@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/data_protocol_test.go

@@ -1,449 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"encoding/json"
-	"os"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-func dataFixture(t testing.TB, name string) []byte {
-	t.Helper()
-	b, err := os.ReadFile("testdata/protocol2/" + name + ".json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	return b
-}
-
-func TestDataRequestFixtures(t *testing.T) {
-	for _, name := range []string{"list", "stat", "read", "create", "write-stream", "publish"} {
-		t.Run(name, func(t *testing.T) {
-			r, code := DecodeDataRequest(bytes.NewReader(dataFixture(t, name)))
-			want := Code("")
-			if name == "create" || name == "write-stream" || name == "publish" {
-				want = ErrUnsupported
-			}
-			if code != want {
-				t.Fatalf("got %q want %q", code, want)
-			}
-			if want == "" && (r.Inventory.Protocol != 2 || r.Op != Action("nas.files."+name)) {
-				t.Fatal("wrong decoded request")
-			}
-		})
-	}
-}
-
-func TestPortableControlFrames(t *testing.T) {
-	var cases []struct {
-		Name  string `json:"name"`
-		Frame string `json:"frame"`
-		Code  Code   `json:"code"`
-	}
-	if err := json.Unmarshal(dataFixture(t, "frames"), &cases); err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range cases {
-		t.Run(tc.Name, func(t *testing.T) {
-			_, code := DecodeDataRequest(strings.NewReader(tc.Frame))
-			if code != tc.Code {
-				t.Fatalf("got %q want %q", code, tc.Code)
-			}
-		})
-	}
-}
-
-func TestTicketBindsArgumentsAndCurrentEpoch(t *testing.T) {
-	r, b, now := validRequestAndTicket(t)
-	w, _ := NewReplayWindow(r.Inventory, r.Epoch, b.SubjectRef, b.SessionRef)
-	changed := r
-	changed.Args = bytes.Replace(r.Args, []byte("note.txt"), []byte("other.txt"), 1)
-	if c := w.Consume(changed, b, now); c != ErrDenied {
-		t.Fatal("ticket substituted args", c)
-	}
-	changed = r
-	changed.Epoch = strings.Repeat("0", 64)
-	if c := w.Consume(changed, b, now); c != ErrStale {
-		t.Fatal("old/new epoch accepted", c)
-	}
-	changed = r
-	changed.Inventory.RegistryDigest = strings.Repeat("0", 64)
-	if c := w.Consume(changed, b, now); c != ErrIncompatible {
-		t.Fatal("inventory changed", c)
-	}
-	if c := w.Consume(r, b, now); c != "" {
-		t.Fatal("invalid request burned valid ticket", c)
-	}
-}
-
-func TestRequiredFieldsAndStagedWrites(t *testing.T) {
-	b := dataFixture(t, "create")
-	var fields map[string]json.RawMessage
-	if err := json.Unmarshal(b, &fields); err != nil {
-		t.Fatal(err)
-	}
-	var args map[string]json.RawMessage
-	if err := json.Unmarshal(fields["args"], &args); err != nil {
-		t.Fatal(err)
-	}
-	delete(args, "bytes")
-	fields["args"], _ = json.Marshal(args)
-	raw, _ := json.Marshal(fields)
-	if _, c := DecodeDataRequest(bytes.NewReader(raw)); c != ErrInvalid {
-		t.Fatal("missing zero-valued required field accepted", c)
-	}
-	for _, pair := range []struct{ from, to string }{
-		{`"exclusive": true`, `"exclusive": false`},
-		{`"bytes":`, `"data":"base64","bytes":`},
-	} {
-		if _, c := DecodeDataRequest(bytes.NewReader(bytes.Replace(b, []byte(pair.from), []byte(pair.to), 1))); c != ErrInvalid {
-			t.Fatal(pair, c)
-		}
-	}
-}
-
-func TestGrantStoreLimitsAndTombstones(t *testing.T) {
-	s, c := DecodeGrantStore(bytes.NewReader(dataFixture(t, "grant-store")))
-	if c != "" {
-		t.Fatal(c)
-	}
-	encode := func(s GrantStore) Code {
-		b, err := json.Marshal(s)
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, c := DecodeGrantStore(bytes.NewReader(b))
-		return c
-	}
-	g := s.Grants[0]
-	g.State = GrantSuspended
-	g.Reason = ErrSuspended
-	s.Grants[0] = g
-	if c := encode(s); c != "" {
-		t.Fatal("suspension record", c)
-	}
-	g.State = GrantRevoked
-	g.Reason = ErrRevoked
-	g.RevokedAt = g.CreatedAt
-	s.Grants[0] = g
-	if c := encode(s); c != "" {
-		t.Fatal("tombstone record", c)
-	}
-	s.Grants = append(s.Grants, g)
-	if c := encode(s); c != ErrInvalid {
-		t.Fatal("duplicate ID accepted", c)
-	}
-	s.Grants = make([]Grant, MaxGrants)
-	for n := range s.Grants {
-		g.ID = strings.Repeat("0", 60) + hex4(n)
-		s.Grants[n] = g
-	}
-	if c := encode(s); c != "" {
-		t.Fatal("capacity boundary", c)
-	}
-	s.Grants = append(s.Grants, g)
-	if c := encode(s); c != ErrLimit {
-		t.Fatal("capacity including tombstones", c)
-	}
-	s.Grants = []Grant{g}
-	s.Grants[0].Issuer.SubjectRef = strings.Repeat("0", 64)
-	if c := encode(s); c != ErrDenied {
-		t.Fatal("admin cannot issue personal grant for another owner", c)
-	}
-}
-
-func TestStrictUnicodeAndDepth(t *testing.T) {
-	b := string(dataFixture(t, "read"))
-	for _, name := range []string{`\ud83d\ude00`, `\uFFFD`, `a\"b`, `a\\b`} {
-		_, c := DecodeDataRequest(strings.NewReader(strings.Replace(b, "note.txt", name, 1)))
-		// A literal backslash in a segment is outside this contract's subset.
-		want := Code("")
-		if name == `a\\b` {
-			want = ErrInvalid
-		}
-		if c != want {
-			t.Fatalf("%s: %q", name, c)
-		}
-	}
-	deep := strings.Repeat(`{"x":`, 65) + `0` + strings.Repeat(`}`, 65)
-	var value DataRequest
-	if c := decodeDataObject(strings.NewReader(strings.Replace(b, `"args": {`, `"args": `+deep+`,"removed": {`, 1)), &value, MaxControlBytes); c != ErrInvalid {
-		t.Fatal("depth accepted", c)
-	}
-}
-
-func TestDataStrictFrames(t *testing.T) {
-	b := string(dataFixture(t, "read"))
-	cases := []struct {
-		name, data string
-		code       Code
-	}{
-		{"unknown root", strings.Replace(b, `"args":`, `"uid":0,"args":`, 1), ErrInvalid},
-		{"unknown inventory", strings.Replace(b, `"package":`, `"admin":true,"package":`, 1), ErrInvalid},
-		{"unknown args", strings.Replace(b, `"maxBytes":`, `"offset":0,"maxBytes":`, 1), ErrInvalid},
-		{"case alias", strings.Replace(b, `"nonce":`, `"Nonce":`, 1), ErrInvalid},
-		{"duplicate root", strings.Replace(b, `"nonce":`, `"nonce":"x","nonce":`, 1), ErrInvalid},
-		{"duplicate nested", strings.Replace(b, `"segments":`, `"segments":[],"segments":`, 1), ErrInvalid},
-		{"trailing object", b + `{}`, ErrInvalid},
-		{"trailing junk", b + `x`, ErrInvalid},
-		{"oversized whitespace", b + strings.Repeat(" ", MaxControlBytes), ErrLimit},
-		{"missing ticket", strings.Replace(b, `"ticket":`, `"missingTicket":`, 1), ErrInvalid},
-		{"null args", strings.Replace(b, `"args": {`, `"args": null,"removed": {`, 1), ErrInvalid},
-		{"null segments", strings.Replace(b, "[\n      \"note.txt\"\n    ]", "null", 1), ErrInvalid},
-		{"wrong scalar", strings.Replace(b, `"grantRevision": 1`, `"grantRevision": "1"`, 1), ErrInvalid},
-		{"zero revision", strings.Replace(b, `"grantRevision": 1`, `"grantRevision": 0`, 1), ErrInvalid},
-		{"unknown op", strings.Replace(b, `nas.files.read`, `shell`, 1), ErrUnsupported},
-		{"protocol downgrade", strings.Replace(b, `"protocol": 2`, `"protocol": 1`, 1), ErrIncompatible},
-		{"future protocol", strings.Replace(b, `"protocol": 2`, `"protocol": 3`, 1), ErrIncompatible},
-		{"absolute path", strings.Replace(b, `note.txt`, `/etc/shadow`, 1), ErrInvalid},
-		{"parent traversal", strings.Replace(b, `note.txt`, `..`, 1), ErrInvalid},
-		{"surrogate", strings.Replace(b, `note.txt`, `\ud800`, 1), ErrInvalid},
-		{"invalid UTF8", strings.Replace(b, `note.txt`, string([]byte{0xff}), 1), ErrInvalid},
-		{"null envelope", `null`, ErrInvalid},
-		{"limit overflow", strings.Replace(b, `1048576`, `18446744073709551616`, 1), ErrInvalid},
-		{"over read limit", strings.Replace(b, `1048576`, `1048577`, 1), ErrLimit},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			_, got := DecodeDataRequest(strings.NewReader(tc.data))
-			if got != tc.code {
-				t.Fatalf("got %q want %q", got, tc.code)
-			}
-		})
-	}
-}
-
-func TestRelativeSegmentsContract(t *testing.T) {
-	for _, s := range [][]string{{".."}, {"."}, {""}, {"a/b"}, {"/x"}, {"x\x00y"}, {"a\\b"}, {strings.Repeat("a", 256)}, nil} {
-		if ValidateRelativeSegments(s, true) == "" {
-			t.Fatalf("accepted %q", s)
-		}
-	}
-	if ValidateRelativeSegments([]string{}, true) != "" || ValidateRelativeSegments([]string{}, false) != ErrInvalid {
-		t.Fatal("root rules")
-	}
-	if ValidateRelativeSegments([]string{"\u8cc7\u6599\u593e", "%2e%2e", "a%2fb", "é", "e\u0301"}, false) != "" {
-		t.Fatal("literal UTF8/percent must not be normalized or URL-decoded again")
-	}
-	if ValidateRelativeSegments(make([]string, MaxPathSegments+1), true) != ErrLimit {
-		t.Fatal("depth ceiling")
-	}
-	segments := make([]string, 17)
-	for i := range segments {
-		segments[i] = strings.Repeat("a", 255)
-	}
-	if ValidateRelativeSegments(segments, true) != ErrLimit {
-		t.Fatal("byte ceiling")
-	}
-}
-
-func TestProtocolNegotiationPinnedToApproval(t *testing.T) {
-	i := fixture(t).Expected
-	for _, tc := range []struct {
-		offered        []int
-		approved, want int
-		files          bool
-		code           Code
-	}{
-		{[]int{1, 2}, 1, 1, false, ""}, {[]int{1, 2}, 2, 2, true, ""},
-		{[]int{1}, 2, 0, false, ErrIncompatible}, {[]int{2}, 1, 0, false, ErrIncompatible},
-		{[]int{1, 2}, 1, 0, true, ErrIncompatible}, {[]int{1, 2, 3}, 2, 0, true, ErrInvalid},
-		{[]int{3}, 2, 0, true, ErrIncompatible},
-		{[]int{2, 2}, 2, 0, true, ErrInvalid}, {nil, 2, 0, true, ErrInvalid},
-	} {
-		i.Protocol = tc.approved
-		got, code := NegotiateProtocol(tc.offered, i, tc.files)
-		if got != tc.want || code != tc.code {
-			t.Fatalf("%+v: %d %q", tc, got, code)
-		}
-	}
-	i.Protocol = 1
-	if Respond(i, false, Request{i, "nas.files.read", strings.Repeat("a", 64)}).Error != "unsupported" {
-		t.Fatal("legacy must never serve files")
-	}
-}
-
-func validRequestAndTicket(t *testing.T) (DataRequest, TicketBinding, time.Time) {
-	t.Helper()
-	r, code := DecodeDataRequest(bytes.NewReader(dataFixture(t, "read")))
-	if code != "" {
-		t.Fatal(code)
-	}
-	now := time.Unix(1791000000, 0)
-	b := TicketBinding{Inventory: r.Inventory, Epoch: r.Epoch, SubjectRef: strings.Repeat("3", 64), SessionRef: strings.Repeat("4", 64), Action: r.Op, GrantID: r.GrantID, GrantRevision: r.GrantRevision, OperationID: r.OperationID, Nonce: r.Nonce, Ticket: r.Ticket, RequestDigest: r.Digest(), ExpiresAt: now.Add(time.Second)}
-	return r, b, now
-}
-
-func TestRequestReplayAndBinding(t *testing.T) {
-	r, b, now := validRequestAndTicket(t)
-	newWindow := func() *ReplayWindow {
-		w, c := NewReplayWindow(r.Inventory, r.Epoch, b.SubjectRef, b.SessionRef)
-		if c != "" {
-			t.Fatal(c)
-		}
-		return w
-	}
-	for _, change := range []string{"inventory", "epoch", "subject", "session", "action", "grant", "revision", "operation", "nonce", "ticket", "expiry"} {
-		t.Run(change, func(t *testing.T) {
-			bad := b
-			switch change {
-			case "inventory":
-				bad.Inventory.PayloadDigest = strings.Repeat("0", 64)
-			case "epoch":
-				bad.Epoch = strings.Repeat("0", 64)
-			case "subject":
-				bad.SubjectRef = strings.Repeat("0", 64)
-			case "session":
-				bad.SessionRef = strings.Repeat("0", 64)
-			case "action":
-				bad.Action = ActionStat
-			case "grant":
-				bad.GrantID = strings.Repeat("0", 64)
-			case "revision":
-				bad.GrantRevision++
-			case "operation":
-				bad.OperationID = strings.Repeat("0", 64)
-			case "nonce":
-				bad.Nonce = strings.Repeat("0", 64)
-			case "ticket":
-				bad.Ticket = strings.Repeat("0", 64)
-			case "expiry":
-				bad.ExpiresAt = now
-			}
-			w := newWindow()
-			if w.Consume(r, bad, now) == "" {
-				t.Fatal("binding accepted")
-			}
-			if c := w.Consume(r, b, now); c != "" {
-				t.Fatalf("failed binding consumed valid request: %q", c)
-			}
-		})
-	}
-	w := newWindow()
-	if c := w.Consume(r, b, now); c != "" {
-		t.Fatal(c)
-	}
-	if c := w.Consume(r, b, now); c != ErrReplay {
-		t.Fatal(c)
-	}
-	for _, duplicate := range []string{"nonce", "operation", "ticket"} {
-		r2, b2 := r, b
-		r2.Nonce = strings.Repeat("5", 64)
-		r2.OperationID = strings.Repeat("6", 64)
-		r2.Ticket = strings.Repeat("7", 64)
-		switch duplicate {
-		case "nonce":
-			r2.Nonce = r.Nonce
-		case "operation":
-			r2.OperationID = r.OperationID
-		case "ticket":
-			r2.Ticket = r.Ticket
-		}
-		b2.Nonce = r2.Nonce
-		b2.OperationID = r2.OperationID
-		b2.Ticket = r2.Ticket
-		b2.RequestDigest = r2.Digest()
-		if c := w.Consume(r2, b2, now); c != ErrReplay {
-			t.Fatalf("%s replay: %q", duplicate, c)
-		}
-	}
-}
-
-func TestReplayConcurrentAndFull(t *testing.T) {
-	r, b, now := validRequestAndTicket(t)
-	w, _ := NewReplayWindow(r.Inventory, r.Epoch, b.SubjectRef, b.SessionRef)
-	var accepted atomic.Int32
-	var wg sync.WaitGroup
-	for n := 0; n < 20; n++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			if w.Consume(r, b, now) == "" {
-				accepted.Add(1)
-			}
-		}()
-	}
-	wg.Wait()
-	if accepted.Load() != 1 {
-		t.Fatal("single-use must be atomic")
-	}
-	for n := 1; n < MaxReplayEntries; n++ {
-		x := strings.Repeat("0", 60) + hex4(n)
-		r.Nonce = x
-		r.OperationID = x
-		r.Ticket = x
-		b.Nonce = x
-		b.OperationID = x
-		b.Ticket = x
-		b.RequestDigest = r.Digest()
-		if c := w.Consume(r, b, now); c != "" {
-			t.Fatal(c)
-		}
-	}
-	r.Nonce = strings.Repeat("9", 64)
-	r.OperationID = r.Nonce
-	r.Ticket = r.Nonce
-	b.Nonce = r.Nonce
-	b.OperationID = r.Nonce
-	b.Ticket = r.Nonce
-	b.RequestDigest = r.Digest()
-	if c := w.Consume(r, b, now); c != ErrBusy {
-		t.Fatal("full must not evict", c)
-	}
-}
-
-func hex4(n int) string {
-	const chars = "0123456789abcdef"
-	return string([]byte{chars[(n>>12)&15], chars[(n>>8)&15], chars[(n>>4)&15], chars[n&15]})
-}
-
-func TestGrantAndIntentStrictRecords(t *testing.T) {
-	g := dataFixture(t, "grant-store")
-	if s, c := DecodeGrantStore(bytes.NewReader(g)); c != "" || len(s.Grants) != 1 {
-		t.Fatal(c)
-	}
-	i := dataFixture(t, "intent")
-	if _, c := DecodeIntent(bytes.NewReader(i)); c != "" {
-		t.Fatal(c)
-	}
-	for _, change := range []struct{ from, to string }{
-		{`"grantSchema": 1`, `"grantSchema": 99`}, {`"kind": "local"`, `"kind": "ldap"`},
-		{`"targetKind": "directory"`, `"targetKind": "file"`}, {`"state": "active"`, `"state": "unknown"`},
-		{`"mountRef":`, `"path":"/secret","mountRef":`}, {`nas.files.read`, `shell`},
-		{`"segments":`, `"Segments":`}, {`"grantRevision": 1`, `"grantRevision": 0`},
-	} {
-		if _, c := DecodeGrantStore(bytes.NewReader(bytes.Replace(g, []byte(change.from), []byte(change.to), 1))); c == "" {
-			t.Fatalf("accepted %+v", change)
-		}
-	}
-	if _, c := DecodeIntent(bytes.NewReader(bytes.Replace(i, []byte(`"summaryDigest":`), []byte(`"admin":true,"summaryDigest":`), 1))); c != ErrInvalid {
-		t.Fatal(c)
-	}
-	if _, c := DecodeGrantStore(strings.NewReader(string(g) + strings.Repeat(" ", MaxGrantStoreBytes))); c != ErrLimit {
-		t.Fatal(c)
-	}
-}
-
-func TestSafeErrorCannotLeakUnknownCode(t *testing.T) {
-	b, err := json.Marshal(SafeError{Code: Code("/secret/path credential=oops"), OperationID: "/secret"})
-	if err != nil || strings.Contains(string(b), "secret") || !strings.Contains(string(b), "internal") {
-		t.Fatalf("%s %v", b, err)
-	}
-}
-
-func FuzzDataDecoder(f *testing.F) {
-	for _, name := range []string{"list", "stat", "read", "create"} {
-		f.Add(dataFixture(f, name))
-	}
-	f.Add([]byte(`{"args":{"x":{"x":{"x":null}}}}`))
-	f.Fuzz(func(t *testing.T, b []byte) {
-		_, c := DecodeDataRequest(bytes.NewReader(b))
-		if c != "" && !c.Valid() {
-			t.Fatalf("unsafe code %q", c)
-		}
-	})
-}

package/templates/native-go/backend/internal/helper/dsm_acl_linux.go

@@ -1,139 +0,0 @@
-package helper
-
-import (
-	"context"
-	"golang.org/x/sys/unix"
-	"os"
-	"runtime"
-	"slices"
-	"strconv"
-	"time"
-)
-
-// EA masks from DSM7-4 libsynoacl and syno_acl_xattr_ds.h. A bridge must prove
-// target support and action semantics; unsupported never falls back to POSIX.
-const (
-	nativeACLExec     uint32 = 0x0001
-	nativeACLRead     uint32 = 0x0004
-	nativeACLReadAttr uint32 = 0x0100
-)
-
-type nativeFDACLObservation struct {
-	FilesystemSupported, ObjectSupported, MasksVerified, Allowed bool
-	CheckedAt                                                    time.Time
-}
-
-// Check runs IN the permanently dropped operation process, not a CLI subprocess.
-// fd/alias are generated by this adapter, never received from caller controls.
-type fixedFDACLBridge interface {
-	Check(context.Context, int, string, uint32) (nativeFDACLObservation, Code)
-}
-type fixedFDNativeACL struct {
-	actor       NativeActor
-	native      fixedFDACLBridge
-	boundary    readOnlyACL
-	now         func() time.Time
-	credentials func(NativeActor) Code
-}
-
-func newFixedFDNativeACL(a NativeActor, n fixedFDACLBridge, b readOnlyACL) *fixedFDNativeACL {
-	return &fixedFDNativeACL{actor: a, native: n, boundary: b, now: time.Now, credentials: fixedFDActorCredentials}
-}
-func fixedFDActorCredentials(a NativeActor) Code {
-	if !a.valid || a.UID() == 0 {
-		return ErrDenied
-	}
-	ru, eu, su := unix.Getresuid()
-	rg, eg, sg := unix.Getresgid()
-	groups, err := os.Getgroups()
-	want := []int{}
-	for _, g := range a.Groups() {
-		want = append(want, int(g))
-	}
-	slices.Sort(groups)
-	slices.Sort(want)
-	if err != nil || ru != int(a.UID()) || eu != ru || su != ru || rg != int(a.GID()) || eg != rg || sg != rg || !slices.Equal(groups, want) {
-		return ErrDenied
-	}
-	var caps [2]unix.CapUserData
-	h := unix.CapUserHeader{Version: unix.LINUX_CAPABILITY_VERSION_3}
-	if unix.Capget(&h, &caps[0]) != nil || caps[0] != (unix.CapUserData{}) || caps[1] != (unix.CapUserData{}) {
-		return ErrDenied
-	}
-	dump, e := unix.PrctlRetInt(unix.PR_GET_DUMPABLE, 0, 0, 0, 0)
-	if e != nil || dump != 0 {
-		return ErrDenied
-	}
-	priv, e := unix.PrctlRetInt(unix.PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)
-	if e != nil || priv != 1 {
-		return ErrDenied
-	}
-	return ""
-}
-func (a *fixedFDNativeACL) Authorize(ctx context.Context, action Action, fd int) Code {
-	if a == nil || a.native == nil || a.boundary == nil || a.now == nil || a.credentials == nil {
-		return ErrUnsupported
-	}
-	if !action.ReadOnly() {
-		return ErrUnsupported
-	}
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	if !a.actor.valid || !nativeFresh(a.actor.account.CheckedAt, a.now()) {
-		return ErrStale
-	}
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	if c := nativeContextCode(ctx); c != "" {
-		return c
-	}
-	if c := a.credentials(a.actor); c != "" {
-		return safeGrantCode(c)
-	}
-	duplicate, err := unix.FcntlInt(uintptr(fd), unix.F_DUPFD_CLOEXEC, 3)
-	if err != nil {
-		return ErrUnavailable
-	}
-	defer unix.Close(duplicate)
-	var st unix.Stat_t
-	if c := readOnlyInspect(duplicate, &st); c != "" {
-		return c
-	}
-	if c := nativeObservationCode(ctx, a.boundary.Authorize(ctx, action, duplicate)); c != "" {
-		return c
-	}
-	mask := nativeACLRead | nativeACLReadAttr
-	if st.Mode&unix.S_IFMT == unix.S_IFDIR {
-		mask |= nativeACLExec
-	}
-	o, c := a.native.Check(ctx, duplicate, "/proc/self/fd/"+strconv.Itoa(duplicate), mask)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return c
-	}
-	if !o.FilesystemSupported || !o.ObjectSupported || !o.MasksVerified {
-		return ErrUnsupported
-	}
-	if !o.Allowed {
-		return ErrDenied
-	}
-	if !nativeFresh(o.CheckedAt, a.now()) {
-		return ErrStale
-	}
-	if c = a.credentials(a.actor); c != "" {
-		return safeGrantCode(c)
-	}
-	var after unix.Stat_t
-	if c = readOnlyInspect(duplicate, &after); c != "" {
-		return c
-	}
-	if !sameReadOnlyObject(st, after) {
-		return ErrStale
-	}
-	if c = nativeObservationCode(ctx, a.boundary.Authorize(ctx, action, duplicate)); c != "" {
-		return c
-	}
-	if !nativeFresh(o.CheckedAt, a.now()) || !nativeFresh(a.actor.account.CheckedAt, a.now()) {
-		return ErrStale
-	}
-	return ""
-}

package/templates/native-go/backend/internal/helper/dsm_acl_linux_test.go

@@ -1,121 +0,0 @@
-package helper
-
-import (
-	"context"
-	"golang.org/x/sys/unix"
-	"os"
-	"strconv"
-	"testing"
-	"time"
-)
-
-type aclNativeFake struct {
-	value    nativeFDACLObservation
-	code     Code
-	calls    int
-	alias    string
-	mask     uint32
-	expected uint64
-	rename   func()
-}
-
-func (f *aclNativeFake) Check(ctx context.Context, fd int, alias string, mask uint32) (nativeFDACLObservation, Code) {
-	f.calls++
-	f.alias = alias
-	f.mask = mask
-	var st unix.Stat_t
-	if unix.Fstat(fd, &st) != nil || st.Ino != f.expected {
-		return nativeFDACLObservation{}, ErrDenied
-	}
-	if alias != "/proc/self/fd/"+strconv.Itoa(fd) {
-		return nativeFDACLObservation{}, ErrDenied
-	}
-	if f.rename != nil {
-		f.rename()
-	}
-	return f.value, f.code
-}
-func TestDSMFixedFDACLUsesPinnedObjectAndNativeSupport(t *testing.T) {
-	p, _, _, c, now := nativeFixture()
-	actor, _ := p.Resolve(context.Background(), c)
-	root := t.TempDir()
-	os.WriteFile(root+"/file", []byte("private"), 0600)
-	file, err := os.Open(root + "/file")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	var st unix.Stat_t
-	unix.Fstat(int(file.Fd()), &st)
-	f := &aclNativeFake{expected: st.Ino, value: nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: true, CheckedAt: now}}
-	a := newFixedFDNativeACL(actor, f, fixtureReadOnlyACL{})
-	a.now = func() time.Time { return now }
-	a.credentials = func(NativeActor) Code { return "" }
-	f.rename = func() {
-		f.rename = nil
-		os.Rename(root+"/file", root+"/old")
-		os.WriteFile(root+"/file", []byte("replacement"), 0600)
-	}
-	if code := a.Authorize(context.Background(), ActionRead, int(file.Fd())); code != "" || f.calls != 1 || f.mask != nativeACLRead|nativeACLReadAttr {
-		t.Fatal(code, f.mask)
-	}
-	for _, change := range []func(*nativeFDACLObservation){func(o *nativeFDACLObservation) { o.FilesystemSupported = false }, func(o *nativeFDACLObservation) { o.ObjectSupported = false }, func(o *nativeFDACLObservation) { o.MasksVerified = false }, func(o *nativeFDACLObservation) { o.Allowed = false }, func(o *nativeFDACLObservation) { o.CheckedAt = time.Time{} }} {
-		f.value = nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: true, CheckedAt: now}
-		change(&f.value)
-		if code := a.Authorize(context.Background(), ActionRead, int(file.Fd())); code == "" {
-			t.Fatal("unproved native Allow")
-		}
-	}
-	a.credentials = func(NativeActor) Code { return ErrDenied }
-	before := f.calls
-	if code := a.Authorize(context.Background(), ActionRead, int(file.Fd())); code != ErrDenied || f.calls != before {
-		t.Fatal("root/stale credential reached ACL", code)
-	}
-}
-func TestDSMFixedFDACLNoNativeOrBoundaryFallback(t *testing.T) {
-	p, _, _, c, _ := nativeFixture()
-	actor, _ := p.Resolve(context.Background(), c)
-	for _, a := range []*fixedFDNativeACL{newFixedFDNativeACL(actor, nil, fixtureReadOnlyACL{}), newFixedFDNativeACL(actor, &aclNativeFake{}, nil)} {
-		if code := a.Authorize(context.Background(), ActionStat, 0); code == "" {
-			t.Fatal("missing gate allowed")
-		}
-	}
-}
-
-// A successful final boundary check must not publish expired native/actor proof.
-type agingACLBoundary struct {
-	calls   int
-	advance func()
-}
-
-func (b *agingACLBoundary) Authorize(context.Context, Action, int) Code {
-	b.calls++
-	if b.calls == 2 {
-		b.advance()
-	}
-	return ""
-}
-func TestDSMFixedFDACLFinalBoundaryCannotPublishExpiredProof(t *testing.T) {
-	p, _, _, carriers, now := nativeFixture()
-	actor, code := p.Resolve(context.Background(), carriers)
-	if code != "" {
-		t.Fatal(code)
-	}
-	file, err := os.CreateTemp(t.TempDir(), "pinned")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	var st unix.Stat_t
-	if err := unix.Fstat(int(file.Fd()), &st); err != nil {
-		t.Fatal(err)
-	}
-	native := &aclNativeFake{expected: st.Ino, value: nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: true, CheckedAt: now}}
-	boundary := &agingACLBoundary{advance: func() { now = now.Add(NativeProofFreshness + time.Nanosecond) }}
-	acl := newFixedFDNativeACL(actor, native, boundary)
-	acl.now = func() time.Time { return now }
-	acl.credentials = func(NativeActor) Code { return "" }
-	if code := acl.Authorize(context.Background(), ActionStat, int(file.Fd())); code != ErrStale {
-		t.Fatalf("expired proof published: %s", code)
-	}
-}