@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go/backend/internal/filestation/session_semantics_test.go

@@ -0,0 +1,383 @@
+package filestation
+
+import (
+	"bytes"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// fakeDSM answers the loopback WebAPI for several DSM sessions. A session id
+// maps to a user; an expired id answers 119 like DSM. Calls are recorded so a
+// test can prove a refused request never reached File Station.
+type fakeDSM struct {
+	mu       sync.Mutex
+	users    map[string]string // session id -> user
+	denied   map[string]bool   // "user method path" -> DSM 407
+	uploads  map[string]string // "user path/name" -> content
+	calls    []string
+	failPush func(user string) string // non-empty raw reply for upload
+}
+
+func newFakeDSM(t *testing.T) (*fakeDSM, *Client) {
+	t.Helper()
+	d := &fakeDSM{users: map[string]string{}, denied: map[string]bool{}, uploads: map[string]string{}}
+	c := fakeClient(t, d.serve)
+	return d, c
+}
+
+func (d *fakeDSM) serve(w http.ResponseWriter, r *http.Request) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	cookie, _ := r.Cookie("id")
+	user := ""
+	if cookie != nil {
+		user = d.users[cookie.Value]
+	}
+	if user == "" {
+		fmt.Fprint(w, `{"success":false,"error":{"code":119}}`)
+		return
+	}
+	if strings.HasPrefix(r.Header.Get("Content-Type"), "multipart/") {
+		m, e := r.MultipartReader()
+		if e != nil {
+			http.Error(w, "bad", 400)
+			return
+		}
+		fields, content := map[string]string{}, ""
+		for {
+			p, e := m.NextPart()
+			if e != nil {
+				break
+			}
+			b := new(bytes.Buffer)
+			b.ReadFrom(p)
+			if p.FormName() == "file" {
+				content = b.String()
+				fields["name"] = p.FileName()
+			} else {
+				fields[p.FormName()] = b.String()
+			}
+		}
+		d.calls = append(d.calls, user+" upload "+fields["path"]+"/"+fields["name"])
+		if d.denied[user+" upload "+fields["path"]] {
+			fmt.Fprint(w, `{"success":false,"error":{"code":407}}`)
+			return
+		}
+		if d.failPush != nil {
+			if raw := d.failPush(user); raw != "" {
+				fmt.Fprint(w, raw)
+				return
+			}
+		}
+		d.uploads[user+" "+fields["path"]+"/"+fields["name"]] = content
+		fmt.Fprint(w, `{"success":true,"data":{}}`)
+		return
+	}
+	r.ParseForm()
+	method, p := r.Form.Get("method"), r.Form.Get("folder_path")
+	if p == "" {
+		p = strings.Trim(r.Form.Get("path"), `[]"`)
+	}
+	d.calls = append(d.calls, user+" "+method+" "+p)
+	if d.denied[user+" "+method+" "+p] {
+		fmt.Fprint(w, `{"success":false,"error":{"code":407}}`)
+		return
+	}
+	switch method {
+	case "get":
+		fmt.Fprintf(w, `{"success":true,"data":{"username":%q}}`, user)
+	case "getinfo":
+		fmt.Fprintf(w, `{"success":true,"data":{"files":[{"path":%q,"name":"x","isdir":true}]}}`, p)
+	case "list":
+		fmt.Fprint(w, `{"success":true,"data":{"files":[],"total":0}}`)
+	default:
+		fmt.Fprint(w, `{"success":true,"data":{}}`)
+	}
+}
+
+func (d *fakeDSM) reached(prefix string) int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	n := 0
+	for _, c := range d.calls {
+		if strings.Contains(c, prefix) {
+			n++
+		}
+	}
+	return n
+}
+
+type sessionHarness struct {
+	t       *testing.T
+	dsm     *fakeDSM
+	service *Service
+	dir     string
+}
+
+func newHarness(t *testing.T) *sessionHarness {
+	d, c := newFakeDSM(t)
+	dir := t.TempDir()
+	s := NewService(c, NewGrantRepository(dir))
+	uids := map[string]string{"alice": "1001", "bob": "1002"}
+	s.lookupUID = func(u string) (string, error) { return uids[u], nil }
+	return &sessionHarness{t: t, dsm: d, service: s, dir: dir}
+}
+
+// call runs one route as the DSM user behind session id sid.
+func (h *sessionHarness) call(user, sid, method, params string) map[string]any {
+	h.t.Helper()
+	server, e := api.NewServer(testAuth{user}, h.service.Routes()...)
+	if e != nil {
+		h.t.Fatal(e)
+	}
+	r := httptest.NewRequest("POST", "http://package/api", ioNop([]byte(fmt.Sprintf(`{"method":%q,"params":%s}`, method, params))))
+	r.Header.Set("Content-Type", "application/json")
+	if sid != "" {
+		r.AddCookie(&http.Cookie{Name: "id", Value: sid})
+	}
+	r.Header.Set("X-SYNO-TOKEN", "token-"+sid)
+	w := httptest.NewRecorder()
+	server.ServeHTTP(w, r)
+	var out map[string]any
+	if json.Unmarshal(w.Body.Bytes(), &out) != nil {
+		h.t.Fatal(w.Body.String())
+	}
+	return out
+}
+
+func errorCode(out map[string]any) string {
+	if out["success"] == true {
+		return ""
+	}
+	if e, ok := out["error"].(map[string]any); ok {
+		code, _ := e["code"].(string)
+		return code
+	}
+	return "malformed"
+}
+
+func (h *sessionHarness) confirm(user, sid, folder string, writable bool) string {
+	h.t.Helper()
+	out := h.call(user, sid, "nas.grants.confirm", fmt.Sprintf(`{"folder":%q,"writable":%v}`, folder, writable))
+	if out["success"] != true {
+		h.t.Fatalf("confirm refused: %v", out)
+	}
+	return out["data"].(map[string]any)["grantId"].(string)
+}
+
+func (h *sessionHarness) wantRefusal(out map[string]any, code string) {
+	h.t.Helper()
+	if got := errorCode(out); got != code {
+		h.t.Fatalf("error code %q, want %q: %v", got, code, out)
+	}
+}
+
+func TestValidSessionConfirmsListsAndWritesInsideItsScope(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-a"] = "alice"
+	id := h.confirm("alice", "sid-a", "/home/alice", true)
+	p := fmt.Sprintf(`{"grantId":%q}`, id)
+	if out := h.call("alice", "sid-a", "nas.files.list", p); out["success"] != true {
+		t.Fatal(out)
+	}
+	w := fmt.Sprintf(`{"grantId":%q,"name":"note.txt","data":"aGk="}`, id)
+	if out := h.call("alice", "sid-a", "nas.files.write", w); out["success"] != true {
+		t.Fatal(out)
+	}
+	if got := h.dsm.uploads["alice /home/alice/note.txt"]; got != "hi" {
+		t.Fatalf("upload landed as %q", got)
+	}
+}
+
+func TestExpiredOrInvalidSessionIsRefusedBeforeAnyFileOperation(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-a"] = "alice"
+	id := h.confirm("alice", "sid-a", "/home/alice", true)
+	p := fmt.Sprintf(`{"grantId":%q}`, id)
+	w := fmt.Sprintf(`{"grantId":%q,"name":"late.txt","data":"aGk="}`, id)
+	delete(h.dsm.users, "sid-a") // DSM expires the session
+	for method, params := range map[string]string{"nas.files.list": p, "nas.files.read": p, "nas.files.write": w, "nas.grants.list": `{}`, "nas.discovery": `{}`} {
+		h.wantRefusal(h.call("alice", "sid-a", method, params), "session_required")
+	}
+	h.wantRefusal(h.call("alice", "", "nas.files.list", p), "session_required") // no cookie at all
+	if len(h.dsm.uploads) != 0 || h.dsm.reached("upload") != 0 {
+		t.Fatal("an expired session reached the upload path")
+	}
+	if h.dsm.reached("list /home/alice") != 0 {
+		t.Fatal("an expired session listed a folder")
+	}
+	h.dsm.users["sid-a"] = "alice" // a fresh session works again with the stored consent
+	if out := h.call("alice", "sid-a", "nas.files.list", p); out["success"] != true {
+		t.Fatal(out)
+	}
+}
+
+func TestSessionOfAnotherUserIsRefusedEvenWithAMatchingCaller(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-b"] = "bob"
+	// The CGI authenticator says alice, but the DSM session belongs to bob.
+	h.wantRefusal(h.call("alice", "sid-b", "nas.discovery", `{}`), "session_required")
+}
+
+func TestTwoUsersCannotUseEachOthersScopes(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-a"], h.dsm.users["sid-b"] = "alice", "bob"
+	a := h.confirm("alice", "sid-a", "/home/alice", true)
+	b := h.confirm("bob", "sid-b", "/home/bob", true)
+	pa, pb := fmt.Sprintf(`{"grantId":%q}`, a), fmt.Sprintf(`{"grantId":%q}`, b)
+	wa := fmt.Sprintf(`{"grantId":%q,"name":"x.txt","data":"aGk="}`, a)
+	for _, method := range []string{"nas.files.list", "nas.files.stat", "nas.files.read"} {
+		h.wantRefusal(h.call("bob", "sid-b", method, pa), "denied")
+		h.wantRefusal(h.call("alice", "sid-a", method, pb), "denied")
+	}
+	h.wantRefusal(h.call("bob", "sid-b", "nas.files.write", wa), "denied")
+	h.wantRefusal(h.call("bob", "sid-b", "nas.grants.revoke", pa), "denied")
+	if h.dsm.reached("bob list /home/alice") != 0 || h.dsm.reached("bob upload /home/alice") != 0 {
+		t.Fatal("bob's session touched alice's scope")
+	}
+	for user, sid := range map[string]string{"alice": "sid-a", "bob": "sid-b"} {
+		listed := h.call(user, sid, "nas.grants.list", `{}`)["data"].([]any)
+		if len(listed) != 1 {
+			t.Fatalf("%s sees %d selections", user, len(listed))
+		}
+	}
+	// alice's grant still works for alice after bob's attempted revoke.
+	if out := h.call("alice", "sid-a", "nas.files.list", pa); out["success"] != true {
+		t.Fatal(out)
+	}
+}
+
+func TestScopeBoundsAndReadOnlyGrants(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-a"] = "alice"
+	ro := h.confirm("alice", "sid-a", "/home/alice", false)
+	for _, rel := range []string{"../bob", "..", "/etc", "a/../../bob", "a//b", `a\b`} {
+		h.wantRefusal(h.call("alice", "sid-a", "nas.files.list", fmt.Sprintf(`{"grantId":%q,"relative":%q}`, ro, rel)), "invalid-request")
+	}
+	if h.dsm.reached("bob") != 0 || h.dsm.reached("/home/bob") != 0 {
+		t.Fatal("a traversal reached File Station")
+	}
+	for _, method := range []string{"nas.files.create", "nas.files.write"} {
+		h.wantRefusal(h.call("alice", "sid-a", method, fmt.Sprintf(`{"grantId":%q,"name":"x","data":"aGk="}`, ro)), "denied")
+	}
+	if h.dsm.reached("upload") != 0 || h.dsm.reached("create") != 0 {
+		t.Fatal("a read-only grant mutated")
+	}
+}
+
+func TestRevokedConsentAndRevokedDSMPermissionAreRefused(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-a"] = "alice"
+	id := h.confirm("alice", "sid-a", "/home/alice", true)
+	p := fmt.Sprintf(`{"grantId":%q}`, id)
+	// DSM drops alice's permission on the folder: the next call is refused fresh.
+	h.dsm.denied["alice list /home/alice"] = true
+	h.wantRefusal(h.call("alice", "sid-a", "nas.files.list", p), "denied")
+	delete(h.dsm.denied, "alice list /home/alice")
+	h.dsm.denied["alice upload /home/alice"] = true
+	h.wantRefusal(h.call("alice", "sid-a", "nas.files.write", fmt.Sprintf(`{"grantId":%q,"name":"x.txt","data":"aGk="}`, id)), "denied")
+	if len(h.dsm.uploads) != 0 {
+		t.Fatal("a denied upload stored a file")
+	}
+	delete(h.dsm.denied, "alice upload /home/alice")
+	// Revoking the stored consent refuses every later operation, upstream untouched.
+	if out := h.call("alice", "sid-a", "nas.grants.revoke", p); out["success"] != true {
+		t.Fatal(out)
+	}
+	before := h.dsm.reached("alice list /home/alice")
+	h.wantRefusal(h.call("alice", "sid-a", "nas.files.list", p), "denied")
+	h.wantRefusal(h.call("alice", "sid-a", "nas.files.write", fmt.Sprintf(`{"grantId":%q,"name":"x.txt","data":"aGk="}`, id)), "denied")
+	if h.dsm.reached("alice list /home/alice") != before || len(h.dsm.uploads) != 0 {
+		t.Fatal("a revoked grant reached File Station")
+	}
+}
+
+func TestWriteFailuresNeverReportSuccessOrLeaveLocalFiles(t *testing.T) {
+	for name, tc := range map[string]struct{ raw, code string }{
+		"DSM conflict":        {`{"success":false,"error":{"code":1805}}`, "conflict"},
+		"DSM permission":      {`{"success":false,"error":{"code":407}}`, "denied"},
+		"unreadable reply":    {`<html>502</html>`, "commit-uncertain"},
+		"success key missing": {`{"data":{}}`, "commit-uncertain"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			h := newHarness(t)
+			h.dsm.users["sid-a"] = "alice"
+			id := h.confirm("alice", "sid-a", "/home/alice", true)
+			h.dsm.failPush = func(string) string { return tc.raw }
+			out := h.call("alice", "sid-a", "nas.files.write", fmt.Sprintf(`{"grantId":%q,"name":"x.txt","data":"aGk="}`, id))
+			h.wantRefusal(out, tc.code)
+			if out["success"] == true || len(h.dsm.uploads) != 0 {
+				t.Fatal("failed write was reported or stored as success")
+			}
+			assertOnlySelectionStore(t, h.dir)
+		})
+	}
+}
+
+func TestStreamAndPublishRefuseWithoutTouchingFileStation(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-a"] = "alice"
+	id := h.confirm("alice", "sid-a", "/home/alice", true)
+	before := len(h.dsm.calls)
+	for _, method := range []string{"nas.files.stream", "nas.files.publish"} {
+		out := h.call("alice", "sid-a", method, fmt.Sprintf(`{"grantId":%q,"name":"big.bin"}`, id))
+		h.wantRefusal(out, "unsupported")
+	}
+	if len(h.dsm.calls) != before || len(h.dsm.uploads) != 0 {
+		t.Fatal("unsupported stream/publish reached File Station")
+	}
+	assertOnlySelectionStore(t, h.dir)
+}
+
+func TestNoSessionMaterialIsPersisted(t *testing.T) {
+	h := newHarness(t)
+	h.dsm.users["sid-secret-cookie"] = "alice"
+	id := h.confirm("alice", "sid-secret-cookie", "/home/alice", true)
+	p := fmt.Sprintf(`{"grantId":%q}`, id)
+	h.call("alice", "sid-secret-cookie", "nas.files.list", p)
+	h.call("alice", "sid-secret-cookie", "nas.files.write", fmt.Sprintf(`{"grantId":%q,"name":"x.txt","data":"aGk="}`, id))
+	delete(h.dsm.users, "sid-secret-cookie")
+	h.call("alice", "sid-secret-cookie", "nas.files.list", p)
+	for _, secret := range []string{"sid-secret-cookie", "token-sid-secret-cookie", "SynoToken", "X-SYNO-TOKEN"} {
+		assertNothingPersists(t, h.dir, secret)
+	}
+	assertOnlySelectionStore(t, h.dir)
+}
+
+// assertOnlySelectionStore: the only package-local state is consent metadata.
+func assertOnlySelectionStore(t *testing.T, dir string) {
+	t.Helper()
+	filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+		name := d.Name()
+		if !strings.HasPrefix(name, "session-selections") {
+			t.Errorf("unexpected package-local file %s", path)
+		}
+		return nil
+	})
+}
+
+func assertNothingPersists(t *testing.T, dir, secret string) {
+	t.Helper()
+	filepath.WalkDir(dir, func(path string, d fs.DirEntry, err error) error {
+		if err != nil || d.IsDir() {
+			return err
+		}
+		b, _ := os.ReadFile(path)
+		if bytes.Contains(b, []byte(secret)) || strings.Contains(path, secret) {
+			t.Errorf("%s persisted in %s", "session material", path)
+		}
+		return nil
+	})
+}

package/templates/native-go/backend/internal/filestation/write.go

@@ -0,0 +1,72 @@
+package filestation
+
+import (
+	"bytes"
+	"context"
+	"dsmapp/internal/api"
+	"errors"
+	"mime/multipart"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+func validName(n string) bool {
+	return n != "" && n != "." && n != ".." && len(n) <= 255 && !strings.ContainsAny(n, "/\\\x00\r\n,\"")
+}
+func (c *Client) Create(ctx context.Context, r *http.Request, parent, name string) error {
+	if !validPath(parent) || !validName(name) {
+		return fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.CreateFolder", "create", "2")
+	v.Set("folder_path", array(parent))
+	v.Set("name", array(name))
+	v.Set("force_parent", "false")
+	return mutationOutcome(c.call(ctx, r, v, nil))
+}
+
+// Write creates one bounded file. Omitting overwrite requests an error if the
+// target already exists; false would silently skip on DSM. No retries or rename
+// publish promise: a timeout may have left a partial or completed remote file.
+func (c *Client) Write(ctx context.Context, r *http.Request, parent, name string, data []byte) error {
+	if !validPath(parent) || !validName(name) {
+		return fail("invalid-request")
+	}
+	if len(data) > MaxBytes {
+		return fail("limit-exceeded")
+	}
+	if r == nil {
+		return fail("unavailable")
+	}
+	var b bytes.Buffer
+	m := multipart.NewWriter(&b)
+	for _, f := range [][2]string{{"api", "SYNO.FileStation.Upload"}, {"method", "upload"}, {"version", "2"}, {"path", parent}, {"create_parents", "false"}, {"size", strconv.Itoa(len(data))}, {"SynoToken", r.Header.Get("X-SYNO-TOKEN")}} {
+		if m.WriteField(f[0], f[1]) != nil {
+			return fail("unavailable")
+		}
+	}
+	part, e := m.CreateFormFile("file", name)
+	if e != nil {
+		return fail("invalid-request")
+	}
+	if _, e = part.Write(data); e != nil {
+		return fail("unavailable")
+	}
+	if m.Close() != nil {
+		return fail("unavailable")
+	}
+	resp, e := c.send(ctx, r, &b, m.FormDataContentType())
+	if e != nil {
+		return mutationOutcome(e)
+	}
+	return mutationOutcome(decode(resp, nil))
+}
+
+// An unreadable response cannot establish whether DSM committed the write.
+func mutationOutcome(err error) error {
+	var e *api.Error
+	if errors.As(err, &e) && (e.Code == "unavailable" || e.Code == "canceled") {
+		return fail("commit-uncertain")
+	}
+	return err
+}

package/templates/native-go/backend/internal/filestation/write_test.go

@@ -0,0 +1,123 @@
+package filestation
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func TestCreateAndUploadAreBoundedAndUseSession(t *testing.T) {
+	calls := 0
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		if r.Header.Get("Cookie") != "id=test-session" {
+			t.Error("session missing")
+		}
+		if calls == 1 {
+			r.ParseForm()
+			if r.Form.Get("api") != "SYNO.FileStation.CreateFolder" || r.Form.Get("folder_path") != `["/home"]` || r.Form.Get("name") != `["new"]` || r.Form.Get("force_parent") != "false" {
+				t.Error("create fields")
+			}
+		} else {
+			m, e := r.MultipartReader()
+			if e != nil {
+				t.Fatal(e)
+			}
+			fields := map[string]string{}
+			last := ""
+			for {
+				p, e := m.NextPart()
+				if e == io.EOF {
+					break
+				}
+				if e != nil {
+					t.Fatal(e)
+				}
+				b, _ := io.ReadAll(p)
+				last = p.FormName()
+				fields[last] = string(b)
+				if last == "file" && p.FileName() != "a.txt" {
+					t.Error("filename")
+				}
+			}
+			if fields["file"] != "abc" || fields["path"] != "/home" || fields["api"] != "SYNO.FileStation.Upload" || fields["SynoToken"] != "test-token" || fields["create_parents"] != "false" || fields["overwrite"] != "" || last != "file" {
+				t.Error("multipart fields")
+			}
+		}
+		fmt.Fprint(w, `{"success":true,"data":{}}`)
+	})
+	r := sessionRequest()
+	ctx := context.Background()
+	if e := c.Create(ctx, r, "/home", "new"); e != nil {
+		t.Fatal(e)
+	}
+	if e := c.Write(ctx, r, "/home", "a.txt", []byte("abc")); e != nil {
+		t.Fatal(e)
+	}
+	for _, n := range []string{"../evil", "/evil", "a/b", "a\\b", "a\r\nx", ".", "..", "a,b"} {
+		if c.Write(ctx, r, "/home", n, []byte("abc")) == nil {
+			t.Fatal(n)
+		}
+	}
+	if c.Write(ctx, r, "/home", "a", make([]byte, MaxBytes+1)) == nil {
+		t.Fatal("oversized write")
+	}
+	if calls != 2 {
+		t.Fatal("invalid input reached server")
+	}
+}
+
+func TestMutationMalformedReplyIsCommitUncertain(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, "broken response") })
+	for _, e := range []error{c.Create(context.Background(), sessionRequest(), "/home", "x"), c.Write(context.Background(), sessionRequest(), "/home", "x", []byte("abc"))} {
+		if e == nil || !strings.Contains(e.Error(), "commit-uncertain") {
+			t.Fatal(e)
+		}
+	}
+}
+
+func TestBinaryUploadDownloadChecksum(t *testing.T) {
+	payload := []byte{0, 1, 2, 255, 128, '\n', '"', '<', '>'}
+	var stored []byte
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost {
+			mr, e := r.MultipartReader()
+			if e != nil {
+				t.Fatal(e)
+			}
+			for {
+				p, e := mr.NextPart()
+				if e == io.EOF {
+					break
+				}
+				if e != nil {
+					t.Fatal(e)
+				}
+				if p.FormName() == "file" {
+					stored, e = io.ReadAll(p)
+					if e != nil {
+						t.Fatal(e)
+					}
+				}
+			}
+			fmt.Fprint(w, `{"success":true}`)
+		} else {
+			w.Header().Set("Content-Disposition", `attachment; filename="bytes"`)
+			w.Write(stored)
+		}
+	})
+	if e := c.Write(context.Background(), sessionRequest(), "/home", "bytes", payload); e != nil {
+		t.Fatal(e)
+	}
+	out, e := c.Read(context.Background(), sessionRequest(), "/home/bytes")
+	if e != nil {
+		t.Fatal(e)
+	}
+	if sha256.Sum256(out) != sha256.Sum256(payload) {
+		t.Fatal("binary checksum mismatch")
+	}
+}