syno-User":      "admin",
+		"X-Syno-Admin":     "true",
+		"X-Forwarded-User": "admin",
+		"X-Remote-User":    "admin",
+		"Remote-User":      "admin",
+		"X-Forwarded-For":  "127.0.0.1",
+		"X-Real-IP":        "127.0.0.1",
+		"Authorization":    "Basic YWRtaW46YWRtaW4=",
+		"X-Syno-Token":     "bogus",
+		"Cookie":           "id=forged; did=forged",
+	}
+	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", forged, "")
+	if w.Code != 401 || up.hits.Load() != 0 {
+		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
+	}
+}
+
+func TestContainerNeverSeesClientIdentityOrSessionHeaders(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{id: identity{User: "bob"}}
+	hdr := map[string]string{
+		"Cookie":              "id=abc; did=xyz",
+		"X-Syno-Token":        "tok",
+		"X-Syno-User":         "admin",
+		"X-Syno-Admin":        "true",
+		"X-Forwarded-User":    "admin",
+		"X-Remote-User":       "admin",
+		"Remote-User":         "admin",
+		"Remote-Groups":       "administrators",
+		"X-Forwarded-For":     "10.0.0.9",
+		"Forwarded":           "for=10.0.0.9",
+		"X-Real-IP":           "10.0.0.9",
+		"X-Auth-Request-User": "admin",
+		"Accept-Language":     "zh-TW",
+	}
+	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/?SynoToken=secret&a=b", hdr, "")
+	if w.Code != 200 {
+		t.Fatalf("code=%d", w.Code)
+	}
+	got := up.request.Load()
+	for _, name := range []string{"Cookie", "X-Syno-Token", "X-Forwarded-User", "X-Remote-User", "Remote-User", "Remote-Groups", "X-Forwarded-For", "Forwarded", "X-Real-Ip", "X-Auth-Request-User"} {
+		if v := got.Header.Get(name); v != "" {
+			t.Errorf("%s reached the container: %q", name, v)
+		}
+	}
+	if got.Header.Get("X-Syno-User") != "bob" || got.Header.Get("X-Syno-Admin") != "false" {
+		t.Errorf("identity = %q / %q, want gateway-set bob/false", got.Header.Get("X-Syno-User"), got.Header.Get("X-Syno-Admin"))
+	}
+	if got.Header.Get("Accept-Language") != "zh-TW" {
+		t.Errorf("ordinary header dropped")
+	}
+	if strings.Contains(got.URL.RawQuery, "SynoToken") || got.URL.Query().Get("a") != "b" {
+		t.Errorf("query = %q", got.URL.RawQuery)
+	}
+}
+
+func TestAdminHeaderIsTrueForAdministrators(t *testing.T) {
+	up := newUpstream(t, hello)
+	auth := &fakeAuth{id: identity{User: "alice", Groups: []string{"administrators"}}}
+	do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", signedIn, "")
+	if got := up.request.Load().Header.Get("X-Syno-Admin"); got != "true" {
+		t.Errorf("X-Syno-Admin = %q", got)
+	}
+}
+
+func TestAdminsOnlyRejectsOrdinaryUsers(t *testing.T) {
+	up := newUpstream(t, hello)
+	cfg := config{Access: "admins"}
+	g := newTestGateway(t, cfg, &fakeAuth{id: identity{User: "bob", Groups: []string{"staff"}}}, up)
+	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 401 || up.hits.Load() != 0 {
+		t.Fatalf("ordinary: code=%d hits=%d", w.Code, up.hits.Load())
+	} else if w.Header().Get("X-Synopkgland-Error") != "forbidden" || w.Header().Get("X-Synopkgland-Status") != "403" {
+		t.Errorf("headers: %v", w.Header())
+	}
+	g = newTestGateway(t, cfg, &fakeAuth{id: identity{User: "alice", Groups: []string{"administrators"}}}, up)
+	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 200 {
+		t.Fatalf("admin: code=%d", w.Code)
+	}
+}
+
+func TestGroupsRejectUsersOutsideEveryListedGroup(t *testing.T) {
+	up := newUpstream(t, hello)
+	cfg := config{Access: "groups", Groups: []string{"staff", "ops"}}
+	g := newTestGateway(t, cfg, &fakeAuth{id: identity{User: "bob", Groups: []string{"users"}}}, up)
+	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 401 || up.hits.Load() != 0 || !strings.Contains(w.Body.String(), "forbidden") {
+		t.Fatalf("outsider: code=%d hits=%d body=%q", w.Code, up.hits.Load(), w.Body.String())
+	}
+	g = newTestGateway(t, cfg, &fakeAuth{id: identity{User: "carol", Groups: []string{"ops"}}}, up)
+	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 200 {
+		t.Fatalf("member: code=%d", w.Code)
+	}
+}
+
+func TestGroupsAccessWithoutGroupsIsRefusedAtStartup(t *testing.T) {
+	for _, cfg := range []config{
+		{Upstream: "127.0.0.1:1", Access: "groups"},
+		{Upstream: "127.0.0.1:1", Access: "everyone"},
+		{Upstream: "127.0.0.1:1", Access: ""},
+		{Upstream: "10.0.0.5:80", Access: "users"},
+		{Upstream: "localhost:80", Access: "users"},
+	} {
+		if _, err := newGateway(cfg, &fakeAuth{}); err == nil {
+			t.Errorf("config %+v accepted", cfg)
+		}
+	}
+	if _, err := newGateway(config{Upstream: "127.0.0.1:18333", Access: "users"}, nil); err == nil {
+		t.Error("nil authenticator accepted")
+	}
+}
+
+func TestStateChangingRequestNeedsSynoToken(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	for _, method := range []string{"POST", "PUT", "PATCH", "DELETE"} {
+		if w := do(g, method, base+"/", signedIn, "x"); w.Code != 401 || !strings.Contains(w.Body.String(), "token_required") || w.Header().Get("X-Synopkgland-Error") != "token_required" {
+			t.Errorf("%s without token: %d %q", method, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+	hdr := browserPost("tok")
+	if w := do(g, "POST", base+"/save", hdr, "payload"); w.Code != 200 || *up.body.Load() != "payload" {
+		t.Fatalf("with token: %d body=%q", w.Code, *up.body.Load())
+	}
+}
+
+func TestQueryTokenDoesNotSatisfyStateChangingRequests(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	hdr := browserPost("")
+	delete(hdr, "X-SYNO-TOKEN")
+	for _, method := range []string{"POST", "PUT", "PATCH", "DELETE"} {
+		w := do(g, method, base+"/?SynoToken=secret", hdr, "x")
+		if w.Code != 401 || w.Header().Get("X-Synopkgland-Error") != "token_required" || strings.Contains(w.Body.String(), "secret") {
+			t.Errorf("%s with query token only: %d %q", method, w.Code, w.Body.String())
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestSafeRequestsNeedNoSynoToken(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	for _, method := range []string{"GET", "HEAD"} {
+		if w := do(g, method, base+"/", signedIn, ""); w.Code != 200 {
+			t.Errorf("%s: %d", method, w.Code)
+		}
+	}
+}
+
+func TestOversizedBodyIsRefused(t *testing.T) {
+	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
+		if _, err := io.ReadAll(r.Body); err != nil {
+			w.WriteHeader(413)
+		}
+	})
+	g := newTestGateway(t, config{Access: "users", MaxBodyBytes: 4}, &fakeAuth{id: identity{User: "bob"}}, up)
+	hdr := browserPost("tok")
+	if w := do(g, "POST", base+"/", hdr, "0123456789"); w.Code != 413 {
+		t.Fatalf("code=%d", w.Code)
+	}
+}
+
+func TestContainerDownIsServiceUnavailable(t *testing.T) {
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	addr := l.Addr().String()
+	l.Close()
+	g, err := newGateway(config{Upstream: addr, Access: "users"}, &fakeAuth{id: identity{User: "bob"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	w := do(g, "GET", base+"/", signedIn, "")
+	if w.Code != 521 || w.Header().Get("Retry-After") == "" || !strings.Contains(w.Body.String(), "upstream_unavailable") {
+		t.Fatalf("code=%d retry=%q body=%q", w.Code, w.Header().Get("Retry-After"), w.Body.String())
+	}
+	if w.Header().Get("X-Synopkgland-Error") != "upstream_unavailable" || w.Header().Get("X-Synopkgland-Status") != "503" {
+		t.Errorf("headers: %v", w.Header())
+	}
+}
+
+func TestSlowContainerIsGatewayTimeout(t *testing.T) {
+	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) { time.Sleep(300 * time.Millisecond) })
+	g := newTestGateway(t, config{Access: "users", ResponseTimeoutMillis: 50}, &fakeAuth{id: identity{User: "bob"}}, up)
+	w := do(g, "GET", base+"/", signedIn, "")
+	if w.Code != 524 || !strings.Contains(w.Body.String(), "upstream_timeout") || w.Header().Get("X-Synopkgland-Status") != "504" {
+		t.Fatalf("code=%d body=%q", w.Code, w.Body.String())
+	}
+}
+
+func TestContainerCannotSetCookiesOnTheDSMOrigin(t *testing.T) {
+	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
+		http.SetCookie(w, &http.Cookie{Name: "id", Value: "evil"})
+		io.WriteString(w, "ok")
+	})
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	w := do(g, "GET", base+"/", signedIn, "")
+	if w.Code != 200 || w.Header().Get("Set-Cookie") != "" {
+		t.Fatalf("code=%d set-cookie=%q", w.Code, w.Header().Get("Set-Cookie"))
+	}
+}
+
+func TestRedirectsStayInsideTheGateway(t *testing.T) {
+	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/abs":
+			http.Redirect(w, r, "http://"+r.Host+"/next?q=1", http.StatusFound)
+		case "/root":
+			http.Redirect(w, r, "/next", http.StatusFound)
+		case "/dir/rel":
+			http.Redirect(w, r, "next", http.StatusFound)
+		case "/rel":
+			w.Header().Set("Location", "next")
+			w.WriteHeader(http.StatusFound)
+		default:
+			http.Redirect(w, r, "https://example.org/away", http.StatusFound)
+		}
+	})
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	for path, want := range map[string]string{
+		"/abs":     base + "/next?q=1",
+		"/root":    base + "/next",
+		"/rel":     "next",
+		"/dir/rel": base + "/dir/next",
+		"/ext":     "https://example.org/away",
+	} {
+		w := do(g, "GET", base+path, signedIn, "")
+		if got := w.Header().Get("Location"); w.Code != 302 || got != want {
+			t.Errorf("%s: %d Location=%q want %q", path, w.Code, got, want)
+		}
+	}
+}
+
+func TestPathsCannotEscapeTheUpstream(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	for _, target := range []string{
+		base + "/../../etc/passwd",
+		base + "/%2e%2e/%2e%2e/x",
+		base + "//evil.example/x",
+		base + "/a/../../x",
+		base + "/x%00y",
+	} {
+		if w := do(g, "GET", target, signedIn, ""); w.Code != 400 {
+			t.Errorf("%s: code=%d", target, w.Code)
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestPathWithoutTrailingSlashRedirectsSoRelativeLinksWork(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	w := do(g, "GET", base+"?x=1", signedIn, "")
+	if w.Code != 308 || w.Header().Get("Location") != "gateway.cgi/?x=1" {
+		t.Fatalf("code=%d location=%q", w.Code, w.Header().Get("Location"))
+	}
+}
+
+func TestRequestOutsideTheGatewayIsNotFound(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	if w := do(g, "GET", "/somewhere/else", signedIn, ""); w.Code != 410 || w.Header().Get("X-Synopkgland-Status") != "404" {
+		t.Fatalf("code=%d headers=%v", w.Code, w.Header())
+	}
+}
+
+func TestResponsesAreNotSharedCacheable(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	w := do(g, "GET", base+"/", signedIn, "")
+	if cc := w.Header().Get("Cache-Control"); !strings.Contains(cc, "private") {
+		t.Errorf("Cache-Control = %q", cc)
+	}
+}
+
+// DSM's nginx has `scgi_intercept_errors on` and `error_page 403 404 500 502 503 504`: a CGI reply with one of
+// these statuses loses its body and headers to DSM's generic error page. Measured on DSM 7.4-90069.
+func TestNoGatewayStatusIsOneThatDSMReplaces(t *testing.T) {
+	replaced := []int{403, 404, 500, 502, 503, 504}
+	for _, intended := range replaced {
+		w := httptest.NewRecorder()
+		reply(w, intended, "some_code", "message")
+		if slices.Contains(replaced, w.Code) || w.Code < 400 {
+			t.Errorf("reply(%d) sent %d, which DSM replaces or is not an error", intended, w.Code)
+		}
+		if got := w.Header().Get("X-Synopkgland-Status"); got != strconv.Itoa(intended) {
+			t.Errorf("reply(%d): X-Synopkgland-Status = %q", intended, got)
+		}
+		if w.Header().Get("X-Synopkgland-Error") != "some_code" || !strings.HasPrefix(w.Body.String(), "some_code\n") {
+			t.Errorf("reply(%d): error code lost: %v %q", intended, w.Header(), w.Body.String())
+		}
+	}
+}
+
+func TestStatusesDSMKeepsAreSentAsTheyAre(t *testing.T) {
+	for _, status := range []int{400, 401, 413, 501, 308} {
+		w := httptest.NewRecorder()
+		reply(w, status, "some_code", "message")
+		if w.Code != status || w.Header().Get("X-Synopkgland-Status") != "" || w.Header().Get("X-Synopkgland-Error") != "some_code" {
+			t.Errorf("reply(%d): sent %d headers=%v", status, w.Code, w.Header())
+		}
+	}
+}
+
+func TestContainerErrorBodiesSurviveDSMWhenTheAppAsks(t *testing.T) {
+	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Retry-After", "7")
+		w.Header().Set("X-App-Reason", "no-such-note")
+		w.WriteHeader(map[string]int{"/missing": 404, "/boom": 500, "/busy": 503, "/denied": 401}[r.URL.Path])
+		io.WriteString(w, `{"error":"x"}`)
+	})
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	keep := map[string]string{"Cookie": "id=abc", "X-Synopkgland-Keep-Error-Body": "1"}
+	for path, want := range map[string][2]int{"/missing": {404, 410}, "/boom": {500, 520}, "/busy": {503, 521}, "/denied": {401, 401}} {
+		plain := do(g, "GET", base+path, signedIn, "")
+		if plain.Code != want[0] || plain.Header().Get("X-Synopkgland-Status") != "" {
+			t.Errorf("%s without the header: %d %v, want the container's own %d", path, plain.Code, plain.Header(), want[0])
+		}
+		w := do(g, "GET", base+path, keep, "")
+		if w.Code != want[1] || w.Body.String() != `{"error":"x"}` || w.Header().Get("Retry-After") != "7" || w.Header().Get("X-App-Reason") != "no-such-note" {
+			t.Errorf("%s with the header: %d %q %v", path, w.Code, w.Body.String(), w.Header())
+		}
+		if want[0] != want[1] && w.Header().Get("X-Synopkgland-Status") != strconv.Itoa(want[0]) {
+			t.Errorf("%s: X-Synopkgland-Status = %q", path, w.Header().Get("X-Synopkgland-Status"))
+		}
+	}
+}
+
+func TestKeepErrorBodyLeavesSuccessAndRedirectsAlone(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	w := do(g, "GET", base+"/", map[string]string{"Cookie": "id=abc", "X-Synopkgland-Keep-Error-Body": "1"}, "")
+	if w.Code != 200 || w.Header().Get("X-Synopkgland-Status") != "" {
+		t.Fatalf("%d %v", w.Code, w.Header())
+	}
+}
+
+// Server-Sent Events work through DSM (nginx does not buffer SCGI replies there), provided the gateway hands
+// each event on as it arrives instead of holding it until the container finishes.
+func TestServerSentEventsAreForwardedAsTheyArrive(t *testing.T) {
+	release := make(chan struct{})
+	gone := make(chan struct{})
+	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/event-stream")
+		io.WriteString(w, "data: one\n\n")
+		w.(http.Flusher).Flush()
+		select {
+		case <-release:
+			io.WriteString(w, "data: two\n\n")
+		case <-r.Context().Done():
+			close(gone)
+		}
+	})
+	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
+	defer srv.Close()
+	req, _ := http.NewRequest("GET", srv.URL+base+"/events", nil)
+	req.Header.Set("Cookie", "id=abc")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	line := make(chan string, 1)
+	go func() {
+		buf := make([]byte, 64)
+		n, _ := resp.Body.Read(buf)
+		line <- string(buf[:n])
+	}()
+	select {
+	case got := <-line:
+		if got != "data: one\n\n" {
+			t.Fatalf("first event = %q", got)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("the first event was held back while the container kept the stream open")
+	}
+	resp.Body.Close()
+	select {
+	case <-gone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("the container was not told the client went away")
+	}
+}
+
+// wsEchoHandler is a container that accepts a WebSocket upgrade and then answers every chunk with "echo:"+chunk.
+func wsEchoHandler(w http.ResponseWriter, r *http.Request) {
+	conn, brw, err := w.(http.Hijacker).Hijack()
+	if err != nil {
+		return
+	}
+	defer conn.Close()
+	io.WriteString(brw, "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n")
+	brw.Flush()
+	buf := make([]byte, 64)
+	for {
+		n, err := brw.Read(buf)
+		if n > 0 {
+			io.WriteString(conn, "echo:"+string(buf[:n]))
+		}
+		if err != nil {
+			return
+		}
+	}
+}
+
+func dialUpgrade(t *testing.T, srv *httptest.Server, headers string) (net.Conn, *bufio.Reader, string) {
+	t.Helper()
+	conn, err := net.Dial("tcp", srv.Listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	conn.SetDeadline(time.Now().Add(5 * time.Second))
+	io.WriteString(conn, "GET "+base+"/ws HTTP/1.1\r\nHost: "+srv.Listener.Addr().String()+"\r\nCookie: id=abc\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n"+headers+"\r\n")
+	r := bufio.NewReader(conn)
+	status, err := r.ReadString('\n')
+	if err != nil {
+		t.Fatal(err)
+	}
+	return conn, r, strings.TrimSpace(status)
+}
+
+func TestWebSocketUpgradeIsProxiedBothWays(t *testing.T) {
+	up := newUpstream(t, wsEchoHandler)
+	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
+	defer srv.Close()
+	conn, r, status := dialUpgrade(t, srv, "Origin: http://"+srv.Listener.Addr().String()+"\r\n")
+	if status != "HTTP/1.1 101 Switching Protocols" {
+		t.Fatalf("status = %q", status)
+	}
+	for line, err := r.ReadString('\n'); strings.TrimSpace(line) != ""; line, err = r.ReadString('\n') {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	io.WriteString(conn, "hello")
+	got := make([]byte, len("echo:hello"))
+	if _, err := io.ReadFull(r, got); err != nil || string(got) != "echo:hello" {
+		t.Fatalf("echo = %q, %v", got, err)
+	}
+	h := up.request.Load().Header
+	if h.Get("X-Syno-User") != "bob" || h.Get("Cookie") != "" || h.Get("Upgrade") != "websocket" {
+		t.Errorf("headers at the container: %v", h)
+	}
+	if up.request.Load().Host != srv.Listener.Addr().String() {
+		t.Errorf("Host at the container = %q, want the one the browser used so that same-origin checks pass", up.request.Load().Host)
+	}
+}
+
+// upgradeRefusal reads the rest of a refused handshake and returns its X-Synopkgland-Error and -Status values.
+func upgradeRefusal(t *testing.T, r *bufio.Reader) (code, intended string) {
+	t.Helper()
+	for line, err := r.ReadString('\n'); strings.TrimSpace(line) != ""; line, err = r.ReadString('\n') {
+		if err != nil {
+			t.Fatal(err)
+		}
+		name, value, _ := strings.Cut(strings.TrimSpace(line), ": ")
+		switch strings.ToLower(name) {
+		case "x-synopkgland-error":
+			code = value
+		case "x-synopkgland-status":
+			intended = value
+		}
+	}
+	return code, intended
+}
+
+func TestWebSocketFromAnotherOriginIsRefused(t *testing.T) {
+	up := newUpstream(t, wsEchoHandler)
+	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
+	defer srv.Close()
+	own := srv.Listener.Addr().String()
+	for name, headers := range map[string]string{
+		"foreign origin":       "Origin: https://evil.example\r\n",
+		"sub-domain of host":   "Origin: http://" + own + ".evil.example\r\n",
+		"origin null":          "Origin: null\r\n",
+		"fetch cross-site":     "Sec-Fetch-Site: cross-site\r\n",
+		"fetch same-site":      "Sec-Fetch-Site: same-site\r\n",
+		"cross-site, own host": "Sec-Fetch-Site: cross-site\r\nOrigin: http://" + own + "\r\n",
+	} {
+		_, r, status := dialUpgrade(t, srv, headers)
+		code, intended := upgradeRefusal(t, r)
+		if status != "HTTP/1.1 401 Unauthorized" || code != "cross_site_blocked" || intended != "403" {
+			t.Errorf("%s: %q %q %q", name, status, code, intended)
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+// Browsers always send Origin on a WebSocket handshake, so a handshake with neither Origin nor
+// Sec-Fetch-Site is not from a browser that can be trusted to scope it: the rule is the one state-changing requests use.
+func TestWebSocketWithoutAnyOriginEvidenceIsRefused(t *testing.T) {
+	up := newUpstream(t, wsEchoHandler)
+	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
+	defer srv.Close()
+	_, r, status := dialUpgrade(t, srv, "")
+	code, _ := upgradeRefusal(t, r)
+	if status != "HTTP/1.1 401 Unauthorized" || code != "cross_site_blocked" || up.hits.Load() != 0 {
+		t.Fatalf("%q %q hits=%d", status, code, up.hits.Load())
+	}
+}
+
+func TestWebSocketWithOneKindOfSameOriginEvidenceIsAllowed(t *testing.T) {
+	up := newUpstream(t, wsEchoHandler)
+	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
+	defer srv.Close()
+	for name, headers := range map[string]string{
+		"origin only":         "Origin: http://" + srv.Listener.Addr().String() + "\r\n",
+		"fetch metadata only": "Sec-Fetch-Site: same-origin\r\n",
+	} {
+		if _, _, status := dialUpgrade(t, srv, headers); status != "HTTP/1.1 101 Switching Protocols" {
+			t.Errorf("%s: %q", name, status)
+		}
+	}
+}
+
+func TestWebSocketNeedsTheSameAccessAsAnyRequest(t *testing.T) {
+	up := newUpstream(t, wsEchoHandler)
+	for name, auth := range map[string]*fakeAuth{"anonymous": {err: errNoSession}, "outsider": {id: identity{User: "bob", Groups: []string{"users"}}}} {
+		srv := httptest.NewServer(newTestGateway(t, config{Access: "admins"}, auth, up))
+		_, _, status := dialUpgrade(t, srv, "")
+		srv.Close()
+		if status != "HTTP/1.1 401 Unauthorized" {
+			t.Errorf("%s: %q", name, status)
+		}
+	}
+	if up.hits.Load() != 0 {
+		t.Fatalf("hits=%d", up.hits.Load())
+	}
+}
+
+func TestOtherProtocolUpgradesAreNotSupported(t *testing.T) {
+	up := newUpstream(t, hello)
+	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
+	w := do(g, "GET", base+"/", map[string]string{"Cookie": "id=abc", "Connection": "Upgrade", "Upgrade": "h2c"}, "")
+	if w.Code != 501 || up.hits.Load() != 0 || w.Header().Get("X-Synopkgland-Error") != "upgrade_unsupported" {
+		t.Fatalf("code=%d hits=%d headers=%v", w.Code, up.hits.Load(), w.Header())
+	}
+}

package/templates/_gateway/go.mod

@@ -0,0 +1,3 @@
+module synopkgland-gateway
+
+go 1.24