@synopackageland/cli 0.4.1 → 0.5.0

package/templates/native-go/backend/internal/filestation/read_file_test.go

@@ -0,0 +1,90 @@
+package filestation
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"dsmapp/internal/api"
+)
+
+// identityServer answers like DSM for user "alice" with one 5-byte file.
+func identityServer(t *testing.T, size int, user string) *Client {
+	return fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		switch r.Form.Get("method") {
+		case "get":
+			fmt.Fprintf(w, `{"success":true,"data":{"username":%q}}`, user)
+		case "getinfo":
+			isdir := "false"
+			if r.Form.Get("path") == `["/home"]` {
+				isdir = "true"
+			}
+			fmt.Fprintf(w, `{"success":true,"data":{"files":[{"path":%s,"name":"x","isdir":%s,"additional":{"size":%d}}]}}`, r.Form.Get("path")[1:len(r.Form.Get("path"))-1], isdir, size)
+		case "download":
+			w.Header().Set("Content-Disposition", `attachment; filename="x"`)
+			fmt.Fprint(w, "hello")
+		}
+	})
+}
+
+func fileService(t *testing.T, c *Client) (*Service, string) {
+	s := NewService(c, NewGrantRepository(t.TempDir()))
+	s.lookupUID = func(string) (string, error) { return "1000", nil }
+	return s, "/home"
+}
+
+func alice(t *testing.T) api.Caller {
+	var got api.Caller
+	srv, _ := api.NewServer(testAuth{"alice"}, api.UserRequest("a.b", func(_ context.Context, c api.Caller, _ *http.Request, _ json.RawMessage) (any, error) {
+		got = c
+		return nil, nil
+	}))
+	r := sessionRequest()
+	r.Body = ioNop([]byte(`{"method":"a.b","params":{}}`))
+	r.Header.Set("Content-Type", "application/json")
+	srv.ServeHTTP(httptest.NewRecorder(), r)
+	return got
+}
+
+func TestReadFileReturnsSelectedFileThroughCurrentSession(t *testing.T) {
+	s, folder := fileService(t, identityServer(t, 5, "alice"))
+	data, err := s.ReadFile(context.Background(), alice(t), sessionRequest(), folder, "docs/x.txt")
+	if err != nil || string(data) != "hello" {
+		t.Fatalf("%q %v", data, err)
+	}
+}
+
+func TestReadFileRefusesWhenSessionBelongsToAnotherUser(t *testing.T) {
+	s, folder := fileService(t, identityServer(t, 5, "mallory"))
+	if _, err := s.ReadFile(context.Background(), alice(t), sessionRequest(), folder, "x.txt"); err == nil {
+		t.Fatal("a session that resolves to another user must be refused")
+	}
+}
+
+func TestReadFileRefusesNonFoldersTraversalAndOversize(t *testing.T) {
+	s, folder := fileService(t, identityServer(t, MaxBytes+1, "alice"))
+	ctx, c := context.Background(), alice(t)
+	if _, err := s.ReadFile(ctx, c, sessionRequest(), folder, "x.txt"); err == nil {
+		t.Fatal("oversize file must be refused before download")
+	}
+	if _, err := s.ReadFile(ctx, c, sessionRequest(), "/home/x.txt", "x.txt"); err == nil {
+		t.Fatal("a folder that is not a directory must be refused")
+	}
+	if _, err := s.ReadFile(ctx, c, sessionRequest(), folder, "../etc/passwd"); err == nil {
+		t.Fatal("traversal must be refused")
+	}
+	if _, err := s.ReadFile(ctx, c, sessionRequest(), folder, ""); err == nil {
+		t.Fatal("the selected folder itself is not a file")
+	}
+}
+
+func TestReadFileOnNilServiceIsUnavailable(t *testing.T) {
+	var s *Service
+	if _, err := s.ReadFile(context.Background(), api.Caller{}, sessionRequest(), "x", "y"); err == nil {
+		t.Fatal("nil service must refuse")
+	}
+}

package/templates/native-go/backend/internal/filestation/repository.go

@@ -0,0 +1,207 @@
+package filestation
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"os"
+	"path"
+	"strings"
+	"time"
+
+	"golang.org/x/sys/unix"
+)
+
+// Selection records user consent, never DSM authority. Unlike helper grants it
+// cannot authorize an offline worker. Names/UIDs follow the relaxed identity
+// contract: recreating the same name and UID can reuse a selection.
+type Selection struct {
+	ID       string `json:"grantId"`
+	User     string `json:"user"`
+	UID      string `json:"uid"`
+	Folder   string `json:"folder"`
+	Writable bool   `json:"writable"`
+}
+type GrantRepository struct{ dir string }
+
+func NewGrantRepository(dir string) *GrantRepository { return &GrantRepository{dir: dir} }
+
+// withStore serializes CGI processes, including in-flight operations and revoke.
+// Local files are package-owned metadata only. No NAS data path is ever opened.
+func (r *GrantRepository) withStore(ctx context.Context, fn func(*[]Selection) (bool, error)) error {
+	if r == nil || r.dir == "" {
+		return fail("unavailable")
+	}
+	root, e := os.OpenRoot(r.dir)
+	if e != nil {
+		return fail("unavailable")
+	}
+	defer root.Close()
+	lock, e := root.OpenFile("session-selections.lock", os.O_CREATE|os.O_RDWR|unix.O_NOFOLLOW, 0600)
+	if e != nil {
+		return fail("unavailable")
+	}
+	defer lock.Close()
+	info, e := lock.Stat()
+	if e != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 {
+		return fail("unavailable")
+	}
+	for {
+		e = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB)
+		if e == nil {
+			break
+		}
+		if !errors.Is(e, unix.EWOULDBLOCK) {
+			return fail("unavailable")
+		}
+		select {
+		case <-ctx.Done():
+			return fail("canceled")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	defer unix.Flock(int(lock.Fd()), unix.LOCK_UN)
+	if ctx.Err() != nil {
+		return fail("canceled")
+	}
+	var entries []Selection
+	f, e := root.OpenFile("session-selections.json", os.O_RDONLY|unix.O_NOFOLLOW, 0)
+	if e == nil {
+		info, se := f.Stat()
+		b, re := io.ReadAll(io.LimitReader(f, maxMetadata+1))
+		f.Close()
+		if se != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 || re != nil || len(b) > maxMetadata || json.Unmarshal(b, &entries) != nil {
+			return fail("unavailable")
+		}
+	} else if !errors.Is(e, os.ErrNotExist) {
+		return fail("unavailable")
+	}
+	seen := map[string]bool{}
+	if len(entries) > 256 {
+		return fail("unavailable")
+	}
+	for _, g := range entries {
+		if !validID(g.ID) || g.User == "" || g.UID == "" || !validPath(g.Folder) || seen[g.ID] {
+			return fail("unavailable")
+		}
+		seen[g.ID] = true
+	}
+	change, e := fn(&entries)
+	if e != nil || !change {
+		return e
+	}
+	b, e := json.Marshal(entries)
+	if e != nil || len(b) > maxMetadata {
+		return fail("limit-exceeded")
+	}
+	nonce := make([]byte, 16)
+	if _, e = rand.Read(nonce); e != nil {
+		return fail("unavailable")
+	}
+	tmp := ".session-selections-" + hex.EncodeToString(nonce)
+	out, e := root.OpenFile(tmp, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
+	if e != nil {
+		return fail("unavailable")
+	}
+	defer root.Remove(tmp)
+	_, e = out.Write(b)
+	if e == nil {
+		e = out.Sync()
+	}
+	ce := out.Close()
+	if e != nil || ce != nil {
+		return fail("unavailable")
+	}
+	dir, e := root.Open(".")
+	if e != nil {
+		return fail("commit-uncertain")
+	}
+	defer dir.Close()
+	if unix.Renameat(int(dir.Fd()), tmp, int(dir.Fd()), "session-selections.json") != nil {
+		return fail("commit-uncertain")
+	}
+	if dir.Sync() != nil {
+		return fail("commit-uncertain")
+	}
+	return nil
+}
+func validID(id string) bool { b, e := hex.DecodeString(id); return e == nil && len(b) == 32 }
+func (r *GrantRepository) Confirm(ctx context.Context, user, uid, folder string, writable bool) (Selection, error) {
+	var g Selection
+	if user == "" || uid == "" || !validPath(folder) {
+		return g, fail("invalid-request")
+	}
+	b := make([]byte, 32)
+	if _, e := rand.Read(b); e != nil {
+		return g, fail("unavailable")
+	}
+	g = Selection{hex.EncodeToString(b), user, uid, folder, writable}
+	e := r.withStore(ctx, func(gs *[]Selection) (bool, error) {
+		if len(*gs) >= 256 {
+			return false, fail("limit-exceeded")
+		}
+		*gs = append(*gs, g)
+		return true, nil
+	})
+	return g, e
+}
+func (r *GrantRepository) WithGrant(ctx context.Context, user, uid, id string, write bool, fn func(Selection) error) error {
+	if !validID(id) {
+		return fail("denied")
+	}
+	return r.withStore(ctx, func(gs *[]Selection) (bool, error) {
+		for _, g := range *gs {
+			if g.ID == id && g.User == user && g.UID == uid && (!write || g.Writable) {
+				return false, fn(g)
+			}
+		}
+		return false, fail("denied")
+	})
+}
+func (r *GrantRepository) List(ctx context.Context, user, uid string) ([]Selection, error) {
+	out := []Selection{}
+	e := r.withStore(ctx, func(gs *[]Selection) (bool, error) {
+		for _, g := range *gs {
+			if g.User == user && g.UID == uid {
+				out = append(out, g)
+			}
+		}
+		return false, nil
+	})
+	return out, e
+}
+func (r *GrantRepository) Revoke(ctx context.Context, user, uid, id string) error {
+	return r.withStore(ctx, func(gs *[]Selection) (bool, error) {
+		for i, g := range *gs {
+			if g.ID == id && g.User == user && g.UID == uid {
+				*gs = append((*gs)[:i], (*gs)[i+1:]...)
+				return true, nil
+			}
+		}
+		return false, fail("denied")
+	})
+}
+func relative(root, rel string) (string, error) {
+	if !validPath(root) {
+		return "", fail("denied")
+	}
+	if rel == "" {
+		return root, nil
+	}
+	if strings.HasPrefix(rel, "/") || path.Clean(rel) != rel {
+		return "", fail("invalid-request")
+	}
+	for _, s := range strings.Split(rel, "/") {
+		if !validName(s) {
+			return "", fail("invalid-request")
+		}
+	}
+	p := root + "/" + rel
+	if !validPath(p) {
+		return "", fail("invalid-request")
+	}
+	return p, nil
+}

package/templates/native-go/backend/internal/filestation/repository_test.go

@@ -0,0 +1,104 @@
+package filestation
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestSelectionPersistenceOwnershipAndRevoke(t *testing.T) {
+	dir := t.TempDir()
+	r := NewGrantRepository(dir)
+	ctx := context.Background()
+	g, e := r.Confirm(ctx, "alice", "1000", "/home", true)
+	if e != nil {
+		t.Fatal(e)
+	}
+	r = NewGrantRepository(dir)
+	called := false
+	if e = r.WithGrant(ctx, "alice", "1000", g.ID, false, func(g Selection) error { called = true; return nil }); e != nil || !called {
+		t.Fatal(e)
+	}
+	for _, owner := range [][2]string{{"bob", "1001"}, {"alice", "1001"}, {"bob", "1000"}} {
+		if e = r.WithGrant(ctx, owner[0], owner[1], g.ID, false, func(Selection) error { t.Fatal("cross user"); return nil }); e == nil {
+			t.Fatal("accepted")
+		}
+	}
+	if e = r.Revoke(ctx, "alice", "1000", g.ID); e != nil {
+		t.Fatal(e)
+	}
+	if e = r.WithGrant(ctx, "alice", "1000", g.ID, false, func(Selection) error { t.Fatal("revoked"); return nil }); e == nil {
+		t.Fatal("accepted")
+	}
+	b, _ := os.ReadFile(dir + "/session-selections.json")
+	if strings.Contains(string(b), "test-session") {
+		t.Fatal("credentials persisted")
+	}
+}
+func TestReadonlySelectionAndTraversal(t *testing.T) {
+	r := NewGrantRepository(t.TempDir())
+	g, e := r.Confirm(context.Background(), "alice", "1000", "/home", false)
+	if e != nil {
+		t.Fatal(e)
+	}
+	if e = r.WithGrant(context.Background(), "alice", "1000", g.ID, true, func(Selection) error { t.Fatal("write admitted"); return nil }); e == nil {
+		t.Fatal("accepted")
+	}
+	for _, p := range []string{"../x", "a/../x", "/x", "a//x", "a\\x", "a,b", "a/./b"} {
+		if _, e := relative("/home", p); e == nil {
+			t.Fatal(p)
+		}
+	}
+	if p, e := relative("/home", "a/b"); e != nil || p != "/home/a/b" {
+		t.Fatal(p, e)
+	}
+}
+
+func TestRevokeWaitsForActiveOperationAcrossRepositoryInstances(t *testing.T) {
+	dir := t.TempDir()
+	a, b := NewGrantRepository(dir), NewGrantRepository(dir)
+	ctx := context.Background()
+	g, e := a.Confirm(ctx, "alice", "1000", "/home", true)
+	if e != nil {
+		t.Fatal(e)
+	}
+	entered, release, done := make(chan struct{}), make(chan struct{}), make(chan error, 1)
+	go func() {
+		done <- a.WithGrant(ctx, "alice", "1000", g.ID, true, func(Selection) error { close(entered); <-release; return nil })
+	}()
+	<-entered
+	canceled, cancel := context.WithCancel(ctx)
+	cancel()
+	if e = b.Revoke(canceled, "alice", "1000", g.ID); e == nil {
+		t.Fatal("revoked through active lock")
+	}
+	close(release)
+	if e = <-done; e != nil {
+		t.Fatal(e)
+	}
+	if e = b.Revoke(ctx, "alice", "1000", g.ID); e != nil {
+		t.Fatal(e)
+	}
+}
+
+func TestCorruptAndSymlinkStoresFailClosed(t *testing.T) {
+	for _, data := range []string{`broken`, `[{"grantId":"bad","folder":"/home"}]`} {
+		dir := t.TempDir()
+		if e := os.WriteFile(dir+"/session-selections.json", []byte(data), 0600); e != nil {
+			t.Fatal(e)
+		}
+		if _, e := NewGrantRepository(dir).List(context.Background(), "alice", "1000"); e == nil {
+			t.Fatal("corrupt accepted")
+		}
+	}
+	dir := t.TempDir()
+	target := t.TempDir() + "/outside"
+	os.WriteFile(target, []byte(`[]`), 0600)
+	if e := os.Symlink(target, dir+"/session-selections.json"); e != nil {
+		t.Fatal(e)
+	}
+	if _, e := NewGrantRepository(dir).List(context.Background(), "alice", "1000"); e == nil {
+		t.Fatal("symlink accepted")
+	}
+}

package/templates/native-go/backend/internal/filestation/sdk_session.go

@@ -0,0 +1,241 @@
+//go:build synopkgland_sdk_workers
+
+package filestation
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/json"
+	"errors"
+	"golang.org/x/sys/unix"
+	"io"
+	"mime"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// SessionIdentity is authenticated per request, not an offline grant, account
+// incarnation or a local ACL calculation. Admin is DSM administrators membership.
+type SessionIdentity struct {
+	User, UID string
+	Admin     bool
+}
+
+func (s *Service) CheckSession(ctx context.Context, auth api.Authenticator, r *http.Request) (SessionIdentity, error) {
+	if s == nil || s.client == nil || auth == nil || r == nil {
+		return SessionIdentity{}, fail("unavailable")
+	}
+	a, e := auth.Authenticate(r.WithContext(ctx))
+	if e != nil || a.User == "" {
+		return SessionIdentity{}, fail("session_required")
+	}
+	if e = s.client.Verify(ctx, r, a.User); e != nil {
+		return SessionIdentity{}, e
+	}
+	uid, e := s.lookupUID(a.User)
+	n, parse := strconv.ParseUint(uid, 10, 32)
+	if e != nil || parse != nil || n == 0 || strconv.FormatUint(n, 10) != uid || ctx.Err() != nil {
+		return SessionIdentity{}, fail("denied")
+	}
+	return SessionIdentity{User: a.User, UID: uid, Admin: a.Admin}, nil
+}
+func (s *Service) JobSelection(ctx context.Context, id SessionIdentity, grant string) error {
+	if s == nil || s.repository == nil {
+		return fail("unavailable")
+	}
+	return s.repository.withJobGrant(ctx, id, grant, func(Selection) error { return nil })
+}
+
+// Fixed, counter-only read plans. No NAS path is opened with POSIX APIs. This
+// shares M2 selection/revoke locking and path semantics, not inode confinement.
+func (s *Service) JobStep(ctx context.Context, r *http.Request, id SessionIdentity, grant string, step jobcontract.Step) (jobcontract.Result, error) {
+	out := jobcontract.Result{ResultSchema: 1}
+	if s == nil || s.client == nil || s.repository == nil {
+		return out, fail("unavailable")
+	}
+	if step.Action != jobcontract.List && step.Action != jobcontract.Stat && step.Action != jobcontract.Read {
+		return out, fail("unsupported")
+	}
+	for _, segment := range step.Segments {
+		if !validName(segment) {
+			return out, fail("invalid-request")
+		}
+	}
+	e := s.repository.withJobGrant(ctx, id, grant, func(g Selection) error {
+		target, e := relative(g.Folder, strings.Join(step.Segments, "/"))
+		if e != nil {
+			return e
+		}
+		switch step.Action {
+		case jobcontract.List:
+			if step.Limit == nil || *step.Limit == 0 || *step.Limit > PageSize {
+				return fail("limit-exceeded")
+			}
+			p, e := s.client.jobList(ctx, r, target, *step.Limit)
+			if e != nil {
+				return e
+			}
+			out.Entries = min(uint64(len(p.Files)), *step.Limit)
+		case jobcontract.Stat:
+			if _, e = s.client.Stat(ctx, r, target); e != nil {
+				return e
+			}
+			out.Entries = 1
+		case jobcontract.Read:
+			if step.MaxBytes == nil || *step.MaxBytes == 0 || *step.MaxBytes > MaxBytes {
+				return fail("limit-exceeded")
+			}
+			item, e := s.client.Stat(ctx, r, target)
+			if e != nil {
+				return e
+			}
+			if item.IsDir || item.Additional.Size < 0 {
+				return fail("denied")
+			}
+			if uint64(item.Additional.Size) > *step.MaxBytes {
+				return fail("limit-exceeded")
+			}
+			b, e := s.client.jobRead(ctx, r, target, *step.MaxBytes)
+			defer clear(b)
+			if e != nil {
+				return e
+			}
+			if uint64(len(b)) > *step.MaxBytes {
+				return fail("limit-exceeded")
+			}
+			out.BytesRead = uint64(len(b))
+		}
+		if ctx.Err() != nil {
+			return fail("canceled")
+		}
+		out.CompletedSteps = 1
+		return nil
+	})
+	return out, e
+}
+
+// Honor the exact step bounds at the WebAPI boundary, including a file that
+// grows after getinfo. The extra byte detects overflow and is never counted or
+// returned as a successful read.
+func (c *Client) jobRead(ctx context.Context, r *http.Request, p string, limit uint64) ([]byte, error) {
+	v := fields("SYNO.FileStation.Download", "download", "2")
+	v.Set("path", array(p))
+	v.Set("mode", "download")
+	resp, e := c.send(ctx, r, strings.NewReader(v.Encode()), "")
+	if e != nil {
+		return nil, e
+	}
+	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
+	if disposition != "attachment" {
+		e = decode(resp, nil)
+		if e == nil {
+			e = fail("unavailable")
+		}
+		return nil, e
+	}
+	defer resp.Body.Close()
+	b, e := io.ReadAll(io.LimitReader(resp.Body, int64(limit)+1))
+	if e != nil {
+		clear(b)
+		return nil, fail("read_failed")
+	}
+	if uint64(len(b)) > limit {
+		clear(b)
+		return nil, fail("limit-exceeded")
+	}
+	if resp.ContentLength >= 0 && resp.ContentLength != int64(len(b)) {
+		clear(b)
+		return nil, fail("read_failed")
+	}
+	return b, nil
+}
+func (c *Client) jobList(ctx context.Context, r *http.Request, p string, limit uint64) (Page, error) {
+	v := fields("SYNO.FileStation.List", "list", "2")
+	v.Set("folder_path", p)
+	v.Set("offset", "0")
+	v.Set("limit", strconv.FormatUint(limit, 10))
+	v.Set("additional", `["size"]`)
+	var page Page
+	e := c.call(ctx, r, v, &page)
+	if uint64(len(page.Files)) > limit || len(page.Shares) > 0 {
+		return Page{}, fail("limit-exceeded")
+	}
+	return page, e
+}
+
+// The supervisor is root, while the M2 selection store is package-owned. This
+// read-only entry never creates, rewrites or follows a metadata file. NONBLOCK
+// plus fstat rejects FIFO/device substitutions before reading. The same flock
+// stays held through each HTTP step, serializing M2 revoke with admission.
+func (r *GrantRepository) withJobGrant(ctx context.Context, id SessionIdentity, grant string, fn func(Selection) error) error {
+	if r == nil || r.dir == "" || !validID(grant) {
+		return fail("denied")
+	}
+	root, e := os.OpenRoot(r.dir)
+	if e != nil {
+		return fail("unavailable")
+	}
+	defer root.Close()
+	open := func(name string) (*os.File, error) {
+		f, e := root.OpenFile(name, os.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+		if e != nil {
+			return nil, fail("unavailable")
+		}
+		st, e := f.Stat()
+		if e != nil || !st.Mode().IsRegular() || st.Mode().Perm()&0077 != 0 || st.Size() > maxMetadata {
+			f.Close()
+			return nil, fail("unavailable")
+		}
+		return f, nil
+	}
+	lock, e := open("session-selections.lock")
+	if e != nil {
+		return e
+	}
+	defer lock.Close()
+	for {
+		e = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB)
+		if e == nil {
+			break
+		}
+		if !errors.Is(e, unix.EWOULDBLOCK) {
+			return fail("unavailable")
+		}
+		select {
+		case <-ctx.Done():
+			return fail("canceled")
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	defer unix.Flock(int(lock.Fd()), unix.LOCK_UN)
+	if ctx.Err() != nil {
+		return fail("canceled")
+	}
+	f, e := open("session-selections.json")
+	if e != nil {
+		return e
+	}
+	defer f.Close()
+	raw, e := io.ReadAll(io.LimitReader(f, maxMetadata+1))
+	var entries []Selection
+	if e != nil || len(raw) > maxMetadata || json.Unmarshal(raw, &entries) != nil || len(entries) > 256 {
+		return fail("unavailable")
+	}
+	seen := map[string]bool{}
+	for _, g := range entries {
+		if !validID(g.ID) || g.User == "" || g.UID == "" || !validPath(g.Folder) || seen[g.ID] {
+			return fail("unavailable")
+		}
+		seen[g.ID] = true
+	}
+	for _, g := range entries {
+		if g.ID == grant && g.User == id.User && g.UID == id.UID {
+			return fn(g)
+		}
+	}
+	return fail("denied")
+}