@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go/backend/internal/helper/sdk_rpc_contract.go

@@ -1,70 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"time"
-)
-
-// Strict, fixed public arguments. No identity/role, epoch, approval or arbitrary
-// handler fields; the root owner constructs the execution binding.
-type sdkPrepareArgs struct {
-	Worker jobcontract.RevisionRef `json:"worker"`
-	Parent jobcontract.RevisionRef `json:"parent"`
-	Input  jobcontract.Input       `json:"input"`
-}
-type sdkSubmitArgs struct {
-	IntentID      string `json:"intentId"`
-	SummaryDigest string `json:"summaryDigest"`
-}
-type sdkStatusArgs struct {
-	Cursor string `json:"cursor,omitempty"`
-}
-type sdkLookupArgs struct {
-	IntentID string `json:"intentId"`
-}
-type sdkResultArgs struct {
-	JobID string `json:"jobId"`
-}
-type sdkCancelArgs struct {
-	JobID    string `json:"jobId"`
-	Revision uint64 `json:"revision"`
-}
-type sdkRevokeArgs struct {
-	JobID              string `json:"jobId"`
-	Revision           uint64 `json:"revision"`
-	DelegationRevision uint64 `json:"delegationRevision"`
-	StoreRevision      uint64 `json:"storeRevision"`
-}
-type sdkAttachArgs struct {
-	JobID    string `json:"jobId"`
-	AttachID string `json:"attachId"`
-}
-type sdkPrepared struct {
-	IntentID      string `json:"intentId"`
-	JobID         string `json:"jobId"`
-	SummaryDigest string `json:"summaryDigest"`
-	ExpiresAt     int64  `json:"expiresAt"`
-}
-type sdkInteractivePending struct {
-	request sdkJobRequest
-	expires time.Duration
-}
-
-// Package CGI -> owned helper -> sole supervisor. Carriers are bounded,
-// transient, and independently verified by the root native authority.
-type sdkWireRequest struct {
-	Inventory Inventory       `json:"inventory"`
-	Nonce     string          `json:"nonce"`
-	Method    string          `json:"method"`
-	Carriers  grantCarriers   `json:"carriers"`
-	Args      json.RawMessage `json:"args"`
-}
-type sdkWireResponse struct {
-	Inventory Inventory       `json:"inventory"`
-	Nonce     string          `json:"nonce"`
-	Code      Code            `json:"code,omitempty"`
-	Data      json.RawMessage `json:"data,omitempty"`
-}

package/templates/native-go/backend/internal/helper/sdk_rpc_test.go

@@ -1,135 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"strings"
-	"testing"
-)
-
-func sdkTestRPC(f *sdkJobTestFixture, method string, args any) sdkWireResponse {
-	raw, _ := json.Marshal(args)
-	nonce, _ := sdkRandomRef()
-	r := sdkWireRequest{f.c.inventory, nonce, method, grantCarriers{f.carriers.Cookie, f.carriers.SynoToken, f.carriers.ClientAddress}, raw}
-	b, _ := json.Marshal(r)
-	return f.o.dispatchSDK(context.Background(), operationPeer{42, 0}, b)
-}
-func prepareSDKTest(t *testing.T, f *sdkJobTestFixture) sdkPrepared {
-	t.Helper()
-	res := sdkTestRPC(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, f.r.Control.Binding.ParentGrant, f.r.Input})
-	if res.Code != "" {
-		t.Fatal(res.Code)
-	}
-	var p sdkPrepared
-	if json.Unmarshal(res.Data, &p) != nil || !allReferences(p.JobID, p.IntentID, p.SummaryDigest) {
-		t.Fatal(string(res.Data))
-	}
-	return p
-}
-func TestSDKRPCIssuedIntentSubmitAttachAndReplay(t *testing.T) {
-	f := sdkJobFixture(t)
-	p := prepareSDKTest(t, f)
-	if len(f.children) != 0 {
-		t.Fatal("prepare dispatched")
-	}
-	r := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	var attach sdkAttachReceipt
-	if json.Unmarshal(r.Data, &attach) != nil || attach.JobID != p.JobID || !allReferences(attach.AttachID) || attach.TTLMS != 6000 || attach.RenewAfterMS != 2000 {
-		t.Fatal(string(r.Data))
-	}
-	if len(f.children) != 1 {
-		t.Fatal("submit did not use fixed launcher")
-	}
-	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}).Code; c != ErrReplay {
-		t.Fatal(c)
-	}
-	if c := sdkTestRPC(f, "jobs.attach", sdkAttachArgs{p.JobID, attach.AttachID}).Code; c != "" {
-		t.Fatal(c)
-	}
-}
-func TestSDKRPCRejectsCallerAuthorityAndUnknownMethods(t *testing.T) {
-	f := sdkJobFixture(t)
-	for _, args := range []string{`{"cursor":"","actor":{}}`, `{"cursor":"","roles":["admin"]}`, `{"cursor":"","epoch":"a"}`, `{"cursor":"","approval":"a"}`, `{"cursor":"","executable":"/bin/sh"}`, `{"cursor":"","cursor":""}`, `{"Cursor":""}`, `{"cursor":null}`} {
-		if c := sdkTestRPC(f, "jobs.status", json.RawMessage(args)).Code; c != ErrInvalid {
-			t.Fatal(args, c)
-		}
-	}
-	for _, method := range []string{"jobs.background.prepare", "jobs.exec", "jobs.resume", "jobs.confirm"} {
-		if c := sdkTestRPC(f, method, struct{}{}).Code; c != ErrUnsupported {
-			t.Fatal(method, c)
-		}
-	}
-	if len(f.children) != 0 {
-		t.Fatal("untrusted public args spawned")
-	}
-}
-func TestSDKRPCRejectsWrongPeerInventorySessionAndSummary(t *testing.T) {
-	f := sdkJobFixture(t)
-	p := prepareSDKTest(t, f)
-	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, grantRef('f')}).Code; c != ErrDenied {
-		t.Fatal(c)
-	}
-	f.native.session.SessionRef = grantRef('e')
-	f.native.app.SessionRef = grantRef('e')
-	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}).Code; c != ErrDenied {
-		t.Fatal(c)
-	}
-	args, _ := json.Marshal(sdkStatusArgs{})
-	req := sdkWireRequest{f.c.inventory, grantRef('a'), "jobs.status", grantCarriers{}, args}
-	raw, _ := json.Marshal(req)
-	if c := f.o.dispatchSDK(context.Background(), operationPeer{43, 0}, raw).Code; c != ErrDenied {
-		t.Fatal(c)
-	}
-	req.Inventory.Version = "2.0.0-0001"
-	raw, _ = json.Marshal(req)
-	if c := f.o.dispatchSDK(context.Background(), operationPeer{42, 0}, raw).Code; c != ErrIncompatible {
-		t.Fatal(c)
-	}
-}
-func TestSDKRPCAdminRoleAndDisplayRedaction(t *testing.T) {
-	f := sdkJobFixture(t)
-	f.native.groups.Admin = false
-	if c := sdkTestRPC(f, "jobs.admin.status", sdkStatusArgs{}).Code; c != ErrDenied {
-		t.Fatal(c)
-	}
-	p := prepareSDKTest(t, f)
-	if c := sdkTestRPC(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}).Code; c != "" {
-		t.Fatal(c)
-	}
-	r := sdkTestRPC(f, "jobs.status", sdkStatusArgs{})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	for _, secret := range []string{"sessionRef", "approvalBinding", "ticket", "fixture", "username"} {
-		if strings.Contains(string(r.Data), secret) {
-			t.Fatal("leak", secret)
-		}
-	}
-	var page sdkJobPage
-	json.Unmarshal(r.Data, &page)
-	if len(page.Items) != 1 || page.Items[0].Mode != jobcontract.Interactive {
-		t.Fatal(string(r.Data))
-	}
-	if c := sdkTestRPC(f, "jobs.cancel", sdkCancelArgs{p.JobID, page.Revision}).Code; c != "" {
-		t.Fatal(c)
-	}
-}
-func TestSDKRPCSharedIntentCapAndOtherConsentCannotConsume(t *testing.T) {
-	f := sdkJobFixture(t)
-	p := prepareSDKTest(t, f)
-	if _, c := f.s.authority.Confirm(context.Background(), f.carriers, p.IntentID, p.SummaryDigest, 1); c != ErrUnsupported {
-		t.Fatal(c)
-	}
-	for i := 1; i < MaxLiveIntents; i++ {
-		prepareSDKTest(t, f)
-	}
-	if c := sdkTestRPC(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, f.r.Control.Binding.ParentGrant, f.r.Input}).Code; c != ErrBusy {
-		t.Fatal(c)
-	}
-}

package/templates/native-go/backend/internal/helper/sdk_server_linux.go

@@ -1,161 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"io"
-	"net"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"time"
-)
-
-func serveLinux(c Client) error {
-	r, err := readRecord(c.StateDir, 0)
-	if err != nil || !r.Enabled || r.Inventory != c.Expected || r.Lifecycle == nil || r.Lifecycle.Phase != "running" {
-		return errTrust
-	}
-	// Only the supervisor writes process.json.
-	// The package group can connect; ordinary users reach only the authenticated
-	// CGI status route. SO_PEERCRED also checks the package's current numeric UID.
-	u, err := user.Lookup(c.Expected.Package)
-	if err != nil {
-		return err
-	}
-	uid, err := strconv.ParseUint(u.Uid, 10, 32)
-	if err != nil {
-		return err
-	}
-	group, err := user.LookupGroup(c.Expected.Package)
-	if err != nil {
-		return err
-	}
-	gid, err := strconv.Atoi(group.Gid)
-	if err != nil {
-		return err
-	}
-	socket := filepath.Join(c.RunDir, "helper.sock")
-	l, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"})
-	if err != nil {
-		return err
-	}
-	l.SetUnlinkOnClose(false)
-	defer l.Close()
-	if err := os.Chown(socket, 0, gid); err != nil {
-		return err
-	}
-	if err := os.Chmod(socket, 0660); err != nil {
-		return err
-	}
-	// Bound concurrency and each frame. The authenticated package UID may only
-	// withdraw authority; activation remains an exact approved root task.
-	slots := make(chan struct{}, 8)
-	for {
-		conn, err := l.AcceptUnix()
-		if err != nil {
-			return err
-		}
-		select {
-		case slots <- struct{}{}:
-		default:
-			conn.Close()
-			continue
-		}
-		go func() {
-			defer func() { conn.Close(); <-slots }()
-			peer, err := peerUID(conn)
-			if err != nil || (peer != 0 && peer != uint32(uid)) {
-				return
-			}
-			conn.SetDeadline(time.Now().Add(time.Second))
-			var raw json.RawMessage
-			d := json.NewDecoder(io.LimitReader(conn, MaxControlBytes+1))
-			if d.Decode(&raw) != nil || len(raw) > MaxControlBytes {
-				return
-			}
-			var kind struct {
-				Method string `json:"method"`
-			}
-			if json.Unmarshal(raw, &kind) != nil {
-				return
-			}
-			if kind.Method != "" {
-				// SDK frames half-close after their bounded body. EOF is only
-				// framing; attach TTL, not this short connection, owns liveness.
-				rest, err := io.ReadAll(io.LimitReader(io.MultiReader(d.Buffered(), conn), MaxControlBytes+1))
-				if err != nil || d.InputOffset()+int64(len(rest)) > MaxControlBytes || len(bytes.TrimSpace(rest)) != 0 {
-					return
-				}
-				conn.SetDeadline(time.Now().Add(3 * time.Second))
-				json.NewEncoder(conn).Encode(forwardSDKJobs(c, raw))
-				return
-			}
-			if len(raw) > 4096 {
-				return
-			}
-			var req Request
-			health := json.NewDecoder(bytes.NewReader(raw))
-			health.DisallowUnknownFields()
-			if health.Decode(&req) != nil {
-				return
-			}
-			if req.Op == "revoke" {
-				err := packageRevoke(c, req)
-				res := Response{Inventory: c.Expected, Nonce: req.Nonce, OK: err == nil}
-				if err != nil {
-					res.Error = "revoke-refused"
-				}
-				json.NewEncoder(conn).Encode(res)
-				return
-			}
-			r, err := readRecord(c.StateDir, 0)
-			readiness := "fenced"
-			if err == nil && r.Enabled && r.Inventory == c.Expected && r.Lifecycle != nil && r.Lifecycle.Phase == "running" {
-				readiness = parentReadiness(c)
-			}
-			res := Respond(c.Expected, readiness != "ready", req)
-			if readiness != "ready" {
-				res.Error = readiness
-			}
-			json.NewEncoder(conn).Encode(res)
-		}()
-	}
-}
-
-// No lifecycle mutations: only the exact owned child can request admission.
-func parentReadiness(c Client) string {
-	p, err := readProcess(c.RunDir, 0)
-	if err != nil || p.PID != os.Getppid() {
-		return "fenced"
-	}
-	actual, err := inspectSupervisor(p.PID, c.Expected)
-	if err != nil || actual != p {
-		return "fenced"
-	}
-	conn, err := net.DialTimeout("unix", filepath.Join(c.RunDir, "supervisor.sock"), 100*time.Millisecond)
-	if err != nil {
-		return "fenced"
-	}
-	defer conn.Close()
-	peer, err := peerCredentials(conn.(*net.UnixConn))
-	if err != nil || peer.Uid != 0 || int(peer.Pid) != p.PID {
-		return "fenced"
-	}
-	conn.SetDeadline(time.Now().Add(200 * time.Millisecond))
-	var nonce [32]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return "fenced"
-	}
-	req := supervisorRequest{Process: p, Op: "admit", Nonce: hex.EncodeToString(nonce[:])}
-	if json.NewEncoder(conn).Encode(req) != nil {
-		return "fenced"
-	}
-	res, err := decodeSupervisorReply(conn, c.Expected, req.Nonce)
-	return supervisorReadiness(res, err)
-}