@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/grant_repository_linux_test.go

@@ -1,469 +0,0 @@
-//go:build linux
-
-package helper
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"golang.org/x/sys/unix"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func rootGrantFixture(t *testing.T) (string, Inventory, Record) {
-	t.Helper()
-	if os.Geteuid() != 0 {
-		t.Skip("requires disposable Linux root VM")
-	}
-	dir, err := os.MkdirTemp("/run", "s3-grants-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(dir) })
-	store, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
-	if c != "" {
-		t.Fatal(c)
-	}
-	g := store.Grants[0]
-	record := Record{Schema: 2, Inventory: g.Inventory, Enabled: true, Lifecycle: &Lifecycle{Schema: 2, Epoch: g.LastValidated.Epoch, Phase: "running", Binding: Binding{Entered: 1, Boot: "fixture-boot", Install: grantRef('7')}}}
-	if err := writeProtected(dir, "approval.json", record); err != nil {
-		t.Fatal(err)
-	}
-	return dir, g.Inventory, record
-}
-func openRootGrantRepository(t *testing.T, dir string, i Inventory) *FileGrantRepository {
-	t.Helper()
-	r, c := OpenFileGrantRepository(dir, i)
-	if c != "" {
-		t.Fatal(c)
-	}
-	t.Cleanup(func() { r.Close() })
-	return r
-}
-func diskGrantSnapshot(t *testing.T, r *FileGrantRepository) (GrantPolicy, GrantStore) {
-	t.Helper()
-	var p GrantPolicy
-	var s GrantStore
-	if c := r.Transact(func(policy GrantPolicy, store *GrantStore) (bool, Code) { p = policy; s = *store; return false, "" }); c != "" {
-		t.Fatal(c)
-	}
-	return p, s
-}
-func insertDiskGrant(t *testing.T, r *FileGrantRepository) Grant {
-	t.Helper()
-	var g Grant
-	code := r.Transact(func(p GrantPolicy, s *GrantStore) (bool, Code) {
-		fixture, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
-		if c != "" {
-			t.Fatal(c)
-		}
-		g = fixture.Grants[0]
-		g.Inventory = p.Inventory
-		g.ApprovalBinding = p.ApprovalBinding
-		g.CapabilityDigest = p.CapabilityDigest
-		g.LastValidated.Epoch = p.Epoch
-		s.Grants = append(s.Grants, g)
-		s.Revision++
-		return true, ""
-	})
-	if code != "" {
-		t.Fatal(code)
-	}
-	return g
-}
-func TestGrantDiskDurabilityPermissionsAndSingleOwner(t *testing.T) {
-	dir, i, _ := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	if other, c := OpenFileGrantRepository(dir, i); c != ErrBusy || other != nil {
-		t.Fatal("multiple ordering owners", c)
-	}
-	g := insertDiskGrant(t, r)
-	p, s := diskGrantSnapshot(t, r)
-	if p.ApprovalBinding == "" || s.Grants[0].ID != g.ID || s.Revision != 2 {
-		t.Fatal("disk snapshot")
-	}
-	info, err := os.Stat(filepath.Join(dir, "grants.json"))
-	if err != nil || info.Mode().Perm() != 0600 {
-		t.Fatal("private snapshot", err)
-	}
-	if err := r.Close(); err != nil {
-		t.Fatal(err)
-	}
-	reopened := openRootGrantRepository(t, dir, i)
-	if _, code := NewGrantAuthority(reopened, nil, nil, nil); code != "" {
-		t.Fatal(code)
-	}
-	_, s = diskGrantSnapshot(t, reopened)
-	if s.Grants[0].State != GrantSuspended || s.Grants[0].Revision != g.Revision+1 || s.Revision != 3 {
-		t.Fatal("restart restored active record")
-	}
-}
-func TestGrantDiskRefusesUntrustedArtifacts(t *testing.T) {
-	for _, kind := range []string{"file-symlink", "parent-symlink", "writable-parent", "file-mode", "owner", "hardlink", "oversize", "bad-schema", "duplicate", "fifo", "policy-symlink", "policy-mode", "lock-symlink"} {
-		t.Run(kind, func(t *testing.T) {
-			dir, i, _ := rootGrantFixture(t)
-			name := filepath.Join(dir, "grants.json")
-			snapshot := []byte(`{"grantSchema":1,"storeRevision":1,"grants":[]}`)
-			if err := os.WriteFile(name, snapshot, 0600); err != nil {
-				t.Fatal(err)
-			}
-			switch kind {
-			case "file-symlink":
-				os.Remove(name)
-				os.Symlink("approval.json", name)
-			case "parent-symlink":
-				link := dir + "-link"
-				if err := os.Symlink(dir, link); err != nil {
-					t.Fatal(err)
-				}
-				t.Cleanup(func() { os.Remove(link) })
-				dir = link
-			case "writable-parent":
-				os.Chmod(dir, 0777)
-			case "file-mode":
-				os.Chmod(name, 0644)
-			case "owner":
-				os.Chown(name, 1001, 1001)
-			case "hardlink":
-				os.Link(name, filepath.Join(dir, "alias"))
-			case "oversize":
-				os.WriteFile(name, bytes.Repeat([]byte{' '}, MaxGrantStoreBytes+1), 0600)
-			case "bad-schema":
-				os.WriteFile(name, []byte(`{"grantSchema":99,"storeRevision":1,"grants":[]}`), 0600)
-			case "duplicate":
-				os.WriteFile(name, []byte(`{"grantSchema":1,"grantSchema":1,"storeRevision":1,"grants":[]}`), 0600)
-			case "fifo":
-				os.Remove(name)
-				if err := makeGrantFIFO(name); err != nil {
-					t.Fatal(err)
-				}
-			case "policy-symlink":
-				os.Remove(filepath.Join(dir, "approval.json"))
-				os.Symlink("grants.json", filepath.Join(dir, "approval.json"))
-			case "policy-mode":
-				os.Chmod(filepath.Join(dir, "approval.json"), 0666)
-			case "lock-symlink":
-				os.Symlink("approval.json", filepath.Join(dir, "grants.lock"))
-			}
-			r, code := OpenFileGrantRepository(dir, i)
-			if code == "" {
-				defer r.Close()
-				code = r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
-					t.Fatal("untrusted disk reached mutation")
-					return false, ""
-				})
-			}
-			if code == "" {
-				t.Fatal("accepted", kind)
-			}
-		})
-	}
-}
-func TestGrantDiskFsyncRenameCrashGaps(t *testing.T) {
-	for _, stage := range []string{"write", "file-sync", "rename", "after-rename", "directory-sync"} {
-		t.Run(stage, func(t *testing.T) {
-			dir, i, _ := rootGrantFixture(t)
-			r := openRootGrantRepository(t, dir, i)
-			g := insertDiskGrant(t, r)
-			r.fault = func(where string) error {
-				if where == stage {
-					return errors.New("fixture disk failure")
-				}
-				return nil
-			}
-			code := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
-				s.Grants[0].State = GrantRevoked
-				s.Grants[0].Reason = ErrRevoked
-				s.Grants[0].RevokedAt = g.CreatedAt + 1
-				s.Grants[0].Revision++
-				s.Revision++
-				return true, ""
-			})
-			want := ErrUnavailable
-			if stage == "after-rename" || stage == "directory-sync" {
-				want = ErrCommitUncertain
-			}
-			if code != want {
-				t.Fatal(code, want)
-			}
-			if code := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) { t.Fatal("failed owner continued"); return false, "" }); code != ErrFenced {
-				t.Fatal(code)
-			}
-			r.Close()
-			reopened := openRootGrantRepository(t, dir, i)
-			if _, code := NewGrantAuthority(reopened, nil, nil, nil); code != "" {
-				t.Fatal(code)
-			}
-			_, snapshot := diskGrantSnapshot(t, reopened)
-			expected := GrantSuspended
-			if want == ErrCommitUncertain {
-				expected = GrantRevoked
-			}
-			if snapshot.Grants[0].State != expected {
-				t.Fatal(snapshot.Grants[0].State, expected)
-			}
-			// Reconsent cannot reuse the old grant ID or undo its revocation.
-		})
-	}
-}
-func TestGrantDiskReplayAndImmutableTombstones(t *testing.T) {
-	dir, i, _ := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	g := insertDiskGrant(t, r)
-	old, err := os.ReadFile(filepath.Join(dir, "grants.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if code := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
-		s.Grants[0].State = GrantRevoked
-		s.Grants[0].Reason = ErrRevoked
-		s.Grants[0].RevokedAt = g.CreatedAt + 1
-		s.Grants[0].Revision++
-		s.Revision++
-		return true, ""
-	}); code != "" {
-		t.Fatal(code)
-	}
-	if code := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
-		s.Grants = s.Grants[:0]
-		s.Revision++
-		return true, ""
-	}); code != ErrDenied {
-		t.Fatal("tombstone dropped", code)
-	}
-	if err := os.WriteFile(filepath.Join(dir, "grants.json"), old, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if code := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) { t.Fatal("replayed disk authority"); return false, "" }); code != ErrStale {
-		t.Fatal(code)
-	}
-}
-func TestGrantDiskTwoSnapshotCrashAndPolicyLocks(t *testing.T) {
-	dir, i, record := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	insertDiskGrant(t, r)
-	// approval and grants are NOT multi-file atomic. Crash after either changes
-	// always reconciles active grants before exposing the new owner.
-	record.Lifecycle.Epoch = grantRef('9')
-	if err := writeProtected(dir, "approval.json", record); err != nil {
-		t.Fatal(err)
-	}
-	r.Close()
-	r = openRootGrantRepository(t, dir, i)
-	if _, c := NewGrantAuthority(r, nil, nil, nil); c != "" {
-		t.Fatal(c)
-	}
-	p, s := diskGrantSnapshot(t, r)
-	if p.Epoch != record.Lifecycle.Epoch || s.Grants[0].State != GrantSuspended {
-		t.Fatal("two snapshot crash restored authority")
-	}
-	held := holdGrantTestLock(t, dir, "policy.lock")
-	if c := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
-		t.Fatal("blocked lock entered callback")
-		return false, ""
-	}); c != ErrBusy {
-		t.Fatal(c)
-	}
-	held.Close()
-	held = holdGrantTestLock(t, dir, "grants.lock")
-	if c := r.Transact(func(GrantPolicy, *GrantStore) (bool, Code) {
-		t.Fatal("blocked grant lock entered callback")
-		return false, ""
-	}); c != ErrBusy {
-		t.Fatal(c)
-	}
-	held.Close()
-}
-func TestGrantDiskQIsSeparateDurableBoundedArtifact(t *testing.T) {
-	dir, i, _ := rootGrantFixture(t)
-	r := openRootGrantRepository(t, dir, i)
-	g := insertDiskGrant(t, r)
-	p, _ := diskGrantSnapshot(t, r)
-	key := GrantDrainKey{p.Epoch, g.ID, g.Revision}
-	if c := r.SaveQuiescence(completeGrantProof(key)); c != ErrStale {
-		t.Fatal("Q before R", c)
-	}
-	if c := r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
-		s.Grants[0].State = GrantRevoked
-		s.Grants[0].Reason = ErrRevoked
-		s.Grants[0].RevokedAt = g.CreatedAt + 1
-		s.Grants[0].Revision++
-		s.Revision++
-		return true, ""
-	}); c != "" {
-		t.Fatal(c)
-	}
-	key.Revision++
-	q := completeGrantProof(key)
-	if c := r.SaveQuiescence(q); c != "" {
-		t.Fatal(c)
-	}
-	name := filepath.Join(dir, "grant-q-"+g.ID+".json")
-	info, err := os.Stat(name)
-	if err != nil || info.Mode().Perm() != 0600 {
-		t.Fatal("Q artifact", err)
-	}
-	q.RelayClosed = false
-	if c := r.SaveQuiescence(q); c != ErrInvalid {
-		t.Fatal("incomplete durable Q", c)
-	}
-	r.fault = func(stage string) error {
-		if stage == "directory-sync" {
-			return errors.New("fixture Q failure")
-		}
-		return nil
-	}
-	if c := r.SaveQuiescence(completeGrantProof(key)); c != ErrCommitUncertain {
-		t.Fatal("Q directory fsync", c)
-	}
-}
-func makeGrantFIFO(name string) error { return unix.Mkfifo(name, 0600) }
-func holdGrantTestLock(t *testing.T, dir, name string) *os.File {
-	t.Helper()
-	f, err := os.OpenFile(filepath.Join(dir, name), os.O_CREATE|os.O_RDWR, 0600)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = unix.Flock(int(f.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { f.Close() })
-	return f
-}
-
-func TestGrantDiskRealCrashRecovery(t *testing.T) {
-	for _, stage := range []string{"file-sync", "rename", "after-rename", "directory-sync"} {
-		t.Run(stage, func(t *testing.T) {
-			dir, i, _ := rootGrantFixture(t)
-			r := openRootGrantRepository(t, dir, i)
-			insertDiskGrant(t, r)
-			r.Close()
-			exe, err := os.Executable()
-			if err != nil {
-				t.Fatal(err)
-			}
-			cmd := exec.Command(exe, "-test.run=^TestGrantDiskCrashSubprocess$")
-			cmd.Env = append(os.Environ(), "S3_CRASH_DIR="+dir, "S3_CRASH_STAGE="+stage)
-			output, err := cmd.CombinedOutput()
-			var exit *exec.ExitError
-			if !errors.As(err, &exit) || exit.ExitCode() != 73 {
-				t.Fatalf("crash fixture: %s %v", output, err)
-			}
-			reopened := openRootGrantRepository(t, dir, i)
-			if _, c := NewGrantAuthority(reopened, nil, nil, nil); c != "" {
-				t.Fatal(c)
-			}
-			_, s := diskGrantSnapshot(t, reopened)
-			want := GrantSuspended
-			if stage == "after-rename" || stage == "directory-sync" {
-				want = GrantRevoked
-			}
-			if s.Grants[0].State != want {
-				t.Fatal(s.Grants[0].State, want)
-			}
-			leftovers, err := filepath.Glob(filepath.Join(dir, ".grant-transition-*"))
-			if err != nil || len(leftovers) != 0 {
-				t.Fatal("unbounded orphan temps", leftovers, err)
-			}
-		})
-	}
-}
-func TestGrantDiskCrashSubprocess(t *testing.T) {
-	dir := os.Getenv("S3_CRASH_DIR")
-	if dir == "" {
-		t.Skip("subprocess only")
-	}
-	s, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
-	if c != "" {
-		t.Fatal(c)
-	}
-	r, c := OpenFileGrantRepository(dir, s.Grants[0].Inventory)
-	if c != "" {
-		t.Fatal(c)
-	}
-	r.fault = func(stage string) error {
-		if stage == os.Getenv("S3_CRASH_STAGE") {
-			os.Exit(73)
-		}
-		return nil
-	}
-	c = r.Transact(func(_ GrantPolicy, s *GrantStore) (bool, Code) {
-		g := &s.Grants[0]
-		g.State = GrantRevoked
-		g.Reason = ErrRevoked
-		g.RevokedAt = g.CreatedAt + 1
-		g.Revision++
-		s.Revision++
-		return true, ""
-	})
-	t.Fatal("did not crash", c)
-}
-
-func TestGrantDiskNonrootProcess(t *testing.T) {
-	i := Inventory{Package: "Fixture", Version: "1.0.0-0001", Protocol: 2, PayloadDigest: grantRef('a'), RegistryDigest: grantRef('b')}
-	if os.Getenv("S3_NONROOT") == "yes" {
-		if os.Geteuid() == 0 {
-			t.Fatal("fixture not dropped")
-		}
-		if r, c := OpenFileGrantRepository("/run", i); c != ErrDenied || r != nil {
-			t.Fatal("nonroot authority", c)
-		}
-		return
-	}
-	if os.Geteuid() != 0 {
-		t.Skip("requires disposable Linux root VM")
-	}
-	exe, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	cmd := exec.Command(exe, "-test.run=^TestGrantDiskNonrootProcess$")
-	cmd.Env = append(os.Environ(), "S3_NONROOT=yes")
-	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: 1001, Gid: 1001}}
-	if output, err := cmd.CombinedOutput(); err != nil {
-		t.Fatalf("nonroot fixture: %s %v", output, err)
-	}
-}
-
-func TestGrantDiskAuthorityEndToEnd(t *testing.T) {
-	dir, i, _ := rootGrantFixture(t)
-	repository := openRootGrantRepository(t, dir, i)
-	fixture, _, p, _, _, v, carriers, now := grantAuthorityFixture(t)
-	authority, code := NewGrantAuthority(repository, p, v, fixture.cohort)
-	if code != "" {
-		t.Fatal(code)
-	}
-	authority.now = func() time.Time { return now }
-	intent := prepareGrant(t, authority, carriers, ScopePersonal)
-	_, initial := diskGrantSnapshot(t, repository)
-	grant, code := authority.Confirm(context.Background(), carriers, intent.ID, intent.SummaryDigest, initial.Revision)
-	if code != "" {
-		t.Fatal(code)
-	}
-	admission := admissionFor(t, p, carriers, grant)
-	if code := authority.WithGrantAdmission(admission, func(Grant, NativeActor) Code { return "" }); code != "" {
-		t.Fatal(code)
-	}
-	result, code := authority.Revoke(context.Background(), carriers, grant.ID, 1, initial.Revision+1)
-	if code != "" || !result.Revoked || !result.Drained {
-		t.Fatal(result, code)
-	}
-	if code := authority.WithGrantAdmission(admission, func(Grant, NativeActor) Code { t.Fatal("revoked disk admitted"); return "" }); code != ErrRevoked {
-		t.Fatal(code)
-	}
-	repository.Close()
-	repository = openRootGrantRepository(t, dir, i)
-	_, code = NewGrantAuthority(repository, p, v, fixture.cohort)
-	if code != "" {
-		t.Fatal(code)
-	}
-	_, s := diskGrantSnapshot(t, repository)
-	if len(s.Grants) != 1 || s.Grants[0].State != GrantRevoked || s.Grants[0].Revision != 2 {
-		t.Fatal("R lost after reopen")
-	}
-}

package/dist/templates/native-go/backend/internal/helper/grant_rpc.go

@@ -1,147 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-)
-
-// Private root-helper -> sole root-supervisor control. Session carriers exist
-// only in this bounded frame; they are never echoed, logged or retained.
-type grantCarriers struct {
-	Cookie        string `json:"cookie"`
-	SynoToken     string `json:"synoToken"`
-	ClientAddress string `json:"clientAddress"`
-}
-type supervisorGrantRequest struct {
-	Epoch    string          `json:"epoch"`
-	Method   string          `json:"method"`
-	Carriers grantCarriers   `json:"carriers"`
-	Args     json.RawMessage `json:"args"`
-}
-type grantPrepareArgs struct {
-	CandidateID string    `json:"candidateId"`
-	ScopeKind   ScopeKind `json:"scopeKind"`
-	Actions     []Action  `json:"actions"`
-}
-type grantConfirmArgs struct {
-	IntentID      string `json:"intentId"`
-	SummaryDigest string `json:"summaryDigest"`
-	StoreRevision uint64 `json:"storeRevision"`
-}
-type grantRevokeArgs struct {
-	GrantID       string `json:"grantId"`
-	GrantRevision uint64 `json:"grantRevision"`
-	StoreRevision uint64 `json:"storeRevision"`
-}
-type supervisorGrantResponse struct {
-	Nonce    string           `json:"nonce"`
-	Code     Code             `json:"code"`
-	Intent   *Intent          `json:"intent,omitempty"`
-	Grant    *Grant           `json:"grant,omitempty"`
-	Files    *readOnlyResult  `json:"files,omitempty"`
-	Mutation *MutationReceipt `json:"mutation,omitempty"`
-	Revoke   *RevokeResult    `json:"revoke,omitempty"`
-}
-
-func (s *supervisorGrants) dispatch(ctx context.Context, peer operationPeer, nonce string, raw []byte) supervisorGrantResponse {
-	res := supervisorGrantResponse{Nonce: nonce}
-	if s == nil || !s.cohort.peerAllowed(peer) {
-		res.Code = ErrDenied
-		return res
-	}
-	if !allReferences(nonce) {
-		res.Code = ErrInvalid
-		return res
-	}
-	var req supervisorGrantRequest
-	if res.Code = decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); res.Code != "" {
-		return res
-	}
-	if req.Epoch != s.cohort.epoch {
-		res.Code = ErrStale
-		return res
-	}
-	if len(req.Carriers.Cookie) > 4096 || len(req.Carriers.SynoToken) > 4096 || len(req.Carriers.ClientAddress) > 256 {
-		res.Code = ErrLimit
-		return res
-	}
-	// Validate method-specific shape before burning a bounded RPC nonce.
-	var prepare grantPrepareArgs
-	var confirm grantConfirmArgs
-	var revoke grantRevokeArgs
-	var data DataRequest
-	var dst any
-	switch req.Method {
-	case "prepare":
-		dst = &prepare
-	case "confirm":
-		dst = &confirm
-	case "revoke":
-		dst = &revoke
-	case "operation.start", "operation.chunk", "operation.result", "operation.commit":
-		dst = &data
-	default:
-		res.Code = ErrUnsupported
-		return res
-	}
-	if res.Code = decodeDataObject(bytes.NewReader(req.Args), dst, MaxControlBytes); res.Code != "" {
-		return res
-	}
-	if s.rpcNonces[nonce] || s.streamRPCNonces[nonce] {
-		res.Code = ErrReplay
-		return res
-	}
-	stream := data.Op == ActionReadStream || data.Op == ActionWriteStream || data.Op == ActionPublish
-	if stream {
-		if res.Code = validateOperationRequest(data, s.services.writes); res.Code != "" {
-			return res
-		}
-	}
-	full := len(s.rpcNonces) >= MaxReplayEntries
-	if stream {
-		full = len(s.streamRPCNonces) >= MaxStreamReplayEntries
-	}
-	if full {
-		res.Code = ErrBusy
-		return res
-	}
-	if stream {
-		s.streamRPCNonces[nonce] = true
-	} else {
-		s.rpcNonces[nonce] = true
-	}
-	carriers := SessionCarriers{req.Carriers.Cookie, req.Carriers.SynoToken, req.Carriers.ClientAddress}
-	switch req.Method {
-	case "prepare":
-		value, code := s.authority.Prepare(ctx, carriers, prepare.CandidateID, prepare.ScopeKind, prepare.Actions)
-		res.Code = code
-		if code == "" {
-			res.Intent = &value
-		}
-	case "confirm":
-		value, code := s.authority.Confirm(ctx, carriers, confirm.IntentID, confirm.SummaryDigest, confirm.StoreRevision)
-		res.Code = code
-		if code == "" {
-			res.Grant = &value
-		}
-	case "revoke":
-		value, code := s.authority.Revoke(ctx, carriers, revoke.GrantID, revoke.GrantRevision, revoke.StoreRevision)
-		res.Code = code
-		res.Revoke = &value
-	case "operation.start":
-		res.Code = s.start(ctx, peer, carriers, data)
-	case "operation.chunk":
-		res.Code = s.chunk(ctx, peer, carriers, data)
-	case "operation.commit":
-		res.Code = s.writeControl(ctx, peer, carriers, data, true)
-	case "operation.result":
-		if !data.Op.ReadOnly() {
-			res.Mutation, res.Code = s.writeResult(ctx, peer, carriers, data)
-		} else {
-			res.Files, res.Code = s.result(ctx, peer, carriers, data)
-		}
-	}
-	res.Code = safeGrantCode(res.Code)
-	return res
-}

package/dist/templates/native-go/backend/internal/helper/grant_rpc_test.go

@@ -1,51 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"testing"
-)
-
-func grantRPC(t *testing.T, method string, epoch string, carriers SessionCarriers, args any) []byte {
-	t.Helper()
-	raw, _ := json.Marshal(args)
-	b, _ := json.Marshal(supervisorGrantRequest{Epoch: epoch, Method: method, Carriers: grantCarriers{carriers.Cookie, carriers.SynoToken, carriers.ClientAddress}, Args: raw})
-	return b
-}
-func TestGrantRPCExactPeerAndStrictControls(t *testing.T) {
-	s, r, c, carriers, g, _ := grantCohortFixture(t)
-	valid := grantRPC(t, "revoke", c.epoch, carriers, grantRevokeArgs{g.ID, g.Revision, r.store.Revision})
-	for _, peer := range []operationPeer{{41, 0}, {42, 1}} {
-		if res := s.dispatch(context.Background(), peer, grantRef('a'), valid); res.Code != ErrDenied {
-			t.Fatal(res)
-		}
-	}
-	for _, b := range [][]byte{bytes.Replace(valid, []byte(`"method":"revoke"`), []byte(`"method":"revoke","method":"prepare"`), 1), append(valid, valid...), bytes.Replace(valid, []byte(`"grantId"`), []byte(`"callerUID"`), 1)} {
-		if res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('b'), b); res.Code != ErrInvalid {
-			t.Fatal(res)
-		}
-	}
-	if res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('c'), grantRPC(t, "revoke", grantRef('f'), carriers, grantRevokeArgs{g.ID, g.Revision, r.store.Revision})); res.Code != ErrStale {
-		t.Fatal(res)
-	}
-	res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('d'), valid)
-	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained || r.q.Cohort == nil {
-		t.Fatal(res)
-	}
-	if res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('d'), valid); res.Code != ErrReplay {
-		t.Fatal(res)
-	}
-}
-func TestGrantRPCPrepareConfirmAndFence(t *testing.T) {
-	s, r, c, carriers, _, _ := grantCohortFixture(t)
-	res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('a'), grantRPC(t, "prepare", c.epoch, carriers, grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}))
-	if res.Code != "" || res.Intent == nil {
-		t.Fatal(res)
-	}
-	c.gate.fence("observer")
-	res = s.dispatch(context.Background(), operationPeer{42, 0}, grantRef('b'), grantRPC(t, "confirm", c.epoch, carriers, grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, r.store.Revision}))
-	if res.Code != ErrFenced {
-		t.Fatal(res)
-	}
-}