@synopackageland/cli 0.4.1 → 0.5.3

package/templates/native-go/backend/internal/helper/background_proof.go

@@ -0,0 +1,163 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"cmp"
+	"context"
+	"slices"
+	"time"
+)
+
+func (o *backgroundObserver) observe(ctx context.Context, recorded RelaxedIdentity) backgroundObservation {
+	refuse := func(code Code) backgroundObservation { return backgroundObservation{code: code} }
+	revoke := func(code Code, observed RelaxedIdentity) backgroundObservation {
+		ids := []RelaxedIdentity{recorded}
+		if validRelaxedIdentity(observed) && observed != recorded {
+			ids = append(ids, observed)
+		}
+		return backgroundObservation{code: code, revoke: true, identities: ids}
+	}
+	if o == nil || o.accounts == nil || o.groups == nil || o.app == nil || o.appID == "" || o.now == nil {
+		return refuse(ErrUnavailable)
+	}
+	if !validRelaxedIdentity(recorded) {
+		return refuse(ErrDenied)
+	}
+	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
+	defer cancel()
+	if c := nativeContextCode(ctx); c != "" {
+		return refuse(c)
+	}
+	a, c := o.accounts.LookupRelaxedAccount(ctx, recorded.Username)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		if c == ErrDenied {
+			return revoke(c, RelaxedIdentity{})
+		}
+		return refuse(c)
+	}
+	if !nativeFresh(a.CheckedAt, o.now()) {
+		return refuse(ErrStale)
+	}
+	if a.Kind != "local" {
+		return refuse(ErrUnsupported)
+	}
+	if !a.StateKnown {
+		return refuse(ErrUnavailable)
+	}
+	if !a.Exists || !a.Enabled {
+		return revoke(ErrDenied, a.Identity)
+	}
+	if a.Identity != recorded {
+		return revoke(ErrSuspended, a.Identity)
+	}
+	if !a.ExpiryKnown || !a.PasswordKnown || !a.PrimaryGIDKnown {
+		return refuse(ErrUnavailable)
+	}
+	if a.Expired || !a.PasswordUsable {
+		return revoke(ErrDenied, a.Identity)
+	}
+	if a.PrimaryGID == 0 {
+		return refuse(ErrDenied)
+	}
+	g, c := o.groups.LookupRelaxedGroups(ctx, a)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		return refuse(c)
+	}
+	if !nativeFresh(g.CheckedAt, o.now()) {
+		return refuse(ErrStale)
+	}
+	if g.Identity != a.Identity || g.PrimaryGID != a.PrimaryGID {
+		return refuse(ErrStale)
+	}
+	if g.Groups == nil || len(g.Groups) > 1024 || !g.Complete || !g.AdminKnown {
+		return refuse(ErrUnavailable)
+	}
+	if slices.Contains(g.Groups, uint32(0)) {
+		return refuse(ErrDenied)
+	}
+	app, c := o.app.observeBackgroundApp(ctx, a, o.appID)
+	if c = nativeObservationCode(ctx, c); c != "" {
+		if c == ErrDenied {
+			return revoke(c, a.Identity)
+		}
+		return refuse(c)
+	}
+	if !nativeFresh(app.CheckedAt, o.now()) {
+		return refuse(ErrStale)
+	}
+	if !app.Known || !app.OfflineEquivalent {
+		return refuse(ErrUnavailable)
+	}
+	if app.Identity != recorded || app.AppID != o.appID {
+		return refuse(ErrDenied)
+	}
+	if !app.Allowed {
+		return revoke(ErrDenied, a.Identity)
+	}
+	oldest := a.CheckedAt
+	for _, at := range []time.Time{g.CheckedAt, app.CheckedAt} {
+		if at.Before(oldest) {
+			oldest = at
+		}
+	}
+	if !nativeFresh(oldest, o.now()) {
+		return refuse(ErrStale)
+	}
+	groups := slices.Clone(g.Groups)
+	slices.Sort(groups)
+	groups = slices.Compact(groups)
+	return backgroundObservation{snapshot: backgroundSnapshot{recorded, a.PrimaryGID, groups, g.Admin, oldest, true}}
+}
+
+func (o *backgroundObserver) revalidate(ctx context.Context, old backgroundSnapshot) backgroundObservation {
+	if !old.valid {
+		return backgroundObservation{code: ErrDenied}
+	}
+	current := o.observe(ctx, old.identity)
+	if current.code != "" {
+		return current
+	}
+	next := current.snapshot
+	if old.gid != next.gid || old.admin != next.admin || !slices.Equal(old.groups, next.groups) {
+		return backgroundObservation{code: ErrStale}
+	}
+	return current
+}
+
+// Pure selection only: a trusted owner must enumerate ALL stored owner/issuer,
+// delegation and running/consumed identities under its existing admission order.
+// Incomplete enumeration fences the owner. This never changes authority or Q.
+func backgroundIdentityClosure(seeds, recorded []RelaxedIdentity, complete bool) ([]RelaxedIdentity, Code) {
+	// 256 authority records, at most four identity roles each, plus old/new seed.
+	if !complete || len(seeds) == 0 || len(seeds) > 2 || len(recorded) > 1024 {
+		return nil, ErrCleanupRequired
+	}
+	for _, set := range [][]RelaxedIdentity{seeds, recorded} {
+		for _, id := range set {
+			if !validRelaxedIdentity(id) {
+				return nil, ErrCleanupRequired
+			}
+		}
+	}
+	selected := slices.Clone(seeds)
+	for changed := true; changed; {
+		changed = false
+		for _, id := range recorded {
+			if slices.Contains(selected, id) {
+				continue
+			}
+			for _, known := range selected {
+				if relaxedRelated(id, known) {
+					selected = append(selected, id)
+					changed = true
+					break
+				}
+			}
+		}
+	}
+	slices.SortFunc(selected, func(a, b RelaxedIdentity) int {
+		return cmp.Or(cmp.Compare(a.UID, b.UID), cmp.Compare(a.Username, b.Username))
+	})
+	return slices.Compact(selected), ""
+}

package/templates/native-go/backend/internal/helper/background_proof_contract.go

@@ -0,0 +1,46 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"time"
+)
+
+// S4 is an unconnected root-side observation seam, not a job admission API.
+// Production assembly deliberately installs no offline observers. These types
+// carry neither a session nor an IP and cannot mint a NativeActor.
+type backgroundAppProof struct {
+	Identity                          RelaxedIdentity
+	AppID                             string
+	Known, Allowed, OfflineEquivalent bool
+	CheckedAt                         time.Time
+}
+type backgroundAppObserver interface {
+	observeBackgroundApp(context.Context, RelaxedAccount, string) (backgroundAppProof, Code)
+}
+type backgroundObserver struct {
+	accounts RelaxedAccountProvider
+	groups   RelaxedGroupProvider
+	app      backgroundAppObserver
+	appID    string // compiled DSM registration privilege ID, not a request field
+	now      func() time.Time
+}
+type backgroundSnapshot struct {
+	identity  RelaxedIdentity
+	gid       uint32
+	groups    []uint32
+	admin     bool
+	checkedAt time.Time // oldest observation; never extended by a later lookup
+	valid     bool
+}
+
+// Revoke is an instruction to the existing authority owner, NOT durable R/Q.
+// Every nonempty Code stops admission/output. The owner must latch revocation,
+// enumerate the complete store, durably revoke, and drain outside its locks.
+type backgroundObservation struct {
+	snapshot   backgroundSnapshot
+	code       Code
+	revoke     bool
+	identities []RelaxedIdentity
+}

package/templates/native-go/backend/internal/helper/background_proof_test.go

@@ -0,0 +1,161 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"slices"
+	"testing"
+	"time"
+)
+
+type offlineFake struct {
+	proof backgroundAppProof
+	code  Code
+	after func()
+}
+
+func (f *offlineFake) observeBackgroundApp(ctx context.Context, a RelaxedAccount, app string) (backgroundAppProof, Code) {
+	if _, ok := ctx.Deadline(); !ok {
+		panic("no deadline")
+	}
+	if f.after != nil {
+		f.after()
+	}
+	return f.proof, f.code
+}
+func offlineFixture(t *testing.T) (*backgroundObserver, *relaxedFake, *offlineFake, RelaxedIdentity) {
+	_, _, p, f, _, _, _ := relaxedFixture(t)
+	app := &offlineFake{proof: backgroundAppProof{Identity: f.account.Identity, AppID: "FixturePrivilege", Known: true, Allowed: true, OfflineEquivalent: true, CheckedAt: p.now()}}
+	return &backgroundObserver{f, f, app, "FixturePrivilege", p.now}, f, app, f.account.Identity
+}
+func TestBackgroundLogoutAndOldestProof(t *testing.T) {
+	o, f, _, id := offlineFixture(t)
+	f.sessionCode = ErrDenied // logout cannot affect a non-session observer
+	f.account.CheckedAt = o.now().Add(-time.Second)
+	got := o.observe(context.Background(), id)
+	if got.code != "" || !got.snapshot.valid || got.snapshot.checkedAt != f.account.CheckedAt {
+		t.Fatalf("%+v", got)
+	}
+	f.groups.Groups[0] = 999
+	if slices.Contains(got.snapshot.groups, uint32(999)) {
+		t.Fatal("aliased credentials")
+	}
+	if got.snapshot.identity != id {
+		t.Fatal("identity")
+	}
+}
+func TestBackgroundRefusals(t *testing.T) {
+	cases := []struct {
+		name   string
+		change func(*backgroundObserver, *relaxedFake, *offlineFake)
+		code   Code
+		revoke bool
+	}{
+		{"nil account", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.accounts = nil }, ErrUnavailable, false},
+		{"nil groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.groups = nil }, ErrUnavailable, false},
+		{"nil app", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.app = nil }, ErrUnavailable, false},
+		{"missing compiled App", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { o.appID = "" }, ErrUnavailable, false},
+		{"unknown state", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.StateKnown = false }, ErrUnavailable, false},
+		{"disabled", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Enabled = false }, ErrDenied, true},
+		{"deleted no tuple", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			f.account.Exists = false
+			f.account.Identity = RelaxedIdentity{}
+		}, ErrDenied, true},
+		{"lookup denied", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.accountCode = ErrDenied }, ErrDenied, true},
+		{"UID change", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Identity.UID++ }, ErrSuspended, true},
+		{"name change", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Identity.Username = "Alice" }, ErrSuspended, true},
+		{"LDAP", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Kind = "ldap" }, ErrUnsupported, false},
+		{"expiry unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.ExpiryKnown = false }, ErrUnavailable, false},
+		{"password unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.PasswordKnown = false }, ErrUnavailable, false},
+		{"expired", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.Expired = true }, ErrDenied, true},
+		{"root GID", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.account.PrimaryGID = 0 }, ErrDenied, false},
+		{"nil groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Groups = nil }, ErrUnavailable, false},
+		{"partial groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Complete = false }, ErrUnavailable, false},
+		{"unknown admin", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.AdminKnown = false }, ErrUnavailable, false},
+		{"group root", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Groups = []uint32{0} }, ErrDenied, false},
+		{"incoherent groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { f.groups.Identity.UID++ }, ErrStale, false},
+		{"App unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Known = false }, ErrUnavailable, false},
+		{"App IP semantics unknown", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.OfflineEquivalent = false }, ErrUnavailable, false},
+		{"wrong App", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.AppID = "other" }, ErrDenied, false},
+		{"wrong App actor", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Identity.UID++ }, ErrDenied, false},
+		{"App revoke", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.Allowed = false }, ErrDenied, true},
+		{"App denied", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.code = ErrDenied }, ErrDenied, true},
+		{"raw error", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.code = "secret native error" }, ErrUnavailable, false},
+		{"old account", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			f.account.CheckedAt = o.now().Add(-3 * time.Second)
+		}, ErrStale, false},
+		{"future groups", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			f.groups.CheckedAt = o.now().Add(time.Nanosecond)
+		}, ErrStale, false},
+		{"zero App time", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) { a.proof.CheckedAt = time.Time{} }, ErrStale, false},
+		{"aged during app", func(o *backgroundObserver, f *relaxedFake, a *offlineFake) {
+			now := o.now()
+			a.after = func() { o.now = func() time.Time { return now.Add(3 * time.Second) } }
+		}, ErrStale, false},
+	}
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			o, f, a, id := offlineFixture(t)
+			tt.change(o, f, a)
+			got := o.observe(context.Background(), id)
+			if got.code != tt.code || got.revoke != tt.revoke || got.snapshot.valid {
+				t.Fatalf("got %+v want %s revoke %v", got, tt.code, tt.revoke)
+			}
+			if got.revoke && !slices.Contains(got.identities, id) {
+				t.Fatal("lost old identity")
+			}
+		})
+	}
+	var nilObserver *backgroundObserver
+	if nilObserver.observe(context.Background(), RelaxedIdentity{}).code != ErrUnavailable {
+		t.Fatal("nil allowed")
+	}
+}
+func TestBackgroundCredentialChangeAndCancellation(t *testing.T) {
+	for _, what := range []string{"groups", "gid", "admin"} {
+		t.Run(what, func(t *testing.T) {
+			o, f, _, id := offlineFixture(t)
+			old := o.observe(context.Background(), id).snapshot
+			switch what {
+			case "groups":
+				f.groups.Groups = []uint32{}
+			case "gid":
+				f.account.PrimaryGID++
+				f.groups.PrimaryGID++
+			case "admin":
+				f.groups.Admin = !f.groups.Admin
+			}
+			if got := o.revalidate(context.Background(), old); got.code != ErrStale || got.snapshot.valid || got.revoke {
+				t.Fatalf("%+v", got)
+			}
+		})
+	}
+	o, _, app, id := offlineFixture(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	app.after = cancel
+	if got := o.observe(ctx, id); got.code != ErrCanceled || got.snapshot.valid {
+		t.Fatal(got.code)
+	}
+}
+func TestBackgroundIdentityClosure(t *testing.T) {
+	old := RelaxedIdentity{1001, "alice"}
+	renamed := RelaxedIdentity{1001, "alice2"}
+	reused := RelaxedIdentity{2001, "alice2"}
+	unrelated := RelaxedIdentity{3001, "bob"}
+	// Complete root-side records include owner/issuer, all delegation actors,
+	// and consumed/running jobs. Order must not hide transitive old associations.
+	got, c := backgroundIdentityClosure([]RelaxedIdentity{old}, []RelaxedIdentity{reused, unrelated, renamed, old}, true)
+	if c != "" || len(got) != 3 || !slices.Contains(got, reused) || slices.Contains(got, unrelated) {
+		t.Fatalf("%v %s", got, c)
+	}
+	for _, complete := range []bool{false, true} {
+		records := []RelaxedIdentity{old}
+		if complete {
+			records = append(records, RelaxedIdentity{})
+		}
+		if _, c := backgroundIdentityClosure([]RelaxedIdentity{old}, records, complete); c != ErrCleanupRequired {
+			t.Fatal("incomplete index allowed", c)
+		}
+	}
+}

package/templates/native-go/backend/internal/helper/data_contract.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/data_contract.go:1
 package helper
 
 import "time"

package/templates/native-go/backend/internal/helper/data_protocol.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/data_protocol.go:1
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/data_protocol_test.go

@@ -411,7 +411,7 @@ func TestGrantAndIntentStrictRecords(t *testing.T) {
 		t.Fatal(c)
 	}
 	for _, change := range []struct{ from, to string }{
-		{`"grantSchema": 1`, `"grantSchema": 2`}, {`"kind": "local"`, `"kind": "ldap"`},
+		{`"grantSchema": 1`, `"grantSchema": 99`}, {`"kind": "local"`, `"kind": "ldap"`},
 		{`"targetKind": "directory"`, `"targetKind": "file"`}, {`"state": "active"`, `"state": "unknown"`},
 		{`"mountRef":`, `"path":"/secret","mountRef":`}, {`nas.files.read`, `shell`},
 		{`"segments":`, `"Segments":`}, {`"grantRevision": 1`, `"grantRevision": 0`},

package/templates/native-go/backend/internal/helper/grant_authority.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/grant_authority.go:1
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/grant_authority_test.go

@@ -81,7 +81,7 @@ func grantAuthorityFixture(t *testing.T) (*GrantAuthority, *memoryGrantRepositor
 		t.Fatal(c)
 	}
 	g := store.Grants[0]
-	r := &memoryGrantRepository{policy: GrantPolicy{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, ApprovalBinding: g.ApprovalBinding, CapabilityDigest: g.CapabilityDigest, Enabled: true}, store: GrantStore{Schema: 1, Revision: 1, Grants: []Grant{}}}
+	r := &memoryGrantRepository{policy: GrantPolicy{Inventory: g.Inventory, Epoch: g.LastValidated.Epoch, ApprovalBinding: g.ApprovalBinding, CapabilityDigest: g.CapabilityDigest, Enabled: true}, store: GrantStore{Schema: testAuthoritySchema, Revision: 1, Grants: []Grant{}}}
 	scope := g.Scope
 	scope.Kind = ScopePersonal
 	scope.Segments = []string{"chosen"}

package/templates/native-go/backend/internal/helper/grant_repository_linux.go

@@ -1,5 +1,6 @@
-//go:build linux
+//go:build linux && !synopkgland_sdk_workers
 
+//line dsmapp/internal/helper/grant_repository_linux.go:3
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/grant_repository_linux_test.go

@@ -134,7 +134,7 @@ func TestGrantDiskRefusesUntrustedArtifacts(t *testing.T) {
 			case "oversize":
 				os.WriteFile(name, bytes.Repeat([]byte{' '}, MaxGrantStoreBytes+1), 0600)
 			case "bad-schema":
-				os.WriteFile(name, []byte(`{"grantSchema":2,"storeRevision":1,"grants":[]}`), 0600)
+				os.WriteFile(name, []byte(`{"grantSchema":99,"storeRevision":1,"grants":[]}`), 0600)
 			case "duplicate":
 				os.WriteFile(name, []byte(`{"grantSchema":1,"grantSchema":1,"storeRevision":1,"grants":[]}`), 0600)
 			case "fifo":
@@ -440,7 +440,8 @@ func TestGrantDiskAuthorityEndToEnd(t *testing.T) {
 	}
 	authority.now = func() time.Time { return now }
 	intent := prepareGrant(t, authority, carriers, ScopePersonal)
-	grant, code := authority.Confirm(context.Background(), carriers, intent.ID, intent.SummaryDigest, 1)
+	_, initial := diskGrantSnapshot(t, repository)
+	grant, code := authority.Confirm(context.Background(), carriers, intent.ID, intent.SummaryDigest, initial.Revision)
 	if code != "" {
 		t.Fatal(code)
 	}
@@ -448,7 +449,7 @@ func TestGrantDiskAuthorityEndToEnd(t *testing.T) {
 	if code := authority.WithGrantAdmission(admission, func(Grant, NativeActor) Code { return "" }); code != "" {
 		t.Fatal(code)
 	}
-	result, code := authority.Revoke(context.Background(), carriers, grant.ID, 1, 2)
+	result, code := authority.Revoke(context.Background(), carriers, grant.ID, 1, initial.Revision+1)
 	if code != "" || !result.Revoked || !result.Drained {
 		t.Fatal(result, code)
 	}

package/templates/native-go/backend/internal/helper/grant_snapshot.go

@@ -1,3 +1,6 @@
+//go:build !synopkgland_sdk_workers
+
+//line dsmapp/internal/helper/grant_snapshot.go:1
 package helper
 
 import (

package/templates/native-go/backend/internal/helper/jobcontract/bindings.go

@@ -0,0 +1,48 @@
+package jobcontract
+
+import (
+	"crypto/sha256"
+	"embed"
+	"encoding/binary"
+	"encoding/hex"
+)
+
+// Source-backed schema fingerprints deliberately overbind the S0 validator,
+// decoder and types. A semantic change cannot silently keep a version label.
+// Test files are excluded. Keep the file lists in sync with worker-registry.ts.
+//
+//go:embed decode.go digest.go types.go validate.go result.go stub.go
+var bindingSources embed.FS
+
+type WorkerSourceBindings struct {
+	HandlerBinding     string
+	InputSchemaDigest  string
+	OutputSchemaDigest string
+}
+
+var compiledSourceBindings = WorkerSourceBindings{
+	HandlerBinding:     sourceDigest("handler", "stub.go"),
+	InputSchemaDigest:  sourceDigest("input", "decode.go", "digest.go", "types.go", "validate.go"),
+	OutputSchemaDigest: sourceDigest("result", "decode.go", "result.go", "types.go", "validate.go"),
+}
+
+func CompiledBindings() WorkerSourceBindings { return compiledSourceBindings }
+
+// SHA256(domain NUL, then u32be name length/name and u32be bytes length/bytes).
+func sourceDigest(kind string, names ...string) string {
+	h := sha256.New()
+	h.Write([]byte("synopkgland/m3/" + kind + "/source-v1\x00"))
+	for _, name := range names {
+		b, err := bindingSources.ReadFile(name)
+		if err != nil {
+			panic("missing compiled worker source")
+		}
+		for _, chunk := range [][]byte{[]byte(name), b} {
+			var n [4]byte
+			binary.BigEndian.PutUint32(n[:], uint32(len(chunk)))
+			h.Write(n[:])
+			h.Write(chunk)
+		}
+	}
+	return hex.EncodeToString(h.Sum(nil))
+}