@synopackageland/cli 0.4.1 → 0.5.3

package/dist/templates/native-go/backend/internal/helper/supervisor_linux.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/supervisor_linux.go:1
 package helper
 
 import (
@@ -88,7 +91,8 @@ func superviseLinux(c Client, binary string) error {
 	defer cancelWatcher()
 	go o.watch(watcher)
 	epoch := r.Lifecycle.Epoch
-	defer persistObserverDiagnostic(c, epoch, o.gate)
+	stopDiagnostics := startObserverDiagnostics(c, epoch, o.gate)
+	defer stopDiagnostics()
 	identity, err := inspectSupervisor(os.Getpid(), c.Expected)
 	if err != nil {
 		return err
@@ -147,7 +151,7 @@ func superviseLinux(c Client, binary string) error {
 		var code Code
 		grants, grantRepo, code = openSupervisorGrants(c, binary, cohort)
 		if code != "" {
-			o.gate.fence("grant-authority-unavailable")
+			o.gate.fenceStartup("grants-open", code)
 		}
 	}
 	fenceRetryExhausted := false

package/dist/templates/native-go/backend/internal/helper/unit_connection_test.go

@@ -7,6 +7,8 @@ import (
 	"io"
 	"net"
 	"testing"
+
+	"github.com/godbus/dbus/v5"
 )
 
 type observerClosedReader struct{ *bytes.Reader }
@@ -33,18 +35,34 @@ func (s *observerTestStream) Write(p []byte) (int, error) {
 }
 func (s *observerTestStream) Close() error { return nil }
 
-func TestObserverDBusFrameCloseReturnsError(t *testing.T) {
+// Cover the dependency directly as well as the production recovery boundary.
+// Canonical frames avoid EncodeTo's map-order-dependent header alignment.
+func TestDBusClosedHeaderPaddingReturnsErrorWithoutPanic(t *testing.T) {
 	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
 		t.Run(order.String(), func(t *testing.T) {
 			packet, header := observerPaddedFrame(t, order)
+			defer func() {
+				if failure := recover(); failure != nil {
+					t.Fatalf("closed socket during header alignment panicked: %v", failure)
+				}
+			}()
+			msg, err := dbus.DecodeMessage(observerClosedReader{bytes.NewReader(packet[:header])})
+			if msg != nil || !errors.Is(err, net.ErrClosed) {
+				t.Fatalf("partial frame accepted or close error lost: %+v %v", msg, err)
+			}
+		})
+	}
+}
+
+func TestObserverDBusFrameCloseReturnsError(t *testing.T) {
+	for _, order := range []binary.ByteOrder{binary.LittleEndian, binary.BigEndian} {
+		t.Run(order.String(), func(t *testing.T) {
+			packet, _ := observerPaddedFrame(t, order)
 			for end := 0; end < len(packet); end++ {
 				frame, err := readObserverDBusFrame(observerClosedReader{bytes.NewReader(packet[:end])})
 				if frame != nil || !errors.Is(err, net.ErrClosed) {
 					t.Fatalf("close at byte %d: partial frame %x error %v", end, frame, err)
 				}
-				if end == header && !errors.Is(err, errObserverDBusDecode) {
-					t.Fatal("fixture did not exercise upstream padding panic recovery")
-				}
 			}
 		})
 	}

package/dist/templates/native-go/backend/internal/helper/unit_linux.go

@@ -17,6 +17,9 @@ import (
 	"github.com/godbus/dbus/v5"
 )
 
+const unitQueryTimeout = 500 * time.Millisecond
+const unitProbeInterval = 250 * time.Millisecond
+
 const systemdName = "org.freedesktop.systemd1"
 const managerInterface = systemdName + ".Manager"
 const unitInterface = systemdName + ".Unit"
@@ -222,7 +225,7 @@ func jobID(v dbus.Variant) (uint32, bool) {
 }
 
 func openUnitObserver(parent context.Context, i Inventory) (*unitObserver, error) {
-	ctx, cancel := context.WithTimeout(parent, 500*time.Millisecond)
+	ctx, cancel := context.WithTimeout(parent, unitQueryTimeout)
 	defer cancel()
 	binding, err := installedBinding(i)
 	if err != nil {
@@ -309,7 +312,7 @@ func openUnitObserver(parent context.Context, i Inventory) (*unitObserver, error
 }
 
 func (o *unitObserver) watch(ctx context.Context) {
-	ticker := time.NewTicker(250 * time.Millisecond)
+	ticker := time.NewTimer(unitProbeInterval)
 	defer ticker.Stop()
 	for {
 		select {
@@ -320,12 +323,13 @@ func (o *unitObserver) watch(ctx context.Context) {
 			o.gate.fenceObserver("observation-unavailable", observerEvent{Detail: "bus-context-done", ErrorClass: observerErrorClass(o.conn.Context().Err())})
 			return
 		case <-ticker.C:
-			probe, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
+			probe, cancel := context.WithTimeout(ctx, unitQueryTimeout)
 			err := o.reconcile(probe)
 			cancel()
 			if err != nil {
 				return
 			}
+			ticker.Reset(unitProbeInterval)
 		}
 	}
 }

package/dist/templates/native-go/backend/internal/helper/unit_query_linux.go

@@ -54,7 +54,8 @@ func (o *unitObserver) reconcile(ctx context.Context) error {
 	return o.reconcileSnapshot(ctx, o.snapshot)
 }
 func (o *unitObserver) reconcileSnapshot(ctx context.Context, query func(context.Context) (Binding, map[string]dbus.Variant, error)) error {
-	serial, ready := o.gate.unitProbe(time.Now())
+	started := time.Now()
+	serial, ready := o.gate.unitProbe(started)
 	// Initial observation has no freshness baseline yet.
 	if !ready {
 		return nil
@@ -73,6 +74,9 @@ func (o *unitObserver) reconcileSnapshot(ctx context.Context, query func(context
 			}
 		}
 		o.gate.recordObserver(e)
+		if !definitive && errors.Is(err, context.DeadlineExceeded) && (e.Phase == "get-owner" || e.Phase == "get-unit" || e.Phase == "get-all") && o.gate.deferUnitDeadline(serial, started, time.Now(), e) {
+			return nil
+		}
 		if o.gate.failUnitProbe(serial, reason, definitive, time.Now(), e) {
 			return err
 		}

package/dist/templates/native-go/backend/internal/helper/write_files_linux.go

@@ -173,10 +173,7 @@ func (x *actorFileWriter) Commit(ctx context.Context) (MutationReceipt, Code) {
 		// the destination is ever performed, including failure/foreign replacement.
 		e := unix.Linkat(unix.AT_FDCWD, "/proc/self/fd/"+strconv.Itoa(int(x.file.Fd())), int(x.parent.data.Fd()), x.work.Segments[len(x.work.Segments)-1], unix.AT_SYMLINK_FOLLOW)
 		if e != nil {
-			if errors.Is(e, unix.EEXIST) {
-				return x.receipt, ErrDenied
-			}
-			return x.receipt, ErrUnsupported
+			return x.receipt, publishLinkError(e)
 		}
 	}
 	x.receipt.Published = true
@@ -192,6 +189,12 @@ func (x *actorFileWriter) Commit(ctx context.Context) (MutationReceipt, Code) {
 	x.receipt.Committed = true
 	return x.receipt, ""
 }
+func publishLinkError(err error) Code {
+	if errors.Is(err, unix.EEXIST) || errors.Is(err, unix.EACCES) {
+		return ErrDenied
+	}
+	return ErrUnsupported
+}
 func (x *actorFileWriter) Close() {
 	if x.closed {
 		return

package/dist/templates/native-go/backend/internal/helper/write_files_linux_test.go

@@ -8,6 +8,32 @@ import (
 	"testing"
 )
 
+func TestPublishLinkError(t *testing.T) {
+	for _, tc := range []struct {
+		err  error
+		want Code
+	}{
+		{unix.EACCES, ErrDenied},
+		{unix.EEXIST, ErrDenied},
+		{unix.EPERM, ErrUnsupported},
+		{unix.ENOSYS, ErrUnsupported},
+		{unix.EOPNOTSUPP, ErrUnsupported},
+		{unix.EINVAL, ErrUnsupported},
+		{unix.ENOENT, ErrUnsupported},
+		{unix.EXDEV, ErrUnsupported},
+		{unix.EROFS, ErrUnsupported},
+		{unix.EIO, ErrUnsupported},
+	} {
+		t.Run(tc.err.Error(), func(t *testing.T) {
+			for _, err := range []error{tc.err, &os.LinkError{Op: "linkat", Old: "fixed-fd", New: "destination", Err: tc.err}} {
+				if got := publishLinkError(err); got != tc.want {
+					t.Errorf("publishLinkError(%v) = %s, want %s", err, got, tc.want)
+				}
+			}
+		})
+	}
+}
+
 func TestWriteExclusivePartialAndNoForeignUnlink(t *testing.T) {
 	pin, root := readOnlyFixture(t)
 	w := writeWork{RootPath: root, Action: ActionCreate, Segments: []string{"new"}, MaxBytes: 10}

package/dist/templates/native-go/dsm-package.yaml

@@ -11,7 +11,7 @@ build: 1
 displayname: __DISPLAY_NAME__
 description: A native DSM package with a Go backend and a DSM window UI.
 maintainer: Your Name
-os_min_ver: "7.2-64570"
+os_min_ver: "7.1-42661"
 
 # One SPK per architecture. Supported: x86_64, aarch64.
 arches: [x86_64, aarch64]
@@ -35,7 +35,7 @@ ui:
 # UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
 # fr, es and it (DSM's other languages fall back to English). build-spk checks
 # that every language has the en.json keys and placeholders, and that the keys
-# listed in the glossary use Synology's own DSM wording.
+# listed in the glossary use DSM's own wording.
 i18n:
   messages: i18n/messages
   glossary: i18n/glossary.json

package/dist/templates/native-go-authorization/backend/internal/app/authorization.go

@@ -0,0 +1,298 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/api"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Compiled into the CGI. Package-owned JSON is never the source of trust.
+type authorizationTask struct {
+	Op     string `json:"op"`
+	Name   string `json:"name"`
+	Header string `json:"header"`
+	Script string `json:"script"`
+	Output bool   `json:"output"`
+}
+type authorizationBuild struct {
+	Schema    int    `json:"schema"`
+	Package   string `json:"package"`
+	Version   string `json:"version"`
+	Pin       string `json:"bootstrapSha256"`
+	Inventory struct {
+		Files []struct {
+			Path string `json:"path"`
+			Size int64  `json:"size"`
+			Hash string `json:"sha256"`
+		} `json:"files"`
+	} `json:"inventory"`
+	Tasks []authorizationTask `json:"tasks"`
+}
+
+func (cfg Config) authorizationRoutes() []api.Route {
+	if cfg.RootAuthorization == "" {
+		return nil
+	}
+	return []api.Route{api.UserRequest("authorization.status", cfg.authorizationStatus), api.Admin("authorization.request", cfg.authorizationRequest), api.Admin("authorization.revoke", cfg.authorizationRevoke)}
+}
+func authorizationDocument(state string, reason any) any {
+	return map[string]any{"command": "authorization", "schema_version": 1, "state": state, "reason": reason}
+}
+func (cfg Config) authorizationPlan() (authorizationBuild, error) {
+	var p authorizationBuild
+	raw, decode := base64.StdEncoding.DecodeString(cfg.RootAuthorization)
+	if decode != nil || json.Unmarshal(raw, &p) != nil || p.Schema != 2 || p.Package != cfg.PackageID || p.Version != cfg.Version || len(p.Tasks) == 0 || len(p.Pin) != 64 {
+		return p, errors.New("invalid build authorization")
+	}
+	if b, e := hex.DecodeString(p.Pin); e != nil || len(b) != 32 {
+		return p, errors.New("invalid bootstrap pin")
+	}
+	return p, nil
+}
+func (cfg Config) authorizationRequest(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return nil, e
+	}
+	if cfg.authorizationTrusted(p) != nil {
+		return nil, &api.Error{Code: "authorization_required", Message: "Build payload cannot be trusted; reinstall this package"}
+	}
+	ops := []string{}
+	for _, t := range p.Tasks {
+		if t.Op == "helper_enable" {
+			ops = []string{t.Op}
+			break
+		}
+		ops = append(ops, t.Op)
+	}
+	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "run": cfg.HelperInventory.Package != ""}, nil
+}
+func (cfg Config) authorizationRevoke(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return nil, e
+	}
+	// Root task still pins bootstrap. Corrupt UI must not prevent safe cleanup.
+	ops := []string{}
+	purge := false
+	for _, t := range p.Tasks {
+		ops = append(ops, t.Op)
+		if cfg.HelperInventory.Package != "" && t.Op == "helper_purge" {
+			purge = true
+		}
+	}
+	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "disable": cfg.HelperInventory.Package != "", "purge": purge}, nil
+}
+func (cfg Config) authorizationTrusted(p authorizationBuild) error {
+	root, e := os.OpenRoot("/var/packages/" + cfg.PackageID + "/target")
+	if e != nil {
+		return e
+	}
+	defer root.Close()
+	verify := func(path string, size int64, want string) error {
+		f, e := root.Open(path)
+		if e != nil {
+			return e
+		}
+		defer f.Close()
+		st, e := f.Stat()
+		if e != nil || !st.Mode().IsRegular() || st.Size() > 64<<20 || size >= 0 && st.Size() != size {
+			return errors.New("untrusted payload")
+		}
+		h := sha256.New()
+		_, e = io.Copy(h, io.LimitReader(f, (64<<20)+1))
+		if e != nil || hex.EncodeToString(h.Sum(nil)) != want {
+			return errors.New("untrusted payload")
+		}
+		return nil
+	}
+	if e = verify("authorization/bootstrap", -1, p.Pin); e != nil {
+		return e
+	}
+	for _, f := range p.Inventory.Files {
+		if e = verify(f.Path, f.Size, f.Hash); e != nil {
+			return e
+		}
+	}
+	return nil
+}
+func (cfg Config) authorizationStatus(ctx context.Context, caller api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return authorizationDocument("unavailable", "service_unavailable"), nil
+	}
+	if cfg.authorizationTrusted(p) != nil {
+		return authorizationDocument("authorization_required", "helper_untrusted"), nil
+	}
+	if cfg.HelperInventory.Package != "" {
+		s := cfg.integrationState(ctx)
+		if s.State == "ready" {
+			return authorizationDocument("ready", nil), nil
+		}
+		if !caller.Admin() {
+			return authorizationDocument("not_admin", "not_admin"), nil
+		}
+		switch s.State {
+		case "incompatible":
+			return authorizationDocument("authorization_required", "grant_incompatible"), nil
+		case "pending":
+			return authorizationDocument("unavailable", "health_probe_timeout"), nil
+		case "failed":
+			return authorizationDocument("unavailable", "service_unavailable"), nil
+		}
+	}
+	if !caller.Admin() {
+		return authorizationDocument("not_admin", "not_admin"), nil
+	}
+	state, reason := authorizationScheduler(ctx, r, p.Tasks)
+	if cfg.HelperInventory.Package != "" && state == "ready" {
+		state = "authorization_required"
+		reason = "grant_missing"
+	}
+	return authorizationDocument(state, reason), nil
+}
+
+// Read-only scheduler observations; never accept caller-selected URLs or task IDs.
+// One modern probe; legacy fallback only for explicit missing method (103).
+func authorizationScheduler(ctx context.Context, r *http.Request, tasks []authorizationTask) (string, any) {
+	return authorizationSchedulerAt(ctx, r, tasks, "http://127.0.0.1:5000")
+}
+func authorizationSchedulerAt(ctx context.Context, r *http.Request, tasks []authorizationTask, endpoint string) (string, any) {
+	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, DisableCompression: true, ResponseHeaderTimeout: 5 * time.Second, MaxResponseHeaderBytes: 32 << 10}
+	defer tr.CloseIdleConnections()
+	client := &http.Client{Transport: tr, Timeout: 8 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	call := func(method string, version int, params url.Values) (json.RawMessage, int, error) {
+		params.Set("api", "SYNO.Core.TaskScheduler")
+		params.Set("method", method)
+		params.Set("version", strconv.Itoa(version))
+		req, e := http.NewRequestWithContext(ctx, "GET", endpoint+"/webapi/entry.cgi?"+params.Encode(), nil)
+		if e != nil {
+			return nil, 0, e
+		}
+		cookies := r.CookiesNamed("id")
+		if len(cookies) != 1 {
+			return nil, 0, errors.New("session")
+		}
+		req.AddCookie(cookies[0])
+		req.Header.Set("X-SYNO-TOKEN", r.Header.Get("X-SYNO-TOKEN"))
+		response, e := client.Do(req)
+		if e != nil {
+			return nil, 0, e
+		}
+		defer response.Body.Close()
+		b, e := io.ReadAll(io.LimitReader(response.Body, (1<<20)+1))
+		if e != nil || len(b) > 1<<20 || response.StatusCode != 200 {
+			return nil, 0, errors.New("scheduler unavailable")
+		}
+		var wire struct {
+			Success bool            `json:"success"`
+			Data    json.RawMessage `json:"data"`
+			Error   struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		if json.Unmarshal(b, &wire) != nil {
+			return nil, 0, errors.New("scheduler schema")
+		}
+		if !wire.Success {
+			return nil, wire.Error.Code, errors.New("scheduler refused")
+		}
+		return wire.Data, 0, nil
+	}
+	data, code, e := call("list", 3, url.Values{"start": {"0"}, "limit": {"500"}})
+	legacy := code == 103
+	if legacy {
+		data, code, e = call("list", 2, url.Values{"offset": {"0"}, "limit": {"500"}})
+	}
+	if e != nil {
+		if code == 106 || code == 107 || code == 119 {
+			return "session_expired", "session_expired"
+		}
+		return "unavailable", "scheduler_unavailable"
+	}
+	type item struct {
+		ID        json.Number `json:"id"`
+		Name      string      `json:"name"`
+		Owner     string      `json:"owner"`
+		RealOwner string      `json:"real_owner"`
+		Enable    *bool       `json:"enable"`
+		Type      string      `json:"type"`
+		Extra     struct {
+			Script string `json:"script"`
+		} `json:"extra"`
+	}
+	var list struct {
+		Tasks []item `json:"tasks"`
+		Total *int   `json:"total"`
+	}
+	if json.Unmarshal(data, &list) != nil || list.Total == nil || *list.Total != len(list.Tasks) || len(list.Tasks) > 500 {
+		return "unavailable", "scheduler_unavailable"
+	}
+	for _, expected := range tasks {
+		// Helper control tasks are individually approved on demand. Enable is the
+		// activation anchor; live helper health remains required separately.
+		if strings.HasPrefix(expected.Op, "helper_") && expected.Op != "helper_enable" {
+			continue
+		}
+		var found *item
+		for n := range list.Tasks {
+			if list.Tasks[n].Name == expected.Name {
+				if found != nil {
+					return "authorization_required", "maintenance_task_mismatch"
+				}
+				found = &list.Tasks[n]
+			}
+		}
+		if found == nil {
+			return "authorization_required", "grant_missing"
+		}
+		valid := func(t item) bool {
+			return t.Owner == "root" && t.RealOwner == "root" && t.Enable != nil && !*t.Enable && t.Type == "script"
+		}
+		if !valid(*found) {
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+		version := 4
+		if legacy {
+			version = 3
+		}
+		detail, _, e := call("get", version, url.Values{"id": {string(found.ID)}, "real_owner": {"root"}})
+		if e != nil {
+			return "unavailable", "scheduler_unavailable"
+		}
+		var full item
+		if json.Unmarshal(detail, &full) != nil || full.ID != found.ID || full.Name != expected.Name || !valid(full) {
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+		if full.Extra.Script != expected.Script {
+			if strings.HasPrefix(full.Extra.Script, expected.Header) {
+				return "authorization_required", "grant_incompatible"
+			}
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+	}
+	return "ready", nil
+}

package/dist/templates/native-go-authorization/backend/internal/app/authorization_test.go

@@ -0,0 +1,96 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+)
+
+func TestAuthorizationFailClosed(t *testing.T) {
+	cfg := Config{PackageID: "RootDemo", Version: "0.1.0-0001", RootAuthorization: `{"schema":2}`}
+	if _, e := cfg.authorizationPlan(); e == nil {
+		t.Fatal("accepted missing pin")
+	}
+	if _, e := cfg.authorizationRequest(context.Background(), api.Caller{}, json.RawMessage(`{"op":"arbitrary"}`)); e == nil {
+		t.Fatal("accepted arbitrary params")
+	}
+	if len((Config{}).authorizationRoutes()) != 0 {
+		t.Fatal("default registered root routes")
+	}
+}
+func TestAuthorizationDocuments(t *testing.T) {
+	for _, state := range []string{"ready", "authorization_required", "not_admin", "unavailable"} {
+		b, e := json.Marshal(authorizationDocument(state, nil))
+		if e != nil {
+			t.Fatal(e)
+		}
+		var d map[string]any
+		json.Unmarshal(b, &d)
+		if d["command"] != "authorization" || d["schema_version"] != float64(1) || d["state"] != state {
+			t.Fatal(string(b))
+		}
+	}
+}
+
+func TestSchedulerRejectsChangedTaskAndFallsBackOnlyOn103(t *testing.T) {
+	for _, legacy := range []bool{false, true} {
+		altered := false
+		var versions []string
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			q := r.URL.Query()
+			versions = append(versions, q.Get("method")+":"+q.Get("version"))
+			if q.Get("method") == "list" && q.Get("version") == "3" && legacy {
+				io.WriteString(w, `{"success":false,"error":{"code":103}}`)
+				return
+			}
+			script := "approved"
+			if altered {
+				script = "unapproved"
+			}
+			item := map[string]any{"id": 1, "name": "RootDemo root: whoami", "owner": "root", "real_owner": "root", "enable": false, "type": "script", "extra": map[string]string{"script": script}}
+			var data any = item
+			if q.Get("method") == "list" {
+				data = map[string]any{"tasks": []any{item}, "total": 1}
+			}
+			json.NewEncoder(w).Encode(map[string]any{"success": true, "data": data})
+		}))
+		request := httptest.NewRequest("POST", "/", nil)
+		request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
+		tasks := []authorizationTask{{Op: "whoami", Name: "RootDemo root: whoami", Script: "approved", Header: "header"}}
+		state, _ := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
+		if state != "ready" {
+			t.Fatal(state)
+		}
+		if legacy && !slices.Contains(versions, "get:3") {
+			t.Fatal(versions)
+		}
+		if !legacy && slices.Contains(versions, "get:3") {
+			t.Fatal(versions)
+		}
+		altered = true
+		state, reason := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
+		if state != "authorization_required" || reason != "maintenance_task_mismatch" {
+			t.Fatal(state, reason)
+		}
+		server.Close()
+	}
+}
+func TestSchedulerPermissionFailureIsNotLegacyFallback(t *testing.T) {
+	calls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		io.WriteString(w, `{"success":false,"error":{"code":105}}`)
+	}))
+	defer server.Close()
+	request := httptest.NewRequest("POST", "/", nil)
+	request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
+	state, _ := authorizationSchedulerAt(context.Background(), request, nil, server.URL)
+	if state != "unavailable" || calls != 1 {
+		t.Fatal(state, calls)
+	}
+}