@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/nas_shipped_refusal_linux_test.go

@@ -1,97 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-)
-
-// Use fixture authority only as a canary for mutation. The services under test
-// are the exact shipped assembly: no native/consent/operation/output adapter.
-func TestS8ShippedAssemblyRefusesWithoutNativeActorOrChildren(t *testing.T) {
-	for _, user := range []string{"normal1", "normal2", "admin"} {
-		s, repo, cohort, _, grant, children := grantCohortFixture(t)
-		services := supervisorGrantAdapters(Client{})
-		if services.native != nil || services.consent != nil || services.operations != nil || services.output != nil {
-			t.Fatal("production installed an adapter")
-		}
-		s.services = services
-		s.authority.native = services.native
-		s.authority.consent = services.consent
-		before, _ := json.Marshal(repo.store)
-		commits := repo.commits
-		carriers := SessionCarriers{Cookie: user, SynoToken: "untrusted", ClientAddress: "127.0.0.1"}
-		if _, code := services.native.Resolve(context.Background(), carriers); code != ErrUnavailable {
-			t.Fatal("missing native actor", code)
-		}
-		for _, kind := range []ScopeKind{ScopePersonal, ScopeShared} {
-			if anchors, code := services.native.Discover(context.Background(), carriers, nil, kind, 1); code != ErrUnavailable || len(anchors) != 0 {
-				t.Fatal("native discovery", code, anchors)
-			}
-		}
-		cases := []struct {
-			method string
-			args   any
-		}{
-			{"prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}},
-			{"prepare", grantPrepareArgs{grantRef('c'), ScopeShared, []Action{ActionRead}}},
-			{"confirm", grantConfirmArgs{grantRef('c'), grantRef('d'), repo.store.Revision}},
-		}
-		for n, c := range cases {
-			res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef(byte('a'+n)), grantRPC(t, c.method, cohort.epoch, carriers, c.args))
-			want := ErrUnavailable
-			if c.method == "confirm" {
-				want = ErrReplay
-			} // No known intent; retain the safe replay distinction.
-			if res.Code != want || res.Grant != nil || res.Intent != nil || res.Files != nil {
-				t.Fatal(user, c.method, res)
-			}
-		}
-		for n, action := range []Action{ActionStat, ActionList, ActionRead, ActionReadStream, ActionCreate, ActionWriteStream, ActionPublish} {
-			req := grantControl(t, grant, '1', byte('1'+n), '3', 1)
-			req.Op = action
-			args := any(ReadArgs{Segments: []string{"fixture"}, MaxBytes: 1})
-			switch action {
-			case ActionStat:
-				args = StatArgs{Segments: []string{"fixture"}}
-			case ActionList:
-				args = ListArgs{Segments: []string{"fixture"}, Limit: 1}
-			case ActionCreate:
-				args = CreateArgs{Segments: []string{"fixture"}, Bytes: 1, Exclusive: true}
-			case ActionWriteStream:
-				args = WriteStreamArgs{Segments: []string{"fixture"}, MaxBytes: 1}
-			case ActionPublish:
-				args = PublishArgs{StageID: grantRef('c'), NoOverwrite: true}
-			}
-			req.Args, _ = json.Marshal(args)
-			// Implemented reads require a native actor; staged writes remain unsupported.
-			// Neither failure may bootstrap a child or mutate authority.
-			res := s.dispatch(context.Background(), operationPeer{42, 0}, grantRef(byte('1'+n)), grantRPC(t, "operation.start", cohort.epoch, carriers, req))
-			if (action.ReadOnly() && res.Code != ErrUnavailable) || (!action.ReadOnly() && res.Code != ErrUnsupported) || res.Files != nil || res.Grant != nil {
-				t.Fatal(user, action, res)
-			}
-		}
-		after, _ := json.Marshal(repo.store)
-		if string(before) != string(after) || repo.commits != commits || len(*children) != 0 || len(cohort.operations) != 0 {
-			t.Fatal("refusal mutated grant or started child")
-		}
-	}
-}
-
-func TestS1RShippedModeStillRefusesUncertifiedDSMAdapters(t *testing.T) {
-	i := Inventory{Package: "Fixture", Version: "1.0.0-0001", Protocol: DataProtocol, PayloadDigest: grantRef('a'), RegistryDigest: grantRef('b'), DataAccess: "relaxed"}
-	services := supervisorGrantAdapters(NewClient(i))
-	if services.native == nil || services.native.relaxed == nil {
-		t.Fatal("relaxed policy was not selected")
-	}
-	if actor, code := services.native.Resolve(context.Background(), SessionCarriers{}); code != ErrUnavailable || actor.valid {
-		t.Fatal("unproved adapter minted actor", code)
-	}
-	if services.consent != nil || services.operations != nil || services.output != nil || services.writes.Create || services.writes.Stream || services.writes.Publish {
-		t.Fatal("relaxed mode enabled uncertified data/write capability")
-	}
-	i.DataAccess = ""
-	if supervisorGrantAdapters(NewClient(i)).native != nil {
-		t.Fatal("default policy silently enabled relaxed")
-	}
-}

package/dist/templates/native-go/backend/internal/helper/native_discovery.go

@@ -1,79 +0,0 @@
-package helper
-
-import (
-	"context"
-	"encoding/json"
-	"slices"
-	"strings"
-	"unicode"
-	"unicode/utf8"
-)
-
-// Discover returns bounded metadata only. Fresh native checks bracket discovery;
-// no result is returned if the actor changed while the adapter was running.
-// This is not a cursor/intent/grant store or a filesystem resolver.
-func (p *NativeProvider) Discover(ctx context.Context, carriers SessionCarriers, adapter NativeDiscoveryAdapter, kind ScopeKind, limit int) ([]DiscoveryAnchor, Code) {
-	if kind != ScopePersonal && kind != ScopeShared {
-		return nil, ErrUnsupported
-	}
-	if limit < 1 || limit > MaxPageEntries {
-		return nil, ErrLimit
-	}
-	if adapter == nil {
-		return nil, ErrUnavailable
-	}
-	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
-	defer cancel()
-	actor, c := p.Resolve(ctx, carriers)
-	if c != "" {
-		return nil, c
-	}
-	observation, c := adapter.DiscoverAnchors(ctx, actor, kind, limit)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return nil, c
-	}
-	current, c := p.Revalidate(ctx, carriers, actor)
-	if c != "" {
-		return nil, c
-	}
-	if observation.Principal != current.Principal() || observation.SessionRef != current.SessionRef() {
-		return nil, ErrDenied
-	}
-	if !nativeFresh(observation.CheckedAt, p.now()) {
-		return nil, ErrStale
-	}
-	if observation.Anchors == nil {
-		return nil, ErrUnavailable
-	}
-	if len(observation.Anchors) > limit {
-		return nil, ErrLimit
-	}
-	if kind == ScopePersonal && len(observation.Anchors) > 1 {
-		return nil, ErrUnavailable
-	}
-	seen := make(map[string]bool, len(observation.Anchors))
-	for _, anchor := range observation.Anchors {
-		if anchor.Kind != kind || (kind == ScopePersonal && anchor.Owner != current.Principal()) || (kind == ScopeShared && anchor.Owner != (Principal{})) {
-			return nil, ErrDenied
-		}
-		if !anchor.LocalFilesystem {
-			return nil, ErrUnsupported
-		}
-		if !digestPattern.MatchString(anchor.Ref) || seen[anchor.Ref] || !nativeDisplayName(anchor.DisplayName) {
-			return nil, ErrUnavailable
-		}
-		seen[anchor.Ref] = true
-	}
-	encoded, err := json.Marshal(observation.Anchors)
-	if err != nil {
-		return nil, ErrUnavailable
-	}
-	if len(encoded) > MaxMetadataBytes {
-		return nil, ErrLimit
-	}
-	return slices.Clone(observation.Anchors), ""
-}
-
-func nativeDisplayName(name string) bool {
-	return name != "" && len(name) <= MaxSegmentBytes && utf8.ValidString(name) && !strings.ContainsAny(name, "/\\") && !strings.ContainsFunc(name, unicode.IsControl)
-}

package/dist/templates/native-go/backend/internal/helper/native_identity.go

@@ -1,89 +0,0 @@
-package helper
-
-import (
-	"context"
-	"time"
-)
-
-// S1 contracts are staged: no provider is installed in the helper or CGI.
-// Implementations are trusted root-side adapters, never package-supplied claims.
-// They must obey ctx and return only closed safe codes, not native diagnostics.
-
-// SessionCarriers are transient secrets, not identity. The transport must derive
-// ClientAddress from its trusted peer/proxy policy. Never persist or log these.
-type SessionCarriers struct {
-	Cookie        string `json:"-"`
-	SynoToken     string `json:"-"`
-	ClientAddress string `json:"-"`
-}
-
-// NativeSessionValidator must revalidate the native session on EVERY call.
-// AccountInstanceRef must prove that this session belongs to the current account
-// incarnation; a username from authenticate.cgi alone cannot supply that proof.
-type NativeSessionValidator interface {
-	ValidateSession(context.Context, SessionCarriers) (NativeSession, Code)
-}
-
-type NativeSession struct {
-	Username           string
-	SessionRef         string // opaque server-side session binding, not a cookie hash
-	AccountInstanceRef string // proven incarnation, never a name/UID fingerprint
-	CheckedAt          time.Time
-}
-
-// LocalAccountProvider resolves a validated native username against the current
-// LOCAL account database. It must prove existence, enabled status, incarnation,
-// complete groups and current admin role in a coherent fresh observation.
-// Unknown incarnation is represented by an empty InstanceRef, not an invented ID.
-type LocalAccountProvider interface {
-	LookupLocalAccount(context.Context, string) (LocalAccount, Code)
-}
-
-type LocalAccount struct {
-	Principal Principal
-	Username  string
-	Enabled   bool
-	UID       uint32
-	GID       uint32
-	Groups    []uint32 // complete supplementary groups; nil means unknown
-	Admin     bool     // current native role, not UID==0 or a caller flag
-	CheckedAt time.Time
-}
-
-// NativeActor is an in-memory, read-only snapshot minted only by NativeProvider.
-// IdentityBasis distinguishes strict S1 from an explicit managed enrollment;
-// neither consumer nor serializer may reinterpret the latter as incarnation.
-// Zero values and serialized/restored snapshots are never admission authority.
-// S2 must revalidate before admitting work and own invalidation/cancel ordering.
-type NativeActor struct {
-	managed    *managedPilot
-	relaxed    *relaxedProvider
-	account    LocalAccount
-	sessionRef string
-	valid      bool
-}
-
-// NativeDiscoveryAdapter only discovers actor-visible local share anchors or
-// this actor's own home. It must enforce native visibility before returning any
-// metadata, never run discovery as admin on behalf of an ordinary actor, and
-// never open data files. Discovery is neither a grant nor an ACL/scope proof.
-type NativeDiscoveryAdapter interface {
-	DiscoverAnchors(context.Context, NativeActor, ScopeKind, int) (DiscoveryObservation, Code)
-}
-
-type DiscoveryObservation struct {
-	Principal  Principal
-	SessionRef string
-	CheckedAt  time.Time
-	Anchors    []DiscoveryAnchor // explicit empty slice means no visible anchors
-}
-
-// An anchor is a display candidate, not an absolute path or bearer authority.
-// Personal Owner must equal the actor; shared discovery carries no grant issuer.
-type DiscoveryAnchor struct {
-	Ref             string    `json:"ref"`
-	DisplayName     string    `json:"displayName"`
-	Kind            ScopeKind `json:"kind"`
-	Owner           Principal `json:"owner"`
-	LocalFilesystem bool      `json:"localFilesystem"`
-}

package/dist/templates/native-go/backend/internal/helper/native_provider.go

@@ -1,159 +0,0 @@
-package helper
-
-import (
-	"context"
-	"slices"
-	"strings"
-	"time"
-	"unicode/utf8"
-)
-
-type NativeProvider struct {
-	managed  *managedPilot
-	relaxed  *relaxedProvider
-	sessions NativeSessionValidator
-	accounts LocalAccountProvider
-	now      func() time.Time
-}
-
-func NewNativeProvider(s NativeSessionValidator, a LocalAccountProvider) *NativeProvider {
-	return &NativeProvider{sessions: s, accounts: a, now: time.Now}
-}
-
-func (a NativeActor) Principal() Principal { return a.account.Principal }
-func (a NativeActor) Username() string     { return a.account.Username }
-func (a NativeActor) SessionRef() string   { return a.sessionRef }
-func (a NativeActor) UID() uint32          { return a.account.UID }
-func (a NativeActor) GID() uint32          { return a.account.GID }
-func (a NativeActor) Groups() []uint32     { return slices.Clone(a.account.Groups) }
-func (a NativeActor) Admin() bool          { return a.valid && a.account.Admin }
-
-// Resolve performs fresh observations; it never caches sessions or credentials.
-// Success is only an identity snapshot, not file/grant/lifecycle admission.
-func (p *NativeProvider) Resolve(ctx context.Context, carriers SessionCarriers) (NativeActor, Code) {
-	if p != nil && p.relaxed != nil {
-		if p.now == nil {
-			return NativeActor{}, ErrUnavailable
-		}
-		return p.relaxed.resolve(ctx, carriers, func() time.Time { return p.now() })
-	}
-	if p != nil && p.managed != nil {
-		return p.managed.resolve(ctx, carriers)
-	}
-	if p == nil || p.sessions == nil || p.accounts == nil || p.now == nil {
-		return NativeActor{}, ErrUnavailable
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	if c := nativeContextCode(ctx); c != "" {
-		return NativeActor{}, c
-	}
-	if carriers.Cookie == "" {
-		return NativeActor{}, ErrDenied
-	}
-	s, c := p.sessions.ValidateSession(ctx, carriers)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return NativeActor{}, c
-	}
-	if s.Username == "" || !utf8.ValidString(s.Username) || strings.ContainsAny(s.Username, "\x00\r\n") || !digestPattern.MatchString(s.SessionRef) {
-		return NativeActor{}, ErrUnavailable
-	}
-	if s.AccountInstanceRef == "" {
-		return NativeActor{}, ErrSuspended
-	}
-	if !digestPattern.MatchString(s.AccountInstanceRef) {
-		return NativeActor{}, ErrUnavailable
-	}
-	if !nativeFresh(s.CheckedAt, p.now()) {
-		return NativeActor{}, ErrStale
-	}
-	a, c := p.accounts.LookupLocalAccount(ctx, s.Username)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return NativeActor{}, c
-	}
-	if a.Principal.Kind != "local" {
-		return NativeActor{}, ErrUnsupported
-	}
-	if !a.Enabled || a.Username != s.Username {
-		return NativeActor{}, ErrDenied
-	}
-	if a.Principal.InstanceRef == "" {
-		return NativeActor{}, ErrSuspended
-	}
-	if !digestPattern.MatchString(a.Principal.SubjectRef) || !digestPattern.MatchString(a.Principal.InstanceRef) || a.Groups == nil {
-		return NativeActor{}, ErrUnavailable
-	}
-	if a.Principal.InstanceRef != s.AccountInstanceRef {
-		return NativeActor{}, ErrSuspended
-	}
-	now := p.now()
-	if !nativeFresh(s.CheckedAt, now) || !nativeFresh(a.CheckedAt, now) {
-		return NativeActor{}, ErrStale
-	}
-	// Group order and duplicates do not change the credential set. Own the slice
-	// so neither a provider nor a consumer can mutate the admitted snapshot.
-	a.Groups = slices.Clone(a.Groups)
-	slices.Sort(a.Groups)
-	a.Groups = slices.Compact(a.Groups)
-	// Carry the oldest subject observation into later chunk deadlines. A newer
-	// account lookup must not extend an older native-session proof.
-	if s.CheckedAt.Before(a.CheckedAt) {
-		a.CheckedAt = s.CheckedAt
-	}
-	return NativeActor{account: a, sessionRef: s.SessionRef, valid: true}, ""
-}
-
-// Revalidate refuses old in-flight credentials after any identity/role change.
-// A caller may Resolve a new snapshot after stale; it must redo ACL/admission.
-// Suspension requires new consent, not replacement of the old grant's owner.
-func (p *NativeProvider) Revalidate(ctx context.Context, carriers SessionCarriers, old NativeActor) (NativeActor, Code) {
-	if !old.valid {
-		return NativeActor{}, ErrDenied
-	}
-	if p != nil && p.relaxed != nil {
-		if p.now == nil {
-			return NativeActor{}, ErrUnavailable
-		}
-		return p.relaxed.revalidate(ctx, carriers, old, func() time.Time { return p.now() })
-	}
-	if p == nil || old.managed != p.managed {
-		return NativeActor{}, ErrSuspended
-	}
-	current, c := p.Resolve(ctx, carriers)
-	if c != "" {
-		return NativeActor{}, c
-	}
-	a, b := old.account, current.account
-	if a.Principal != b.Principal || a.Username != b.Username || a.UID != b.UID || a.GID != b.GID {
-		return NativeActor{}, ErrSuspended
-	}
-	if old.sessionRef != current.sessionRef || a.Admin != b.Admin || !slices.Equal(a.Groups, b.Groups) {
-		return NativeActor{}, ErrStale
-	}
-	return current, ""
-}
-
-func nativeFresh(checkedAt, now time.Time) bool {
-	return !checkedAt.IsZero() && !now.IsZero() && !checkedAt.After(now) && now.Sub(checkedAt) <= NativeProofFreshness
-}
-
-func nativeContextCode(ctx context.Context) Code {
-	switch ctx.Err() {
-	case context.Canceled:
-		return ErrCanceled
-	case context.DeadlineExceeded:
-		return ErrTimeout
-	default:
-		return ""
-	}
-}
-
-func nativeObservationCode(ctx context.Context, code Code) Code {
-	if c := nativeContextCode(ctx); c != "" {
-		return c
-	}
-	if code != "" && !code.Valid() {
-		return ErrUnavailable
-	}
-	return code
-}