@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/datamigrate/migrate_test.go

@@ -0,0 +1,177 @@
+package datamigrate
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func readState(t *testing.T, dir string) State {
+	t.Helper()
+	got, err := Load(dir)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	return got
+}
+
+func TestMissingStateIsZero(t *testing.T) {
+	got, err := Load(t.TempDir())
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if got != (State{}) {
+		t.Fatalf("missing state = %+v, want zero", got)
+	}
+}
+
+func TestRunAppliesEveryMigrationInVersionOrderAndRecordsSchema(t *testing.T) {
+	dir := t.TempDir()
+	var order []int
+	migrations := []Migration{
+		{Version: 2, Name: "second", Apply: func(Context) error { order = append(order, 2); return nil }},
+		{Version: 1, Name: "first", Apply: func(Context) error { order = append(order, 1); return nil }},
+	}
+	got, err := Run(dir, Info{NewPkgVer: "1.1.0-0002"}, migrations)
+	if err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	if want := []int{1, 2}; !reflect.DeepEqual(order, want) {
+		t.Fatalf("migration order = %v, want %v", order, want)
+	}
+	if got.Schema != 2 {
+		t.Fatalf("returned schema = %d, want 2", got.Schema)
+	}
+	if reread := readState(t, dir); reread.Schema != 2 || reread.PackageVersion != "1.1.0-0002" {
+		t.Fatalf("recorded state = %+v", reread)
+	}
+}
+
+func TestRunSkipsMigrationsAlreadyRecorded(t *testing.T) {
+	dir := t.TempDir()
+	runs := 0
+	migration := Migration{Version: 1, Name: "once", Apply: func(Context) error { runs++; return nil }}
+	for range 2 {
+		if _, err := Run(dir, Info{}, []Migration{migration}); err != nil {
+			t.Fatalf("Run: %v", err)
+		}
+	}
+	if runs != 1 {
+		t.Fatalf("migration applied %d times, want 1", runs)
+	}
+}
+
+func TestRunStopsAtFailureAndKeepsEarlierVersion(t *testing.T) {
+	dir := t.TempDir()
+	sentinel := errors.New("boom")
+	applied := 0
+	migrations := []Migration{
+		{Version: 1, Name: "ok", Apply: func(Context) error { applied++; return nil }},
+		{Version: 2, Name: "bad", Apply: func(Context) error { applied++; return sentinel }},
+		{Version: 3, Name: "later", Apply: func(Context) error { applied++; return nil }},
+	}
+	_, err := Run(dir, Info{}, migrations)
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("Run error = %v, want the migration error", err)
+	}
+	if applied != 2 {
+		t.Fatalf("applied %d migrations, want 2", applied)
+	}
+	if got := readState(t, dir); got.Schema != 1 {
+		t.Fatalf("recorded schema = %d, want 1 (last success)", got.Schema)
+	}
+}
+
+func TestRunLeavesOldDataWhenAMigrationFails(t *testing.T) {
+	dir := t.TempDir()
+	keep := filepath.Join(dir, "old.db")
+	if err := os.WriteFile(keep, []byte("old"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Run(dir, Info{}, []Migration{{Version: 1, Name: "bad", Apply: func(Context) error { return errors.New("nope") }}}); err == nil {
+		t.Fatal("want error")
+	}
+	if data, err := os.ReadFile(keep); err != nil || string(data) != "old" {
+		t.Fatalf("old data = %q, %v", data, err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, StateFile)); !os.IsNotExist(err) {
+		t.Fatalf("a failed first migration must not record a version: %v", err)
+	}
+}
+
+func TestRunGivesMigrationsTheOldAndNewPackageVersion(t *testing.T) {
+	dir := t.TempDir()
+	var first Context
+	if _, err := Run(dir, Info{OldPkgVer: "1.0.0-0001", NewPkgVer: "1.1.0-0002"}, []Migration{
+		{Version: 1, Name: "m1", Apply: func(ctx Context) error { first = ctx; return nil }},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if first.OldPkgVer != "1.0.0-0001" || first.NewPkgVer != "1.1.0-0002" || first.DataDir != dir {
+		t.Fatalf("context = %+v", first)
+	}
+	var second Context
+	if _, err := Run(dir, Info{NewPkgVer: "1.2.0-0003"}, []Migration{
+		{Version: 2, Name: "m2", Apply: func(ctx Context) error { second = ctx; return nil }},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if second.OldPkgVer != "1.1.0-0002" {
+		t.Fatalf("old package version without SYNOPKG_OLD_PKGVER = %q, want the recorded one", second.OldPkgVer)
+	}
+}
+
+func TestRunRecordsThePackageVersionWithoutMigrations(t *testing.T) {
+	dir := t.TempDir()
+	if _, err := Run(dir, Info{NewPkgVer: "1.0.0-0001"}, nil); err != nil {
+		t.Fatal(err)
+	}
+	if got := readState(t, dir); got.Schema != 0 || got.PackageVersion != "1.0.0-0001" {
+		t.Fatalf("state = %+v", got)
+	}
+	if _, err := Run(dir, Info{NewPkgVer: "1.1.0-0002"}, nil); err != nil {
+		t.Fatal(err)
+	}
+	if got := readState(t, dir); got.PackageVersion != "1.1.0-0002" {
+		t.Fatalf("state = %+v", got)
+	}
+}
+
+func TestRunRejectsInvalidMigrationLists(t *testing.T) {
+	dir := t.TempDir()
+	ok := func(Context) error { return nil }
+	for name, migrations := range map[string][]Migration{
+		"zero version": {{Version: 0, Name: "z", Apply: ok}},
+		"negative":     {{Version: -1, Name: "n", Apply: ok}},
+		"duplicate":    {{Version: 1, Name: "a", Apply: ok}, {Version: 1, Name: "b", Apply: ok}},
+		"nil apply":    {{Version: 1, Name: "a"}},
+	} {
+		if _, err := Run(dir, Info{}, migrations); err == nil {
+			t.Errorf("%s: want an error before anything runs", name)
+		}
+	}
+}
+
+func TestRunRejectsAnEmptyDataDirectory(t *testing.T) {
+	if _, err := Run("", Info{}, nil); err == nil {
+		t.Fatal("want an error")
+	}
+}
+
+func TestLoadRejectsCorruptState(t *testing.T) {
+	for name, body := range map[string]string{
+		"not json":     "{",
+		"negative":     `{"schema":-1}`,
+		"not a number": `{"schema":"one"}`,
+	} {
+		dir := t.TempDir()
+		if err := os.WriteFile(filepath.Join(dir, StateFile), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := Load(dir); err == nil {
+			t.Errorf("%s: want an error", name)
+		}
+	}
+}

package/templates/native-go/backend/internal/filestation/browse_test.go

@@ -0,0 +1,67 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+)
+
+// browseServer answers the session check and both List methods, and records
+// the folder_path DSM was asked to list ("" for the share roots).
+func browseServer(t *testing.T, user string, listed *[]string) *Client {
+	return fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		switch r.Form.Get("method") {
+		case "get":
+			fmt.Fprintf(w, `{"success":true,"data":{"username":%q}}`, user)
+		case "list_share":
+			*listed = append(*listed, "")
+			fmt.Fprint(w, `{"success":true,"data":{"shares":[{"path":"/share","name":"share","isdir":true}],"total":1,"offset":0}}`)
+		case "list":
+			*listed = append(*listed, r.Form.Get("folder_path"))
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/share/a.txt","name":"a.txt","isdir":false,"additional":{"size":3}}],"total":1,"offset":0}}`)
+		}
+	})
+}
+
+func TestBrowseListsShareRootsAndFoldersThroughCurrentSession(t *testing.T) {
+	var listed []string
+	s, _ := fileService(t, browseServer(t, "alice", &listed))
+	roots, err := s.Browse(context.Background(), alice(t), sessionRequest(), "", 0)
+	if err != nil || len(roots.Shares) != 1 || roots.Shares[0].Path != "/share" {
+		t.Fatalf("%+v %v", roots, err)
+	}
+	page, err := s.Browse(context.Background(), alice(t), sessionRequest(), "/share", 0)
+	if err != nil || len(page.Files) != 1 || page.Files[0].Name != "a.txt" {
+		t.Fatalf("%+v %v", page, err)
+	}
+	if len(listed) != 2 || listed[0] != "" || listed[1] != "/share" {
+		t.Fatalf("listed %q", listed)
+	}
+}
+
+func TestBrowseRefusesAnotherUsersSessionBeforeListing(t *testing.T) {
+	var listed []string
+	s, _ := fileService(t, browseServer(t, "mallory", &listed))
+	if _, err := s.Browse(context.Background(), alice(t), sessionRequest(), "/share", 0); err == nil {
+		t.Fatal("a session that resolves to another user must be refused")
+	}
+	if len(listed) != 0 {
+		t.Fatalf("listed %q", listed)
+	}
+}
+
+func TestBrowseRefusesBadPathsAndOnNilService(t *testing.T) {
+	var listed []string
+	s, _ := fileService(t, browseServer(t, "alice", &listed))
+	for _, folder := range []string{"share", "/share/../etc"} {
+		if _, err := s.Browse(context.Background(), alice(t), sessionRequest(), folder, 0); err == nil {
+			t.Errorf("%q must be refused", folder)
+		}
+	}
+	var nilService *Service
+	if _, err := nilService.Browse(context.Background(), alice(t), sessionRequest(), "", 0); err == nil {
+		t.Fatal("nil service must refuse")
+	}
+}

package/templates/native-go/backend/internal/filestation/client.go

@@ -0,0 +1,251 @@
+package filestation
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+const MaxBytes = 512 * 1024
+const maxMetadata = 1024 * 1024
+const PageSize = 100
+
+// Client has no cookie jar or credentials. The destination is startup-owned,
+// literal loopback only; proxies, redirects and automatic retries are disabled.
+type Client struct {
+	endpoint string
+	http     *http.Client
+}
+
+func NewClient(base string) (*Client, error) {
+	u, e := url.Parse(base)
+	if e != nil || u.Scheme != "http" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (u.Path != "" && u.Path != "/") || net.ParseIP(u.Hostname()) == nil || !net.ParseIP(u.Hostname()).IsLoopback() {
+		return nil, fail("unavailable")
+	}
+	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, ResponseHeaderTimeout: 10 * time.Second, MaxResponseHeaderBytes: 32 * 1024, DisableCompression: true}
+	return &Client{endpoint: strings.TrimRight(base, "/") + "/webapi/entry.cgi", http: &http.Client{Transport: tr, Timeout: 15 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}, nil
+}
+func fail(code string) error {
+	return &api.Error{Code: code, Message: "File Station operation refused"}
+}
+func wireError(code int) error {
+	switch code {
+	case 106, 107, 119:
+		return fail("session_required")
+	case 105, 403, 407:
+		return fail("denied")
+	case 408:
+		return fail("not_found")
+	case 414, 1805:
+		return fail("conflict")
+	case 400:
+		return fail("invalid-request")
+	default:
+		return fail("unavailable")
+	}
+}
+func fields(family, method, version string) url.Values {
+	return url.Values{"api": {family}, "method": {method}, "version": {version}}
+}
+func array(s string) string { b, _ := json.Marshal([]string{s}); return string(b) }
+func validPath(p string) bool {
+	return len(p) > 1 && len(p) <= 4096 && strings.HasPrefix(p, "/") && path.Clean(p) == p && !strings.ContainsAny(p, "\x00\r\n\\,\"")
+}
+func (c *Client) send(ctx context.Context, original *http.Request, body io.Reader, contentType string) (*http.Response, error) {
+	if c == nil || original == nil {
+		return nil, fail("unavailable")
+	}
+	cookies := original.CookiesNamed("id")
+	token := original.Header.Get("X-SYNO-TOKEN")
+	if len(cookies) != 1 || cookies[0].Value == "" || len(cookies[0].Value) > 4096 || len(token) > 4096 || strings.ContainsAny(token, "\r\n\x00") {
+		return nil, fail("session_required")
+	}
+	method, endpoint := http.MethodPost, c.endpoint
+	if contentType == "" {
+		method = http.MethodGet
+		encoded, err := io.ReadAll(body)
+		if err != nil {
+			return nil, fail("unavailable")
+		}
+		endpoint += "?" + string(encoded)
+		body = nil
+	}
+	req, e := http.NewRequestWithContext(ctx, method, endpoint, body)
+	if e != nil {
+		return nil, fail("unavailable")
+	}
+	req.Header.Set("Content-Type", contentType)
+	req.AddCookie(cookies[0])
+	req.Header.Set("X-SYNO-TOKEN", token)
+	// Never forward caller Host, Authorization, forwarding headers or URLs.
+	resp, e := c.http.Do(req)
+	if e != nil {
+		if ctx.Err() != nil {
+			return nil, fail("canceled")
+		}
+		return nil, fail("unavailable")
+	}
+	if resp.StatusCode != http.StatusOK {
+		resp.Body.Close()
+		return nil, fail("unavailable")
+	}
+	return resp, nil
+}
+func (c *Client) form(ctx context.Context, r *http.Request, v url.Values) (*http.Response, error) {
+	if r == nil {
+		return nil, fail("unavailable")
+	}
+	v.Set("SynoToken", r.Header.Get("X-SYNO-TOKEN"))
+	return c.send(ctx, r, strings.NewReader(v.Encode()), "application/x-www-form-urlencoded")
+}
+func decode(resp *http.Response, into any) error {
+	defer resp.Body.Close()
+	b, e := io.ReadAll(io.LimitReader(resp.Body, maxMetadata+1))
+	if e != nil || len(b) > maxMetadata {
+		return fail("unavailable")
+	}
+	var envelope struct {
+		Success *bool           `json:"success"`
+		Data    json.RawMessage `json:"data"`
+		Error   struct {
+			Code int `json:"code"`
+		} `json:"error"`
+	}
+	if json.Unmarshal(b, &envelope) != nil || envelope.Success == nil {
+		return fail("unavailable")
+	}
+	if !*envelope.Success {
+		return wireError(envelope.Error.Code)
+	}
+	if into != nil && json.Unmarshal(envelope.Data, into) != nil {
+		return fail("unavailable")
+	}
+	return nil
+}
+func (c *Client) call(ctx context.Context, r *http.Request, v url.Values, into any) error {
+	resp, e := c.form(ctx, r, v)
+	if e != nil {
+		return e
+	}
+	return decode(resp, into)
+}
+
+// Verify checks that loopback WebAPI resolves the same user as authenticate.cgi.
+// Failure (including DSM IP-bound sessions) never falls back to admin credentials.
+func (c *Client) Verify(ctx context.Context, r *http.Request, user string) error {
+	var d struct {
+		Username string `json:"username"`
+	}
+	if e := c.call(ctx, r, fields("SYNO.Core.NormalUser", "get", "1"), &d); e != nil {
+		return e
+	}
+	if user == "" || d.Username != user {
+		return fail("session_required")
+	}
+	return nil
+}
+
+type Entry struct {
+	Path       string `json:"path"`
+	Name       string `json:"name"`
+	IsDir      bool   `json:"isdir"`
+	Additional struct {
+		Size int64 `json:"size"`
+	} `json:"additional"`
+}
+type Page struct {
+	Files  []Entry `json:"files"`
+	Shares []Entry `json:"shares,omitempty"`
+	Total  int     `json:"total"`
+	Offset int     `json:"offset"`
+}
+
+func (c *Client) page(ctx context.Context, r *http.Request, p string, offset int) (Page, error) {
+	var d Page
+	if offset < 0 || offset > 1000000 || (p != "" && !validPath(p)) {
+		return d, fail("invalid-request")
+	}
+	method := "list"
+	if p == "" {
+		method = "list_share"
+	}
+	v := fields("SYNO.FileStation.List", method, "2")
+	v.Set("offset", strconv.Itoa(offset))
+	v.Set("limit", strconv.Itoa(PageSize))
+	v.Set("additional", `["size"]`)
+	if p != "" {
+		v.Set("folder_path", p)
+	}
+	e := c.call(ctx, r, v, &d)
+	if len(d.Files) > PageSize || len(d.Shares) > PageSize {
+		return Page{}, fail("unavailable")
+	}
+	return d, e
+}
+func (c *Client) Discover(ctx context.Context, r *http.Request, offset int) (Page, error) {
+	return c.page(ctx, r, "", offset)
+}
+func (c *Client) List(ctx context.Context, r *http.Request, p string, offset int) (Page, error) {
+	return c.page(ctx, r, p, offset)
+}
+func (c *Client) Stat(ctx context.Context, r *http.Request, p string) (Entry, error) {
+	var d Page
+	if !validPath(p) {
+		return Entry{}, fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.List", "getinfo", "2")
+	v.Set("path", array(p))
+	v.Set("additional", `["size"]`)
+	if e := c.call(ctx, r, v, &d); e != nil {
+		return Entry{}, e
+	}
+	if len(d.Files) != 1 || d.Files[0].Path != p || d.Files[0].Name == "" {
+		return Entry{}, fail("not_found")
+	}
+	return d.Files[0], nil
+}
+func (c *Client) Read(ctx context.Context, r *http.Request, p string) ([]byte, error) {
+	if !validPath(p) {
+		return nil, fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.Download", "download", "2")
+	v.Set("path", array(p))
+	v.Set("mode", "download")
+	resp, e := c.send(ctx, r, strings.NewReader(v.Encode()), "")
+	if e != nil {
+		return nil, e
+	}
+	// DSM error envelopes must never be returned as successful file content.
+	// A real JSON file remains downloadable when attachment disposition is set.
+	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
+	if disposition != "attachment" {
+		e = decode(resp, nil)
+		if e == nil {
+			e = fail("unavailable")
+		}
+		return nil, e
+	}
+	defer resp.Body.Close()
+	b, e := io.ReadAll(io.LimitReader(resp.Body, MaxBytes+1))
+	if e != nil {
+		return nil, fail("read_failed")
+	}
+	if len(b) > MaxBytes {
+		return nil, fail("limit-exceeded")
+	}
+	if resp.ContentLength >= 0 && resp.ContentLength != int64(len(b)) {
+		return nil, fail("read_failed")
+	}
+	return bytes.Clone(b), nil
+}

package/templates/native-go/backend/internal/filestation/client_test.go

@@ -0,0 +1,155 @@
+package filestation
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func fakeClient(t *testing.T, h http.HandlerFunc) *Client {
+	t.Helper()
+	s := httptest.NewServer(h)
+	t.Cleanup(s.Close)
+	c, err := NewClient(s.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return c
+}
+func sessionRequest() *http.Request {
+	r := httptest.NewRequest("POST", "http://package/api", nil)
+	r.AddCookie(&http.Cookie{Name: "id", Value: "test-session"})
+	r.Header.Set("X-SYNO-TOKEN", "test-token")
+	return r
+}
+func TestReadOperationsUseOnlyCurrentSession(t *testing.T) {
+	calls := 0
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		if (r.Method != "GET" && r.URL.RawQuery != "") || r.Header.Get("X-SYNO-TOKEN") != "test-token" || r.Header.Get("Cookie") != "id=test-session" {
+			t.Error("incorrect session transport")
+		}
+		r.ParseForm()
+		if r.Form.Get("_sid") != "" || (r.Method != "GET" && r.Form.Get("SynoToken") != "test-token") {
+			t.Error("incorrect form carriers")
+		}
+		switch r.Form.Get("method") {
+		case "get":
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+		case "list_share":
+			fmt.Fprint(w, `{"success":true,"data":{"shares":[{"path":"/home","name":"home","isdir":true}],"total":1}}`)
+		case "list":
+			if r.Form.Get("folder_path") != "/home" || r.Form.Get("limit") != "100" {
+				t.Error("list fields")
+			}
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/a","name":"a","isdir":false}],"total":1}}`)
+		case "getinfo":
+			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/a","name":"a","isdir":false,"additional":{"size":3}}]}}`)
+		case "download":
+			if r.Form.Get("path") != `["/home/a"]` {
+				t.Error("download path")
+			}
+			w.Header().Set("Content-Type", "application/octet-stream")
+			w.Header().Set("Content-Disposition", `attachment; filename="a"`)
+			fmt.Fprint(w, "abc")
+		default:
+			t.Error("unexpected method")
+		}
+	})
+	r := sessionRequest()
+	if err := c.Verify(context.Background(), r, "alice"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := c.Discover(context.Background(), r, 0); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := c.List(context.Background(), r, "/home", 0); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := c.Stat(context.Background(), r, "/home/a"); err != nil {
+		t.Fatal(err)
+	}
+	b, err := c.Read(context.Background(), r, "/home/a")
+	if err != nil || string(b) != "abc" {
+		t.Fatal(err)
+	}
+	if calls != 5 {
+		t.Fatal(calls)
+	}
+}
+func TestRefusalAndBoundedErrors(t *testing.T) {
+	for _, tt := range []struct{ body, want string }{
+		{`{"success":false,"error":{"code":119,"secret":"test-session"}}`, "session_required"},
+		{`{"success":false,"error":{"code":407}}`, "denied"},
+		{`{"success":false,"error":{"code":408}}`, "not_found"},
+		{`{"success":false,"error":{"code":1805}}`, "conflict"},
+		{`{"success":false,"error":{"code":9999}}`, "unavailable"},
+		{`{"data":{}}`, "unavailable"}, {`not json`, "unavailable"},
+	} {
+		t.Run(tt.want+tt.body, func(t *testing.T) {
+			c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, tt.body) })
+			_, err := c.List(context.Background(), sessionRequest(), "/home", 0)
+			if err == nil || !strings.Contains(err.Error(), tt.want) || strings.Contains(err.Error(), "test-session") {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+func TestNoSessionRedirectOrRemoteDestination(t *testing.T) {
+	for _, url := range []string{"https://example.com", "http://localhost:5000", "http://127.0.0.1:5000/evil", "http://user@127.0.0.1:5000", "http://127.0.0.1:5000?x=y"} {
+		if _, err := NewClient(url); err == nil {
+			t.Fatal("accepted", url)
+		}
+	}
+	calls := 0
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		http.Redirect(w, r, "http://127.0.0.1:1/leak", 302)
+	})
+	if _, err := c.List(context.Background(), httptest.NewRequest("POST", "/", nil), "/home", 0); err == nil || calls != 0 {
+		t.Fatal("missing session sent")
+	}
+	if _, err := c.List(context.Background(), sessionRequest(), "/home", 0); err == nil || calls != 1 {
+		t.Fatal("redirect accepted")
+	}
+}
+func TestDownloadDoesNotTurnErrorsIntoFileBytes(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]any{"success": false, "error": map[string]int{"code": 407}})
+	})
+	if b, err := c.Read(context.Background(), sessionRequest(), "/home/a"); err == nil || len(b) != 0 {
+		t.Fatal("error bytes escaped")
+	}
+}
+
+func TestBoundariesCancellationAndIdentityMismatch(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("method") == "download" {
+			w.Header().Set("Content-Disposition", `attachment; filename="large"`)
+			fmt.Fprint(w, strings.Repeat("x", MaxBytes+1))
+			return
+		}
+		fmt.Fprint(w, `{"success":true,"data":{"username":"someone-else"}}`)
+	})
+	if e := c.Verify(context.Background(), sessionRequest(), "alice"); e == nil {
+		t.Fatal("identity mismatch admitted")
+	}
+	if b, e := c.Read(context.Background(), sessionRequest(), "/home/large"); e == nil || len(b) != 0 {
+		t.Fatal("oversized read escaped")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, e := c.List(ctx, sessionRequest(), "/home", 0); e == nil {
+		t.Fatal("canceled request succeeded")
+	}
+	r := sessionRequest()
+	r.AddCookie(&http.Cookie{Name: "id", Value: "other"})
+	if _, e := c.List(context.Background(), r, "/home", 0); e == nil {
+		t.Fatal("ambiguous session accepted")
+	}
+}

package/templates/native-go/backend/internal/filestation/doc.go

@@ -0,0 +1,4 @@
+// Package filestation implements interactive NAS operations using the current
+// DSM user's session. It never opens NAS data paths or retains credentials.
+// Folder selections are not background grants or filesystem confinement.
+package filestation