@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go/backend/internal/app/sdk_jobs_test.go

@@ -0,0 +1,116 @@
+//go:build synopkgland_sdk_workers
+
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/helper"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+type sdkAppAuth struct{ calls int }
+
+func (a *sdkAppAuth) Authenticate(r *http.Request) (api.Identity, error) {
+	a.calls++
+	if r.Header.Get("Cookie") == "" {
+		return api.Identity{}, api.ErrNoSession
+	}
+	return api.Identity{User: "fixture"}, nil
+}
+func TestSDKCGIRoutesCarryOnlyNativeSessionAndFixedMethods(t *testing.T) {
+	auth := &sdkAppAuth{}
+	var got helper.SessionCarriers
+	calls := 0
+	cfg := Config{SDKJobs: func(ctx context.Context, method string, c helper.SessionCarriers, p json.RawMessage) (json.RawMessage, helper.Code) {
+		calls++
+		got = c
+		return json.RawMessage(`{"revision":1,"items":[]}`), ""
+	}}
+	s, e := api.NewServer(auth, Routes(cfg)...)
+	if e != nil {
+		t.Fatal(e)
+	}
+	h := SDKHandler(s)
+	for _, body := range []string{`{"method":"jobs.status","params":{}}`, `{"method":"jobs.status","params":{"actor":"root"}}`, `{"method":"jobs.status","method":"jobs.cancel","params":{}}`} {
+		req := httptest.NewRequest("POST", "http://nas.test/cgi/api.cgi", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Cookie", "fixture-cookie")
+		req.Header.Set("X-SYNO-TOKEN", "fixture-csrf")
+		req.RemoteAddr = "192.0.2.1:1234"
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+	}
+	if calls != 1 || got.Cookie != "fixture-cookie" || got.SynoToken != "fixture-csrf" || got.ClientAddress != "192.0.2.1" {
+		t.Fatal(calls, got)
+	}
+	req := httptest.NewRequest("POST", "http://nas.test/cgi/api.cgi", strings.NewReader(`{"method":"jobs.status","params":{}}`))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+	if calls != 1 || !strings.Contains(w.Body.String(), "session_required") {
+		t.Fatal(w.Body.String())
+	}
+	// No side-channel namespace registration of arbitrary dispatch or background.
+	for _, r := range Routes(cfg) {
+		if strings.HasPrefix(r.Method(), "jobs.") && r.Public() {
+			t.Fatal("public job route")
+		}
+	}
+}
+
+func TestSDKIntegrationSeparatesLifecycleAndJobReadiness(t *testing.T) {
+	cfg := Config{SDKJobs: func(_ context.Context, method string, c helper.SessionCarriers, _ json.RawMessage) (json.RawMessage, helper.Code) {
+		if method != "jobs.diagnose" || c.Cookie != "fixture" {
+			t.Fatal(method, c)
+		}
+		return nil, helper.ErrUnavailable
+	}}
+	ctx := context.WithValue(context.Background(), sdkCarrierKey{}, helper.SessionCarriers{Cookie: "fixture"})
+	result, err := cfg.integrationStatus(ctx, api.Caller{}, json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(result)
+	if !strings.Contains(string(raw), `"interactive":"unavailable"`) || !strings.Contains(string(raw), `"background":"unavailable"`) || !strings.Contains(string(raw), `"attachTtlMs":6000`) {
+		t.Fatal(string(raw))
+	}
+}
+
+func init() {
+	ref := strings.Repeat("a", 64)
+	params := map[string]any{
+		"jobs.prepare":      map[string]any{"worker": map[string]any{"id": "scan", "revision": 1}, "parent": map[string]any{"id": ref, "revision": 1}, "input": map[string]any{"steps": []any{map[string]any{"action": "nas.files.stat", "segments": []string{"fixture"}}}}},
+		"jobs.submit":       map[string]any{"intentId": ref, "summaryDigest": ref},
+		"jobs.lookup":       map[string]any{"intentId": ref},
+		"jobs.result":       map[string]any{"jobId": ref},
+		"jobs.cancel":       map[string]any{"jobId": ref, "revision": 1},
+		"jobs.admin.cancel": map[string]any{"jobId": ref, "revision": 1},
+		"jobs.attach":       map[string]any{"jobId": ref, "attachId": ref},
+		"jobs.revoke":       map[string]any{"jobId": ref, "revision": 1, "delegationRevision": 1, "storeRevision": 1},
+		"jobs.status":       map[string]any{}, "jobs.admin.status": map[string]any{},
+	}
+	for method, param := range params {
+		raw, _ := json.Marshal(param)
+		sampleParams[method] = string(raw)
+	}
+}
+
+func TestSDKIntegrationReportsLiveSessionModeOnly(t *testing.T) {
+	cfg := Config{SDKJobs: func(context.Context, string, helper.SessionCarriers, json.RawMessage) (json.RawMessage, helper.Code) {
+		return json.RawMessage(`{"diagnosticSchema":1,"availability":"session-required","jobs":[],"total":0,"truncated":false}`), ""
+	}}
+	ctx := context.WithValue(context.Background(), sdkCarrierKey{}, helper.SessionCarriers{Cookie: "fixture"})
+	result, err := cfg.integrationStatus(ctx, api.Caller{}, json.RawMessage(`{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(result)
+	if !strings.Contains(string(raw), `"interactive":"session-required"`) || !strings.Contains(string(raw), `"background":"unavailable"`) || !strings.Contains(string(raw), `"validation":"local-only"`) {
+		t.Fatal("missing session mode readiness")
+	}
+}

package/templates/native-go/backend/internal/app/sdk_routes.go

@@ -0,0 +1,177 @@
+//go:build synopkgland_sdk_workers
+
+// Package app holds this package's business operations. Add a route here and
+// pick its policy: api.User (any signed-in DSM user), api.Admin (DSM
+// administrators only) or, rarely, api.Public (no sign-in at all).
+package app
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"time"
+	"unicode/utf8"
+
+	"dsmapp/internal/api"
+	"dsmapp/internal/filestation"
+	"dsmapp/internal/helper"
+)
+
+// Config is fixed at build time and startup, never taken from a request.
+type Config struct {
+	RootAuthorization string
+
+	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
+	SessionFiles    *filestation.Service
+	SDKJobs         func(context.Context, string, helper.SessionCarriers, json.RawMessage) (json.RawMessage, helper.Code)
+	PackageID       string
+	Version         string
+	HelperInventory helper.Inventory
+	// PackageIntegration marks an integration built without a privileged
+	// helper. SDK workers need the helper, so this build never sets it.
+	PackageIntegration bool
+	// Staged trusted adapter. Nil refuses; no production data transport is installed.
+	NASBinaryRead api.BinaryReadHandler
+	// DataDir is the package's persistent, package-owned directory
+	// (/var/packages/<package>/var). It survives upgrades.
+	DataDir string
+	// VolumeRoot is where /volumeN lives; empty means "/". Tests set it.
+	VolumeRoot string
+}
+
+func Routes(cfg Config) []api.Route {
+	routes := cfg.authorizationRoutes()
+	routes = append(routes, []api.Route{
+		api.User("integration.status", cfg.integrationStatus),
+		api.BoundedRead(cfg.binaryRead),
+		api.User("app.status", cfg.status),
+		api.User("greeting.get", cfg.getGreeting),
+		api.Admin("greeting.set", cfg.setGreeting),
+	}...)
+	routes = append(routes, cfg.sdkJobRoutes()...)
+	routes = append(routes, cfg.SessionFiles.Routes()...)
+	routes = append(routes, cfg.backgroundRoutes()...)
+	return append(routes, cfg.rootRoutes()...)
+}
+
+func (cfg Config) integrationStatus(ctx context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	state := cfg.integrationState(ctx)
+	jobs := map[string]any{"interactive": "unavailable", "background": "unavailable", "reason": "native-proof-unavailable", "attachRenewMs": helper.SDKAttachRenewMS, "attachTtlMs": helper.SDKAttachTTLMS}
+	if carriers, ok := ctx.Value(sdkCarrierKey{}).(helper.SessionCarriers); ok {
+		invoke := cfg.SDKJobs
+		if invoke == nil {
+			invoke = helper.NewClient(cfg.HelperInventory).SDKJobs
+		}
+		if data, code := invoke(ctx, "jobs.diagnose", carriers, json.RawMessage(`{}`)); code == "" {
+			jobs["diagnostic"] = data
+			var diagnostic struct {
+				Availability string `json:"availability"`
+			}
+			if json.Unmarshal(data, &diagnostic) == nil && diagnostic.Availability == "session-required" {
+				jobs["interactive"] = "session-required"
+				jobs["reason"] = "filestation-session"
+				jobs["validation"] = "local-only"
+			}
+		}
+	}
+	return struct {
+		helper.State
+		Jobs map[string]any `json:"jobs"`
+	}{state, jobs}, nil
+}
+
+func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage) (any, error) {
+	return cfg.withSharedFolders(map[string]any{
+		"package":    cfg.PackageID,
+		"version":    cfg.Version,
+		"user":       caller.User(),
+		"admin":      caller.Admin(),
+		"process":    map[string]int{"uid": os.Getuid(), "gid": os.Getgid()},
+		"go_version": runtime.Version(),
+		"platform":   runtime.GOOS + "/" + runtime.GOARCH,
+		"time":       time.Now().UTC().Format(time.RFC3339),
+	}), nil
+}
+
+type greeting struct {
+	Text      string `json:"text"`
+	UpdatedBy string `json:"updated_by,omitempty"`
+}
+
+func (cfg Config) greetingPath() string { return filepath.Join(cfg.DataDir, "greeting.json") }
+
+func (cfg Config) getGreeting(context.Context, api.Caller, json.RawMessage) (any, error) {
+	data, err := os.ReadFile(cfg.greetingPath())
+	if errors.Is(err, fs.ErrNotExist) {
+		return greeting{Text: "Hello"}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var g greeting
+	return g, json.Unmarshal(data, &g)
+}
+
+func (cfg Config) setGreeting(_ context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+	var in struct {
+		Text string `json:"text"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if n := utf8.RuneCountInString(in.Text); n < 1 || n > 200 {
+		return nil, api.BadRequest("text must be 1 to 200 characters")
+	}
+	g := greeting{Text: in.Text, UpdatedBy: caller.User()}
+	data, err := json.Marshal(g)
+	if err != nil {
+		return nil, err
+	}
+	return g, writeFileAtomic(cfg.greetingPath(), data)
+}
+
+// decodeParams decodes params strictly: unknown fields are an error.
+func decodeParams(params json.RawMessage, into any) error {
+	if len(params) == 0 {
+		params = json.RawMessage(`{}`)
+	}
+	dec := json.NewDecoder(bytes.NewReader(params))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(into); err != nil {
+		return api.BadRequest("invalid params: " + err.Error())
+	}
+	return nil
+}
+
+// writeFileAtomic replaces path in one rename, so readers never see half a file.
+func writeFileAtomic(path string, data []byte) error {
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".tmp-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), path)
+}
+
+func (cfg Config) binaryRead(ctx context.Context, c api.Caller, r *http.Request, p json.RawMessage) (api.BinaryRead, error) {
+	if cfg.NASBinaryRead == nil {
+		return api.BinaryRead{}, &api.Error{Code: "unsupported", Message: "NAS binary read is unavailable"}
+	}
+	return cfg.NASBinaryRead(ctx, c, r, p)
+}

package/templates/native-go/backend/internal/app/session_files.go

@@ -0,0 +1,15 @@
+package app
+
+import "dsmapp/internal/helper"
+
+// FileStationSession is the build-time value that selects the package-account
+// interactive File Station adapter without a helper.
+const FileStationSession = "session"
+
+// SessionFilesEnabled reports whether the build installs the interactive File
+// Station adapter: for a protocol 2 helper inventory, or when the project opted
+// in with fileStation: session. Both inputs are fixed at build time, never from
+// a request; any other fileStation value refuses.
+func SessionFilesEnabled(inventory helper.Inventory, fileStation string) bool {
+	return inventory.Protocol == 2 || fileStation == FileStationSession
+}

package/templates/native-go/backend/internal/app/session_files_test.go

@@ -0,0 +1,26 @@
+package app
+
+import (
+	"testing"
+
+	"dsmapp/internal/helper"
+)
+
+func TestSessionFilesEnabledByEitherTrustedBuildSetting(t *testing.T) {
+	for name, tc := range map[string]struct {
+		inventory   helper.Inventory
+		fileStation string
+		want        bool
+	}{
+		"nothing selected":             {helper.Inventory{}, "", false},
+		"helper protocol 1":            {helper.Inventory{Protocol: 1}, "", false},
+		"helper protocol 2":            {helper.Inventory{Protocol: 2}, "", true},
+		"package-only file station":    {helper.Inventory{}, "session", true},
+		"unknown build value refuses":  {helper.Inventory{}, "yes", false},
+		"protocol 1 plus file station": {helper.Inventory{Protocol: 1}, "session", true},
+	} {
+		if got := SessionFilesEnabled(tc.inventory, tc.fileStation); got != tc.want {
+			t.Errorf("%s: got %v, want %v", name, got, tc.want)
+		}
+	}
+}

package/templates/native-go/backend/internal/app/shared_folder.go

@@ -0,0 +1,144 @@
+package app
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"syscall"
+)
+
+// The install wizard stores the chosen Shared Folder's *name* in
+// <DataDir>/config.json (see dsm-package.yaml install.sharedFolder). The path
+// is resolved on every call, so a Shared Folder moved to another volume keeps
+// working. config.json is written by the package's postinst/postupgrade, not
+// by the app.
+
+var (
+	ErrSharedFolderNotFound  = errors.New("shared folder not found on any volume")
+	ErrSharedFolderAmbiguous = errors.New("shared folder name matches more than one volume")
+)
+
+// SharedFolder says where one configured Shared Folder is right now and what
+// the package account may do there.
+type SharedFolder struct {
+	Key      string `json:"key"`
+	Name     string `json:"name"`
+	Path     string `json:"path,omitempty"`
+	Exists   bool   `json:"exists"`
+	Readable bool   `json:"readable"`
+	Writable bool   `json:"writable"`
+	Error    string `json:"error,omitempty"`
+}
+
+func validShareName(name string) bool {
+	return name != "" && !strings.ContainsAny(name, "/\\\x00") && !strings.Contains(name, "..") &&
+		!strings.HasPrefix(name, "@") && !strings.HasPrefix(name, ".")
+}
+
+// ReadSharedFolders returns the Shared Folder names the installer stored, by
+// key. A package without config.json has none.
+func ReadSharedFolders(dataDir string) (map[string]string, error) {
+	data, err := os.ReadFile(filepath.Join(dataDir, "config.json"))
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var cfg struct {
+		Schema        int               `json:"schema"`
+		SharedFolders map[string]string `json:"shared_folders"`
+	}
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		return nil, fmt.Errorf("config.json: %w", err)
+	}
+	if cfg.Schema != 1 {
+		return nil, fmt.Errorf("config.json: unsupported schema %d", cfg.Schema)
+	}
+	for key, name := range cfg.SharedFolders {
+		if !validShareName(name) {
+			return nil, fmt.Errorf("config.json: invalid shared folder name for %q", key)
+		}
+	}
+	return cfg.SharedFolders, nil
+}
+
+// ResolveSharedFolder finds /volumeN/<name> under root ("/" on a NAS).
+func ResolveSharedFolder(root, name string) (string, error) {
+	if !validShareName(name) {
+		return "", fmt.Errorf("invalid shared folder name %q", name)
+	}
+	volumes, err := filepath.Glob(filepath.Join(root, "volume[0-9]*"))
+	if err != nil {
+		return "", err
+	}
+	var found []string
+	for _, volume := range volumes {
+		path := filepath.Join(volume, name)
+		if info, err := os.Stat(path); err == nil && info.IsDir() {
+			found = append(found, path)
+		}
+	}
+	switch len(found) {
+	case 0:
+		return "", ErrSharedFolderNotFound
+	case 1:
+		return found[0], nil
+	}
+	return "", ErrSharedFolderAmbiguous
+}
+
+const (
+	accessRead  = 0x4 // R_OK
+	accessWrite = 0x2 // W_OK
+	accessExec  = 0x1 // X_OK
+)
+
+// SharedFolders reports every configured Shared Folder, sorted by key. The
+// error is a corrupt config.json.
+func (cfg Config) SharedFolders() ([]SharedFolder, error) {
+	names, err := ReadSharedFolders(cfg.DataDir)
+	if err != nil {
+		return nil, err
+	}
+	root := cfg.VolumeRoot
+	if root == "" {
+		root = "/"
+	}
+	keys := make([]string, 0, len(names))
+	for key := range names {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	folders := make([]SharedFolder, 0, len(keys))
+	for _, key := range keys {
+		folder := SharedFolder{Key: key, Name: names[key]}
+		path, err := ResolveSharedFolder(root, folder.Name)
+		if err != nil {
+			folder.Error = err.Error()
+		} else {
+			folder.Path, folder.Exists = path, true
+			folder.Readable = syscall.Access(path, accessRead|accessExec) == nil
+			folder.Writable = syscall.Access(path, accessWrite|accessExec) == nil
+		}
+		folders = append(folders, folder)
+	}
+	return folders, nil
+}
+
+// withSharedFolders adds the configured Shared Folders to an app.status
+// answer; a package that configures none is answered exactly as before.
+func (cfg Config) withSharedFolders(status map[string]any) map[string]any {
+	folders, err := cfg.SharedFolders()
+	if err != nil {
+		status["shared_folders_error"] = err.Error()
+	} else if len(folders) > 0 {
+		status["shared_folders"] = folders
+	}
+	return status
+}

package/templates/native-go/backend/internal/app/shared_folder_test.go

@@ -0,0 +1,158 @@
+package app
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConfig(t *testing.T, dir, body string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, "config.json"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReadSharedFoldersWithoutConfigIsEmpty(t *testing.T) {
+	got, err := ReadSharedFolders(t.TempDir())
+	if err != nil || len(got) != 0 {
+		t.Fatalf("got %v %v", got, err)
+	}
+}
+
+func TestReadSharedFoldersReturnsNamesByKey(t *testing.T) {
+	dir := t.TempDir()
+	writeConfig(t, dir, `{"schema":1,"shared_folders":{"media":"Family Photos"}}`)
+	got, err := ReadSharedFolders(dir)
+	if err != nil || got["media"] != "Family Photos" || len(got) != 1 {
+		t.Fatalf("got %v %v", got, err)
+	}
+}
+
+func TestReadSharedFoldersRefusesUnknownSchemaAndBadNames(t *testing.T) {
+	for _, body := range []string{
+		`{"schema":2,"shared_folders":{"media":"x"}}`,
+		`{"schema":1,"shared_folders":{"media":"a/b"}}`,
+		`{"schema":1,"shared_folders":{"media":".."}}`,
+		`{"schema":1,"shared_folders":{"media":"@appdata"}}`,
+		`{"schema":1,"shared_folders":{"media":""}}`,
+		`not json`,
+	} {
+		dir := t.TempDir()
+		writeConfig(t, dir, body)
+		if _, err := ReadSharedFolders(dir); err == nil {
+			t.Errorf("%s: want an error", body)
+		}
+	}
+}
+
+func TestResolveSharedFolderFindsTheNameOnItsVolume(t *testing.T) {
+	root := t.TempDir()
+	for _, d := range []string{"volume1/other", "volume2/Photos", "volume2/@appdata"} {
+		if err := os.MkdirAll(filepath.Join(root, d), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := ResolveSharedFolder(root, "Photos")
+	if err != nil || got != filepath.Join(root, "volume2", "Photos") {
+		t.Fatalf("got %q %v", got, err)
+	}
+}
+
+func TestResolveSharedFolderFollowsAMovedShare(t *testing.T) {
+	root := t.TempDir()
+	os.MkdirAll(filepath.Join(root, "volume1", "Photos"), 0o755)
+	first, _ := ResolveSharedFolder(root, "Photos")
+	os.Rename(filepath.Join(root, "volume1", "Photos"), filepath.Join(root, "Photos.tmp"))
+	os.MkdirAll(filepath.Join(root, "volume2"), 0o755)
+	os.Rename(filepath.Join(root, "Photos.tmp"), filepath.Join(root, "volume2", "Photos"))
+	second, err := ResolveSharedFolder(root, "Photos")
+	if err != nil || first == second || second != filepath.Join(root, "volume2", "Photos") {
+		t.Fatalf("%q -> %q %v", first, second, err)
+	}
+}
+
+func TestResolveSharedFolderErrors(t *testing.T) {
+	root := t.TempDir()
+	if _, err := ResolveSharedFolder(root, "Missing"); !errors.Is(err, ErrSharedFolderNotFound) {
+		t.Fatalf("missing: %v", err)
+	}
+	os.MkdirAll(filepath.Join(root, "volume1", "Dup"), 0o755)
+	os.MkdirAll(filepath.Join(root, "volume2", "Dup"), 0o755)
+	if _, err := ResolveSharedFolder(root, "Dup"); !errors.Is(err, ErrSharedFolderAmbiguous) {
+		t.Fatalf("ambiguous: %v", err)
+	}
+	for _, bad := range []string{"", "..", "a/b", "@appdata", ".x"} {
+		if _, err := ResolveSharedFolder(root, bad); err == nil {
+			t.Errorf("%q: want an error", bad)
+		}
+	}
+}
+
+func TestResolveSharedFolderIgnoresAFileOfThatName(t *testing.T) {
+	root := t.TempDir()
+	os.MkdirAll(filepath.Join(root, "volume1"), 0o755)
+	os.WriteFile(filepath.Join(root, "volume1", "Notes"), nil, 0o644)
+	if _, err := ResolveSharedFolder(root, "Notes"); !errors.Is(err, ErrSharedFolderNotFound) {
+		t.Fatalf("got %v", err)
+	}
+}
+
+func TestStatusOmitsSharedFoldersWhenNoneConfigured(t *testing.T) {
+	_, out := call(t, testConfig(t), bob, "app.status", `{}`)
+	if _, present := out["data"].(map[string]any)["shared_folders"]; present {
+		t.Fatalf("unexpected shared_folders: %v", out)
+	}
+}
+
+func TestStatusReportsEachConfiguredSharedFolder(t *testing.T) {
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	os.MkdirAll(filepath.Join(cfg.VolumeRoot, "volume1", "Photos"), 0o755)
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Photos","gone":"Missing"}}`)
+	_, out := call(t, cfg, bob, "app.status", `{}`)
+	rows := out["data"].(map[string]any)["shared_folders"].([]any)
+	if len(rows) != 2 {
+		t.Fatalf("rows: %v", rows)
+	}
+	byKey := map[string]map[string]any{}
+	for _, r := range rows {
+		m := r.(map[string]any)
+		byKey[m["key"].(string)] = m
+	}
+	media, gone := byKey["media"], byKey["gone"]
+	if media["name"] != "Photos" || media["exists"] != true || media["readable"] != true || media["writable"] != true || media["path"] != filepath.Join(cfg.VolumeRoot, "volume1", "Photos") {
+		t.Fatalf("media: %v", media)
+	}
+	if gone["exists"] != false || gone["readable"] != false || gone["writable"] != false || gone["error"] == nil || gone["path"] != nil {
+		t.Fatalf("gone: %v", gone)
+	}
+}
+
+func TestStatusReportsAFolderThePackageAccountCannotWrite(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores directory modes")
+	}
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	dir := filepath.Join(cfg.VolumeRoot, "volume1", "Locked")
+	os.MkdirAll(dir, 0o755)
+	os.Chmod(dir, 0o555)
+	t.Cleanup(func() { os.Chmod(dir, 0o755) })
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Locked"}}`)
+	_, out := call(t, cfg, bob, "app.status", `{}`)
+	row := out["data"].(map[string]any)["shared_folders"].([]any)[0].(map[string]any)
+	if row["exists"] != true || row["readable"] != true || row["writable"] != false {
+		t.Fatalf("row: %v", row)
+	}
+}
+
+func TestStatusReportsACorruptConfigWithoutFailing(t *testing.T) {
+	cfg := testConfig(t)
+	writeConfig(t, cfg.DataDir, `not json`)
+	code, out := call(t, cfg, bob, "app.status", `{}`)
+	if code != "" || out["data"].(map[string]any)["shared_folders_error"] == nil {
+		t.Fatalf("%q %v", code, out)
+	}
+}