@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/_executor/dsm.go

@@ -0,0 +1,319 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"os/user"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Command interface {
+	Exec(context.Context, string, []string) ([]byte, error)
+}
+type Accounts interface{ Lookup(string) (Subject, error) }
+type localAccounts struct{}
+
+func (localAccounts) Lookup(name string) (Subject, error) {
+	var s Subject
+	u, err := user.Lookup(name)
+	if err != nil || u.Username != name {
+		return s, errors.New("account")
+	}
+	uid, err := strconv.Atoi(u.Uid)
+	if err != nil {
+		return s, err
+	}
+	gid, err := strconv.Atoi(u.Gid)
+	if err != nil {
+		return s, err
+	}
+	gs, err := u.GroupIds()
+	if err != nil {
+		return s, err
+	}
+	admin, err := user.LookupGroup("administrators")
+	if err != nil {
+		return s, err
+	}
+	s = Subject{Username: name, UID: uid, GID: gid, Home: u.HomeDir}
+	for _, v := range gs {
+		g, err := strconv.Atoi(v)
+		if err != nil {
+			return Subject{}, err
+		}
+		s.Groups = append(s.Groups, g)
+		if v == admin.Gid {
+			s.Admin = true
+		}
+	}
+	sort.Ints(s.Groups)
+	return s, nil
+}
+
+type HTTPDoer interface {
+	Do(*http.Request) (*http.Response, error)
+}
+type liveDSM struct {
+	Command  Command
+	Accounts Accounts
+	HTTP     HTTPDoer
+	Endpoint string
+}
+
+func newDSM() *liveDSM {
+	return &liveDSM{Command: processCommand{}, Accounts: localAccounts{}, HTTP: &http.Client{Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, Endpoint: "http://127.0.0.1:5000/webapi/entry.cgi"}
+}
+
+type envelope struct {
+	Success bool            `json:"success"`
+	Data    json.RawMessage `json:"data"`
+}
+
+func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	var r envelope
+	d := json.NewDecoder(bytes.NewReader(b))
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
+		return nil, errors.New("DSM refused")
+	}
+	return r.Data, nil
+}
+func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, error) {
+	form := url.Values{"api": {"SYNO.Core.NormalUser"}, "version": {"1"}, "method": {"get"}}
+	req, err := http.NewRequestWithContext(ctx, "POST", d.Endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
+	req.Header.Set("X-SYNO-TOKEN", token)
+	res, err := d.HTTP.Do(req)
+	if err != nil {
+		return "", errors.New("session")
+	}
+	defer res.Body.Close()
+	b, err := io.ReadAll(io.LimitReader(res.Body, maxRequest+1))
+	if err != nil || len(b) > maxRequest || res.StatusCode != 200 {
+		return "", errors.New("session")
+	}
+	data, err := decodeEnvelope(b)
+	if err != nil {
+		return "", err
+	}
+	var out struct {
+		Username string `json:"username"`
+	}
+	if json.Unmarshal(data, &out) != nil || out.Username == "" || strings.ContainsFunc(out.Username, func(r rune) bool { return r < 32 }) {
+		return "", errors.New("session")
+	}
+	return out.Username, nil
+}
+func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
+	if runner != "" {
+		args = append(args, "runner="+runner)
+	}
+	keys := make([]string, 0, len(params))
+	for k := range params {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		b, err := json.Marshal(params[k])
+		if err != nil {
+			return nil, err
+		}
+		args = append(args, k+"="+string(b))
+	}
+	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
+	if err != nil {
+		return nil, errors.New("DSM command")
+	}
+	return decodeEnvelope(b)
+}
+func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
+	s, err := d.Accounts.Lookup(name)
+	if err != nil {
+		return s, err
+	}
+	data, err := d.call(ctx, "SYNO.Core.User", "get", "1", "", map[string]any{"name": name, "additional": []string{"expired"}})
+	if err != nil {
+		return Subject{}, err
+	}
+	var out struct {
+		Users []struct {
+			Name    string `json:"name"`
+			UID     *int   `json:"uid"`
+			Expired string `json:"expired"`
+		} `json:"users"`
+	}
+	if json.Unmarshal(data, &out) != nil || len(out.Users) != 1 || out.Users[0].Name != name || out.Users[0].UID == nil || *out.Users[0].UID != s.UID || out.Users[0].Expired != "normal" {
+		return Subject{}, errors.New("account ineligible")
+	}
+	s.Expired = out.Users[0].Expired
+	return s, nil
+}
+func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
+	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
+	if err != nil {
+		return err
+	}
+	// DSM 7.x omits default-allowed Apps from preview (measured on vt-nas).
+	// An explicit deny/custom entry or malformed/ambiguous response still refuses.
+	var out struct {
+		Apps *[]json.RawMessage `json:"applications"`
+	}
+	if json.Unmarshal(data, &out) != nil || out.Apps == nil || app == "" {
+		return errors.New("app privilege")
+	}
+	count := 0
+	for _, raw := range *out.Apps {
+		var a struct {
+			ID        string `json:"app_id"`
+			Privilege string `json:"privilelge"`
+		}
+		if json.Unmarshal(raw, &a) != nil || a.ID == "" || !contains([]string{"allow", "deny", "custom"}, a.Privilege) {
+			return errors.New("app privilege entry")
+		}
+		if a.ID == app {
+			count++
+			if a.Privilege != "allow" {
+				return errors.New("app denied")
+			}
+		}
+	}
+	if count > 1 {
+		return errors.New("app ambiguous")
+	}
+	return nil
+}
+func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
+	if scope == "home" {
+		if !cleanPath(s.Home) || s.Home == "/" {
+			return "", errors.New("home")
+		}
+		return filepath.EvalSymlinks(s.Home)
+	}
+	if scopeVirtual(scope) == "" {
+		return "", errors.New("scope")
+	}
+	name := strings.TrimPrefix(scope, "shared:")
+	data, err := d.call(ctx, "SYNO.Core.Share", "get", "1", "", map[string]any{"name": name})
+	if err != nil {
+		return "", err
+	}
+	var out struct {
+		Shares []struct {
+			Name string `json:"name"`
+			Path string `json:"path"`
+		} `json:"shares"`
+	}
+	if json.Unmarshal(data, &out) != nil || len(out.Shares) != 1 || out.Shares[0].Name != name || !cleanPath(out.Shares[0].Path) {
+		return "", errors.New("share")
+	}
+	return filepath.EvalSymlinks(out.Shares[0].Path)
+}
+func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
+	if runner == "" {
+		return nil, errors.New("runner")
+	}
+	api, method := "", ""
+	version := "2"
+	params := map[string]any{}
+	switch op {
+	case "files.list":
+		api = "SYNO.FileStation.List"
+		method = "list"
+		params["folder_path"] = p["path"]
+	case "files.info":
+		api = "SYNO.FileStation.List"
+		method = "getinfo"
+		params["path"] = []any{p["path"]}
+	case "files.createFolder":
+		api = "SYNO.FileStation.CreateFolder"
+		method = "create"
+		params["folder_path"] = p["path"]
+		params["name"] = p["name"]
+		params["force_parent"] = false
+	case "files.checkPermission":
+		api = "SYNO.FileStation.CheckPermission"
+		method = "write"
+		version = "3"
+		params["path"] = p["path"]
+		params["filename"] = ".synopkgland-permission-probe"
+		params["overwrite"] = false
+		params["size"] = 0
+	default:
+		return nil, errors.New("operation")
+	}
+	data, err := d.call(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	// Some File Station methods report per-file errors inside success:true.
+	if hasDSMError(data) {
+		return nil, errors.New("DSM file error")
+	}
+	var shape map[string]json.RawMessage
+	if json.Unmarshal(data, &shape) != nil {
+		return nil, errors.New("DSM data")
+	}
+	if op == "files.checkPermission" {
+		var skip *bool
+		if json.Unmarshal(shape["blSkip"], &skip) != nil || skip == nil || *skip {
+			return nil, errors.New("permission not confirmed")
+		}
+	} else {
+		key := "files"
+		if op == "files.createFolder" {
+			key = "folders"
+		}
+		var entries []json.RawMessage
+		if json.Unmarshal(shape[key], &entries) != nil || entries == nil {
+			return nil, errors.New("missing files")
+		}
+		if (op == "files.info" || op == "files.createFolder") && len(entries) != 1 {
+			return nil, errors.New("missing target")
+		}
+	}
+	return data, nil
+}
+func hasDSMError(data json.RawMessage) bool {
+	var v any
+	if json.Unmarshal(data, &v) != nil {
+		return true
+	}
+	var walk func(any) bool
+	walk = func(v any) bool {
+		switch x := v.(type) {
+		case map[string]any:
+			for k, v := range x {
+				if k == "error" {
+					return true
+				}
+				if k == "success" && v == false {
+					return true
+				}
+				if walk(v) {
+					return true
+				}
+			}
+		case []any:
+			for _, v := range x {
+				if walk(v) {
+					return true
+				}
+			}
+		}
+		return false
+	}
+	return walk(v)
+}

package/dist/templates/_executor/dsm_test.go

@@ -0,0 +1,196 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+type accountsStub struct {
+	s   Subject
+	err error
+}
+
+func (a accountsStub) Lookup(string) (Subject, error) { return a.s, a.err }
+
+type cmdStub struct {
+	reply string
+	args  []string
+	path  string
+	err   error
+}
+
+func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
+	c.path = p
+	c.args = args
+	return []byte(c.reply), c.err
+}
+func TestDSMAccountFailClosed(t *testing.T) {
+	for _, tc := range []struct {
+		name, reply string
+		pass        bool
+	}{
+		{"valid", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"normal"}]}}`, true},
+		{"success empty", `{"success":true,"data":{}}`, false},
+		{"success no user", `{"success":true,"data":{"users":[]}}`, false},
+		{"missing expiry", `{"success":true,"data":{"users":[{"name":"alice","uid":1200}]}}`, false},
+		{"disabled", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"now"}]}}`, false},
+		{"uid mismatch", `{"success":true,"data":{"users":[{"name":"alice","uid":1201,"expired":"normal"}]}}`, false},
+		{"name mismatch", `{"success":true,"data":{"users":[{"name":"bob","uid":1200,"expired":"normal"}]}}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := &cmdStub{reply: tc.reply}
+			d := &liveDSM{Command: c, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200}}}
+			_, err := d.Account(context.Background(), "alice")
+			if (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+func TestDSMAppPrivilege(t *testing.T) {
+	for _, tc := range []struct {
+		name, reply string
+		pass        bool
+	}{
+		{"allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`, true},
+		{"deny", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`, false},
+		{"custom", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"custom"}]}}`, false},
+		{"default allow", `{"success":true,"data":{"applications":[]}}`, true},
+		{"missing applications", `{"success":true,"data":{}}`, false},
+		{"null applications", `{"success":true,"data":{"applications":null}}`, false},
+		{"deny overrides allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"deny"}]}}`, false},
+		{"duplicate", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"allow"}]}}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := &cmdStub{reply: tc.reply}
+			d := &liveDSM{Command: c}
+			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app")
+			if (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(c.args, []string{"--exec", "api=SYNO.Core.AppPriv.App", "method=preview", "version=2", `username="alice"`}) {
+				t.Fatal(c.args)
+			}
+		})
+	}
+}
+func TestDSMVerify(t *testing.T) {
+	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			c, err := r.Cookie("id")
+			if err != nil || c.Value != "cookie" || r.Header.Get("X-SYNO-TOKEN") != "token" {
+				t.Error("cookie")
+			}
+			w.Write([]byte(reply))
+		}))
+		d := &liveDSM{HTTP: srv.Client(), Endpoint: srv.URL}
+		name, err := d.Verify(context.Background(), "cookie", "token")
+		srv.Close()
+		if strings.Contains(reply, `"alice"`) {
+			if err != nil || name != "alice" {
+				t.Fatal(name, err)
+			}
+		} else if err == nil {
+			t.Fatal("invalid identity accepted")
+		}
+	}
+}
+func TestDSMArgvAndEmbeddedError(t *testing.T) {
+	c := &cmdStub{reply: `{"success":true,"data":{"files":[{"error":{"code":407}}]}}`}
+	d := &liveDSM{Command: c}
+	_, err := d.API(context.Background(), "alice", "files.createFolder", map[string]any{"path": "/home", "name": "$(touch nope);`x`"})
+	if err == nil || c.path != "/usr/syno/bin/synowebapi" || !contains(c.args, "runner=alice") {
+		t.Fatal(err, c)
+	}
+	if !contains(c.args, `name="$(touch nope);`+"`x`"+`"`) {
+		t.Fatal(c.args)
+	}
+	c.err = errors.New("unavailable")
+	if _, err = d.API(context.Background(), "alice", "files.list", map[string]any{"path": "/home"}); err == nil {
+		t.Fatal("command error")
+	}
+}
+
+type rootStub struct {
+	calls int
+	err   error
+}
+
+func (r *rootStub) Run(context.Context, string, string) (string, error) {
+	r.calls++
+	return "root", r.err
+}
+func TestRootRequiresVerifiedAdmin(t *testing.T) {
+	e, f, _ := setup(t)
+	r := &rootStub{}
+	e.Runner = r
+	e.Policy.Root = map[string]string{"whoami": strings.Repeat("a", 64)}
+	out := request(e, "root.run", map[string]any{"name": "whoami"})
+	if out.Code != "ADMIN_REQUIRED" || r.calls != 0 {
+		t.Fatal(out)
+	}
+	f.user.Admin = true
+	if out = request(e, "root.run", map[string]any{"name": "whoami"}); !out.OK || r.calls != 1 {
+		t.Fatal(out)
+	}
+	if out = request(e, "root.run", map[string]any{"name": "other"}); out.Code != "POLICY_DENIED" {
+		t.Fatal(out)
+	}
+}
+func TestSubdirectoryBinding(t *testing.T) {
+	e, f, _ := setup(t)
+	f.root = t.TempDir()
+	f.root = realTestPath(t, f.root)
+	if err := makeTestDir(f.root + "/downloads"); err != nil {
+		t.Fatal(err)
+	}
+	out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home/downloads", "ttl_seconds": 60})
+	if !out.OK {
+		t.Fatal(out)
+	}
+}
+
+func TestDSMEmptyOperationDataDenied(t *testing.T) {
+	for _, op := range []string{"files.list", "files.info", "files.createFolder", "files.checkPermission"} {
+		c := &cmdStub{reply: `{"success":true,"data":{}}`}
+		d := &liveDSM{Command: c}
+		if _, err := d.API(context.Background(), "alice", op, map[string]any{"path": "/home", "name": "new"}); err == nil {
+			t.Fatal(op, "empty success accepted")
+		}
+	}
+}
+
+type eligibilityCommand struct{ expired, deniedApp string }
+
+func (c eligibilityCommand) Exec(_ context.Context, _ string, args []string) ([]byte, error) {
+	if contains(args, "api=SYNO.Core.User") {
+		return []byte(`{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"` + c.expired + `"}]}}`), nil
+	}
+	if c.deniedApp != "" {
+		return []byte(`{"success":true,"data":{"applications":[{"app_id":"` + c.deniedApp + `","privilelge":"deny"}]}}`), nil
+	}
+	return []byte(`{"success":true,"data":{"applications":[]}}`), nil
+}
+func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *testing.T) {
+	for _, tc := range []struct{ name, expiry, deny, want string }{
+		{"ordinary defaults", "normal", "", ""},
+		{"explicit App deny", "normal", "app", "APP_DENIED"},
+		{"explicit File Station deny", "normal", "SYNO.SDS.App.FileStation3.Instance", "APP_DENIED"},
+		{"disabled with default Apps", "now", "", "INELIGIBLE"},
+		{"unknown account state", "", "", "INELIGIBLE"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			e, _, _ := setup(t)
+			e.DSM = &liveDSM{Command: eligibilityCommand{expired: tc.expiry, deniedApp: tc.deny}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
+			_, code := e.eligible(context.Background(), "alice", 1200, true)
+			if code != tc.want {
+				t.Fatal(code, tc.want)
+			}
+		})
+	}
+}