@synopackageland/cli 0.5.0 → 0.6.0

package/templates/native-go-better-auth/backend/internal/app/identity_test.go

@@ -1,113 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestIdentityCGIBindsFreshCallerAndPersistsStore(t *testing.T) {
-	cfg := personalFixture(t)
-	old := identityRun
-	t.Cleanup(func() { identityRun = old })
-	tickets := map[string]bool{}
-	identityRun = func(_ context.Context, cfg Config, input []byte) ([]byte, error) {
-		var in struct {
-			Ticket    string
-			Principal map[string]string
-			Store     map[string]any
-		}
-		if err := json.Unmarshal(input, &in); err != nil {
-			t.Fatal(err)
-		}
-		if len(in.Ticket) != 64 || tickets[in.Ticket] || in.Principal["name"] != "normal1" || in.Principal["uid"] != "1001" {
-			t.Fatal("not fresh native caller", in)
-		}
-		tickets[in.Ticket] = true
-		return []byte(`{"store":{"marker":"saved"},"result":{"ok":true,"user":"normal1","cookie":"session=fixture"}}`), nil
-	}
-	for i := 0; i < 2; i++ {
-		code, out := personalCall(t, cfg, "normal1", "identity.login", `{}`)
-		if code != "" || out["data"].(map[string]any)["user"] != "normal1" {
-			t.Fatal(code, out)
-		}
-	}
-	if len(tickets) != 2 {
-		t.Fatal(tickets)
-	}
-	data, _ := os.ReadFile(filepath.Join(cfg.DataDir, "identity/store.json"))
-	if !strings.Contains(string(data), "saved") {
-		t.Fatal(string(data))
-	}
-	for _, params := range []string{`{"user":"normal2"}`, `{"ticket":"forged"}`, `{"path":"/etc/passwd"}`} {
-		if code, _ := personalCall(t, cfg, "normal1", "identity.login", params); code != "bad_request" {
-			t.Fatal(code)
-		}
-	}
-	if code, _ := call(t, cfg, stubAuth{err: api.ErrNoSession}, "identity.login", `{}`); code != "session_required" {
-		t.Fatal(code)
-	}
-}
-func TestIdentityRefusesSymlinkStore(t *testing.T) {
-	cfg := personalFixture(t)
-	os.Mkdir(filepath.Join(cfg.DataDir, "identity"), 0700)
-	outside := filepath.Join(t.TempDir(), "victim")
-	os.WriteFile(outside, []byte("unchanged"), 0600)
-	os.Symlink(outside, filepath.Join(cfg.DataDir, "identity/store.json"))
-	if code, _ := personalCall(t, cfg, "normal1", "identity.login", `{}`); code != "identity_unavailable" {
-		t.Fatal(code)
-	}
-	b, _ := os.ReadFile(outside)
-	if string(b) != "unchanged" {
-		t.Fatal("escaped")
-	}
-}
-
-func TestIdentityRealBundledNodeRoundTrip(t *testing.T) {
-	bundle := os.Getenv("M1B_NODE_FIXTURE_BUNDLE")
-	node := os.Getenv("M1B_NODE_FIXTURE_EXECUTABLE")
-	if bundle == "" || node == "" {
-		t.Skip("artifact runner provides the selected Node bundle")
-	}
-	cfg := personalFixture(t)
-	old := identityRun
-	t.Cleanup(func() { identityRun = old })
-	identityRun = func(ctx context.Context, _ Config, input []byte) ([]byte, error) {
-		cmd := exec.CommandContext(ctx, node, bundle)
-		cmd.Env = []string{"NODE_ENV=production", "PATH=/usr/bin:/bin"}
-		cmd.Stdin = bytes.NewReader(input)
-		var out limitedIdentityOutput
-		cmd.Stdout = &out
-		if err := cmd.Run(); err != nil {
-			return nil, err
-		}
-		return out.Bytes(), nil
-	}
-	code, out := personalCall(t, cfg, "normal1", "identity.login", `{}`)
-	if code != "" {
-		t.Fatal(code, out)
-	}
-	cookie := out["data"].(map[string]any)["cookie"].(string)
-	if cookie == "" {
-		t.Fatal("no app session")
-	}
-	params, _ := json.Marshal(map[string]string{"cookie": cookie})
-	if code, _ := personalCall(t, cfg, "normal1", "identity.current", string(params)); code != "" {
-		t.Fatal(code)
-	}
-	if code, _ := personalCall(t, cfg, "normal2", "identity.current", string(params)); code != "identity_refused" {
-		t.Fatal("cross-user session accepted", code)
-	}
-	if code, _ := personalCall(t, cfg, "normal1", "identity.logout", string(params)); code != "" {
-		t.Fatal(code)
-	}
-	if code, _ := personalCall(t, cfg, "normal1", "identity.current", string(params)); code != "identity_refused" {
-		t.Fatal("logout not durable", code)
-	}
-}

package/templates/native-go-better-auth/node/app.mjs

@@ -1,72 +0,0 @@
-import {betterAuth} from 'better-auth';
-import {createAuthEndpoint, APIError} from 'better-auth/api';
-import {setSessionCookie} from 'better-auth/cookies';
-import {memoryAdapter} from '@better-auth/memory-adapter';
-import {randomBytes, createHash, timingSafeEqual} from 'node:crypto';
-import {fileURLToPath} from 'node:url';
-import {realpathSync} from 'node:fs';
-
-// A ticket arrives only through the trusted CGI's stdin, never through a
-// public HTTP listener. One Node process handles one request. Every operation
-// consumes the fresh native ticket; an app session alone carries no NAS rights.
-export function makeApp({packageID,store,ticket,principal}) {
- const origin=`https://${packageID.toLowerCase()}.invalid`;
- const prefix=`spl${createHash('sha256').update(packageID).digest('hex').slice(0,16)}`;
- store.secret ||= randomBytes(32).toString('hex');
- store.db ||= {user:[],session:[],account:[],verification:[]};
- store.bindings ||= {};
- // Hydrate dates after a CGI restart. This JSON snapshot adapter is a bounded
- // example; production DB migration and account lifecycle policy belong to M2.
- for(const rows of Object.values(store.db)) for(const row of rows) for(const key of ['createdAt','updatedAt','expiresAt']) if(row[key]) row[key]=new Date(row[key]);
- let available=true;
- function consume(value){
-  if(!available||typeof value!=='string'||!ticket||value.length!==ticket.length||!timingSafeEqual(Buffer.from(value),Buffer.from(ticket))) throw new APIError('UNAUTHORIZED',{message:'native_ticket_required'});
-  available=false;
-  if(!principal?.name||!/^\d+$/.test(principal.uid)||!/^\d+$/.test(principal.gid)) throw new APIError('UNAUTHORIZED',{message:'native_identity_invalid'});
-  return principal;
- }
- const key=p=>JSON.stringify([packageID,p.name,p.uid,p.gid]);
- const auth=betterAuth({baseURL:origin,basePath:'/api/auth',secret:store.secret,database:memoryAdapter(store.db),
-  session:{expiresIn:60,updateAge:0,disableSessionRefresh:true,cookieCache:{enabled:false}},
-  advanced:{cookiePrefix:prefix,useSecureCookies:true},trustedOrigins:[origin],
-  plugins:[{id:'spl-dsm-native',endpoints:{nativeLogin:createAuthEndpoint('/native-login',{method:'POST'},async ctx=>{
-   const p=consume(ctx.request?.headers.get('x-native-ticket'));
-   let user=store.db.user.find(u=>u.id===store.bindings[key(p)]);
-   if(!user){user=await ctx.context.internalAdapter.createUser({name:p.name,email:`${createHash('sha256').update(key(p)).digest('hex')}@identity.invalid`,emailVerified:false});store.bindings[key(p)]=user.id;}
-   const session=await ctx.context.internalAdapter.createSession(user.id);
-   await setSessionCookie(ctx,{session,user});
-   return ctx.json({user:p.name});
-  })}}],
- });
- return {async handle(method,value,cookie=''){
-  const headers=new Headers({'content-type':'application/json',origin,'x-native-ticket':value||'',cookie});
-  if(method==='login'){
-   const r=await auth.handler(new Request(`${origin}/api/auth/native-login`,{method:'POST',headers,body:'{}'}));
-   return {status:r.status,cookies:r.headers.getSetCookie(),body:await r.json()};
-  }
-  let native;try{native=consume(value)}catch{return {status:401,cookies:[],body:{error:'native_ticket_required'}}}
-  const session=await auth.api.getSession({headers});
-  if(!session)return {status:401,cookies:[],body:{error:'app_session_required'}};
-  if(store.bindings[key(native)]!==session.user.id)return {status:403,cookies:[],body:{error:'principal_mismatch'}};
-  if(method==='current')return {status:200,cookies:[],body:{user:native.name,expiresAt:session.session.expiresAt}};
-  if(method==='logout'){
-   const r=await auth.handler(new Request(`${origin}/api/auth/sign-out`,{method:'POST',headers,body:'{}'}));
-   return {status:r.status,cookies:r.headers.getSetCookie(),body:await r.json()};
-  }
-  return {status:400,cookies:[],body:{error:'invalid_method'}};
- }};
-}
-export async function run(input){
- const {packageID,store,ticket,principal,method,cookie}=input;
- if(!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(packageID)||!['login','current','logout'].includes(method))throw Error('invalid_input');
- const app=makeApp({packageID,store,ticket,principal});
- const response=await app.handle(method,ticket,cookie);
- if(response.status!==200)return {store,result:{ok:false,error:response.body.error||response.body.message||'identity_refused'}};
- return {store,result:{ok:true,user:principal.name,cookie:response.cookies.map(v=>v.split(';')[0]).join('; '),expiresAt:response.body.expiresAt}};
-}
-if(process.argv[1] && realpathSync(process.argv[1])===fileURLToPath(import.meta.url)){
- try {
-  let body='';for await(const chunk of process.stdin){body+=chunk;if(Buffer.byteLength(body)>1048576)throw Error('oversized')}
-  process.stdout.write(JSON.stringify(await run(JSON.parse(body))));
- }catch{process.stderr.write('identity_refused\n');process.exitCode=1}
-}

package/templates/native-go-better-auth/node/build.mjs

@@ -1,4 +0,0 @@
-import {build} from 'esbuild';
-import {writeThirdPartyNotices} from './third-party-notices.mjs';
-await build({entryPoints:['app.mjs'],bundle:true,platform:'node',format:'esm',target:'node22',outfile:'dist/app.mjs',banner:{js:"import {createRequire} from 'node:module'; const require = createRequire(import.meta.url);"}});
-writeThirdPartyNotices(process.cwd(), 'dist/LICENSES');