@synopackageland/cli 0.5.0 → 0.5.3

package/dist/templates/native-go/backend/internal/helper/revoke.go

@@ -0,0 +1,109 @@
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"time"
+)
+
+// Called by the already approved root child after SO_PEERCRED authorization.
+// This endpoint can only withdraw the exact installed build's authority. It
+// cannot start a process, select a path, signal a PID, or replace an inventory.
+func packageRevoke(c Client, req Request) error {
+	if req.Op != "revoke" || req.Inventory != c.Expected || !c.Expected.Valid() || !digestPattern.MatchString(req.Nonce) {
+		return errTrust
+	}
+	if err := protected(c.StateDir, c.Owner, true); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	if err := protected(f.Name(), c.Owner, false); err != nil {
+		return err
+	}
+	if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
+		return errBusy
+	}
+	defer syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+	return policyUpdate(c, func(r *Record) error {
+		if r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" || !r.Enabled {
+			return errTrust
+		}
+		r.Enabled = false
+		r.Residual = true
+		r.Lifecycle.Phase = "fenced"
+		r.Lifecycle.Completion = ""
+		r.Lifecycle.Reason = "package-revoke"
+		return nil
+	})
+}
+
+// Revoke runs as the package UID. A socket acknowledgement proves only durable
+// withdrawal; success additionally requires the owning supervisor's sealed
+// terminal publication and absent runtime. No missing-socket shortcut.
+func (c Client) Revoke(ctx context.Context) error {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	r, err := readRecord(c.StateDir, c.Owner)
+	if errors.Is(err, fs.ErrNotExist) {
+		return c.CheckStopped(ctx)
+	}
+	// The new build may manage the old disabled terminal publication without
+	// acquiring its authority or mutating it. This keeps uninstall possible
+	// before the user has approved the upgraded build.
+	if err == nil && !r.Enabled && c.managementStopped(r) {
+		return nil
+	}
+	if err != nil || r.Inventory != c.Expected {
+		return errTrust
+	}
+	if !r.Enabled {
+		if c.managementStopped(r) {
+			return nil
+		}
+		return errTrust
+	}
+	if r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
+		return errTrust
+	}
+	dialer := net.Dialer{Timeout: time.Second}
+	conn, err := dialer.DialContext(ctx, "unix", filepath.Join(c.RunDir, "helper.sock"))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	if c.Peer == nil || c.Peer(conn.(*net.UnixConn)) != nil {
+		return errTrust
+	}
+	conn.SetDeadline(time.Now().Add(time.Second))
+	var nonce [32]byte
+	if _, err := rand.Read(nonce[:]); err != nil {
+		return err
+	}
+	req := Request{Inventory: c.Expected, Op: "revoke", Nonce: hex.EncodeToString(nonce[:])}
+	if err := json.NewEncoder(conn).Encode(req); err != nil {
+		return err
+	}
+	var res Response
+	d := json.NewDecoder(io.LimitReader(conn, 4097))
+	d.DisallowUnknownFields()
+	if d.Decode(&res) != nil || res.Inventory != c.Expected || res.Nonce != req.Nonce || !res.OK || res.Error != "" {
+		return errTrust
+	}
+	return waitHealthy(ctx, func(context.Context) bool {
+		r, err := readRecord(c.StateDir, c.Owner)
+		return err == nil && r.Inventory == c.Expected && !r.Enabled && c.managementStopped(r)
+	})
+}

package/dist/templates/native-go/backend/internal/helper/revoke_test.go

@@ -0,0 +1,121 @@
+package helper
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestPackageRevokeDurablyDisablesExactInventory(t *testing.T) {
+	c, _ := controlFixture(t)
+	r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+	record(t, c.Client, r)
+	if err := packageRevoke(c.Client, Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || got.Enabled || !got.Residual || got.Lifecycle.Phase != "fenced" {
+		t.Fatalf("not durably revoked: %+v %v", got, err)
+	}
+	if c.CheckStopped(context.Background()) == nil {
+		t.Fatal("revocation acknowledgement accepted as completion")
+	}
+	if err := c.Control(context.Background(), "recover"); err == nil {
+		t.Fatal("revoked approval recovered")
+	}
+}
+
+func TestRevokeAcknowledgementCannotCertifyQuiescence(t *testing.T) {
+	c, _ := controlFixture(t)
+	live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: req.Nonce, OK: true} })
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+	if c.Revoke(ctx) == nil {
+		t.Fatal("socket acknowledgement certified live process")
+	}
+}
+
+func TestRevokeRejectsUntrustedPeerAndWrongNonce(t *testing.T) {
+	for _, which := range []string{"peer", "nonce"} {
+		t.Run(which, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			live(t, c.Client, c.Expected, func(req Request) Response { return Response{Inventory: c.Expected, Nonce: "wrong", OK: true} })
+			if which == "peer" {
+				c.Peer = func(*net.UnixConn) error { return errTrust }
+			}
+			if c.Revoke(context.Background()) == nil {
+				t.Fatal("untrusted response accepted")
+			}
+		})
+	}
+}
+
+func TestRevokeNewBuildConsumesOldDisabledTerminalWithoutMutation(t *testing.T) {
+	c, f := controlFixture(t)
+	l := testLifecycle("fenced")
+	if err := createLifetime(c.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	before, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	c.Expected.Version = "1.0.0-0002"
+	if err := c.Revoke(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := os.ReadFile(filepath.Join(c.StateDir, "approval.json"))
+	if string(before) != string(after) {
+		t.Fatal("new build rewrote old publication")
+	}
+	if err := os.Remove(filepath.Join(c.StateDir, "completion-"+l.Epoch+".json")); err != nil {
+		t.Fatal(err)
+	}
+	if c.Revoke(context.Background()) == nil {
+		t.Fatal("missing terminal proof accepted")
+	}
+}
+
+func TestPackageRevokeRejectsWrongBuildInvalidFrameAndConcurrentEnable(t *testing.T) {
+	for _, kind := range []string{"build", "nonce", "operation", "busy"} {
+		t.Run(kind, func(t *testing.T) {
+			c, _ := controlFixture(t)
+			r := Record{Inventory: c.Expected, Enabled: true, Lifecycle: testLifecycle("running")}
+			record(t, c.Client, r)
+			req := Request{Inventory: c.Expected, Op: "revoke", Nonce: strings.Repeat("a", 64)}
+			switch kind {
+			case "build":
+				req.Inventory.Version = "0.1.0-0002"
+			case "nonce":
+				req.Nonce = ""
+			case "operation":
+				req.Op = "enable"
+			case "busy":
+				f, err := os.OpenFile(filepath.Join(c.StateDir, "control.lock"), os.O_CREATE|os.O_RDWR, 0600)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer f.Close()
+				if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if packageRevoke(c.Client, req) == nil {
+				t.Fatal("unsafe revoke accepted")
+			}
+			got, _ := readRecord(c.StateDir, c.Owner)
+			if !got.Enabled || got.Residual || got.Lifecycle.Phase != "running" {
+				t.Fatal("rejected request changed approval")
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/helper/sdk_server_linux.go

@@ -53,8 +53,8 @@ func serveLinux(c Client) error {
 	if err := os.Chmod(socket, 0660); err != nil {
 		return err
 	}
-	// Bound concurrency and each frame's size/time. No privileged mutations are
-	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	// Bound concurrency and each frame. The authenticated package UID may only
+	// withdraw authority; activation remains an exact approved root task.
 	slots := make(chan struct{}, 8)
 	for {
 		conn, err := l.AcceptUnix()
@@ -105,6 +105,15 @@ func serveLinux(c Client) error {
 			if health.Decode(&req) != nil {
 				return
 			}
+			if req.Op == "revoke" {
+				err := packageRevoke(c, req)
+				res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
+				if err != nil {
+					res.Error = "revoke-refused"
+				}
+				json.NewEncoder(conn).Encode(res)
+				return
+			}
 			r, err := readRecord(c.StateDir, 0)
 			readiness := "fenced"
 			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {

package/dist/templates/native-go/backend/internal/helper/server_linux.go

@@ -53,8 +53,8 @@ func serveLinux(c Client) error {
 	if err := os.Chmod(socket, 0660); err != nil {
 		return err
 	}
-	// Bound concurrency and each frame's size/time. No privileged mutations are
-	// accepted over this socket; lifecycle control remains fixed admin tasks.
+	// Bound concurrency and each frame. The authenticated package UID may only
+	// withdraw authority; activation remains an exact approved root task.
 	slots := make(chan struct{}, 8)
 	for {
 		conn, err := l.AcceptUnix()
@@ -80,6 +80,15 @@ func serveLinux(c Client) error {
 			if d.Decode(&req) != nil {
 				return
 			}
+			if req.Op == "revoke" {
+				err := packageRevoke(c, req)
+				res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
+				if err != nil {
+					res.Error = "revoke-refused"
+				}
+				json.NewEncoder(conn).Encode(res)
+				return
+			}
 			r, err := readRecord(c.StateDir, 0)
 			readiness := "fenced"
 			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {

package/dist/templates/native-go/dsm-package.yaml

@@ -35,7 +35,7 @@ ui:
 # UI languages: i18n/messages/<locale>.json for en, zh-TW, zh-CN, ja, ko, de,
 # fr, es and it (DSM's other languages fall back to English). build-spk checks
 # that every language has the en.json keys and placeholders, and that the keys
-# listed in the glossary use Synology's own DSM wording.
+# listed in the glossary use DSM's own wording.
 i18n:
   messages: i18n/messages
   glossary: i18n/glossary.json

package/dist/templates/native-go-authorization/backend/internal/app/authorization.go

@@ -0,0 +1,298 @@
+package app
+
+import (
+	"context"
+	"crypto/sha256"
+	"dsmapp/internal/api"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Compiled into the CGI. Package-owned JSON is never the source of trust.
+type authorizationTask struct {
+	Op     string `json:"op"`
+	Name   string `json:"name"`
+	Header string `json:"header"`
+	Script string `json:"script"`
+	Output bool   `json:"output"`
+}
+type authorizationBuild struct {
+	Schema    int    `json:"schema"`
+	Package   string `json:"package"`
+	Version   string `json:"version"`
+	Pin       string `json:"bootstrapSha256"`
+	Inventory struct {
+		Files []struct {
+			Path string `json:"path"`
+			Size int64  `json:"size"`
+			Hash string `json:"sha256"`
+		} `json:"files"`
+	} `json:"inventory"`
+	Tasks []authorizationTask `json:"tasks"`
+}
+
+func (cfg Config) authorizationRoutes() []api.Route {
+	if cfg.RootAuthorization == "" {
+		return nil
+	}
+	return []api.Route{api.UserRequest("authorization.status", cfg.authorizationStatus), api.Admin("authorization.request", cfg.authorizationRequest), api.Admin("authorization.revoke", cfg.authorizationRevoke)}
+}
+func authorizationDocument(state string, reason any) any {
+	return map[string]any{"command": "authorization", "schema_version": 1, "state": state, "reason": reason}
+}
+func (cfg Config) authorizationPlan() (authorizationBuild, error) {
+	var p authorizationBuild
+	raw, decode := base64.StdEncoding.DecodeString(cfg.RootAuthorization)
+	if decode != nil || json.Unmarshal(raw, &p) != nil || p.Schema != 2 || p.Package != cfg.PackageID || p.Version != cfg.Version || len(p.Tasks) == 0 || len(p.Pin) != 64 {
+		return p, errors.New("invalid build authorization")
+	}
+	if b, e := hex.DecodeString(p.Pin); e != nil || len(b) != 32 {
+		return p, errors.New("invalid bootstrap pin")
+	}
+	return p, nil
+}
+func (cfg Config) authorizationRequest(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return nil, e
+	}
+	if cfg.authorizationTrusted(p) != nil {
+		return nil, &api.Error{Code: "authorization_required", Message: "Build payload cannot be trusted; reinstall this package"}
+	}
+	ops := []string{}
+	for _, t := range p.Tasks {
+		if t.Op == "helper_enable" {
+			ops = []string{t.Op}
+			break
+		}
+		ops = append(ops, t.Op)
+	}
+	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "run": cfg.HelperInventory.Package != ""}, nil
+}
+func (cfg Config) authorizationRevoke(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return nil, e
+	}
+	// Root task still pins bootstrap. Corrupt UI must not prevent safe cleanup.
+	ops := []string{}
+	purge := false
+	for _, t := range p.Tasks {
+		ops = append(ops, t.Op)
+		if cfg.HelperInventory.Package != "" && t.Op == "helper_purge" {
+			purge = true
+		}
+	}
+	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "disable": cfg.HelperInventory.Package != "", "purge": purge}, nil
+}
+func (cfg Config) authorizationTrusted(p authorizationBuild) error {
+	root, e := os.OpenRoot("/var/packages/" + cfg.PackageID + "/target")
+	if e != nil {
+		return e
+	}
+	defer root.Close()
+	verify := func(path string, size int64, want string) error {
+		f, e := root.Open(path)
+		if e != nil {
+			return e
+		}
+		defer f.Close()
+		st, e := f.Stat()
+		if e != nil || !st.Mode().IsRegular() || st.Size() > 64<<20 || size >= 0 && st.Size() != size {
+			return errors.New("untrusted payload")
+		}
+		h := sha256.New()
+		_, e = io.Copy(h, io.LimitReader(f, (64<<20)+1))
+		if e != nil || hex.EncodeToString(h.Sum(nil)) != want {
+			return errors.New("untrusted payload")
+		}
+		return nil
+	}
+	if e = verify("authorization/bootstrap", -1, p.Pin); e != nil {
+		return e
+	}
+	for _, f := range p.Inventory.Files {
+		if e = verify(f.Path, f.Size, f.Hash); e != nil {
+			return e
+		}
+	}
+	return nil
+}
+func (cfg Config) authorizationStatus(ctx context.Context, caller api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	if e := decodeParams(params, &struct{}{}); e != nil {
+		return nil, e
+	}
+	p, e := cfg.authorizationPlan()
+	if e != nil {
+		return authorizationDocument("unavailable", "service_unavailable"), nil
+	}
+	if cfg.authorizationTrusted(p) != nil {
+		return authorizationDocument("authorization_required", "helper_untrusted"), nil
+	}
+	if cfg.HelperInventory.Package != "" {
+		s := cfg.integrationState(ctx)
+		if s.State == "ready" {
+			return authorizationDocument("ready", nil), nil
+		}
+		if !caller.Admin() {
+			return authorizationDocument("not_admin", "not_admin"), nil
+		}
+		switch s.State {
+		case "incompatible":
+			return authorizationDocument("authorization_required", "grant_incompatible"), nil
+		case "pending":
+			return authorizationDocument("unavailable", "health_probe_timeout"), nil
+		case "failed":
+			return authorizationDocument("unavailable", "service_unavailable"), nil
+		}
+	}
+	if !caller.Admin() {
+		return authorizationDocument("not_admin", "not_admin"), nil
+	}
+	state, reason := authorizationScheduler(ctx, r, p.Tasks)
+	if cfg.HelperInventory.Package != "" && state == "ready" {
+		state = "authorization_required"
+		reason = "grant_missing"
+	}
+	return authorizationDocument(state, reason), nil
+}
+
+// Read-only scheduler observations; never accept caller-selected URLs or task IDs.
+// One modern probe; legacy fallback only for explicit missing method (103).
+func authorizationScheduler(ctx context.Context, r *http.Request, tasks []authorizationTask) (string, any) {
+	return authorizationSchedulerAt(ctx, r, tasks, "http://127.0.0.1:5000")
+}
+func authorizationSchedulerAt(ctx context.Context, r *http.Request, tasks []authorizationTask, endpoint string) (string, any) {
+	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, DisableCompression: true, ResponseHeaderTimeout: 5 * time.Second, MaxResponseHeaderBytes: 32 << 10}
+	defer tr.CloseIdleConnections()
+	client := &http.Client{Transport: tr, Timeout: 8 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+	call := func(method string, version int, params url.Values) (json.RawMessage, int, error) {
+		params.Set("api", "SYNO.Core.TaskScheduler")
+		params.Set("method", method)
+		params.Set("version", strconv.Itoa(version))
+		req, e := http.NewRequestWithContext(ctx, "GET", endpoint+"/webapi/entry.cgi?"+params.Encode(), nil)
+		if e != nil {
+			return nil, 0, e
+		}
+		cookies := r.CookiesNamed("id")
+		if len(cookies) != 1 {
+			return nil, 0, errors.New("session")
+		}
+		req.AddCookie(cookies[0])
+		req.Header.Set("X-SYNO-TOKEN", r.Header.Get("X-SYNO-TOKEN"))
+		response, e := client.Do(req)
+		if e != nil {
+			return nil, 0, e
+		}
+		defer response.Body.Close()
+		b, e := io.ReadAll(io.LimitReader(response.Body, (1<<20)+1))
+		if e != nil || len(b) > 1<<20 || response.StatusCode != 200 {
+			return nil, 0, errors.New("scheduler unavailable")
+		}
+		var wire struct {
+			Success bool            `json:"success"`
+			Data    json.RawMessage `json:"data"`
+			Error   struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		if json.Unmarshal(b, &wire) != nil {
+			return nil, 0, errors.New("scheduler schema")
+		}
+		if !wire.Success {
+			return nil, wire.Error.Code, errors.New("scheduler refused")
+		}
+		return wire.Data, 0, nil
+	}
+	data, code, e := call("list", 3, url.Values{"start": {"0"}, "limit": {"500"}})
+	legacy := code == 103
+	if legacy {
+		data, code, e = call("list", 2, url.Values{"offset": {"0"}, "limit": {"500"}})
+	}
+	if e != nil {
+		if code == 106 || code == 107 || code == 119 {
+			return "session_expired", "session_expired"
+		}
+		return "unavailable", "scheduler_unavailable"
+	}
+	type item struct {
+		ID        json.Number `json:"id"`
+		Name      string      `json:"name"`
+		Owner     string      `json:"owner"`
+		RealOwner string      `json:"real_owner"`
+		Enable    *bool       `json:"enable"`
+		Type      string      `json:"type"`
+		Extra     struct {
+			Script string `json:"script"`
+		} `json:"extra"`
+	}
+	var list struct {
+		Tasks []item `json:"tasks"`
+		Total *int   `json:"total"`
+	}
+	if json.Unmarshal(data, &list) != nil || list.Total == nil || *list.Total != len(list.Tasks) || len(list.Tasks) > 500 {
+		return "unavailable", "scheduler_unavailable"
+	}
+	for _, expected := range tasks {
+		// Helper control tasks are individually approved on demand. Enable is the
+		// activation anchor; live helper health remains required separately.
+		if strings.HasPrefix(expected.Op, "helper_") && expected.Op != "helper_enable" {
+			continue
+		}
+		var found *item
+		for n := range list.Tasks {
+			if list.Tasks[n].Name == expected.Name {
+				if found != nil {
+					return "authorization_required", "maintenance_task_mismatch"
+				}
+				found = &list.Tasks[n]
+			}
+		}
+		if found == nil {
+			return "authorization_required", "grant_missing"
+		}
+		valid := func(t item) bool {
+			return t.Owner == "root" && t.RealOwner == "root" && t.Enable != nil && !*t.Enable && t.Type == "script"
+		}
+		if !valid(*found) {
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+		version := 4
+		if legacy {
+			version = 3
+		}
+		detail, _, e := call("get", version, url.Values{"id": {string(found.ID)}, "real_owner": {"root"}})
+		if e != nil {
+			return "unavailable", "scheduler_unavailable"
+		}
+		var full item
+		if json.Unmarshal(detail, &full) != nil || full.ID != found.ID || full.Name != expected.Name || !valid(full) {
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+		if full.Extra.Script != expected.Script {
+			if strings.HasPrefix(full.Extra.Script, expected.Header) {
+				return "authorization_required", "grant_incompatible"
+			}
+			return "authorization_required", "maintenance_task_mismatch"
+		}
+	}
+	return "ready", nil
+}

package/dist/templates/native-go-authorization/backend/internal/app/authorization_test.go

@@ -0,0 +1,96 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+)
+
+func TestAuthorizationFailClosed(t *testing.T) {
+	cfg := Config{PackageID: "RootDemo", Version: "0.1.0-0001", RootAuthorization: `{"schema":2}`}
+	if _, e := cfg.authorizationPlan(); e == nil {
+		t.Fatal("accepted missing pin")
+	}
+	if _, e := cfg.authorizationRequest(context.Background(), api.Caller{}, json.RawMessage(`{"op":"arbitrary"}`)); e == nil {
+		t.Fatal("accepted arbitrary params")
+	}
+	if len((Config{}).authorizationRoutes()) != 0 {
+		t.Fatal("default registered root routes")
+	}
+}
+func TestAuthorizationDocuments(t *testing.T) {
+	for _, state := range []string{"ready", "authorization_required", "not_admin", "unavailable"} {
+		b, e := json.Marshal(authorizationDocument(state, nil))
+		if e != nil {
+			t.Fatal(e)
+		}
+		var d map[string]any
+		json.Unmarshal(b, &d)
+		if d["command"] != "authorization" || d["schema_version"] != float64(1) || d["state"] != state {
+			t.Fatal(string(b))
+		}
+	}
+}
+
+func TestSchedulerRejectsChangedTaskAndFallsBackOnlyOn103(t *testing.T) {
+	for _, legacy := range []bool{false, true} {
+		altered := false
+		var versions []string
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			q := r.URL.Query()
+			versions = append(versions, q.Get("method")+":"+q.Get("version"))
+			if q.Get("method") == "list" && q.Get("version") == "3" && legacy {
+				io.WriteString(w, `{"success":false,"error":{"code":103}}`)
+				return
+			}
+			script := "approved"
+			if altered {
+				script = "unapproved"
+			}
+			item := map[string]any{"id": 1, "name": "RootDemo root: whoami", "owner": "root", "real_owner": "root", "enable": false, "type": "script", "extra": map[string]string{"script": script}}
+			var data any = item
+			if q.Get("method") == "list" {
+				data = map[string]any{"tasks": []any{item}, "total": 1}
+			}
+			json.NewEncoder(w).Encode(map[string]any{"success": true, "data": data})
+		}))
+		request := httptest.NewRequest("POST", "/", nil)
+		request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
+		tasks := []authorizationTask{{Op: "whoami", Name: "RootDemo root: whoami", Script: "approved", Header: "header"}}
+		state, _ := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
+		if state != "ready" {
+			t.Fatal(state)
+		}
+		if legacy && !slices.Contains(versions, "get:3") {
+			t.Fatal(versions)
+		}
+		if !legacy && slices.Contains(versions, "get:3") {
+			t.Fatal(versions)
+		}
+		altered = true
+		state, reason := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
+		if state != "authorization_required" || reason != "maintenance_task_mismatch" {
+			t.Fatal(state, reason)
+		}
+		server.Close()
+	}
+}
+func TestSchedulerPermissionFailureIsNotLegacyFallback(t *testing.T) {
+	calls := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		io.WriteString(w, `{"success":false,"error":{"code":105}}`)
+	}))
+	defer server.Close()
+	request := httptest.NewRequest("POST", "/", nil)
+	request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
+	state, _ := authorizationSchedulerAt(context.Background(), request, nil, server.URL)
+	if state != "unavailable" || calls != 1 {
+		t.Fatal(state, calls)
+	}
+}