@synopackageland/cli 0.4.1 → 0.5.0

package/templates/_gateway/groups.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+)
+
+// groupsOf reads local group files fresh on each request. Directory accounts
+// use NSS afresh; DSM provider caching may delay directory membership changes.
+// DSM keeps no member list for the group
+// that is an account's primary group (users), so membership is the member
+// list or the primary gid from the passwd file. Accounts absent from passwd use
+// DSM NSS; no local member-list fallback is permitted on lookup failure.
+func (a *dsmAuthenticator) groupsOf(ctx context.Context, user string) ([]string, error) {
+	primary, err := a.primaryGID(user)
+	if err != nil {
+		return nil, err
+	}
+	if primary == "" {
+		if a.directoryGroups == nil {
+			return nil, fmt.Errorf("directory group lookup unavailable")
+		}
+		return a.directoryGroups(ctx, user)
+	}
+	f, err := os.Open(a.groupFile)
+	if err != nil {
+		return nil, fmt.Errorf("read groups: %w", err)
+	}
+	defer f.Close()
+	var groups []string
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Split(scanner.Text(), ":")
+		if len(fields) == 4 && (fields[2] == primary || slices.Contains(strings.Split(fields[3], ","), user)) {
+			groups = append(groups, fields[0])
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("read groups: %w", err)
+	}
+	return groups, nil
+}
+
+// primaryGID is the account's gid in the passwd file; "" when the account has
+// no local entry, which requires a fresh directory lookup.
+func (a *dsmAuthenticator) primaryGID(user string) (string, error) {
+	f, err := os.Open(a.passwdFile)
+	if err != nil {
+		return "", fmt.Errorf("read accounts: %w", err)
+	}
+	defer f.Close()
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		if fields := strings.Split(scanner.Text(), ":"); len(fields) >= 4 && fields[0] == user {
+			return fields[3], nil
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return "", fmt.Errorf("read accounts: %w", err)
+	}
+	return "", nil
+}

package/templates/_gateway/main.go

@@ -0,0 +1,45 @@
+// Command gateway is the DSM-authenticated front door of a container package.
+// DSM runs it as a CGI (ui/cgi/gateway.cgi in the package) under the package
+// account, once per request.
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http/cgi"
+	"os"
+)
+
+// Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
+var (
+	packageID  = "dev"
+	configJSON = ""
+)
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix(packageID + ": ")
+	if os.Getenv("GATEWAY_INTERFACE") == "" {
+		fmt.Fprintf(os.Stderr, "%s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID)
+		os.Exit(2)
+	}
+	var cfg config
+	decoder := json.NewDecoder(bytes.NewReader([]byte(configJSON)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&cfg); err != nil {
+		log.Fatalf("invalid gateway configuration: %v", err)
+	}
+	g, err := newGateway(cfg, newDSMAuthenticator())
+	if err != nil {
+		log.Fatal(err)
+	}
+	req, err := cgi.Request()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := serveCGI(g, req, os.Stdin, os.Stdout); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/binary/synology-app.yaml

@@ -4,4 +4,4 @@ version: 0.1.0
 displayname: Binary App
 description: A minimal Syno Package Land app that runs one prebuilt binary.
 maintainer: Syno Package Land
-os_min_ver: "7.2-60000"
+os_min_ver: "7.1-42661"

package/templates/compose-import/compose.yaml

@@ -1,6 +1,6 @@
 services:
   app:
-    image: hello-world:latest
+    image: hello-world:latest@sha256:5e23090353324d887c48ad5e5c56d294eab81588df9605b07d1afe895f9cc8f8
     volumes:
       - "${MEDIA_SHARE}:/media"
       - "${BACKUP_SHARE}:/backup"

package/templates/compose-import/synology-app.yaml

@@ -4,7 +4,7 @@ version: 0.1.0
 displayname: Compose Import
 description: Start from an existing Compose file and select two Shared Folders at install time.
 maintainer: Syno Package Land
-os_min_ver: "7.2-69057"
+os_min_ver: "7.2.1-69057"
 
 install:
   MEDIA_SHARE:

package/templates/hello-files/compose.yaml

@@ -1,6 +1,6 @@
 services:
   worker:
-    image: alpine:3.20
+    image: alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc
     command: ["sleep", "infinity"]
     volumes:
       # intentionally outside the zero-config docker-project resource-worker path.

package/templates/hello-files/synology-app.yaml

@@ -4,7 +4,7 @@ version: 0.1.0
 displayname: Hello Files
 description: A minimal headless app with a Shared Folder mount.
 maintainer: Syno Package Land
-os_min_ver: "7.2-69057"
+os_min_ver: "7.2.1-69057"
 
 install:
   MEDIA_SHARE:

package/templates/hello-web/compose.yaml

@@ -1,6 +1,6 @@
 services:
   web:
-    image: busybox:1.36
+    image: busybox:1.36@sha256:73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662
     # DSM worker constraints to preserve when changing this service:
     # 1) command/entrypoint arrays must not contain bare numeric elements
     #    (such as "18333"). DSM's docker-project worker drops the quotes on a
@@ -15,7 +15,10 @@ services:
     # injects an arbitrary package UID/GID, and the nginx entrypoint needs
     # root during startup, so it exits immediately under that identity.
     command: ["sh","-c","httpd -f -p 18333 -h /usr/share/nginx/html"]
+    # Bound to loopback on purpose: the DSM-authenticated gateway generated by
+    # `synopkgland build-spk` is the only way in. A port on every interface would
+    # bypass DSM sign-in, and `synopkgland validate` rejects it.
     ports:
-      - "18333:18333"
+      - "127.0.0.1:18333:18333"
     volumes:
       - "./html:/usr/share/nginx/html:ro"

package/templates/hello-web/synology-app.yaml

@@ -4,10 +4,13 @@ version: 0.1.0
 displayname: Hello Web
 description: A minimal Syno Package Land web app template.
 maintainer: Syno Package Land
-os_min_ver: "7.2-69057"
+os_min_ver: "7.2.1-69057"
 adminprotocol: http
 adminport: 18333
 adminurl: /
 integration:
   web:
     launch: dsm-window
+    # Who may open the app: dsm-users (any signed-in DSM user), dsm-admins,
+    # dsm-groups (with groups: [...]) or public (no DSM sign-in).
+    access: dsm-users

package/templates/hello-web-page/compose.yaml

@@ -1,6 +1,6 @@
 services:
   web:
-    image: busybox:1.36
+    image: busybox:1.36@sha256:73aaf090f3d85aa34ee199857f03fa3a95c8ede2ffd4cc2cdb5b94e566b11662
     # DSM worker constraints to preserve when changing this service:
     # 1) command/entrypoint arrays must not contain bare numeric elements
     #    (such as "18333"). DSM's docker-project worker drops the quotes on a
@@ -15,7 +15,10 @@ services:
     # injects an arbitrary package UID/GID, and the nginx entrypoint needs
     # root during startup, so it exits immediately under that identity.
     command: ["sh","-c","httpd -f -p 18333 -h /usr/share/nginx/html"]
+    # Bound to loopback on purpose: the DSM-authenticated gateway generated by
+    # `synopkgland build-spk` is the only way in. A port on every interface would
+    # bypass DSM sign-in, and `synopkgland validate` rejects it.
     ports:
-      - "18333:18333"
+      - "127.0.0.1:18333:18333"
     volumes:
       - "./html:/usr/share/nginx/html:ro"

package/templates/hello-web-page/synology-app.yaml

@@ -4,10 +4,13 @@ version: 0.1.0
 displayname: Hello Web Page
 description: A Syno Package Land web app template that opens in a new browser page.
 maintainer: Syno Package Land
-os_min_ver: "7.2-69057"
+os_min_ver: "7.2.1-69057"
 adminprotocol: http
 adminport: 18333
 adminurl: /
 integration:
   web:
     launch: new-page
+    # Who may open the app: dsm-users (any signed-in DSM user), dsm-admins,
+    # dsm-groups (with groups: [...]) or public (no DSM sign-in).
+    access: dsm-users

package/templates/native-go/README.md

@@ -171,7 +171,17 @@ not location completion or ACL success. Use canonical virtual share paths only;
 OS `/volumeN/...`, traversal, repeated/trailing slash, controls and backslash are
 invalid. No path conversion or grant is performed. `openFile`, `showFileDetails`
 and `openAppSetting` return unsupported; private preview/details/settings flows
-have no proven generic contract. DSM runtime remains unknown.
+have no proven generic contract.
+
+File reveal adds a best-effort correction using File Station 1.4.x private
+structures. Required APIs are feature-detected; absent/throwing APIs silently
+cancel and release timers/listeners. One AppLaunch callback binds one receiver;
+only its model may be selected once. Interaction, navigation away from the reached
+parent, close/destroy, disposal and new requests cancel the correction. The named
+5000 ms total budget, 100 ms checks and 300 ms quiet interval have no device latency
+proof. `requested` still does not mean `selected`; actual effectiveness on DSM 7.4 /
+File Station 1.4.4 awaits a rebuilt-SPK device matrix. No second launch or broadcast
+setter is used, and later reloads may still clear selection.
 
 For an independent browser shell, use the SPK's generated `ui/host-0001.js`
 (the number follows the manifest build). It has no Ext or npm runtime dependency:
@@ -206,7 +216,7 @@ ui:
 ```
 
 The build must emit `app.js` (one script that registers `mount`) and
-`app.css`. The public `@synopackageland/ui@0.4.0` package on
+`app.css`. The public `@synopackageland/ui@0.5.7` package on
 `https://registry.npmjs.org` gives Vue components with DSM 7 styling;
 import its `themes/dsm7-embedded.css` for use inside a DSM window.
 
@@ -269,6 +279,51 @@ own folder, kept across upgrades). Bump `build` for every SPK you hand out;
 bump `version` for feature releases. There are no lifecycle scripts to write:
 the CGI starts per request, so start/stop do nothing.
 
+### What an upgrade keeps
+
+An upgrade replaces the program files and keeps the data. DSM preserves `var`
+(`@appdata`), `home` (`@apphome`) and `etc` (`@appconf`) across an upgrade and
+removes `tmp` (`@apptemp`) and `target` (`@appstore`). Keep everything you need
+to keep under `var`, `home` or `etc`.
+
+### Schema migrations
+
+`backend/internal/datamigrate` applies ordered, idempotent schema migrations and
+records the result in `<var>/data-version`. `backend/cmd/app` runs `app.Migrate`
+on every start; the recorded version makes that a cheap no-op.
+
+- Versions start at 1 and never change meaning. The template ships one empty
+example in `backend/internal/app/migrations.go`; replace it with your steps.
+- Every step must be idempotent: a crash between `Apply` and the version record,
+or two CGI requests racing on the first start after an upgrade, can run one step
+twice.
+- A step that fails stops the run with the previous version still recorded, and
+the next start resumes from there. The helper never deletes or rewrites data
+itself, so a failed migration leaves your old data in place.
+- `datamigrate.Context.OldPkgVer` is the version being upgraded from:
+`SYNOPKG_OLD_PKGVER` when your environment sets it, otherwise the version the last
+successful run recorded. `NewPkgVer` is the version running now.
+
+Uninstalling keeps your data: DSM leaves `@appdata` and `@apphome` on the volume,
+and reinstalling the same package ID picks them up again. The install wizard is a
+dynamic `WIZARD_UIFILES/install_uifile.sh` that checks — read-only — whether
+`@appdata/<package>` already exists and, if it does, tells the administrator the
+install reuses the old data and how to start clean.
+
+The generated SPK ships
+an uninstall wizard (English, plus eight other languages) with one box, **Also
+delete the app data listed above** (`pkgwizard_remove_additional`), unchecked by
+default. Ticked, `postuninst` empties `@appdata/<package>` and `@apphome/<package>`
+and nothing else: not `@appconf`, Shared Folders, the package account or other
+packages. An upgrade never deletes anything. Do not write your own `postuninst`;
+`synopkgland inspect --spk` flags a deleting script that lacks the upgrade guard
+or deletes outside the package's own folders.
+
+A package with a root integration (the helper) also warns in its uninstall
+wizard: disable the integration in the App first. While it stays enabled,
+`preuninst` refuses the uninstall and writes the reason to
+`SYNOPKG_TEMP_LOGFILE`, which Package Center shows.
+
 ## Root access
 
 By default (`privilege: none`) nothing in this package ever runs as root, and
@@ -295,7 +350,8 @@ How it works, with no keys or signing involved:
    DSM language. A DSM administrator clicks **Authorize** and confirms with
    their DSM password in DSM's own dialog. DSM then creates one **disabled**
    root task in Task Scheduler, named `<package> root: <name>`. The
-   confirmation is used for that one task and never stored.
+   DSM 7.2+ uses its one-use password token for that task and never stores it.
+   DSM 7.1 uses the client-side confirmation described below.
 3. **Run** checks that the task is still exactly the approved text, runs it
    with the administrator's session and shows its result. The task writes
    only to `/run/synopkgland-<package>/<name>.out`, which root owns and your
@@ -308,6 +364,39 @@ How it works, with no keys or signing involved:
    password. Remove it before uninstalling the package, because DSM keeps
    Task Scheduler tasks after an uninstall.
 
+Root templates keep a minimum of **DSM 7.1-42661**. Init, validation and build
+reject a root-package minimum below that version. DSM 7.0 has not been verified.
+The window probes TaskScheduler `list v3` once per access instance; only DSM
+error 103 selects the legacy API matrix. Permission, session and network errors
+do not trigger a fallback, and create/run requests are never automatically
+resent with another API version.
+
+| Operation | DSM 7.1 | DSM 7.2+ |
+| --- | --- | --- |
+| List / detail | `list v2` (offset/limit) / `get v3` | `list v3` (start/limit) / `get v4` |
+| Create | `TaskScheduler.create v3` | `TaskScheduler.Root.create v4` + `SynoConfirmPWToken` |
+| Run / delete | `run v2` / `delete v2` | `run v2` / `delete v2` |
+| Completion | `view v1` | `get_history_status_list v1` |
+
+**DSM 7.1 security difference:** DSM's PasswordConfirmDialog is still required
+in the window, but root-task creation has **no server-side password token**.
+Any authenticated administrator session can call `create v3` to create root
+tasks without this client dialog. The client confirmation records the user's
+intent; it does not provide the server-enforced fresh password proof of the
+7.2+ Root API. Both paths verify task name, root owner/real owner, disabled
+script type and the exact approved action text before run or removal.
+
+The legacy path saves the existing history before run and requires one new,
+completed record with a valid `stop_time`, integer `exit_code: 0` and
+`exit_type: normal`. It checks task identity again before returning output.
+An accepted run request or old output never proves completion. Calls and polls
+share a 30-second deadline (at most 60 polls, 500 ms apart); a timeout does not
+cancel a task that DSM already started. Concurrent calls in one window share
+one run. Existing running tasks, malformed or ambiguous history, and incomplete
+scheduler lists are refused. List/history snapshots are limited to 500 entries.
+Second-resolution history cannot identify same-second reruns reliably; those
+runs may time out rather than reuse an old success record.
+
 Non-administrators see DSM's "Only administrator accounts can perform this
 operation." and nothing else. HTTP requests can never choose what runs as
 root: the only root code is the fixed text an administrator approved. Your app
@@ -320,5 +409,5 @@ drive the same flow from its own UI.
 | --- | --- |
 | Build hosts | macOS, Linux (any OS with Go and Node) |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each) |
-| DSM | 7.2 or later declared (`os_min_ver`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
+| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build-spk --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | 32-bit ARM, DSM 6, running anything as root without an administrator's approval |

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,8 @@
 DSM integration helper build dependencies
 
-github.com/godbus/dbus/v5 v5.2.2 (BSD-2-Clause)
+github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82 (BSD-2-Clause)
+Pinned upstream commit: 0ea052abeb820894f944095b3c2dc125cef0df85
+Fix panic in DecodeMessageWithFDs on read error (not yet in a tagged release).
 
 Copyright (c) 2013, Georg Reinke (<guelfey at gmail dot com>), Google
 All rights reserved.

package/templates/native-go/backend/cmd/app/main.go

@@ -1,5 +1,9 @@
+//go:build !synopkgland_sdk_workers
+
 // Command app is the package backend. DSM runs it as a CGI (ui/cgi/api.cgi in
 // the package) under the package account, once per request.
+//
+//line dsmapp/cmd/app/main.go:1
 package main
 
 import (
@@ -12,6 +16,7 @@ import (
 	"dsmapp/internal/api"
 	"dsmapp/internal/app"
 	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
 	"dsmapp/internal/helper"
 )
 
@@ -20,6 +25,10 @@ var (
 	packageID       = "dev"
 	version         = "0.0.0"
 	helperInventory = ""
+	// "package" when the project has an integration but no privileged helper.
+	integrationMode = ""
+	// "session" when the project opted into the interactive File Station adapter.
+	fileStation = ""
 )
 
 func main() {
@@ -33,12 +42,20 @@ func main() {
 		PackageID: packageID,
 		Version:   version,
 		DataDir:   "/var/packages/" + packageID + "/var",
+
+		PackageIntegration: integrationMode == "package",
 	}
 	if helperInventory != "" {
 		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {
 			cfg.HelperInventory = helper.Inventory{Package: packageID}
 		}
 	}
+	if err := app.Migrate(cfg); err != nil {
+		log.Fatalf("schema migration failed: %v", err)
+	}
+	if app.SessionFilesEnabled(cfg.HelperInventory, fileStation) {
+		cfg.SessionFiles = filestation.Local(cfg.DataDir)
+	}
 	srv, err := api.NewServer(dsm.NewAuthenticator(), app.Routes(cfg)...)
 	if err != nil {
 		log.Fatal(err)

package/templates/native-go/backend/cmd/app/sdk_main.go

@@ -0,0 +1,60 @@
+//go:build synopkgland_sdk_workers
+
+// Command app is the package backend. DSM runs it as a CGI (ui/cgi/api.cgi in
+// the package) under the package account, once per request.
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http/cgi"
+	"os"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/app"
+	"dsmapp/internal/dsm"
+	"dsmapp/internal/filestation"
+	"dsmapp/internal/helper"
+)
+
+// Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
+var (
+	packageID       = "dev"
+	version         = "0.0.0"
+	helperInventory = ""
+	// "session" when the project opted into the interactive File Station adapter.
+	fileStation = ""
+)
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix(packageID + ": ")
+	if os.Getenv("GATEWAY_INTERFACE") == "" {
+		fmt.Fprintf(os.Stderr, "%s %s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID, version)
+		os.Exit(2)
+	}
+	cfg := app.Config{
+		PackageID: packageID,
+		Version:   version,
+		DataDir:   "/var/packages/" + packageID + "/var",
+	}
+	if helperInventory != "" {
+		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {
+			cfg.HelperInventory = helper.Inventory{Package: packageID}
+		}
+	}
+	if err := app.Migrate(cfg); err != nil {
+		log.Fatalf("schema migration failed: %v", err)
+	}
+	if app.SessionFilesEnabled(cfg.HelperInventory, fileStation) {
+		cfg.SessionFiles = filestation.Local(cfg.DataDir)
+	}
+	srv, err := api.NewServer(dsm.NewAuthenticator(), app.Routes(cfg)...)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := cgi.Serve(app.SDKHandler(srv)); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/native-go/backend/cmd/background-worker/main.go

@@ -0,0 +1,38 @@
+// Command background-worker is the package's fixed background worker. DSM runs
+// it as the package's systemd user unit under the package account; it never
+// runs as root and takes no input except the jobs in its private spool.
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+	"os/signal"
+	"os/user"
+	"strconv"
+	"syscall"
+
+	"dsmapp/internal/background"
+)
+
+// Set by `synopkgland build-spk` through -ldflags -X.
+var packageID = "dev"
+
+func main() {
+	log.SetFlags(0)
+	log.SetPrefix(packageID + " background: ")
+	if err := background.RefuseRoot(os.Geteuid()); err != nil {
+		log.Fatal(err)
+	}
+	name := ""
+	if u, err := user.Current(); err == nil {
+		name = u.Username
+	}
+	info := background.WorkerInfo{PID: os.Getpid(), UID: os.Getuid(), Username: name}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
+	defer stop()
+	log.Printf("started as uid %s", strconv.Itoa(info.UID))
+	if err := background.NewRunner("/var/packages/"+packageID+"/var/background", info).Run(ctx); err != nil {
+		log.Fatal(err)
+	}
+}

package/templates/native-go/backend/cmd/helper/main.go

@@ -16,11 +16,20 @@ func main() {
 	if len(os.Args) != 2 || json.Unmarshal([]byte(helperInventory), &i) != nil {
 		os.Exit(2)
 	}
-	if os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" {
+	if os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
 		c, err := helper.LocalClient(i)
 		if err != nil {
 			os.Exit(1)
 		}
+		if os.Args[1] == "diagnose-startup" {
+			diagnostic, err := c.StartupDiagnostic()
+			if err != nil {
+				fmt.Fprintln(os.Stderr, "startup diagnostic unavailable")
+				os.Exit(1)
+			}
+			json.NewEncoder(os.Stdout).Encode(diagnostic)
+			return
+		}
 		if os.Args[1] == "diagnose" {
 			json.NewEncoder(os.Stdout).Encode(c.Status(context.Background()))
 			return

package/templates/native-go/backend/cmd/helper/sdk_registry.go

@@ -0,0 +1,19 @@
+//go:build synopkgland_sdk_workers
+
+package main
+
+import (
+	"dsmapp/internal/helper"
+	"encoding/json"
+	"os"
+)
+
+// Linker-bound source-validated registry, never package-writable JSON.
+var sdkWorkerRegistry string
+
+func init() {
+	var inventory helper.Inventory
+	if json.Unmarshal([]byte(helperInventory), &inventory) != nil || helper.InstallSDKRegistry(inventory, sdkWorkerRegistry) != "" {
+		os.Exit(2)
+	}
+}

package/templates/native-go/backend/go.mod

@@ -1,7 +1,9 @@
 module dsmapp
 
-go 1.24
+go 1.25.0
 
-require github.com/godbus/dbus/v5 v5.2.2
+toolchain go1.26.8
 
-require golang.org/x/sys v0.27.0 // indirect
+require github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82
+
+require golang.org/x/sys v0.44.0

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
-github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
-golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
-golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82 h1:QN/vQc8LI8KFWH6uZZ4R4jermkdwzvKzGy0Taimhbm0=
+github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/api/registry.go

@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net/http"
 	"regexp"
 )
 
@@ -29,10 +30,11 @@ type Handler func(ctx context.Context, caller Caller, params json.RawMessage) (a
 // Route binds a method name to its handler and access policy. Its fields are
 // private: build routes with User, Admin or Public.
 type Route struct {
-	method  string
-	policy  policy
-	handler Handler
-	binary  BinaryReadHandler
+	method         string
+	policy         policy
+	handler        Handler
+	binary         BinaryReadHandler
+	requestHandler RequestHandler
 }
 
 // User declares an operation any signed-in DSM user may call.
@@ -40,6 +42,15 @@ func User(method string, h Handler) Route {
 	return Route{method: method, policy: policyUser, handler: h}
 }
 
+// RequestHandler receives the original request after the normal transport and
+// authentication guards. Credentials must remain request-scoped.
+type RequestHandler func(context.Context, Caller, *http.Request, json.RawMessage) (any, error)
+
+// UserRequest declares a session-aware operation for a signed-in DSM user.
+func UserRequest(method string, h RequestHandler) Route {
+	return Route{method: method, policy: policyUser, requestHandler: h}
+}
+
 // Admin declares an operation only members of DSM's administrators group may call.
 func Admin(method string, h Handler) Route {
 	return Route{method: method, policy: policyAdmin, handler: h}
@@ -80,10 +91,10 @@ func buildRegistry(routes []Route) (map[string]Route, error) {
 		if !methodName.MatchString(r.method) {
 			return nil, fmt.Errorf("route %q: method must look like \"area.action\" (lowercase)", r.method)
 		}
-		if r.binary != nil && (r.method != "nas.files.read.binary" || r.policy != policyUser || r.handler != nil) {
+		if r.binary != nil && (r.method != "nas.files.read.binary" || r.policy != policyUser || r.handler != nil || r.requestHandler != nil) {
 			return nil, errors.New("binary read must use the fixed authenticated route")
 		}
-		if r.handler == nil && r.binary == nil {
+		if r.handler == nil && r.binary == nil && r.requestHandler == nil {
 			return nil, fmt.Errorf("route %q has no handler", r.method)
 		}
 		if _, dup := registry[r.method]; dup {

package/templates/native-go/backend/internal/api/server.go

@@ -71,7 +71,13 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		serveBoundedRead(w, r, caller, req.Params, route.binary)
 		return
 	}
-	data, err := route.handler(r.Context(), caller, req.Params)
+	var data any
+	var err error
+	if route.requestHandler != nil {
+		data, err = route.requestHandler(r.Context(), caller, r, req.Params)
+	} else {
+		data, err = route.handler(r.Context(), caller, req.Params)
+	}
 	if err != nil {
 		writeError(w, asError(err))
 		return