@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go-background/frontend/test/background.test.ts

@@ -1,179 +0,0 @@
-// @vitest-environment jsdom
-import {readFileSync} from 'node:fs'
-import {join} from 'node:path'
-import {test,expect} from 'vitest'
-import {createApp,h,nextTick} from 'vue'
-import {AppRoot} from '@synopackageland/ui'
-import BackgroundPanel from '../src/background/BackgroundPanel.vue'
-import {backgroundCatalogs,backgroundCopy} from '../src/background/i18n'
-import {m2Copy} from '../src/nas/m2-i18n'
-// The UI Select is a Reka combobox: drive it by keyboard (the UI README helper), which also proves it is keyboard operable.
-// Attrs such as data-schedule-interval land on the focusable combobox itself.
-async function choose(root:HTMLElement,marker:string,label:string){
- const trigger=root.querySelector<HTMLElement>(`[${marker}][role=combobox]`)!;expect(trigger,marker).toBeTruthy()
- expect(trigger.id,marker).toBeTruthy();expect(root.querySelector(`label[for="${trigger.id}"]`),marker).toBeTruthy()
- trigger.dispatchEvent(new KeyboardEvent('keydown',{key:'ArrowDown',bubbles:true,cancelable:true}));await settle()
- const option=[...document.querySelectorAll<HTMLElement>('[role=option]')].find(o=>o.textContent?.trim()===label)
- if(!option||option.getAttribute('aria-disabled')==='true')throw new Error(`No enabled option: ${label}`)
- option.focus();option.dispatchEvent(new KeyboardEvent('keydown',{key:'Enter',bubbles:true,cancelable:true}));await settle()
- expect(trigger.textContent).toContain(label)
-}
-async function settle(){for(let i=0;i<20;i++){await Promise.resolve();await nextTick()}}
-type Call=(method:string,params?:Record<string,unknown>)=>Promise<any>
-function mount(call:Call,locale='en'){
- const root=document.createElement('div');document.body.append(root)
- const app=createApp({render:()=>h(AppRoot,{},()=>h(BackgroundPanel,{ctx:{call,locale}}))})
- app.config.idPrefix=`bg-${Math.random()}`;app.mount(root)
- return {root,close(){app.unmount();root.remove()}}
-}
-const click=(root:HTMLElement,text:string)=>{const b=[...root.querySelectorAll('button')].find(b=>b.textContent?.trim()===text)!;expect(b).toBeTruthy();b.click()}
-const status=(enabled:boolean)=>({supported:true,enabled,admin:true,allowOrdinaryUsers:false,revision:1,queued:0,running:0,worker:{username:'SynoPkg',alive:true},limits:{maxInputBytes:524288,maxQueued:16,maxOwnerPending:2,maxOwnerBytes:1048576,maxTotalBytes:16777216,jobTimeoutSeconds:60}})
-
-test('non-administrators see unsupported and no action',async()=>{
- const f=mount(async()=>{throw {code:'unsupported'}});await settle()
- expect(f.root.textContent).toContain(backgroundCopy('en').unsupported);expect(f.root.querySelector('button')).toBeNull();f.close()
-})
-const browse=(args?:Record<string,unknown>)=>args?.folder
- ?{files:[{name:'fixture.bin',path:`${args.folder}/fixture.bin`,isdir:false,additional:{size:3}}],total:1,offset:0}
- :{shares:[{name:'share',path:'/share',isdir:true}],total:1,offset:0}
-test('enable, pick a file, submit, cancel and result use only bg.* routes',async()=>{
- const calls:Array<[string,Record<string,unknown>|undefined]>=[];let enabled=false,jobs:any[]=[]
- const f=mount(async(m,p)=>{
-  calls.push([m,p])
-  switch(m){
-   case 'bg.status':return status(enabled)
-   case 'bg.jobs.list':return {jobs}
-   case 'bg.browse':return browse(p)
-   case 'bg.mode.set':enabled=true;return {enabled}
-   case 'bg.jobs.submit':jobs=[{id:'j1',name:'fixture.bin',state:'queued'}];return {job:jobs[0],duplicate:false}
-   case 'bg.jobs.cancel':jobs=[{...jobs[0],state:'canceled'}];return {job:jobs[0]}
-   case 'bg.jobs.result':return {result:{sha256:'x'}}
-  }
- });await settle()
- const copy=backgroundCopy('en'),pick=m2Copy('en')
- click(f.root,copy.enable);await settle()
- expect(f.root.querySelector('[data-bg-folder]')).toBeNull();expect(f.root.querySelector('[data-bg-file]')).toBeNull()
- const submitButton=()=>[...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===copy.submit)!
- expect(submitButton().disabled).toBe(true)
- click(f.root,copy.chooseFile);await settle()
- click(f.root,'Open share');await settle()
- click(f.root,'Select fixture.bin');await settle();click(f.root,pick.confirm);await settle()
- expect(f.root.textContent).toContain('/share/fixture.bin')
- expect(submitButton().disabled).toBe(false)
- click(f.root,copy.submit);await settle()
- const submit=calls.find(c=>c[0]==='bg.jobs.submit')![1]!
- expect(submit.folder).toBe('/share');expect(submit.relative).toBe('fixture.bin');expect(typeof submit.key).toBe('string')
- expect(f.root.querySelector('[data-job-state=queued]')).not.toBeNull()
- click(f.root,copy.cancel);await settle()
- expect(f.root.querySelector('[data-job-state=canceled]')).not.toBeNull()
- expect(calls.filter(c=>c[0]==='bg.browse').length).toBeGreaterThan(0)
- expect(calls.every(c=>/^bg\./.test(c[0]))).toBe(true)
- f.close()
-})
-test('a denied listing shows a localized error and cannot submit',async()=>{
- const f=mount(async(m)=>{
-  if(m==='bg.status')return status(true)
-  if(m==='bg.jobs.list')return {jobs:[]}
-  if(m==='bg.browse')throw {code:'denied',message:'Cookie=CANARY'}
- });await settle()
- click(f.root,backgroundCopy('en').chooseFile);await settle()
- expect(f.root.textContent).toContain(m2Copy('en').errorDenied);expect(f.root.textContent).not.toContain('CANARY')
- expect([...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===backgroundCopy('en').submit)!.disabled).toBe(true)
- f.close()
-})
-test('nine locales have identical keys and placeholders',()=>{
- const en=backgroundCatalogs.en,flat=(o:any,p=''):Record<string,string>=>Object.fromEntries(Object.entries(o).flatMap(([k,v])=>typeof v==='string'?[[p+k,v]]:Object.entries(flat(v,`${p}${k}.`))))
- const base=flat(en)
- expect(Object.keys(backgroundCatalogs).sort()).toEqual(['de','en','es','fr','it','ja','ko','zh-CN','zh-TW'])
- for(const catalog of Object.values(backgroundCatalogs)){
-  const map=flat(catalog);expect(Object.keys(map).sort()).toEqual(Object.keys(base).sort())
-  for(const [k,v] of Object.entries(map)){expect(v.length).toBeGreaterThan(0);expect(v.match(/\{\w+\}/g)??[]).toEqual(base[k].match(/\{\w+\}/g)??[])}
- }
-})
-
-test('a null job list from the worker renders as no jobs',async()=>{
- const f=mount(async m=>m==='bg.status'?status(true):m==='bg.jobs.list'?{jobs:null}:{});await settle()
- expect(f.root.textContent).toContain(backgroundCopy('en').noJobs);f.close()
-})
-
-test('the picker dialog explains the one-time read, not the M2 saved-selection consent',async()=>{
- for(const locale of Object.keys(backgroundCatalogs)){
-  const f=mount(async(m,p)=>m==='bg.status'?status(true):m==='bg.jobs.list'?{jobs:[]}:browse(p),locale);await settle()
-  const copy=backgroundCopy(locale)
-  click(f.root,copy.chooseFile);await settle()
-  const dialog=f.root.querySelector('[role=dialog]')!.textContent!
-  expect(dialog).toContain(copy.pickerConsent);expect(dialog).not.toContain(m2Copy(locale).consent)
-  f.close()
- }
-})
-
-test('ordinary owner can submit but has no administrator controls',async()=>{
- const calls:string[]=[]
- const f=mount(async(m,p)=>{calls.push(m);if(m==='bg.status')return {...status(true),admin:false,allowOrdinaryUsers:true};if(m==='bg.jobs.list')return {jobs:[{id:'owned',name:'owned.bin',state:'queued',submitter:{user:'bob',uid:'1025'}}]};if(m==='bg.browse')return browse(p);return {}});await settle()
- const c=backgroundCopy('en')
- expect(f.root.textContent).toContain(c.ownerScope)
- expect(f.root.textContent).not.toContain(c.disable)
- expect(f.root.textContent).not.toContain(c.allowUsers)
- expect(f.root.textContent).not.toContain(c.purgeOwner)
- expect([...f.root.querySelectorAll('button')].some(b=>b.textContent?.trim()===c.chooseFile)).toBe(true)
- click(f.root,c.cancel);await settle();expect(calls).toContain('bg.jobs.cancel');f.close()
-})
-test('admin ordinary-user switch and exact owner purge require explicit confirmation',async()=>{
- const calls:Array<[string,Record<string,unknown>|undefined]>=[]
- const f=mount(async(m,p)=>{calls.push([m,p]);if(m==='bg.status')return {...status(true),admin:true,allowOrdinaryUsers:false};if(m==='bg.jobs.list')return {jobs:[{id:'one',name:'a',state:'succeeded',submitter:{user:'bob',uid:'1025'}}]};return {}});await settle()
- const c=backgroundCopy('en');click(f.root,c.allowUsers);await settle()
- expect(calls.find(([m])=>m==='bg.users.set')?.[1]).toEqual({allowOrdinaryUsers:true})
- click(f.root,c.purgeOwner);await settle();expect(calls.some(([m])=>m==='bg.jobs.purge')).toBe(false)
- click(f.root,c.confirmPurge);await settle()
- expect(calls.find(([m])=>m==='bg.jobs.purge')?.[1]).toEqual({owner:{user:'bob',uid:'1025'}});f.close()
-})
-test('malformed status cannot render action controls or crash the panel',async()=>{
- const f=mount(async()=>({state:'not-enabled'}));await settle()
- expect(f.root.textContent).toContain(backgroundCopy('en').errors.failed)
- expect(f.root.querySelector('button')).toBeNull();f.close()
-})
-
-test('schedule creation requires copy consent; owner controls disable and delete exact schedule',async()=>{
- const calls:Array<[string,Record<string,unknown>|undefined]>=[];let schedules:any[]=[]
- const f=mount(async(m,p)=>{calls.push([m,p]);switch(m){
- case 'bg.status':return {...status(true),owner:{user:'bob',uid:'1025'},admin:false,allowOrdinaryUsers:true}
- case 'bg.jobs.list':return {jobs:[{id:'import',name:'copy.bin',state:'succeeded',copyRetained:true,submitter:{user:'bob',uid:'1025'}}]}
- case 'bg.schedules.list':return {schedules}
- case 'bg.schedules.create':schedules=[{id:'schedule',name:'copy.bin',owner:{user:'bob',uid:'1025'},enabled:true,intervalSeconds:3600,nextAt:'2026-10-05T01:00:00Z',missed:0,workerRevision:1}];return {schedule:schedules[0]}
- case 'bg.schedules.disable':schedules=[{...schedules[0],enabled:false}];return {schedule:schedules[0]}
- case 'bg.schedules.delete':schedules=[];return {deleted:true}
- default:return {}
- }});await settle();const c=backgroundCopy('en')
- click(f.root,c.scheduleCopy);await settle()
- expect(calls.some(([m])=>m==='bg.schedules.create')).toBe(false)
- const create=[...f.root.querySelectorAll('button')].find(b=>b.textContent?.trim()===c.createSchedule)!
- expect(create.disabled).toBe(true)
- await choose(f.root,'data-schedule-interval',c.weekly)
- const consent=f.root.querySelector<HTMLElement>('[data-schedule-consent] [role=checkbox], [role=checkbox][data-schedule-consent]')!;consent.click();await settle()
- click(f.root,c.createSchedule);await settle()
- expect(calls.find(([m])=>m==='bg.schedules.create')?.[1]).toMatchObject({jobId:'import',intervalSeconds:604800,consent:true})
- expect(f.root.querySelector('[data-schedule-id=schedule]')?.textContent).toContain(c.nextRun.replace('{time}','').trim().split(':')[0])
- click(f.root,c.disableSchedule);await settle();expect(calls.find(([m])=>m==='bg.schedules.disable')?.[1]).toEqual({id:'schedule'})
- click(f.root,c.deleteSchedule);await settle();expect(calls.some(([m])=>m==='bg.schedules.delete')).toBe(false)
- click(f.root,c.confirmDeleteSchedule);await settle();expect(calls.find(([m])=>m==='bg.schedules.delete')?.[1]).toEqual({id:'schedule'});f.close()
-})
-
-test('administrator sees the exact selected copy before enabling a schedule',async()=>{
- const calls:Array<[string,Record<string,unknown>|undefined]>=[]
- const name='private-'.padEnd(128,'x')
- const f=mount(async(m,p)=>{calls.push([m,p]);if(m==='bg.status')return status(true);if(m==='bg.jobs.list')return {jobs:[]};if(m==='bg.schedules.list')return {schedules:[{id:'disabled',name,owner:{user:'normal1',uid:'1025'},enabled:false,nextAt:'2026-10-05T01:00:00Z',missed:0}]};return {}});await settle()
- const c=backgroundCopy('en');click(f.root,c.enableSchedule);await settle()
- const expected=c.enableScheduleConsent.replace('{name}',name)
- expect(expected).toContain(name);expect(f.root.textContent).toContain(expected)
- expect(calls.some(([m])=>m==='bg.schedules.enable')).toBe(false)
- click(f.root,c.confirmEnableSchedule);await settle()
- expect(calls.find(([m])=>m==='bg.schedules.enable')?.[1]).toEqual({id:'disabled',consent:true});f.close()
-})
-
-// Same rule as the base template (test/native-controls.test.ts): UI components only, and the
-// UI's own Form auto layout and FormItem id binding instead of per-app workarounds.
-test('the background panel uses only UI components and the UI form binding',()=>{
- const template=readFileSync(join(__dirname,'../src/background/BackgroundPanel.vue'),'utf8').replace(/<script[\s\S]*?<\/script>/g,'').replace(/<style[\s\S]*?<\/style>/g,'')
- expect(template.match(/<(?:a|input|select|textarea|label)[\s>/]/g)).toBeNull()
- expect(template).not.toMatch(/direction="vertical"|field\.controlId|role="group"/)
-})

package/templates/native-go-better-auth/backend/internal/app/identity.go

@@ -1,208 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"os/exec"
-	"syscall"
-	"time"
-
-	"dsmapp/internal/api"
-)
-
-const maxIdentityBytes = 1 << 20
-
-// Only the selected overlay includes this runner. It invokes a fixed package
-// payload as the package account, never a root helper or arbitrary command.
-var identityRun = func(ctx context.Context, cfg Config, input []byte) ([]byte, error) {
-	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, "/var/packages/Node.js_v22/target/usr/local/bin/node", "/var/packages/"+cfg.PackageID+"/target/integration/identity/app.mjs")
-	cmd.Env = []string{"NODE_ENV=production", "PATH=/usr/bin:/bin"}
-	cmd.Stdin = bytes.NewReader(input)
-	var out limitedIdentityOutput
-	cmd.Stdout = &out
-	// Do not expose subprocess messages or credentials in the CGI envelope.
-	if err := cmd.Run(); err != nil {
-		return nil, err
-	}
-	return out.Bytes(), nil
-}
-
-type limitedIdentityOutput struct{ bytes.Buffer }
-
-func (w *limitedIdentityOutput) Write(p []byte) (int, error) {
-	if w.Len()+len(p) > maxIdentityBytes {
-		return 0, errors.New("oversized identity output")
-	}
-	return w.Buffer.Write(p)
-}
-func (cfg Config) identityRoutes() []api.Route {
-	return []api.Route{
-		api.User("identity.status", func(_ context.Context, _ api.Caller, p json.RawMessage) (any, error) {
-			if err := decodeParams(p, &struct{}{}); err != nil {
-				return nil, err
-			}
-			return map[string]string{"mode": "better-auth"}, nil
-		}),
-		api.User("identity.login", cfg.identityHandler("login")), api.User("identity.current", cfg.identityHandler("current")), api.User("identity.logout", cfg.identityHandler("logout")),
-	}
-}
-func (cfg Config) identityHandler(method string) api.Handler {
-	return func(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
-		var cookie string
-		if method == "login" {
-			if err := decodeParams(params, &struct{}{}); err != nil {
-				return nil, err
-			}
-		} else {
-			var in struct {
-				Cookie string `json:"cookie"`
-			}
-			if err := decodeParams(params, &in); err != nil {
-				return nil, err
-			}
-			cookie = in.Cookie
-			if len(cookie) > 8192 {
-				return nil, api.BadRequest("app session too large")
-			}
-		}
-		if _, err := cfg.personalID(ctx, caller); err != nil {
-			return nil, err
-		}
-		principal, err := personalLookup(caller.User())
-		if err != nil || principal.Username != caller.User() {
-			return nil, identityUnavailable()
-		}
-		result, err := cfg.identityExchange(ctx, method, cookie, map[string]string{"name": caller.User(), "uid": principal.Uid, "gid": principal.Gid})
-		if err != nil {
-			return nil, identityUnavailable()
-		}
-		if !result.OK {
-			return nil, &api.Error{Code: "identity_refused", Message: "App session refused; create a fresh app session with your DSM login"}
-		}
-		return map[string]string{"user": result.User, "cookie": result.Cookie, "expiresAt": result.ExpiresAt}, nil
-	}
-}
-
-type identityResult struct {
-	OK        bool   `json:"ok"`
-	User      string `json:"user"`
-	Cookie    string `json:"cookie"`
-	ExpiresAt string `json:"expiresAt"`
-}
-
-func identityUnavailable() error {
-	return &api.Error{Code: "identity_unavailable", Message: "Optional Node identity is unavailable; check the selected Node.js_v22 runtime"}
-}
-func (cfg Config) identityExchange(ctx context.Context, method, cookie string, principal map[string]string) (identityResult, error) {
-	var result identityResult
-	root, err := os.OpenRoot(cfg.DataDir)
-	if err != nil {
-		return result, err
-	}
-	defer root.Close()
-	if err = root.Mkdir("identity", 0700); err != nil && !errors.Is(err, fs.ErrExist) {
-		return result, err
-	}
-	info, err := root.Lstat("identity")
-	if err != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
-		return result, errors.New("unsafe directory")
-	}
-	dir, err := root.OpenRoot("identity")
-	if err != nil {
-		return result, err
-	}
-	defer dir.Close()
-	lock, err := dir.OpenFile("store.lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return result, err
-	}
-	defer lock.Close()
-	if err = personalRegular(lock); err != nil {
-		return result, err
-	}
-	// Nonblocking retry bounds contention. CGI never hangs on an abandoned lock.
-	deadline := time.NewTimer(10 * time.Second)
-	defer deadline.Stop()
-	for {
-		err = syscall.Flock(int(lock.Fd()), syscall.LOCK_EX|syscall.LOCK_NB)
-		if err == nil {
-			break
-		}
-		if err != syscall.EWOULDBLOCK && err != syscall.EAGAIN {
-			return result, err
-		}
-		select {
-		case <-ctx.Done():
-			return result, ctx.Err()
-		case <-deadline.C:
-			return result, errors.New("identity busy")
-		case <-time.After(10 * time.Millisecond):
-		}
-	}
-	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
-	store := json.RawMessage(`{}`)
-	f, err := dir.OpenFile("store.json", os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if err == nil {
-		if err = personalRegular(f); err != nil {
-			f.Close()
-			return result, err
-		}
-		b, e := io.ReadAll(io.LimitReader(f, maxIdentityBytes+1))
-		f.Close()
-		if e != nil || len(b) > maxIdentityBytes || !json.Valid(b) {
-			return result, errors.New("invalid store")
-		}
-		store = b
-	} else if !errors.Is(err, fs.ErrNotExist) {
-		return result, err
-	}
-	nonce := make([]byte, 32)
-	if _, err = rand.Read(nonce); err != nil {
-		return result, err
-	}
-	input, err := json.Marshal(map[string]any{"packageID": cfg.PackageID, "store": store, "method": method, "cookie": cookie, "principal": principal, "ticket": hex.EncodeToString(nonce)})
-	if err != nil || len(input) > maxIdentityBytes {
-		return result, errors.New("identity input too large")
-	}
-	output, err := identityRun(ctx, cfg, input)
-	if err != nil || len(output) > maxIdentityBytes {
-		return result, errors.New("identity subprocess failed")
-	}
-	var response struct {
-		Store  json.RawMessage `json:"store"`
-		Result identityResult  `json:"result"`
-	}
-	if err = json.Unmarshal(output, &response); err != nil || len(response.Store) == 0 || !json.Valid(response.Store) {
-		return result, errors.New("invalid response")
-	}
-	tempName := ".store-" + hex.EncodeToString(nonce)
-	temp, err := dir.OpenFile(tempName, os.O_CREATE|os.O_EXCL|os.O_WRONLY|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return result, err
-	}
-	defer dir.Remove(tempName)
-	_, err = temp.Write(response.Store)
-	if err == nil {
-		err = temp.Sync()
-	}
-	closeErr := temp.Close()
-	if err != nil {
-		return result, err
-	}
-	if closeErr != nil {
-		return result, closeErr
-	}
-	if err = dir.Rename(tempName, "store.json"); err != nil {
-		return result, err
-	}
-	return response.Result, nil
-}

package/templates/native-go-better-auth/backend/internal/app/identity_test.go

@@ -1,113 +0,0 @@
-package app
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestIdentityCGIBindsFreshCallerAndPersistsStore(t *testing.T) {
-	cfg := personalFixture(t)
-	old := identityRun
-	t.Cleanup(func() { identityRun = old })
-	tickets := map[string]bool{}
-	identityRun = func(_ context.Context, cfg Config, input []byte) ([]byte, error) {
-		var in struct {
-			Ticket    string
-			Principal map[string]string
-			Store     map[string]any
-		}
-		if err := json.Unmarshal(input, &in); err != nil {
-			t.Fatal(err)
-		}
-		if len(in.Ticket) != 64 || tickets[in.Ticket] || in.Principal["name"] != "normal1" || in.Principal["uid"] != "1001" {
-			t.Fatal("not fresh native caller", in)
-		}
-		tickets[in.Ticket] = true
-		return []byte(`{"store":{"marker":"saved"},"result":{"ok":true,"user":"normal1","cookie":"session=fixture"}}`), nil
-	}
-	for i := 0; i < 2; i++ {
-		code, out := personalCall(t, cfg, "normal1", "identity.login", `{}`)
-		if code != "" || out["data"].(map[string]any)["user"] != "normal1" {
-			t.Fatal(code, out)
-		}
-	}
-	if len(tickets) != 2 {
-		t.Fatal(tickets)
-	}
-	data, _ := os.ReadFile(filepath.Join(cfg.DataDir, "identity/store.json"))
-	if !strings.Contains(string(data), "saved") {
-		t.Fatal(string(data))
-	}
-	for _, params := range []string{`{"user":"normal2"}`, `{"ticket":"forged"}`, `{"path":"/etc/passwd"}`} {
-		if code, _ := personalCall(t, cfg, "normal1", "identity.login", params); code != "bad_request" {
-			t.Fatal(code)
-		}
-	}
-	if code, _ := call(t, cfg, stubAuth{err: api.ErrNoSession}, "identity.login", `{}`); code != "session_required" {
-		t.Fatal(code)
-	}
-}
-func TestIdentityRefusesSymlinkStore(t *testing.T) {
-	cfg := personalFixture(t)
-	os.Mkdir(filepath.Join(cfg.DataDir, "identity"), 0700)
-	outside := filepath.Join(t.TempDir(), "victim")
-	os.WriteFile(outside, []byte("unchanged"), 0600)
-	os.Symlink(outside, filepath.Join(cfg.DataDir, "identity/store.json"))
-	if code, _ := personalCall(t, cfg, "normal1", "identity.login", `{}`); code != "identity_unavailable" {
-		t.Fatal(code)
-	}
-	b, _ := os.ReadFile(outside)
-	if string(b) != "unchanged" {
-		t.Fatal("escaped")
-	}
-}
-
-func TestIdentityRealBundledNodeRoundTrip(t *testing.T) {
-	bundle := os.Getenv("M1B_NODE_FIXTURE_BUNDLE")
-	node := os.Getenv("M1B_NODE_FIXTURE_EXECUTABLE")
-	if bundle == "" || node == "" {
-		t.Skip("artifact runner provides the selected Node bundle")
-	}
-	cfg := personalFixture(t)
-	old := identityRun
-	t.Cleanup(func() { identityRun = old })
-	identityRun = func(ctx context.Context, _ Config, input []byte) ([]byte, error) {
-		cmd := exec.CommandContext(ctx, node, bundle)
-		cmd.Env = []string{"NODE_ENV=production", "PATH=/usr/bin:/bin"}
-		cmd.Stdin = bytes.NewReader(input)
-		var out limitedIdentityOutput
-		cmd.Stdout = &out
-		if err := cmd.Run(); err != nil {
-			return nil, err
-		}
-		return out.Bytes(), nil
-	}
-	code, out := personalCall(t, cfg, "normal1", "identity.login", `{}`)
-	if code != "" {
-		t.Fatal(code, out)
-	}
-	cookie := out["data"].(map[string]any)["cookie"].(string)
-	if cookie == "" {
-		t.Fatal("no app session")
-	}
-	params, _ := json.Marshal(map[string]string{"cookie": cookie})
-	if code, _ := personalCall(t, cfg, "normal1", "identity.current", string(params)); code != "" {
-		t.Fatal(code)
-	}
-	if code, _ := personalCall(t, cfg, "normal2", "identity.current", string(params)); code != "identity_refused" {
-		t.Fatal("cross-user session accepted", code)
-	}
-	if code, _ := personalCall(t, cfg, "normal1", "identity.logout", string(params)); code != "" {
-		t.Fatal(code)
-	}
-	if code, _ := personalCall(t, cfg, "normal1", "identity.current", string(params)); code != "identity_refused" {
-		t.Fatal("logout not durable", code)
-	}
-}

package/templates/native-go-better-auth/node/app.mjs

@@ -1,72 +0,0 @@
-import {betterAuth} from 'better-auth';
-import {createAuthEndpoint, APIError} from 'better-auth/api';
-import {setSessionCookie} from 'better-auth/cookies';
-import {memoryAdapter} from '@better-auth/memory-adapter';
-import {randomBytes, createHash, timingSafeEqual} from 'node:crypto';
-import {fileURLToPath} from 'node:url';
-import {realpathSync} from 'node:fs';
-
-// A ticket arrives only through the trusted CGI's stdin, never through a
-// public HTTP listener. One Node process handles one request. Every operation
-// consumes the fresh native ticket; an app session alone carries no NAS rights.
-export function makeApp({packageID,store,ticket,principal}) {
- const origin=`https://${packageID.toLowerCase()}.invalid`;
- const prefix=`spl${createHash('sha256').update(packageID).digest('hex').slice(0,16)}`;
- store.secret ||= randomBytes(32).toString('hex');
- store.db ||= {user:[],session:[],account:[],verification:[]};
- store.bindings ||= {};
- // Hydrate dates after a CGI restart. This JSON snapshot adapter is a bounded
- // example; production DB migration and account lifecycle policy belong to M2.
- for(const rows of Object.values(store.db)) for(const row of rows) for(const key of ['createdAt','updatedAt','expiresAt']) if(row[key]) row[key]=new Date(row[key]);
- let available=true;
- function consume(value){
-  if(!available||typeof value!=='string'||!ticket||value.length!==ticket.length||!timingSafeEqual(Buffer.from(value),Buffer.from(ticket))) throw new APIError('UNAUTHORIZED',{message:'native_ticket_required'});
-  available=false;
-  if(!principal?.name||!/^\d+$/.test(principal.uid)||!/^\d+$/.test(principal.gid)) throw new APIError('UNAUTHORIZED',{message:'native_identity_invalid'});
-  return principal;
- }
- const key=p=>JSON.stringify([packageID,p.name,p.uid,p.gid]);
- const auth=betterAuth({baseURL:origin,basePath:'/api/auth',secret:store.secret,database:memoryAdapter(store.db),
-  session:{expiresIn:60,updateAge:0,disableSessionRefresh:true,cookieCache:{enabled:false}},
-  advanced:{cookiePrefix:prefix,useSecureCookies:true},trustedOrigins:[origin],
-  plugins:[{id:'spl-dsm-native',endpoints:{nativeLogin:createAuthEndpoint('/native-login',{method:'POST'},async ctx=>{
-   const p=consume(ctx.request?.headers.get('x-native-ticket'));
-   let user=store.db.user.find(u=>u.id===store.bindings[key(p)]);
-   if(!user){user=await ctx.context.internalAdapter.createUser({name:p.name,email:`${createHash('sha256').update(key(p)).digest('hex')}@identity.invalid`,emailVerified:false});store.bindings[key(p)]=user.id;}
-   const session=await ctx.context.internalAdapter.createSession(user.id);
-   await setSessionCookie(ctx,{session,user});
-   return ctx.json({user:p.name});
-  })}}],
- });
- return {async handle(method,value,cookie=''){
-  const headers=new Headers({'content-type':'application/json',origin,'x-native-ticket':value||'',cookie});
-  if(method==='login'){
-   const r=await auth.handler(new Request(`${origin}/api/auth/native-login`,{method:'POST',headers,body:'{}'}));
-   return {status:r.status,cookies:r.headers.getSetCookie(),body:await r.json()};
-  }
-  let native;try{native=consume(value)}catch{return {status:401,cookies:[],body:{error:'native_ticket_required'}}}
-  const session=await auth.api.getSession({headers});
-  if(!session)return {status:401,cookies:[],body:{error:'app_session_required'}};
-  if(store.bindings[key(native)]!==session.user.id)return {status:403,cookies:[],body:{error:'principal_mismatch'}};
-  if(method==='current')return {status:200,cookies:[],body:{user:native.name,expiresAt:session.session.expiresAt}};
-  if(method==='logout'){
-   const r=await auth.handler(new Request(`${origin}/api/auth/sign-out`,{method:'POST',headers,body:'{}'}));
-   return {status:r.status,cookies:r.headers.getSetCookie(),body:await r.json()};
-  }
-  return {status:400,cookies:[],body:{error:'invalid_method'}};
- }};
-}
-export async function run(input){
- const {packageID,store,ticket,principal,method,cookie}=input;
- if(!/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(packageID)||!['login','current','logout'].includes(method))throw Error('invalid_input');
- const app=makeApp({packageID,store,ticket,principal});
- const response=await app.handle(method,ticket,cookie);
- if(response.status!==200)return {store,result:{ok:false,error:response.body.error||response.body.message||'identity_refused'}};
- return {store,result:{ok:true,user:principal.name,cookie:response.cookies.map(v=>v.split(';')[0]).join('; '),expiresAt:response.body.expiresAt}};
-}
-if(process.argv[1] && realpathSync(process.argv[1])===fileURLToPath(import.meta.url)){
- try {
-  let body='';for await(const chunk of process.stdin){body+=chunk;if(Buffer.byteLength(body)>1048576)throw Error('oversized')}
-  process.stdout.write(JSON.stringify(await run(JSON.parse(body))));
- }catch{process.stderr.write('identity_refused\n');process.exitCode=1}
-}

package/templates/native-go-better-auth/node/build.mjs

@@ -1,4 +0,0 @@
-import {build} from 'esbuild';
-import {writeThirdPartyNotices} from './third-party-notices.mjs';
-await build({entryPoints:['app.mjs'],bundle:true,platform:'node',format:'esm',target:'node22',outfile:'dist/app.mjs',banner:{js:"import {createRequire} from 'node:module'; const require = createRequire(import.meta.url);"}});
-writeThirdPartyNotices(process.cwd(), 'dist/LICENSES');