@synopackageland/cli 0.5.3 → 0.6.0

package/templates/native-go-better-auth/node/package.json

@@ -1 +0,0 @@
-{"name":"native-dsm-better-auth","private":true,"type":"module","scripts":{"build":"node build.mjs","test":"node --test test/*.test.mjs"},"dependencies":{"better-auth":"1.7.7","@better-auth/memory-adapter":"1.7.7"},"devDependencies":{"esbuild":"0.25.12"},"engines":{"node":">=22"}}

package/templates/native-go-better-auth/node/test/auth.test.mjs

@@ -1,31 +0,0 @@
-import {test} from 'node:test';
-import assert from 'node:assert/strict';
-import {makeApp} from '../app.mjs';
-const p1={name:'normal1',uid:'1001',gid:'100'},p2={name:'normal2',uid:'1002',gid:'100'};
-const state=()=>({secret:'fixture-secret-'.repeat(4),db:{user:[],session:[],account:[],verification:[]},bindings:{}});
-const cookie=r=>r.cookies.map(v=>v.split(';')[0]).join('; ');
-test('single-use native tickets bind Better Auth to a freshly authenticated principal',async()=>{
- const store=state(),app=makeApp({packageID:'Alpha',store,ticket:'one',principal:p1});
- const login=await app.handle('login','one');assert.equal(login.status,200);assert.equal(login.body.user,'normal1');
- const repeated=await app.handle('login','one');assert.equal(repeated.status,401);
- const session=cookie(login);assert.ok(session);
- const fresh=makeApp({packageID:'Alpha',store,ticket:'two',principal:p1});
- assert.equal((await fresh.handle('current','two',session)).status,200);
- const crossed=makeApp({packageID:'Alpha',store,ticket:'three',principal:p2});
- assert.equal((await crossed.handle('current','three',session)).body.error,'principal_mismatch');
-});
-test('store survives a CGI restart and refuses expired or foreign-package sessions',async()=>{
- const store=state(),a=makeApp({packageID:'Alpha',store,ticket:'one',principal:p1});
- const login=await a.handle('login','one'),session=cookie(login);
- const restored=JSON.parse(JSON.stringify(store));
- assert.equal((await makeApp({packageID:'Alpha',store:restored,ticket:'two',principal:p1}).handle('current','two',session)).status,200);
- assert.equal((await makeApp({packageID:'Beta',store:restored,ticket:'three',principal:p1}).handle('current','three',session)).status,401);
- restored.db.session[0].expiresAt=new Date(0).toISOString();
- assert.equal((await makeApp({packageID:'Alpha',store:restored,ticket:'four',principal:p1}).handle('current','four',session)).status,401);
-});
-test('logout revokes app session and does not create a verified placeholder identity',async()=>{
- const store=state();const login=await makeApp({packageID:'Alpha',store,ticket:'one',principal:p1}).handle('login','one');const session=cookie(login);
- assert.equal(store.db.user[0].emailVerified,false);
- assert.equal((await makeApp({packageID:'Alpha',store,ticket:'two',principal:p1}).handle('logout','two',session)).status,200);
- assert.equal((await makeApp({packageID:'Alpha',store,ticket:'three',principal:p1}).handle('current','three',session)).status,401);
-});

package/templates/native-go-integration/backend/internal/app/identity_none.go

@@ -1,6 +0,0 @@
-package app
-
-import "dsmapp/internal/api"
-
-// The Go-only integration has no Node process, dependency or identity route.
-func (cfg Config) identityRoutes() []api.Route { return nil }

package/templates/native-go-integration/backend/internal/app/personal.go

@@ -1,203 +0,0 @@
-package app
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"os/user"
-	"syscall"
-	"unicode/utf8"
-
-	"dsmapp/internal/api"
-	"dsmapp/internal/helper"
-)
-
-// This example stores one synthetic note per authenticated local account in
-// package-owned data. It is not a shared-folder grant or a NAS file gateway.
-// The client may send an opaque ID, never a user name, UID or filesystem path.
-var personalLookup = user.Lookup
-var integrationHealth = func(ctx context.Context, cfg Config) helper.State {
-	return cfg.integrationState(ctx)
-}
-
-func (cfg Config) integrationRoutes() []api.Route {
-	if !cfg.PackageIntegration && cfg.HelperInventory.Protocol != 1 {
-		return nil
-	}
-	return append([]api.Route{api.User("personal.list", cfg.personalList), api.User("personal.read", cfg.personalRead), api.User("personal.write", cfg.personalWrite)}, cfg.identityRoutes()...)
-}
-func (cfg Config) personalID(ctx context.Context, caller api.Caller) (string, error) {
-	if !caller.Authenticated() {
-		return "", &api.Error{Code: "session_required", Message: "Sign in to DSM again"}
-	}
-	if integrationHealth(ctx, cfg).State != "ready" {
-		return "", &api.Error{Code: "integration_unavailable", Message: "Ask an administrator to activate or recover integration"}
-	}
-	// Re-resolve the authenticated name on every request. No browser-supplied
-	// identity is used; directory users and account lifecycle need M2 validation.
-	u, err := personalLookup(caller.User())
-	if err != nil || u.Username != caller.User() || u.Uid == "" || u.Gid == "" {
-		return "", &api.Error{Code: "identity_unavailable", Message: "Local account identity is unavailable"}
-	}
-	digest := sha256.Sum256([]byte(cfg.PackageID + "\x00" + caller.User() + "\x00" + u.Uid + "\x00" + u.Gid))
-	return hex.EncodeToString(digest[:]), nil
-}
-func (cfg Config) personalList(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
-	if err := decodeParams(params, &struct{}{}); err != nil {
-		return nil, err
-	}
-	id, err := cfg.personalID(ctx, caller)
-	if err != nil {
-		return nil, err
-	}
-	return map[string]any{"items": []map[string]string{{"id": id, "name": "My sample note"}}, "scope": "package-owned synthetic data"}, nil
-}
-func (cfg Config) personalRead(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
-	var in struct {
-		ID string `json:"id"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	id, err := cfg.personalID(ctx, caller)
-	if err != nil {
-		return nil, err
-	}
-	if in.ID != id {
-		return nil, personalDenied()
-	}
-	text, err := cfg.personalFile(id, nil)
-	if err != nil {
-		return nil, personalUnavailable()
-	}
-	if text == nil {
-		return map[string]string{"id": id, "text": "Private synthetic sample for " + caller.User()}, nil
-	}
-	return map[string]string{"id": id, "text": *text}, nil
-}
-func (cfg Config) personalWrite(ctx context.Context, caller api.Caller, params json.RawMessage) (any, error) {
-	var in struct {
-		ID   string `json:"id"`
-		Text string `json:"text"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	if len(in.Text) > 4096 || !utf8.ValidString(in.Text) {
-		return nil, api.BadRequest("text must be valid UTF-8, at most 4096 bytes")
-	}
-	id, err := cfg.personalID(ctx, caller)
-	if err != nil {
-		return nil, err
-	}
-	if in.ID != id {
-		return nil, personalDenied()
-	}
-	if _, err := cfg.personalFile(id, &in.Text); err != nil {
-		return nil, personalUnavailable()
-	}
-	return map[string]string{"id": id, "text": in.Text}, nil
-}
-func personalDenied() error {
-	return &api.Error{Code: "access_denied", Message: "This sample belongs to another account"}
-}
-func personalUnavailable() error {
-	return &api.Error{Code: "personal_unavailable", Message: "Sample storage is unavailable; ask an administrator to check package data"}
-}
-
-// Root confines every lookup to package data; no paths come from the client.
-// O_NOFOLLOW rejects final symlinks. Shared/exclusive flock covers reads/writes
-// across separate CGI processes; a write is bounded and fsynced before success.
-func (cfg Config) personalFile(id string, text *string) (*string, error) {
-	root, err := os.OpenRoot(cfg.DataDir)
-	if err != nil {
-		return nil, err
-	}
-	defer root.Close()
-	if err = root.Mkdir("personal", 0700); err != nil && !errors.Is(err, fs.ErrExist) {
-		return nil, err
-	}
-	info, err := root.Lstat("personal")
-	if err != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
-		return nil, errors.New("unsafe directory")
-	}
-	dir, err := root.OpenRoot("personal")
-	if err != nil {
-		return nil, err
-	}
-	defer dir.Close()
-	lock, err := dir.OpenFile(id+".lock", os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
-	if err != nil {
-		return nil, err
-	}
-	defer lock.Close()
-	if err = personalRegular(lock); err != nil {
-		return nil, err
-	}
-	mode := syscall.LOCK_SH
-	if text != nil {
-		mode = syscall.LOCK_EX
-	}
-	if err = syscall.Flock(int(lock.Fd()), mode); err != nil {
-		return nil, err
-	}
-	defer syscall.Flock(int(lock.Fd()), syscall.LOCK_UN)
-	flags := os.O_RDONLY | syscall.O_NOFOLLOW
-	if text != nil {
-		flags = os.O_CREATE | os.O_RDWR | syscall.O_NOFOLLOW
-	}
-	file, err := dir.OpenFile(id+".json", flags, 0600)
-	if text == nil && errors.Is(err, fs.ErrNotExist) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer file.Close()
-	if err = personalRegular(file); err != nil {
-		return nil, err
-	}
-	if text != nil {
-		bytes, err := json.Marshal(map[string]string{"text": *text})
-		if err != nil {
-			return nil, err
-		}
-		if err = file.Truncate(0); err != nil {
-			return nil, err
-		}
-		if _, err = file.Write(bytes); err != nil {
-			return nil, err
-		}
-		if err = file.Sync(); err != nil {
-			return nil, err
-		}
-		return text, nil
-	}
-	bytes, err := io.ReadAll(io.LimitReader(file, 32769))
-	if err != nil || len(bytes) > 32768 {
-		return nil, errors.New("oversized note")
-	}
-	var note struct {
-		Text string `json:"text"`
-	}
-	if err = json.Unmarshal(bytes, &note); err != nil {
-		return nil, err
-	}
-	return &note.Text, nil
-}
-func personalRegular(f *os.File) error {
-	info, err := f.Stat()
-	if err != nil {
-		return err
-	}
-	st, ok := info.Sys().(*syscall.Stat_t)
-	if !ok || !info.Mode().IsRegular() || info.Mode().Perm()&0077 != 0 || st.Uid != uint32(os.Getuid()) || st.Nlink != 1 {
-		return errors.New("unsafe file")
-	}
-	return nil
-}

package/templates/native-go-integration/backend/internal/app/personal_test.go

@@ -1,156 +0,0 @@
-package app
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/helper"
-	"encoding/json"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func personalFixture(t *testing.T) Config {
-	oldLookup, oldHealth := personalLookup, integrationHealth
-	personalLookup = func(name string) (*user.User, error) {
-		return &user.User{Username: name, Uid: map[string]string{"normal1": "1001", "normal2": "1002", "alice": "1000"}[name], Gid: "100"}, nil
-	}
-	integrationHealth = func(context.Context, Config) helper.State { return helper.State{State: "ready"} }
-	t.Cleanup(func() { personalLookup, integrationHealth = oldLookup, oldHealth })
-	cfg := testConfig(t)
-	cfg.HelperInventory = helper.Inventory{Package: cfg.PackageID, Protocol: 1}
-	return cfg
-}
-func personalCall(t *testing.T, cfg Config, name, method, params string) (string, map[string]any) {
-	return call(t, cfg, stubAuth{identity: api.Identity{User: name}}, method, params)
-}
-func personalHandle(t *testing.T, cfg Config, name string) string {
-	code, out := personalCall(t, cfg, name, "personal.list", `{}`)
-	if code != "" {
-		t.Fatal(code, out)
-	}
-	return out["data"].(map[string]any)["items"].([]any)[0].(map[string]any)["id"].(string)
-}
-func TestPersonalUsersReadWriteAndMutuallyRefuse(t *testing.T) {
-	cfg := personalFixture(t)
-	first, second := personalHandle(t, cfg, "normal1"), personalHandle(t, cfg, "normal2")
-	if first == second {
-		t.Fatal("handles must bind caller")
-	}
-	for _, pair := range [][2]string{{"normal1", first}, {"normal2", second}} {
-		data, _ := json.Marshal(map[string]string{"id": pair[1], "text": "Private " + pair[0]})
-		code, out := personalCall(t, cfg, pair[0], "personal.write", string(data))
-		if code != "" {
-			t.Fatal(code, out)
-		}
-		code, out = personalCall(t, cfg, pair[0], "personal.read", `{"id":"`+pair[1]+`"}`)
-		if code != "" || out["data"].(map[string]any)["text"] != "Private "+pair[0] {
-			t.Fatal(code, out)
-		}
-	}
-	for _, pair := range [][2]string{{"normal1", second}, {"normal2", first}} {
-		for _, method := range []string{"personal.read", "personal.write"} {
-			params := `{"id":"` + pair[1] + `"`
-			if method == "personal.write" {
-				params += `,"text":"attack"`
-			}
-			params += `}`
-			code, _ := personalCall(t, cfg, pair[0], method, params)
-			if code != "access_denied" {
-				t.Fatal(method, code)
-			}
-		}
-	}
-	// Administrator privilege also gives no authority over another user's note.
-	if code, _ := call(t, cfg, alice, "personal.read", `{"id":"`+first+`"}`); code != "access_denied" {
-		t.Fatal(code)
-	}
-}
-// Package-only integration has no helper: the sample stays package-owned data
-// and never waits for a helper health check.
-func TestPackageOnlyPersonalDataNeedsNoHelper(t *testing.T) {
-	oldLookup := personalLookup
-	personalLookup = func(name string) (*user.User, error) {
-		return &user.User{Username: name, Uid: map[string]string{"normal1": "1001", "normal2": "1002"}[name], Gid: "100"}, nil
-	}
-	t.Cleanup(func() { personalLookup = oldLookup })
-	cfg := testConfig(t)
-	cfg.PackageIntegration = true
-	if cfg.HelperInventory != (helper.Inventory{}) {
-		t.Fatal("fixture must have no helper inventory")
-	}
-	first, second := personalHandle(t, cfg, "normal1"), personalHandle(t, cfg, "normal2")
-	if first == second {
-		t.Fatal("handles must bind caller")
-	}
-	if code, out := personalCall(t, cfg, "normal1", "personal.write", `{"id":"`+first+`","text":"mine"}`); code != "" {
-		t.Fatal(code, out)
-	}
-	if code, out := personalCall(t, cfg, "normal1", "personal.read", `{"id":"`+first+`"}`); code != "" || out["data"].(map[string]any)["text"] != "mine" {
-		t.Fatal(code, out)
-	}
-	if code, _ := personalCall(t, cfg, "normal2", "personal.read", `{"id":"`+first+`"}`); code != "access_denied" {
-		t.Fatal(code)
-	}
-}
-
-// Without package-only mode and without an approved helper nothing is served:
-// a helper build whose inventory failed to load stays closed.
-func TestHelperlessConfigWithoutPackageModeServesNoPersonalRoutes(t *testing.T) {
-	cfg := testConfig(t)
-	if routes := cfg.integrationRoutes(); len(routes) != 0 {
-		t.Fatalf("%d routes", len(routes))
-	}
-}
-
-func TestPersonalRejectsForgedIdentityAndPaths(t *testing.T) {
-	cfg := personalFixture(t)
-	id := personalHandle(t, cfg, "normal1")
-	for _, params := range []string{`{"user":"normal2"}`, `{"path":"../normal2"}`, `{"id":"` + id + `","user":"normal2"}`} {
-		if code, _ := personalCall(t, cfg, "normal1", "personal.list", params); code != "bad_request" {
-			t.Fatal(code)
-		}
-	}
-	for _, id := range []string{"../normal2", "/etc/passwd", "", "unknown"} {
-		if code, _ := personalCall(t, cfg, "normal1", "personal.read", `{"id":"`+id+`"}`); code != "access_denied" {
-			t.Fatal(code)
-		}
-	}
-	if code, _ := call(t, cfg, nobody, "personal.list", `{}`); code != "session_required" {
-		t.Fatal(code)
-	}
-	integrationHealth = func(context.Context, Config) helper.State { return helper.State{State: "stopped"} }
-	if code, _ := personalCall(t, cfg, "normal1", "personal.list", `{}`); code != "integration_unavailable" {
-		t.Fatal(code)
-	}
-}
-func TestPersonalRefusesSymlinkAndOversizedData(t *testing.T) {
-	cfg := personalFixture(t)
-	id := personalHandle(t, cfg, "normal1")
-	outside := filepath.Join(t.TempDir(), "victim")
-	os.WriteFile(outside, []byte("unchanged"), 0600)
-	os.Mkdir(filepath.Join(cfg.DataDir, "personal"), 0700)
-	if err := os.Symlink(outside, filepath.Join(cfg.DataDir, "personal", id+".json")); err != nil {
-		t.Fatal(err)
-	}
-	for _, method := range []string{"personal.read", "personal.write"} {
-		params := `{"id":"` + id + `"`
-		if method == "personal.write" {
-			params += `,"text":"attack"`
-		}
-		params += `}`
-		if code, _ := personalCall(t, cfg, "normal1", method, params); code != "personal_unavailable" {
-			t.Fatal(method, code)
-		}
-	}
-	b, _ := os.ReadFile(outside)
-	if string(b) != "unchanged" {
-		t.Fatal("escaped")
-	}
-	data, _ := json.Marshal(map[string]string{"id": id, "text": strings.Repeat("x", 4097)})
-	if code, _ := personalCall(t, cfg, "normal1", "personal.write", string(data)); code != "bad_request" {
-		t.Fatal(code)
-	}
-}

package/templates/native-go-root/backend/internal/app/root.go

@@ -1,107 +0,0 @@
-package app
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"regexp"
-	"syscall"
-
-	"dsmapp/internal/api"
-)
-
-// Root operations (root/<name>.sh) run as DSM Task Scheduler tasks that a DSM
-// administrator approved in the package window. Each one writes its standard
-// output to /run/synopkgland-<package>/<name>.out, a root-owned folder this
-// package can read but not write. This package never runs anything as root
-// itself; it only reads those results.
-
-var rootOpName = regexp.MustCompile(`^[a-z][a-z0-9_]{0,31}$`)
-
-const maxRootOutput = 64 << 10
-
-// rootRunDir and rootOwner are variables only so tests can point them at a
-// temporary folder owned by the test user.
-var (
-	rootRunDir = "/run"
-	rootOwner  = uint32(0)
-)
-
-func (cfg Config) rootRoutes() []api.Route {
-	return []api.Route{
-		api.Admin("root.output", cfg.rootOutput),
-	}
-}
-
-type rootResult struct {
-	Op        string  `json:"op"`
-	Output    *string `json:"output"`
-	Modified  int64   `json:"modified"`
-	Truncated bool    `json:"truncated,omitempty"`
-}
-
-func (cfg Config) rootOutput(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
-	var in struct {
-		Op string `json:"op"`
-	}
-	if err := decodeParams(params, &in); err != nil {
-		return nil, err
-	}
-	if !rootOpName.MatchString(in.Op) {
-		return nil, api.BadRequest("op must be the name of a root operation")
-	}
-	dir := filepath.Join(rootRunDir, "synopkgland-"+cfg.PackageID)
-	if err := requireRootOwned(dir, true); err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			return rootResult{Op: in.Op}, nil
-		}
-		return nil, err
-	}
-	file, err := os.OpenFile(filepath.Join(dir, in.Op+".out"), os.O_RDONLY|syscall.O_NOFOLLOW, 0)
-	if errors.Is(err, fs.ErrNotExist) {
-		return rootResult{Op: in.Op}, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer file.Close()
-	info, err := file.Stat()
-	if err != nil {
-		return nil, err
-	}
-	if err := requireRootOwnedInfo(info, false); err != nil {
-		return nil, err
-	}
-	data, err := io.ReadAll(io.LimitReader(file, maxRootOutput+1))
-	if err != nil {
-		return nil, err
-	}
-	text := string(data[:min(len(data), maxRootOutput)])
-	return rootResult{Op: in.Op, Output: &text, Modified: info.ModTime().Unix(), Truncated: len(data) > maxRootOutput}, nil
-}
-
-// requireRootOwned refuses anything the package account, or anyone but root,
-// could have put there: symlinks, other owners, group- or world-writable.
-func requireRootOwned(path string, dir bool) error {
-	info, err := os.Lstat(path)
-	if err != nil {
-		return err
-	}
-	return requireRootOwnedInfo(info, dir)
-}
-
-func requireRootOwnedInfo(info fs.FileInfo, dir bool) error {
-	st, ok := info.Sys().(*syscall.Stat_t)
-	wantType := info.Mode().IsRegular()
-	if dir {
-		wantType = info.IsDir()
-	}
-	if !ok || !wantType || st.Uid != rootOwner || info.Mode().Perm()&0o022 != 0 {
-		return errors.New("root output is not a root-owned " + map[bool]string{true: "folder", false: "file"}[dir])
-	}
-	return nil
-}

package/templates/native-go-root/backend/internal/app/root_test.go

@@ -1,124 +0,0 @@
-package app
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func init() { sampleParams["root.output"] = `{"op":"whoami"}` }
-
-// rootFixture points the reader at a temporary run folder owned by the test
-// user, standing in for root's /run/synopkgland-<package>.
-func rootFixture(t *testing.T) (Config, string) {
-	t.Helper()
-	base := t.TempDir()
-	rootRunDir, rootOwner = base, uint32(os.Getuid())
-	t.Cleanup(func() { rootRunDir, rootOwner = "/run", 0 })
-	cfg := testConfig(t)
-	return cfg, filepath.Join(base, "synopkgland-"+cfg.PackageID)
-}
-
-func writeResult(t *testing.T, dir, name, text string) {
-	t.Helper()
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(dir, name), []byte(text), 0o644); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestRootOutputIsForAdministratorsOnly(t *testing.T) {
-	cfg, dir := rootFixture(t)
-	writeResult(t, dir, "whoami.out", `{"euid":0}`)
-	if code, _ := call(t, cfg, bob, "root.output", `{"op":"whoami"}`); code != "admin_required" {
-		t.Fatalf("non-admin: %q", code)
-	}
-	if code, _ := call(t, cfg, nobody, "root.output", `{"op":"whoami"}`); code != "session_required" {
-		t.Fatalf("no session: %q", code)
-	}
-}
-
-func TestRootOutputIsEmptyBeforeTheFirstRun(t *testing.T) {
-	cfg, _ := rootFixture(t)
-	code, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`)
-	data := out["data"].(map[string]any)
-	if code != "" || data["output"] != nil || data["modified"] != float64(0) {
-		t.Fatalf("%q %v", code, out)
-	}
-}
-
-func TestRootOutputReturnsTheLatestResult(t *testing.T) {
-	cfg, dir := rootFixture(t)
-	writeResult(t, dir, "whoami.out", "{\"euid\":0}\n")
-	code, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`)
-	data := out["data"].(map[string]any)
-	if code != "" || data["output"] != "{\"euid\":0}\n" || data["modified"].(float64) <= 0 || data["truncated"] != nil {
-		t.Fatalf("%q %v", code, out)
-	}
-}
-
-func TestRootOutputOnlyReadsOperationNames(t *testing.T) {
-	cfg, dir := rootFixture(t)
-	writeResult(t, dir, "whoami.out", "x")
-	for _, op := range []string{"", "../whoami", "Whoami", "who/ami", "whoami.out", strings.Repeat("a", 33)} {
-		if code, _ := call(t, cfg, alice, "root.output", `{"op":"`+op+`"}`); code != "bad_request" {
-			t.Errorf("op %q: %q", op, code)
-		}
-	}
-}
-
-func TestRootOutputRefusesAnythingTheRootTaskDidNotWrite(t *testing.T) {
-	cases := map[string]func(t *testing.T, dir string){
-		"symlinked result": func(t *testing.T, dir string) {
-			writeResult(t, dir, "elsewhere", "x")
-			if err := os.Symlink(filepath.Join(dir, "elsewhere"), filepath.Join(dir, "whoami.out")); err != nil {
-				t.Fatal(err)
-			}
-		},
-		"symlinked folder": func(t *testing.T, dir string) {
-			real := dir + "-real"
-			writeResult(t, real, "whoami.out", "x")
-			if err := os.Symlink(real, dir); err != nil {
-				t.Fatal(err)
-			}
-		},
-		"writable folder": func(t *testing.T, dir string) {
-			writeResult(t, dir, "whoami.out", "x")
-			if err := os.Chmod(dir, 0o777); err != nil {
-				t.Fatal(err)
-			}
-		},
-		"writable result": func(t *testing.T, dir string) {
-			writeResult(t, dir, "whoami.out", "x")
-			if err := os.Chmod(filepath.Join(dir, "whoami.out"), 0o666); err != nil {
-				t.Fatal(err)
-			}
-		},
-		"another owner": func(t *testing.T, dir string) {
-			writeResult(t, dir, "whoami.out", "x")
-			rootOwner = uint32(os.Getuid()) + 1
-		},
-	}
-	for name, arrange := range cases {
-		t.Run(name, func(t *testing.T) {
-			cfg, dir := rootFixture(t)
-			arrange(t, dir)
-			if code, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`); code != "internal" {
-				t.Fatalf("%q %v", code, out)
-			}
-		})
-	}
-}
-
-func TestRootOutputIsBounded(t *testing.T) {
-	cfg, dir := rootFixture(t)
-	writeResult(t, dir, "whoami.out", strings.Repeat("x", maxRootOutput+10))
-	_, out := call(t, cfg, alice, "root.output", `{"op":"whoami"}`)
-	data := out["data"].(map[string]any)
-	if len(data["output"].(string)) != maxRootOutput || data["truncated"] != true {
-		t.Fatalf("not bounded: %d %v", len(data["output"].(string)), data["truncated"])
-	}
-}

package/templates/native-go-root/root/whoami.sh

@@ -1,6 +0,0 @@
-#!/bin/sh
-# A root operation: runs as root only when a DSM administrator clicks Run in
-# the package window, after approving this exact text with their password.
-# Its standard output is the result the window shows. Keep root operations
-# small and fixed; every change needs the administrator's approval again.
-printf '{"euid":%s}\n' "$(id -u)"