@synopackageland/cli 0.5.0 → 0.6.0

package/templates/native-go/backend/internal/filestation/write_test.go

@@ -1,6 +1,7 @@
 package filestation
 
 import (
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"fmt"
@@ -55,15 +56,15 @@ func TestCreateAndUploadAreBoundedAndUseSession(t *testing.T) {
 	if e := c.Create(ctx, r, "/home", "new"); e != nil {
 		t.Fatal(e)
 	}
-	if e := c.Write(ctx, r, "/home", "a.txt", []byte("abc")); e != nil {
+	if e := c.UploadStream(ctx, r, "/home", "a.txt", strings.NewReader("abc"), 3); e != nil {
 		t.Fatal(e)
 	}
 	for _, n := range []string{"../evil", "/evil", "a/b", "a\\b", "a\r\nx", ".", "..", "a,b"} {
-		if c.Write(ctx, r, "/home", n, []byte("abc")) == nil {
+		if c.UploadStream(ctx, r, "/home", n, strings.NewReader("abc"), 3) == nil {
 			t.Fatal(n)
 		}
 	}
-	if c.Write(ctx, r, "/home", "a", make([]byte, MaxBytes+1)) == nil {
+	if c.UploadStream(ctx, r, "/home", "a", strings.NewReader("abc"), MaxUploadBytes+1) == nil {
 		t.Fatal("oversized write")
 	}
 	if calls != 2 {
@@ -73,7 +74,7 @@ func TestCreateAndUploadAreBoundedAndUseSession(t *testing.T) {
 
 func TestMutationMalformedReplyIsCommitUncertain(t *testing.T) {
 	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, "broken response") })
-	for _, e := range []error{c.Create(context.Background(), sessionRequest(), "/home", "x"), c.Write(context.Background(), sessionRequest(), "/home", "x", []byte("abc"))} {
+	for _, e := range []error{c.Create(context.Background(), sessionRequest(), "/home", "x"), c.UploadStream(context.Background(), sessionRequest(), "/home", "x", strings.NewReader("abc"), 3)} {
 		if e == nil || !strings.Contains(e.Error(), "commit-uncertain") {
 			t.Fatal(e)
 		}
@@ -110,7 +111,7 @@ func TestBinaryUploadDownloadChecksum(t *testing.T) {
 			w.Write(stored)
 		}
 	})
-	if e := c.Write(context.Background(), sessionRequest(), "/home", "bytes", payload); e != nil {
+	if e := c.UploadStream(context.Background(), sessionRequest(), "/home", "bytes", bytes.NewReader(payload), int64(len(payload))); e != nil {
 		t.Fatal(e)
 	}
 	out, e := c.Read(context.Background(), sessionRequest(), "/home/bytes")

package/templates/native-go/backend/internal/identity/README.md

@@ -0,0 +1,55 @@
+# Standalone identity
+
+Enable only with `-X main.identity=standalone`. The CGI creates this service from
+its package var directory and trusted `SCRIPT_NAME`; `internal/app/identity.go`
+registers the transport. The Vue shell discovers `identity.status` at runtime.
+The CLI worker must wire `capabilities.identity: standalone` to the ldflag.
+
+The transport accepts same-origin JSON POST requests:
+
+- `identity.status {}` reports whether this transport is enabled.
+- `identity.session {bootstrap: true}` exchanges the incoming DSM `id` cookie
+  for an app session when no app cookie is present. Without bootstrap it reads
+  the app session. Expired app cookies are cleared before another bootstrap.
+- `identity.login {account, password, otp}` verifies credentials with DSM Auth
+  v7, without a `session=DSM` argument. `otp_required` requests the second step.
+- `identity.logout {}` removes the app session and clears the cookie.
+
+NormalUser.get is the only DSM cookie identity check; anonymous Initdata success
+cannot establish identity. Local `user.Lookup` binds the username to its UID.
+Auth login creates a temporary SID, then immediately logs it out before issuing
+an app session. A logout failure refuses the app login. No password, OTP, DSM SID
+or DSM cookie is logged or persisted. Only hashes of app bearer IDs are stored.
+
+The package-private store uses directory mode 0700, files mode 0600, atomic
+replacement and a cross-process lock, so CGI restarts preserve sessions and
+rate limits. Sessions have a default 15-minute expiry. Sliding requires a live
+DSM cookie; password-only sessions cannot extend themselves indefinitely.
+Login limits are five attempts per account and twenty per IP per minute;
+forwarded client address and HTTPS headers are not trusted.
+
+Cookies are host-only, HttpOnly, Secure and SameSite=Lax, scoped to the app path,
+with a package-specific name. Lax supports top-level app navigation. JSON POST
+requires an exact Origin scheme/host/port and rejects cross-site Fetch Metadata.
+Password login and cookie bootstrap require HTTPS, determined by Go's TLS state
+(the CGI library maps the trusted `HTTPS` environment variable to that state).
+
+The package account has no verified disabled-account reader. Every operation
+except the explicit read-only `app.status` and `greeting.get` therefore requires
+both a matching local UID and live DSM cookie verification. Missing DSM cookies
+produce `session_revalidation_required`; invalid cookies revoke the app session.
+Password-only login supports those basic reads for at most 15 minutes. Different
+hostnames need a same-host DSM login before sensitive operations can succeed.
+App business permissions live in `internal/api/permissions.json`; SDK-owned
+routes use `internal/api/sdk-permissions.json`, verified against the CLI policy.
+app identity grants no File Station authority and does not create a NAS session.
+
+New business methods default to live revalidation. Do not add a read exception
+for sensitive data or state-changing operations. Unavailable account checks fail
+closed. Tests use a fake DSM server; actual DSM/Web Station deployment remains
+an integration acceptance step.
+
+File metadata and transfers return `dsm_session_required` for an App session
+without a DSM cookie. Sign in to DSM on the same hostname to use File Station.
+HTTP streaming transfers pass through the central API policy and identity
+revalidation without JSON buffering.

package/templates/native-go/backend/internal/identity/dsm.go

@@ -0,0 +1,96 @@
+package identity
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+type dsmReply struct {
+	Success bool `json:"success"`
+	Data    struct {
+		Username string `json:"username"`
+		SID      string `json:"sid"`
+	} `json:"data"`
+	Error struct {
+		Code  int `json:"code"`
+		Types []struct {
+			Type string `json:"type"`
+		} `json:"types"`
+	} `json:"error"`
+}
+
+func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (dsmReply, error) {
+	var out dsmReply
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, "POST", s.cfg.Endpoint, strings.NewReader(form.Encode()))
+	if err != nil {
+		return out, errors.New("DSM unavailable")
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	if cookie != "" {
+		req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
+	}
+	res, err := s.cfg.Client.Do(req)
+	if err != nil {
+		return out, errors.New("DSM unavailable")
+	}
+	defer res.Body.Close()
+	raw, err := io.ReadAll(io.LimitReader(res.Body, (64<<10)+1))
+	if err != nil || len(raw) > 64<<10 || res.StatusCode != 200 || json.Unmarshal(raw, &out) != nil {
+		return out, errors.New("DSM unavailable")
+	}
+	return out, nil
+}
+func (s *Service) verify(ctx context.Context, cookie string) (Subject, error) {
+	out, err := s.dsmCall(ctx, url.Values{"api": {"SYNO.Core.NormalUser"}, "method": {"get"}, "version": {"1"}}, cookie)
+	if err != nil || !out.Success {
+		return Subject{}, errors.New("DSM session refused")
+	}
+	return s.resolve(out.Data.Username)
+}
+func (s *Service) login(ctx context.Context, account, password, otp string) (Subject, string) {
+	form := url.Values{"api": {"SYNO.API.Auth"}, "method": {"login"}, "version": {"7"}, "account": {account}, "passwd": {password}, "format": {"sid"}}
+	if otp != "" {
+		form.Set("otp_code", otp)
+	}
+	out, err := s.dsmCall(ctx, form, "")
+	if err != nil {
+		return Subject{}, "auth_unavailable"
+	}
+	if !out.Success {
+		switch out.Error.Code {
+		case 400:
+			return Subject{}, "invalid_credentials"
+		case 401:
+			return Subject{}, "account_disabled"
+		case 403:
+			for _, kind := range out.Error.Types {
+				if kind.Type == "otp" {
+					return Subject{}, "otp_required"
+				}
+			}
+		}
+		return Subject{}, "login_not_permitted"
+	}
+	if out.Data.SID == "" {
+		return Subject{}, "auth_unavailable"
+	}
+	// The temporary DSM session exists only to prove identity. Dispose of it
+	// before issuing an application session, including when local lookup fails.
+	loggedOut, err := s.dsmCall(context.WithoutCancel(ctx), url.Values{"api": {"SYNO.API.Auth"}, "method": {"logout"}, "version": {"7"}, "_sid": {out.Data.SID}}, "")
+	if err != nil || !loggedOut.Success {
+		return Subject{}, "auth_unavailable"
+	}
+	sub, err := s.resolve(account)
+	if err != nil {
+		return Subject{}, "invalid_credentials"
+	}
+	return sub, ""
+}

package/templates/native-go/backend/internal/identity/http.go

@@ -0,0 +1,291 @@
+package identity
+
+import (
+	"bytes"
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"errors"
+	"io"
+	"mime"
+	"net"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+type request struct {
+	Method string          `json:"method"`
+	Params json.RawMessage `json:"params"`
+}
+
+func decode(raw []byte, into any) error {
+	d := json.NewDecoder(bytes.NewReader(raw))
+	d.DisallowUnknownFields()
+	if err := d.Decode(into); err != nil {
+		return err
+	}
+	if d.Decode(new(any)) != io.EOF {
+		return errors.New("trailing JSON")
+	}
+	return nil
+}
+func reply(w http.ResponseWriter, data any, code string) {
+	out := map[string]any{"success": code == ""}
+	if code == "" {
+		out["data"] = data
+	} else {
+		out["error"] = map[string]string{"code": code, "message": "Sign-in could not be completed."}
+	}
+	raw, _ := json.Marshal(out)
+	h := w.Header()
+	h.Set("Content-Type", "application/json")
+	h.Set("Cache-Control", "no-store")
+	h.Set("X-Content-Type-Options", "nosniff")
+	h.Set("Content-Length", strconv.Itoa(len(raw)))
+	w.WriteHeader(200)
+	_, _ = w.Write(raw)
+}
+func sameOrigin(r *http.Request) bool {
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	}
+	origin, err := url.Parse(r.Header.Get("Origin"))
+	if err != nil || origin.Scheme != scheme || origin.Host != r.Host || origin.User != nil || origin.Path != "" || origin.RawQuery != "" || origin.Fragment != "" {
+		return false
+	}
+	site := r.Header.Get("Sec-Fetch-Site")
+	return site == "" || site == "same-origin"
+}
+
+// Routes registers identity operations under the central immutable SDK policy.
+func (s *Service) Routes() []api.Route {
+	routes := []api.Route{}
+	for _, method := range []string{"identity.status", "identity.login", "identity.session", "identity.logout"} {
+		name := method
+		routes = append(routes, api.HandleResponse(name, func(_ context.Context, _ api.Caller, w http.ResponseWriter, r *http.Request, p json.RawMessage) error {
+			if len(p) == 0 {
+				p = []byte(`{}`)
+			}
+			s.handle(w, r, request{Method: name, Params: p})
+			return nil
+		}))
+	}
+	return routes
+}
+
+// Wrap revalidates App identity before business JSON and HTTP transfers.
+// Identity operations use the same central policy engine with no App methods.
+func (s *Service) Wrap(next http.Handler) http.Handler {
+	identityServer, err := api.NewServerWithPermissions(s, []byte(`{"schema":1,"default":"administrators","methods":{}}`), s.Routes()...)
+	if err != nil {
+		panic(err)
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer io.Copy(io.Discard, r.Body)
+		if r.URL.Query().Get("method") != "" {
+			if e := api.PrepareTransferRequest(w, r); e != nil {
+				reply(w, nil, e.Code)
+				return
+			}
+			if !s.guard(w, r, r.URL.Query().Get("method")) {
+				return
+			}
+			next.ServeHTTP(w, r)
+			return
+		}
+		if r.Method != "POST" {
+			reply(w, nil, "method_not_allowed")
+			return
+		}
+		if !sameOrigin(r) {
+			reply(w, nil, "csrf_rejected")
+			return
+		}
+		media, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
+		if err != nil || media != "application/json" {
+			reply(w, nil, "json_required")
+			return
+		}
+		raw, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
+		if err != nil {
+			reply(w, nil, "request_too_large")
+			return
+		}
+		var req request
+		if decode(raw, &req) != nil || req.Method == "" {
+			reply(w, nil, "bad_request")
+			return
+		}
+		if len(req.Params) == 0 {
+			req.Params = []byte(`{}`)
+		}
+		if strings.HasPrefix(req.Method, "identity.") {
+			r.Body = io.NopCloser(bytes.NewReader(raw))
+			identityServer.ServeHTTP(w, r)
+			return
+		}
+		if !s.guard(w, r, req.Method) {
+			return
+		}
+		r.Body = io.NopCloser(bytes.NewReader(raw))
+		next.ServeHTTP(w, r)
+	})
+}
+func (s *Service) guard(w http.ResponseWriter, r *http.Request, method string) bool {
+	// Every business request rechecks identity: no developer-maintained list of
+	// sensitive method names can accidentally omit a write operation.
+	var token string
+	var rec record
+	revalidate := method != "app.status" && method != "greeting.get"
+	err := s.transaction(func(st *state) error { var e error; token, rec, e = s.current(st, r, revalidate); return e })
+	if err != nil {
+		code := "session_required"
+		if errors.Is(err, errRevalidation) {
+			code = "session_revalidation_required"
+			if strings.HasPrefix(method, "nas.") || method == "bg.browse" || method == "bg.jobs.submit" {
+				code = "dsm_session_required"
+			}
+		}
+		reply(w, nil, code)
+		return false
+	}
+	if revalidate {
+		s.cookie(w, token, rec.Expires)
+	}
+
+	return true
+}
+func (s *Service) handle(w http.ResponseWriter, r *http.Request, req request) {
+	if req.Method == "identity.status" {
+		if decode(req.Params, &struct{}{}) != nil {
+			reply(w, nil, "bad_request")
+			return
+		}
+		reply(w, map[string]bool{"enabled": true}, "")
+		return
+	}
+	if req.Method == "identity.login" && r.TLS == nil {
+		reply(w, nil, "https_required")
+		return
+	}
+	var token string
+	var rec record
+	code := ""
+	err := s.transaction(func(st *state) error {
+		switch req.Method {
+		case "identity.login":
+			var in struct {
+				Account  string `json:"account"`
+				Password string `json:"password"`
+				OTP      string `json:"otp"`
+			}
+			if decode(req.Params, &in) != nil || in.Account == "" || in.Password == "" || len(in.Account) > 1024 || len(in.Password) > 4096 || len(in.OTP) > 128 {
+				code = "bad_request"
+				return nil
+			}
+			ip, _, err := net.SplitHostPort(r.RemoteAddr)
+			if err != nil {
+				ip = r.RemoteAddr
+			}
+			if s.limited(st, ip, strings.ToLower(in.Account)) {
+				code = "rate_limited"
+				return nil
+			}
+			sub, c := s.login(r.Context(), in.Account, in.Password, in.OTP)
+			code = c
+			if code != "" {
+				return nil
+			}
+			if len(st.Sessions) >= 4096 {
+				code = "auth_unavailable"
+				return nil
+			}
+			// Rotation also removes the caller's previous session.
+			if old, err := r.Cookie(s.cookieName); err == nil {
+				delete(st.Sessions, digest(old.Value))
+			}
+			token, err = randomID()
+			if err != nil {
+				return err
+			}
+			rec = record{Subject: sub, Expires: s.cfg.Now().Add(s.cfg.TTL)}
+			st.Sessions[digest(token)] = rec
+		case "identity.session":
+			var in struct {
+				Bootstrap bool `json:"bootstrap"`
+			}
+			if decode(req.Params, &in) != nil {
+				code = "bad_request"
+				return nil
+			}
+			_, hasDSM := r.Cookie("id")
+			var e error
+			token, rec, e = s.current(st, r, hasDSM == nil)
+			// Explicit bootstrap only when there is no application cookie. An expired
+			// application session must return to the login surface before reissuing.
+			_, appErr := r.Cookie(s.cookieName)
+			if e != nil && in.Bootstrap && appErr != nil {
+				if r.TLS == nil {
+					code = "https_required"
+					return nil
+				}
+				dc, err := r.Cookie("id")
+				if err != nil {
+					code = "session_required"
+					return nil
+				}
+				sub, err := s.verify(r.Context(), dc.Value)
+				if err != nil {
+					code = "session_required"
+					return nil
+				}
+				if len(st.Sessions) >= 4096 {
+					code = "auth_unavailable"
+					return nil
+				}
+				token, err = randomID()
+				if err != nil {
+					return err
+				}
+				rec = record{Subject: sub, Expires: s.cfg.Now().Add(s.cfg.TTL)}
+				st.Sessions[digest(token)] = rec
+				e = nil
+			}
+			if e != nil {
+				code = "session_required"
+			}
+		case "identity.logout":
+			if decode(req.Params, &struct{}{}) != nil {
+				code = "bad_request"
+				return nil
+			}
+			if old, err := r.Cookie(s.cookieName); err == nil {
+				delete(st.Sessions, digest(old.Value))
+			}
+		default:
+			code = "unknown_method"
+		}
+		return nil
+	})
+	if err != nil {
+		reply(w, nil, "auth_unavailable")
+		return
+	}
+	if code != "" {
+		if code == "session_required" {
+			s.cookie(w, "", rec.Expires)
+		}
+		reply(w, nil, code)
+		return
+	}
+	if req.Method == "identity.logout" {
+		s.cookie(w, "", rec.Expires)
+		reply(w, map[string]bool{"loggedOut": true}, "")
+		return
+	}
+	s.cookie(w, token, rec.Expires)
+	reply(w, map[string]any{"user": rec.Subject.User, "uid": rec.Subject.UID, "expiresAt": rec.Expires}, "")
+}