@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/app/nas_cgi_artifact_test.go

@@ -1,129 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"os"
-	"os/exec"
-	"strconv"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// The NIC-free VM points this at the actual unpacked, generated arm64 SPK CGI.
-// The VM's DSM authenticate.cgi oracle is a fixture, never a shipped adapter.
-func TestS8FinalCGIArtifactRefusal(t *testing.T) {
-	binary := os.Getenv("M2_S8_CGI_ARTIFACT")
-	if binary == "" {
-		t.Skip("requires final generated SPK in disposable Linux VM")
-	}
-
-	helperBinary := os.Getenv("M2_S8_HELPER_ARTIFACT")
-	if helperBinary != "" {
-		run := func(action string) {
-			t.Helper()
-			if b, err := exec.Command(helperBinary, action).CombinedOutput(); err != nil {
-				t.Fatalf("%s: %s %v", action, b, err)
-			}
-		}
-		state := func(want string) {
-			t.Helper()
-			for n := 0; n < 100; n++ {
-				b, err := exec.Command(helperBinary, "diagnose").Output()
-				var out map[string]any
-				json.Unmarshal(b, &out)
-				if err == nil && out["state"] == want {
-					t.Log("final generated helper state", want)
-					return
-				}
-				time.Sleep(20 * time.Millisecond)
-			}
-			t.Fatal("helper state did not become", want)
-		}
-		run("enable")
-		state("ready")
-		t.Cleanup(func() { exec.Command(helperBinary, "disable").Run() })
-		hook := os.Getenv("M2_S8_PREUPGRADE_HOOK")
-		if hook != "" {
-			if exec.Command("/bin/sh", hook).Run() == nil {
-				t.Fatal("generated preupgrade admitted a ready helper")
-			}
-		}
-		defer func() {
-			run("teardown")
-			state("stopped")
-			if hook != "" {
-				if b, err := exec.Command("/bin/sh", hook).CombinedOutput(); err != nil {
-					t.Fatal("generated preupgrade after teardown", string(b), err)
-				}
-			}
-			run("recover")
-			state("ready")
-			run("disable")
-			state("not-enabled")
-			if exec.Command(helperBinary, "recover").Run() == nil {
-				t.Fatal("disabled helper recovered without approval")
-			}
-		}()
-	}
-	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.unknown", "nas.files.read.binary"}
-	for _, user := range []string{"normal1", "normal2", "admin", "", "expired"} {
-		for _, method := range methods {
-			params := `{"user":"admin","path":"/volume1/secret"}`
-			if method == "nas.files.read.binary" {
-				params = sampleParams[method]
-			}
-			body := fmt.Sprintf(`{"method":%q,"params":%s}`, method, params)
-			cmd := exec.Command(binary)
-			if uidText := os.Getenv("M2_S8_CGI_PACKAGE_UID"); uidText != "" {
-				uid, err := strconv.ParseUint(uidText, 10, 32)
-				if err != nil {
-					t.Fatal(err)
-				}
-				cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uint32(uid), Gid: uint32(uid)}}
-			}
-			cmd.Env = []string{"GATEWAY_INTERFACE=CGI/1.1", "REQUEST_METHOD=POST", "SERVER_PROTOCOL=HTTP/1.1", "SERVER_NAME=localhost", "SERVER_PORT=80", "SCRIPT_NAME=/api.cgi", "CONTENT_TYPE=application/json", fmt.Sprintf("CONTENT_LENGTH=%d", len(body)), "REMOTE_ADDR=127.0.0.1"}
-			if user != "" {
-				cmd.Env = append(cmd.Env, "HTTP_COOKIE=fixture="+user)
-			}
-			cmd.Stdin = strings.NewReader(body)
-			b, err := cmd.Output()
-			if err != nil {
-				t.Fatal(method, err)
-			}
-			parts := bytes.SplitN(b, []byte("\r\n\r\n"), 2)
-			if len(parts) != 2 {
-				t.Fatal("not CGI", string(b))
-			}
-			var result map[string]any
-			if err = json.Unmarshal(parts[1], &result); err != nil {
-				t.Fatal(err, string(b))
-			}
-			want := "unknown_method"
-			// Protocol 2 now installs the interactive File Station adapter. This
-			// historical fixture has only a fixture cookie, never a real DSM id cookie.
-			switch method {
-			case "nas.discovery", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.create":
-				want = "session_required"
-			case "nas.files.publish":
-				want = "unsupported"
-			}
-			if method == "nas.files.read.binary" {
-				want = "unsupported"
-			}
-			if user == "" || user == "expired" {
-				want = "session_required"
-			}
-			e, ok := result["error"].(map[string]any)
-			if !ok || e["code"] != want || result["success"] != false || result["data"] != nil {
-				t.Fatalf("%s %s: %s", user, method, parts[1])
-			}
-			if bytes.Contains(b, []byte("volume1")) || bytes.Contains(b, []byte("fixture=")) {
-				t.Fatal("metadata leaked")
-			}
-		}
-	}
-}

package/templates/native-go/backend/internal/app/nas_refusal_test.go

@@ -1,46 +0,0 @@
-package app
-
-import (
-	"encoding/json"
-	"os"
-	"strings"
-	"testing"
-
-	"dsmapp/internal/helper"
-)
-
-// These are unavailable wire methods, not public grant/file routes. CGI names
-// are never used as S1 actors. Test both administrators and ordinary sessions.
-func TestS8NASWireRefusalHasNoDataEffects(t *testing.T) {
-	methods := []string{"nas.discovery", "nas.grants.prepare", "nas.grants.confirm", "nas.grants.list", "nas.files.stat", "nas.files.list", "nas.files.read", "nas.files.read-stream", "nas.files.create", "nas.files.write-stream", "nas.files.publish", "nas.future-method"}
-	for _, auth := range []stubAuth{alice, bob, nobody} {
-		cfg := testConfig(t)
-		cfg.HelperInventory = helper.Inventory{Package: cfg.PackageID, Version: cfg.Version, Protocol: 2, PayloadDigest: strings.Repeat("a", 64), RegistryDigest: strings.Repeat("b", 64)}
-		for _, method := range methods {
-			code, out := call(t, cfg, auth, method, `{"user":"admin","path":"/volume1/private","nativeProof":true}`)
-			want := "unknown_method"
-			if auth.err != nil {
-				want = "session_required"
-			}
-			if code != want || out["success"] != false || out["data"] != nil {
-				t.Fatalf("%s: %s %v", method, code, out)
-			}
-			b, _ := json.Marshal(out)
-			if strings.Contains(string(b), "volume1") || strings.Contains(string(b), "nativeProof") {
-				t.Fatal("request metadata leaked", string(b))
-			}
-		}
-		code, out := call(t, cfg, auth, "nas.files.read.binary", sampleParams["nas.files.read.binary"])
-		want := "unsupported"
-		if auth.err != nil {
-			want = "session_required"
-		}
-		if code != want || out["data"] != nil {
-			t.Fatal(code, out)
-		}
-		entries, err := os.ReadDir(cfg.DataDir)
-		if err != nil || len(entries) != 0 {
-			t.Fatal("NAS refusal changed package data", entries, err)
-		}
-	}
-}

package/templates/native-go/backend/internal/app/sdk_jobs.go

@@ -1,70 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package app
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/helper"
-	"encoding/json"
-	"io"
-	"net"
-	"net/http"
-)
-
-type sdkCarrierKey struct{}
-
-// Only session carriers from the HTTP request are forwarded. The authenticated
-// Caller and root NativeActor remain independent trust decisions.
-func SDKHandler(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		raw, err := io.ReadAll(http.MaxBytesReader(w, r.Body, api.MaxRequestBytes))
-		if err != nil || helper.ValidateSDKEnvelope(raw) != "" {
-			w.Header().Set("Content-Type", "application/json")
-			w.Header().Set("Cache-Control", "no-store")
-			io.WriteString(w, `{"success":false,"error":{"code":"invalid-request","message":"Invalid request"}}`)
-			return
-		}
-		r.Body = io.NopCloser(bytes.NewReader(raw))
-		address, _, err := net.SplitHostPort(r.RemoteAddr)
-		if err != nil {
-			address = r.RemoteAddr
-		}
-		c := helper.SessionCarriers{Cookie: r.Header.Get("Cookie"), SynoToken: r.Header.Get("X-SYNO-TOKEN"), ClientAddress: address}
-		next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), sdkCarrierKey{}, c)))
-	})
-}
-func (cfg Config) sdkJobRoutes() []api.Route {
-	routes := []api.Route{}
-	for _, method := range []string{"jobs.prepare", "jobs.submit", "jobs.status", "jobs.lookup", "jobs.result", "jobs.cancel", "jobs.revoke", "jobs.attach", "jobs.admin.status", "jobs.admin.cancel"} {
-		name := method
-		handler := func(ctx context.Context, caller api.Caller, args json.RawMessage) (any, error) {
-			if !caller.Authenticated() {
-				return nil, &api.Error{Code: "session_required", Message: "Sign in again"}
-			}
-			if code := helper.ValidateSDKArgs(name, args); code != "" {
-				return nil, &api.Error{Code: string(code), Message: "Job request refused"}
-			}
-			c, ok := ctx.Value(sdkCarrierKey{}).(helper.SessionCarriers)
-			if !ok {
-				return nil, &api.Error{Code: "unavailable", Message: "Native proof unavailable"}
-			}
-			invoke := cfg.SDKJobs
-			if invoke == nil {
-				invoke = helper.NewClient(cfg.HelperInventory).SDKJobs
-			}
-			data, code := invoke(ctx, name, c, args)
-			if code != "" {
-				return nil, &api.Error{Code: string(code), Message: "Job request refused"}
-			}
-			return data, nil
-		}
-		if name == "jobs.admin.status" || name == "jobs.admin.cancel" {
-			routes = append(routes, api.Admin(name, handler))
-		} else {
-			routes = append(routes, api.User(name, handler))
-		}
-	}
-	return routes
-}

package/templates/native-go/backend/internal/app/sdk_jobs_test.go

@@ -1,116 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package app
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/helper"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-type sdkAppAuth struct{ calls int }
-
-func (a *sdkAppAuth) Authenticate(r *http.Request) (api.Identity, error) {
-	a.calls++
-	if r.Header.Get("Cookie") == "" {
-		return api.Identity{}, api.ErrNoSession
-	}
-	return api.Identity{User: "fixture"}, nil
-}
-func TestSDKCGIRoutesCarryOnlyNativeSessionAndFixedMethods(t *testing.T) {
-	auth := &sdkAppAuth{}
-	var got helper.SessionCarriers
-	calls := 0
-	cfg := Config{SDKJobs: func(ctx context.Context, method string, c helper.SessionCarriers, p json.RawMessage) (json.RawMessage, helper.Code) {
-		calls++
-		got = c
-		return json.RawMessage(`{"revision":1,"items":[]}`), ""
-	}}
-	s, e := api.NewServer(auth, Routes(cfg)...)
-	if e != nil {
-		t.Fatal(e)
-	}
-	h := SDKHandler(s)
-	for _, body := range []string{`{"method":"jobs.status","params":{}}`, `{"method":"jobs.status","params":{"actor":"root"}}`, `{"method":"jobs.status","method":"jobs.cancel","params":{}}`} {
-		req := httptest.NewRequest("POST", "http://nas.test/cgi/api.cgi", strings.NewReader(body))
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Cookie", "fixture-cookie")
-		req.Header.Set("X-SYNO-TOKEN", "fixture-csrf")
-		req.RemoteAddr = "192.0.2.1:1234"
-		w := httptest.NewRecorder()
-		h.ServeHTTP(w, req)
-	}
-	if calls != 1 || got.Cookie != "fixture-cookie" || got.SynoToken != "fixture-csrf" || got.ClientAddress != "192.0.2.1" {
-		t.Fatal(calls, got)
-	}
-	req := httptest.NewRequest("POST", "http://nas.test/cgi/api.cgi", strings.NewReader(`{"method":"jobs.status","params":{}}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, req)
-	if calls != 1 || !strings.Contains(w.Body.String(), "session_required") {
-		t.Fatal(w.Body.String())
-	}
-	// No side-channel namespace registration of arbitrary dispatch or background.
-	for _, r := range Routes(cfg) {
-		if strings.HasPrefix(r.Method(), "jobs.") && r.Public() {
-			t.Fatal("public job route")
-		}
-	}
-}
-
-func TestSDKIntegrationSeparatesLifecycleAndJobReadiness(t *testing.T) {
-	cfg := Config{SDKJobs: func(_ context.Context, method string, c helper.SessionCarriers, _ json.RawMessage) (json.RawMessage, helper.Code) {
-		if method != "jobs.diagnose" || c.Cookie != "fixture" {
-			t.Fatal(method, c)
-		}
-		return nil, helper.ErrUnavailable
-	}}
-	ctx := context.WithValue(context.Background(), sdkCarrierKey{}, helper.SessionCarriers{Cookie: "fixture"})
-	result, err := cfg.integrationStatus(ctx, api.Caller{}, json.RawMessage(`{}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(result)
-	if !strings.Contains(string(raw), `"interactive":"unavailable"`) || !strings.Contains(string(raw), `"background":"unavailable"`) || !strings.Contains(string(raw), `"attachTtlMs":6000`) {
-		t.Fatal(string(raw))
-	}
-}
-
-func init() {
-	ref := strings.Repeat("a", 64)
-	params := map[string]any{
-		"jobs.prepare":      map[string]any{"worker": map[string]any{"id": "scan", "revision": 1}, "parent": map[string]any{"id": ref, "revision": 1}, "input": map[string]any{"steps": []any{map[string]any{"action": "nas.files.stat", "segments": []string{"fixture"}}}}},
-		"jobs.submit":       map[string]any{"intentId": ref, "summaryDigest": ref},
-		"jobs.lookup":       map[string]any{"intentId": ref},
-		"jobs.result":       map[string]any{"jobId": ref},
-		"jobs.cancel":       map[string]any{"jobId": ref, "revision": 1},
-		"jobs.admin.cancel": map[string]any{"jobId": ref, "revision": 1},
-		"jobs.attach":       map[string]any{"jobId": ref, "attachId": ref},
-		"jobs.revoke":       map[string]any{"jobId": ref, "revision": 1, "delegationRevision": 1, "storeRevision": 1},
-		"jobs.status":       map[string]any{}, "jobs.admin.status": map[string]any{},
-	}
-	for method, param := range params {
-		raw, _ := json.Marshal(param)
-		sampleParams[method] = string(raw)
-	}
-}
-
-func TestSDKIntegrationReportsLiveSessionModeOnly(t *testing.T) {
-	cfg := Config{SDKJobs: func(context.Context, string, helper.SessionCarriers, json.RawMessage) (json.RawMessage, helper.Code) {
-		return json.RawMessage(`{"diagnosticSchema":1,"availability":"session-required","jobs":[],"total":0,"truncated":false}`), ""
-	}}
-	ctx := context.WithValue(context.Background(), sdkCarrierKey{}, helper.SessionCarriers{Cookie: "fixture"})
-	result, err := cfg.integrationStatus(ctx, api.Caller{}, json.RawMessage(`{}`))
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(result)
-	if !strings.Contains(string(raw), `"interactive":"session-required"`) || !strings.Contains(string(raw), `"background":"unavailable"`) || !strings.Contains(string(raw), `"validation":"local-only"`) {
-		t.Fatal("missing session mode readiness")
-	}
-}

package/templates/native-go/backend/internal/app/sdk_routes.go

@@ -1,177 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-// Package app holds this package's business operations. Add a route here and
-// pick its policy: api.User (any signed-in DSM user), api.Admin (DSM
-// administrators only) or, rarely, api.Public (no sign-in at all).
-package app
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io/fs"
-	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-	"time"
-	"unicode/utf8"
-
-	"dsmapp/internal/api"
-	"dsmapp/internal/filestation"
-	"dsmapp/internal/helper"
-)
-
-// Config is fixed at build time and startup, never taken from a request.
-type Config struct {
-	RootAuthorization string
-
-	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
-	SessionFiles    *filestation.Service
-	SDKJobs         func(context.Context, string, helper.SessionCarriers, json.RawMessage) (json.RawMessage, helper.Code)
-	PackageID       string
-	Version         string
-	HelperInventory helper.Inventory
-	// PackageIntegration marks an integration built without a privileged
-	// helper. SDK workers need the helper, so this build never sets it.
-	PackageIntegration bool
-	// Staged trusted adapter. Nil refuses; no production data transport is installed.
-	NASBinaryRead api.BinaryReadHandler
-	// DataDir is the package's persistent, package-owned directory
-	// (/var/packages/<package>/var). It survives upgrades.
-	DataDir string
-	// VolumeRoot is where /volumeN lives; empty means "/". Tests set it.
-	VolumeRoot string
-}
-
-func Routes(cfg Config) []api.Route {
-	routes := cfg.authorizationRoutes()
-	routes = append(routes, []api.Route{
-		api.User("integration.status", cfg.integrationStatus),
-		api.BoundedRead(cfg.binaryRead),
-		api.User("app.status", cfg.status),
-		api.User("greeting.get", cfg.getGreeting),
-		api.Admin("greeting.set", cfg.setGreeting),
-	}...)
-	routes = append(routes, cfg.sdkJobRoutes()...)
-	routes = append(routes, cfg.SessionFiles.Routes()...)
-	routes = append(routes, cfg.backgroundRoutes()...)
-	return append(routes, cfg.rootRoutes()...)
-}
-
-func (cfg Config) integrationStatus(ctx context.Context, _ api.Caller, params json.RawMessage) (any, error) {
-	if err := decodeParams(params, &struct{}{}); err != nil {
-		return nil, err
-	}
-	state := cfg.integrationState(ctx)
-	jobs := map[string]any{"interactive": "unavailable", "background": "unavailable", "reason": "native-proof-unavailable", "attachRenewMs": helper.SDKAttachRenewMS, "attachTtlMs": helper.SDKAttachTTLMS}
-	if carriers, ok := ctx.Value(sdkCarrierKey{}).(helper.SessionCarriers); ok {
-		invoke := cfg.SDKJobs
-		if invoke == nil {
-			invoke = helper.NewClient(cfg.HelperInventory).SDKJobs
-		}
-		if data, code := invoke(ctx, "jobs.diagnose", carriers, json.RawMessage(`{}`)); code == "" {
-			jobs["diagnostic"] = data
-			var diagnostic struct {
-				Availability string `json:"availability"`
-			}
-			if json.Unmarshal(data, &diagnostic) == nil && diagnostic.Availability == "session-required" {
-				jobs["interactive"] = "session-required"
-				jobs["reason"] = "filestation-session"
-				jobs["validation"] = "local-only"
-			}
-		}
-	}
-	return struct {
-		helper.State
-		Jobs map[string]any `json:"jobs"`
-	}{state, jobs}, nil
-}
-
-func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage) (any, error) {
-	return cfg.withSharedFolders(map[string]any{
-		"package":    cfg.PackageID,
-		"version":    cfg.Version,
-		"user":       caller.User(),
-		"admin":      caller.Admin(),
-		"process":    map[string]int{"uid": os.Getuid(), "gid": os.Getgid()},
-		"go_version": runtime.Version(),
-		"platform":   runtime.GOOS + "/" + runtime.GOARCH,
-		"time":       time.Now().UTC().Format(time.RFC3339),
-	}), nil
-}
-
-type greeting struct {
-	Text      string `json:"text"`
-	UpdatedBy string `json:"updated_by,omitempty"`
-}
-
-func (cfg Config) greetingPath() string { return filepath.Join(cfg.DataDir, "greeting.json") }
-
-func (cfg Config) getGreeting(context.Context, api.Caller, json.RawMessage) (any, error) {
-	data, err := os.ReadFile(cfg.greetingPath())
-	if errors.Is(err, fs.ErrNotExist) {
-		return greeting{Text: "Hello"}, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	var g greeting
-	return g, json.Unmarshal(data, &g)
-}
-
-func (cfg Config) setGreeting(_ context.Context, caller api.Caller, params json.RawMessage) (any, error) {
-	var in struct {
-		Text string `json:"text"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	if n := utf8.RuneCountInString(in.Text); n < 1 || n > 200 {
-		return nil, api.BadRequest("text must be 1 to 200 characters")
-	}
-	g := greeting{Text: in.Text, UpdatedBy: caller.User()}
-	data, err := json.Marshal(g)
-	if err != nil {
-		return nil, err
-	}
-	return g, writeFileAtomic(cfg.greetingPath(), data)
-}
-
-// decodeParams decodes params strictly: unknown fields are an error.
-func decodeParams(params json.RawMessage, into any) error {
-	if len(params) == 0 {
-		params = json.RawMessage(`{}`)
-	}
-	dec := json.NewDecoder(bytes.NewReader(params))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(into); err != nil {
-		return api.BadRequest("invalid params: " + err.Error())
-	}
-	return nil
-}
-
-// writeFileAtomic replaces path in one rename, so readers never see half a file.
-func writeFileAtomic(path string, data []byte) error {
-	tmp, err := os.CreateTemp(filepath.Dir(path), ".tmp-*")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(tmp.Name())
-	if _, err := tmp.Write(data); err != nil {
-		tmp.Close()
-		return err
-	}
-	if err := tmp.Close(); err != nil {
-		return err
-	}
-	return os.Rename(tmp.Name(), path)
-}
-
-func (cfg Config) binaryRead(ctx context.Context, c api.Caller, r *http.Request, p json.RawMessage) (api.BinaryRead, error) {
-	if cfg.NASBinaryRead == nil {
-		return api.BinaryRead{}, &api.Error{Code: "unsupported", Message: "NAS binary read is unavailable"}
-	}
-	return cfg.NASBinaryRead(ctx, c, r, p)
-}