@synopackageland/cli 0.5.3 → 0.6.0

package/dist/templates/native-go-delegate/backend/internal/filestation/files.go

@@ -0,0 +1,73 @@
+package filestation
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"io"
+	"net/http"
+)
+
+// Files is the operation set shared by live requests and delegated jobs.
+// Construct a RequestContext at the authenticated CGI boundary; never persist it.
+type Files interface {
+	List(context.Context, string, ListOptions) (Page, error)
+	Info(context.Context, string) (Entry, error)
+	CreateFolder(context.Context, string, string) error
+	CheckPermission(context.Context, string) error
+	Write(context.Context, string, string, io.Reader, int64) error
+}
+type RequestContext struct {
+	Caller  api.Caller
+	Request *http.Request
+	Service *Service
+}
+
+func (r RequestContext) Files() Files { return sessionFiles{r} }
+
+type sessionFiles struct{ RequestContext }
+
+func (s sessionFiles) List(ctx context.Context, p string, o ListOptions) (Page, error) {
+	return s.Service.List(ctx, s.Caller, s.Request, p, o)
+}
+func (s sessionFiles) Info(ctx context.Context, p string) (Entry, error) {
+	return s.Service.Info(ctx, s.Caller, s.Request, p)
+}
+func (s sessionFiles) CreateFolder(ctx context.Context, p, n string) error {
+	return s.Service.CreateFolder(ctx, s.Caller, s.Request, p, n)
+}
+func (s sessionFiles) Write(ctx context.Context, p, n string, r io.Reader, size int64) error {
+	return s.Service.Upload(ctx, s.Caller, s.Request, p, n, r, size)
+}
+func (s sessionFiles) CheckPermission(ctx context.Context, p string) error {
+	if e := s.Service.verify(ctx, s.Caller, s.Request); e != nil {
+		return e
+	}
+	// Kept outside DSMClient so existing session providers need no new methods.
+	checker, ok := s.Service.client.(interface {
+		CheckPermission(context.Context, *http.Request, string) error
+	})
+	if !ok {
+		return fail("unsupported")
+	}
+	return checker.CheckPermission(ctx, s.Request, p)
+}
+func (c *Client) CheckPermission(ctx context.Context, r *http.Request, p string) error {
+	if !validPath(p) {
+		return fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.CheckPermission", "write", "3")
+	v.Set("path", p)
+	v.Set("filename", ".synopkgland-permission-probe")
+	v.Set("overwrite", "false")
+	v.Set("size", "0")
+	var out struct {
+		Skip *bool `json:"blSkip"`
+	}
+	if e := c.call(ctx, r, v, &out); e != nil {
+		return e
+	}
+	if out.Skip == nil || *out.Skip {
+		return fail("denied")
+	}
+	return nil
+}

package/dist/templates/native-go-delegate/backend/internal/filestation/files_test.go

@@ -0,0 +1,59 @@
+package filestation
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"fmt"
+	"net/http"
+	"testing"
+)
+
+func TestRequestFilesCheckUsesCurrentSessionAndRefusesMismatchedSubject(t *testing.T) {
+	checks := 0
+	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		if r.Header.Get("Cookie") != "id=test-session" {
+			t.Error("cookie changed")
+		}
+		if r.Form.Get("api") == "SYNO.Core.NormalUser" {
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+			return
+		}
+		checks++
+		if r.Form.Get("api") != "SYNO.FileStation.CheckPermission" || r.Form.Get("method") != "write" || r.Form.Get("path") != "/home" {
+			t.Error(r.Form)
+		}
+		fmt.Fprint(w, `{"success":false,"error":{"code":407}}`)
+	})
+	files := RequestContext{Service: NewService(client), Request: sessionRequest(), Caller: callerFor(t, "alice")}.Files()
+	if e := files.CheckPermission(context.Background(), "/home"); e == nil {
+		t.Fatal("DSM refusal lost")
+	}
+	files = RequestContext{Service: NewService(client), Request: sessionRequest(), Caller: callerFor(t, "bob")}.Files()
+	if e := files.CheckPermission(context.Background(), "/home"); e == nil {
+		t.Fatal("mismatched subject accepted")
+	}
+	if checks != 1 {
+		t.Fatal("mismatched request reached DSM file operation")
+	}
+	var _ Files = RequestContext{Caller: api.Caller{}}.Files()
+}
+
+func TestCheckPermissionRequiresExplicitNonSkipResult(t *testing.T) {
+	for _, data := range []string{`{}`, `{"blSkip":true}`} {
+		client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprintf(w, `{"success":true,"data":%s}`, data) })
+		if e := client.CheckPermission(context.Background(), sessionRequest(), "/home"); e == nil {
+			t.Fatal("permission inferred from success:true")
+		}
+	}
+	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		r.ParseForm()
+		if r.Form.Get("filename") != ".synopkgland-permission-probe" || r.Form.Get("overwrite") != "false" || r.Form.Get("size") != "0" {
+			t.Error("missing fixed permission probe fields")
+		}
+		fmt.Fprint(w, `{"success":true,"data":{"blSkip":false}}`)
+	})
+	if e := client.CheckPermission(context.Background(), sessionRequest(), "/home"); e != nil {
+		t.Fatal(e)
+	}
+}

package/dist/templates/native-go-delegate/frontend/src/CapabilityPanels.vue

@@ -0,0 +1,10 @@
+<script setup lang="ts">
+import type {Context} from './context'
+import ExecutorSettings from './delegate/ExecutorSettings.vue'
+import DelegatePanel from './delegate/DelegatePanel.vue'
+defineProps<{ctx:Context;admin:boolean}>()
+</script>
+<template>
+ <ExecutorSettings :admin="admin" :locale="ctx.locale" />
+ <DelegatePanel :ctx="ctx" />
+</template>

package/dist/templates/native-go-delegate/frontend/src/delegate/DelegatePanel.vue

@@ -0,0 +1,70 @@
+<script setup lang="ts">
+import {computed,onBeforeUnmount,onMounted,ref,watch} from 'vue'
+import {Button,Callout,Form,FormActions,FormItem,Input,SettingsSection} from '@synopackageland/ui'
+import type {Context} from '../context'
+import NasPicker from '../nas/NasPicker.vue'
+import {createNasProvider} from '../nas/provider'
+import type {CapabilityStatus} from './executor-setup'
+import {delegateCopy,errorCopy} from './copy'
+interface Grant{delegation_id:string;job_id:string;path:string;expires_at:string;revoked?:boolean}
+interface Job{id:string;name:string;state:'waiting_executor'|'queued'|'running'|'succeeded'|'failed'|'canceled'|'interrupted'}
+const props=defineProps<{ctx:Pick<Context,'call'|'locale'>}>()
+const copy=computed(()=>delegateCopy(props.ctx.locale)),provider=createNasProvider(props.ctx)
+const status=ref<CapabilityStatus>(),grants=ref<Grant[]>([]),jobs=ref<Job[]>([]),busy=ref(false),error=ref<unknown>(),notice=ref(''),picking=ref(false),dest=ref(''),url=ref(''),name=ref('')
+let disposed=false,timer:ReturnType<typeof setInterval>|undefined,submissionKey:string|undefined
+watch([url,dest,name],()=>{submissionKey=undefined},{flush:'sync'})
+const pending=(j:Job)=>['queued','running','waiting_executor'].includes(j.state)
+const waitingForExecutor=computed(()=>jobs.value.some(j=>j.state==='waiting_executor'))
+const startupCodes=['EXECUTOR_UNAVAILABLE','EXECUTOR_TIMEOUT']
+const waitingError=computed(()=>waitingForExecutor.value&&startupCodes.includes((error.value as {code?:string})?.code??''))
+const showCapability=computed(()=>status.value&&status.value.state!=='ready'&&!(waitingForExecutor.value&&status.value.state==='needs-admin-approval'&&startupCodes.includes(status.value.reason??'')))
+async function refresh(){
+ if(disposed)return
+ const [capability,list,work]=await Promise.allSettled([props.ctx.call<CapabilityStatus>('delegate.status'),props.ctx.call<{delegations:Grant[]}>('delegate.list'),props.ctx.call<{jobs:Job[]}>('delegate.jobs.list')])
+ if(disposed)return
+ if(capability.status==='fulfilled')status.value=capability.value
+ if(list.status==='fulfilled')grants.value=(list.value.delegations??[]).filter(g=>!g.revoked)
+ if(work.status==='fulfilled')jobs.value=work.value.jobs??[]
+ for(const result of [capability,list,work])if(result.status==='rejected')throw result.reason
+}
+async function action(work:()=>Promise<unknown>){if(busy.value||disposed)return;busy.value=true;error.value=undefined;try{await work()}catch(e){if(!disposed)error.value=e}finally{if(!disposed)busy.value=false}}
+const reload=()=>action(refresh)
+const revoke=(id:string)=>action(async()=>{await props.ctx.call('delegate.revoke',{delegation_id:id});await refresh()})
+const cancel=(id:string)=>action(async()=>{const out=await props.ctx.call<{revocation_pending:boolean}>('delegate.jobs.cancel',{id});if(!disposed)notice.value=out.revocation_pending?copy.value.pending:'';await refresh()})
+const canSubmit=computed(()=>status.value?.state==='ready'&&!!dest.value&&!!url.value&&!!name.value)
+const submit=()=>action(async()=>{if(!canSubmit.value)return;await props.ctx.call('delegate.jobs.submit',{key:submissionKey??(submissionKey=crypto.randomUUID()),url:url.value,dest:dest.value,name:name.value});if(!disposed){url.value='';name.value='';dest.value=''};await refresh()})
+const time=(date:string)=>{const d=new Date(date);return Number.isNaN(d.getTime())?'—':d.toLocaleString(props.ctx.locale)}
+onMounted(()=>{void reload();timer=setInterval(()=>{if(jobs.value.some(pending))void reload()},3000)})
+onBeforeUnmount(()=>{disposed=true;if(timer)clearInterval(timer);provider.dispose()})
+</script>
+<template>
+ <SettingsSection :title="copy.title" :collapsible="false" :aria-busy="busy" class="delegate-panel">
+  <p>{{ copy.help }}</p>
+  <Callout v-if="error&&!waitingError" tone="danger" role="alert">{{ errorCopy(error,copy) }}</Callout>
+  <p v-if="notice" role="status">{{ notice }}</p>
+  <p v-if="showCapability" role="status">{{ status?.state==='needs-admin-approval'?copy.needs:copy.blocked }}</p>
+  <Form @submit.prevent="submit">
+   <FormItem :label="copy.url" label-for="delegate-url"><Input id="delegate-url" v-model="url" type="url" :disabled="busy||status?.state!=='ready'" /></FormItem>
+   <FormItem :label="copy.name" label-for="delegate-name"><Input id="delegate-name" v-model="name" data-file-name :disabled="busy||status?.state!=='ready'" /></FormItem>
+   <p>{{ copy.size }}</p>
+   <p v-if="dest" role="status" class="destination">{{ copy.destination }}: {{ dest }}</p>
+   <FormActions><Button type="button" variant="secondary" :disabled="busy||status?.state!=='ready'" @click="picking=true">{{ copy.choose }}</Button><Button type="submit" variant="primary" :disabled="busy||!canSubmit">{{ copy.submit }}</Button></FormActions>
+  </Form>
+  <NasPicker v-model:open="picking" :locale="ctx.locale" :provider="provider" mode="folder" @selected="dest=$event" />
+  <div class="section-heading"><h3>{{ copy.downloads }}</h3><Button variant="secondary" :disabled="busy" @click="reload">{{ copy.refresh }}</Button></div>
+  <p v-if="!jobs.length&&!error">{{ copy.noJobs }}</p>
+  <ul v-else class="records"><li v-for="job in jobs" :key="job.id" :data-job-state="job.state"><span :role="job.state==='waiting_executor'?'status':undefined">{{ job.name }} · {{ copy[job.state] }}</span><Button v-if="pending(job)" variant="secondary" :disabled="busy" @click="cancel(job.id)">{{ copy.cancel }}</Button></li></ul>
+  <h3>{{ copy.delegations }}</h3>
+  <p v-if="!grants.length&&!error">{{ copy.noDelegations }}</p>
+  <ul v-else class="records"><li v-for="grant in grants" :key="grant.delegation_id"><div><strong>{{ grant.path }}</strong><p>{{ copy.expires }}: {{ time(grant.expires_at) }}</p></div><Button variant="secondary" :disabled="busy" @click="revoke(grant.delegation_id)">{{ copy.revoke }}</Button></li></ul>
+ </SettingsSection>
+</template>
+<style scoped>
+.delegate-panel {min-width:0;overflow-wrap:anywhere;}
+h3 {font-size:var(--ui-font-size-base,14px);font-weight:600;margin:var(--ui-space-6,24px) 0 var(--ui-space-3,12px);}
+.section-heading {display:flex;align-items:baseline;justify-content:space-between;flex-wrap:wrap;gap:var(--ui-space-3,12px);}
+.records {list-style:none;padding:0;margin:0;}
+.records li {display:flex;align-items:flex-start;justify-content:space-between;flex-wrap:wrap;gap:var(--ui-space-3,12px);padding-block:var(--ui-space-4,16px);border-bottom:1px solid var(--ui-border);}
+.records li>div,.records li>span,.destination {min-width:0;max-width:100%;overflow-wrap:anywhere;}
+.records p {margin:var(--ui-space-2,8px) 0 0;}
+</style>

package/dist/templates/native-go-delegate/frontend/src/delegate/copy.ts

@@ -0,0 +1,9 @@
+import en from './i18n/en.json'
+import zh from './i18n/zh-TW.json'
+import waiting from './i18n/waiting.json'
+export function delegateCopy(locale='en'){
+ const language=locale.toLowerCase().replaceAll('_','-')
+ const key=language.startsWith('zh')?(language.startsWith('zh-cn')||language.startsWith('zh-hans')?'zh-CN':'zh-TW'):language.split('-')[0]
+ return {...(language.startsWith('zh')?zh:en),waiting_executor:waiting[key as keyof typeof waiting]??waiting.en}
+}
+export function errorCopy(error:unknown,copy:typeof en){const code=(error as {code?:string})?.code;return ['session_required','AUTH_DENIED'].includes(code??'')?copy.session:['DENIED','SCOPE_DENIED','PERMISSION_DENIED','APP_DENIED','INELIGIBLE','denied'].includes(code??'')?copy.denied:copy.error}

package/dist/templates/native-go-delegate/frontend/src/delegate/i18n/waiting.json

@@ -0,0 +1,11 @@
+{
+  "en": "Waiting for system services to start",
+  "zh-TW": "等待系統服務啟動",
+  "zh-CN": "等待系统服务启动",
+  "de": "Warten auf den Start der Systemdienste",
+  "es": "Esperando a que se inicien los servicios del sistema",
+  "fr": "En attente du démarrage des services système",
+  "it": "In attesa dell’avvio dei servizi di sistema",
+  "ja": "システムサービスの起動を待っています",
+  "ko": "시스템 서비스 시작을 기다리는 중"
+}

package/dist/templates/native-go-delegate/frontend/test/delegate.test.ts

@@ -0,0 +1,130 @@
+// @vitest-environment jsdom
+import {afterEach,expect,test,vi} from 'vitest'
+import {createApp,h,nextTick} from 'vue'
+import {AppRoot} from '@synopackageland/ui'
+import DelegatePanel from '../src/delegate/DelegatePanel.vue'
+import ExecutorSettings from '../src/delegate/ExecutorSettings.vue'
+import waitingMessages from '../src/delegate/i18n/waiting.json'
+import {ExecutorSetupKey,type ExecutorSetup} from '../src/delegate/executor-setup'
+const disposers:Array<()=>void>=[]
+afterEach(()=>disposers.splice(0).forEach(fn=>fn()))
+async function settle(){for(let i=0;i<25;i++){await Promise.resolve();await nextTick()}}
+function mount(component:any,props:Record<string,unknown>,setup?:ExecutorSetup){const root=document.createElement('div');document.body.append(root);const app=createApp({render:()=>h(AppRoot,{},()=>h(component,props))});if(setup)app.provide(ExecutorSetupKey,setup);app.mount(root);disposers.push(()=>{app.unmount();root.remove()});return root}
+function button(root:HTMLElement,label:string){const b=Array.from(root.querySelectorAll('button')).find(b=>b.textContent?.trim()===label||b.getAttribute('aria-label')===label);expect(b,label).toBeTruthy();return b!}
+const context=(call:any)=>({call,locale:'en'})
+test('personal delegation list revokes only its selected ID and refreshes',async()=>{
+ let revoked=false
+ const call=vi.fn(async(method:string)=>{if(method==='delegate.status')return {state:'ready'};if(method==='delegate.jobs.list')return {jobs:[]};if(method==='delegate.list')return {delegations:revoked?[]:[{delegation_id:'d1',job_id:'j1',path:'/home/Downloads',expires_at:'2030-01-01T00:00:00Z'}]};if(method==='delegate.revoke'){revoked=true;return {revoked:true}};throw {code:'unknown_method'}})
+ const root=mount(DelegatePanel,{ctx:context(call)});await settle();expect(root.textContent).toContain('/home/Downloads');button(root,'Revoke').click();await settle();expect(call).toHaveBeenCalledWith('delegate.revoke',{delegation_id:'d1'});expect(root.textContent).toContain('You have no active delegations.')
+})
+test('errors hide executor messages and retain a retry action',async()=>{
+ const call=vi.fn(async()=>{throw {code:'DENIED',message:'secret SID'}}),root=mount(DelegatePanel,{ctx:context(call)});await settle();expect(root.querySelector('[role="alert"]')).toBeTruthy();expect(root.textContent).not.toContain('secret SID');button(root,'Refresh').click();await settle();expect(call.mock.calls.length).toBeGreaterThan(1)
+})
+test('administrator setup uses only status and authorize and clears password',async()=>{
+ const setup:ExecutorSetup={control:vi.fn(async()=>({state:'ready'})),status:vi.fn(async()=>({state:'needs-admin-approval'})),authorize:vi.fn(async()=>({state:'ready'}))}
+ const root=mount(ExecutorSettings,{admin:true},setup);await settle();const password=root.querySelector('input[type="password"]') as HTMLInputElement;expect(password).toBeTruthy();password.value='once';password.dispatchEvent(new Event('input',{bubbles:true}));await settle();root.querySelector('form')!.dispatchEvent(new Event('submit',{bubbles:true,cancelable:true}));await settle();expect(setup.authorize).toHaveBeenCalledWith('once');expect(root.querySelector('input[type="password"]')).toBeNull();expect(root.textContent).toContain('Background file access is ready.')
+})
+test('ordinary users never call setup or see a password field',async()=>{
+ const setup:ExecutorSetup={control:vi.fn(async()=>({state:'ready'})),status:vi.fn(async()=>({state:'ready'})),authorize:vi.fn(async()=>({state:'ready'}))};const root=mount(ExecutorSettings,{admin:false},setup);await settle();expect(setup.status).not.toHaveBeenCalled();expect(root.querySelector('input')).toBeNull()
+})
+test('setup failures erase the entered password and explain recovery',async()=>{
+ const setup:ExecutorSetup={control:vi.fn(async()=>({state:'ready'})),status:vi.fn(async()=>({state:'needs-admin-approval'})),authorize:vi.fn(async()=>{throw {code:'DENIED',message:'secret'}})};const root=mount(ExecutorSettings,{admin:true},setup);await settle();const password=root.querySelector('input')!;password.value='once';password.dispatchEvent(new Event('input',{bubbles:true}));await settle();root.querySelector('form')!.dispatchEvent(new Event('submit',{bubbles:true,cancelable:true}));await settle();expect(password.value).toBe('');expect(root.textContent).not.toContain('secret');expect(root.querySelector('[role="alert"]')).toBeTruthy()
+})
+test('download requires a folder selected through the existing NAS picker',async()=>{
+ const call=vi.fn(async(method:string)=>{if(method==='delegate.status')return {state:'ready'};if(method==='delegate.list')return {delegations:[]};if(method==='delegate.jobs.list')return {jobs:[]};if(method==='nas.files.shares')return {shares:[{name:'home',path:'/home',isdir:true}],total:1,offset:0};if(method==='delegate.jobs.submit')return {id:'job1'};throw {code:'unknown_method'}})
+ const root=mount(DelegatePanel,{ctx:context(call)});await settle();const url=root.querySelector('input[type="url"]')!;url.value='https://example.com/file';url.dispatchEvent(new Event('input',{bubbles:true}));const name=root.querySelector('input[data-file-name]')!;name.value='file.txt';name.dispatchEvent(new Event('input',{bubbles:true}));await settle();expect(button(root,'Download to my folder').disabled).toBe(true);button(root,'Choose folder').click();await settle();const picker=document.body;button(picker,'Select home').click();await settle();button(picker,'Confirm selection').click();await settle();button(root,'Download to my folder').click();await settle();const submitted=call.mock.calls.find(([m])=>m==='delegate.jobs.submit');expect(submitted).toBeTruthy();expect((submitted as unknown as [string,any])[1]).toMatchObject({url:'https://example.com/file',dest:'/home',name:'file.txt'})
+})
+
+test('an unavailable delegation list still displays approval status and owner jobs',async()=>{
+ const call=vi.fn(async(method:string)=>{if(method==='delegate.status')return {state:'needs-admin-approval'};if(method==='delegate.jobs.list')return {jobs:[{id:'j',name:'file.txt',state:'queued'}]};throw {code:'EXECUTOR_UNAVAILABLE'}})
+ const root=mount(DelegatePanel,{ctx:context(call)});await settle();expect(root.textContent).toContain('An administrator must approve background file access.');expect(root.textContent).toContain('file.txt');expect(root.querySelector('[role="alert"]')).toBeTruthy()
+})
+test('retrying an uncertain submission reuses the original idempotency key',async()=>{
+ let attempts=0
+ const call=vi.fn(async(method:string)=>{if(method==='delegate.status')return {state:'ready'};if(method==='delegate.list')return {delegations:[]};if(method==='delegate.jobs.list')return {jobs:[]};if(method==='nas.files.shares')return {shares:[{name:'home',path:'/home',isdir:true}],total:1,offset:0};if(method==='delegate.jobs.submit'){attempts++;if(attempts===1)throw {code:'commit-uncertain'};return {id:'j'}};throw {code:'unknown_method'}})
+ const root=mount(DelegatePanel,{ctx:context(call)});await settle();const url=root.querySelector('input[type="url"]')!;url.value='https://example.com/file';url.dispatchEvent(new Event('input',{bubbles:true}));const name=root.querySelector('input[data-file-name]')!;name.value='file';name.dispatchEvent(new Event('input',{bubbles:true}));await settle();button(root,'Choose folder').click();await settle();button(document.body,'Select home').click();await settle();button(document.body,'Confirm selection').click();await settle();button(root,'Download to my folder').click();await settle();button(root,'Download to my folder').click();await settle();const submissions=call.mock.calls.filter(([m])=>m==='delegate.jobs.submit') as unknown as Array<[string,{key:string}]>;expect(submissions).toHaveLength(2);expect(submissions[0][1].key).toBe(submissions[1][1].key)
+})
+
+test('generated app mount forwards ctx.executor to admin setup and renders ordinary delegation UI',async()=>{
+ const {mount:mountApp}=await import('../src/main')
+ for(const admin of [true,false]){
+  const status=vi.fn(async()=>({state:'needs-admin-approval' as const}))
+  const authorize=vi.fn(async()=>({state:'ready' as const}))
+  const call=vi.fn(async(method:string)=>{
+   if(method==='app.status')return {package:'DelegateApp',version:'1',user:admin?'admin':'alice',admin}
+   if(method==='greeting.get')return {text:'Hello'}
+   if(method==='delegate.status')return {state:'needs-admin-approval'}
+   if(method==='delegate.list')return {delegations:[]}
+   if(method==='delegate.jobs.list')return {jobs:[]}
+   throw {code:'unknown_method'}
+  })
+  const root=document.createElement('div');document.body.append(root)
+  const app=mountApp(root,{locale:'en',call,reopen:()=>()=>{},executor:{status,authorize,control:vi.fn(async()=>({state:'ready' as const}))}} as any)
+  disposers.push(()=>{app.unmount();root.remove()});await settle()
+  expect(root.textContent).toContain('You have no active delegations.')
+  if(admin){
+   expect(status).toHaveBeenCalled()
+   const password=root.querySelector('input[type=password]')! as HTMLInputElement
+   password.value='one-time';password.dispatchEvent(new Event('input',{bubbles:true}));await settle()
+   password.closest('form')!.dispatchEvent(new Event('submit',{bubbles:true,cancelable:true}));await settle()
+   expect(authorize).toHaveBeenCalledWith('one-time')
+  }else{
+   expect(status).not.toHaveBeenCalled()
+   expect(root.querySelector('input[type=password]')).toBeNull()
+   expect(call).not.toHaveBeenCalledWith('greeting.get',undefined)
+   expect(root.querySelector('textarea')).toBeNull()
+  }
+ }
+})
+
+test.each(Object.entries(waitingMessages))('waiting jobs show startup status and remain cancelable in %s',async(locale,message)=>{
+ const {delegateCopy}=await import('../src/delegate/copy')
+ const call=vi.fn(async(method:string)=>{
+  if(method==='delegate.status')return {state:'needs-admin-approval',reason:'EXECUTOR_UNAVAILABLE'}
+  if(method==='delegate.jobs.list')return {jobs:[{id:'waiting',name:'file.txt',state:'waiting_executor'}]}
+  if(method==='delegate.jobs.cancel')return {revocation_pending:true}
+  throw {code:'EXECUTOR_UNAVAILABLE'}
+ })
+ const root=mount(DelegatePanel,{ctx:{call,locale}});await settle()
+ expect(root.textContent).toContain(message)
+ expect(root.querySelector('[role=alert]')).toBeNull()
+ expect(root.textContent).not.toContain(delegateCopy(locale).needs)
+ button(root,delegateCopy(locale).cancel).click();await settle()
+ expect(call).toHaveBeenCalledWith('delegate.jobs.cancel',{id:'waiting'})
+})
+
+test('waiting startup status keeps polling until the saved result arrives',async()=>{
+ vi.useFakeTimers()
+ try{
+  let lists=0
+  const call=vi.fn(async(method:string)=>{
+   if(method==='delegate.status')return {state:'ready'}
+   if(method==='delegate.list')return {delegations:[]}
+   if(method==='delegate.jobs.list')return {jobs:[{id:'waiting',name:'file.txt',state:++lists===1?'waiting_executor':'succeeded'}]}
+   throw {code:'unknown_method'}
+  })
+  const root=mount(DelegatePanel,{ctx:context(call)});await settle()
+  expect(root.querySelector('[data-job-state=waiting_executor]')).toBeTruthy()
+  vi.advanceTimersByTime(3000);await settle()
+  expect(root.querySelector('[data-job-state=succeeded]')).toBeTruthy()
+  expect(root.textContent).toContain('Saved')
+  expect(Array.from(root.querySelectorAll('button')).some(b=>b.textContent?.trim()==='Cancel job')).toBe(false)
+ }finally{vi.useRealTimers()}
+})
+
+test('a waiting job still displays unrelated permission errors',async()=>{
+ const call=vi.fn(async(method:string)=>{
+  if(method==='delegate.status')return {state:'blocked'}
+  if(method==='delegate.jobs.list')return {jobs:[{id:'waiting',name:'file.txt',state:'waiting_executor'}]}
+  throw {code:'AUTH_DENIED'}
+ })
+ const root=mount(DelegatePanel,{ctx:context(call)});await settle()
+ expect(root.querySelector('[role=alert]')?.textContent).toContain('Sign in to DSM again')
+ expect(root.textContent).toContain('Waiting for system services to start')
+})
+
+
+test('startup waiting catalog covers exactly nine distinct language messages',()=>{
+ expect(Object.keys(waitingMessages).sort()).toEqual(['en','zh-TW','zh-CN','de','es','fr','it','ja','ko'].sort())
+ expect(new Set(Object.values(waitingMessages)).size).toBe(9)
+})

package/dist/templates/native-go-delegate/test-frontend.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+repo=$(cd "$(dirname "$0")/../../../.." && pwd)
+overlay="$repo/packages/app-cli/templates/native-go-delegate"
+fixture=$(mktemp -d "${TMPDIR:-/tmp}/delegate-ui.XXXXXX")
+trap 'rm -rf "$fixture"' EXIT
+cp -R "$repo/packages/app-cli/templates/native-go-vue/frontend/" "$fixture/"
+cp -R "$repo/packages/app-cli/templates/native-go-jobs/frontend/" "$fixture/"
+cp -R "$overlay/frontend/" "$fixture/"
+# The normal CLI supplies this notices module when it creates a project.
+cp "$repo/packages/app-cli/templates/_shared/third-party-notices.mjs" "$fixture/third-party-notices.mjs"
+(cd "$fixture" && npm ci && npx vitest run test/delegate.test.ts && npm run build)

package/dist/templates/native-go-delegate/test.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Test the overlay as shipped, without editing the base or CLI-owned files.
+set -euo pipefail
+repo=$(cd "$(dirname "$0")/../../../.." && pwd)
+overlay="$repo/packages/app-cli/templates/native-go-delegate"
+fixture=$(mktemp -d "${TMPDIR:-/tmp}/delegate.XXXXXX")
+trap 'rm -rf "$fixture"' EXIT
+cp -R "$repo/packages/app-cli/templates/native-go/backend" "$fixture/backend"
+cp -R "$repo/packages/app-cli/templates/native-go-jobs/backend/" "$fixture/backend/"
+rm "$fixture/backend/internal/app/background_none.go" "$fixture/backend/internal/app/delegate_none.go"
+cp -R "$overlay/backend/" "$fixture/backend/"
+python3 - "$fixture/backend/internal/app/routes_test.go" <<'PYCODE'
+import sys
+from pathlib import Path
+p=Path(sys.argv[1]);s=p.read_text().replace('want := ""','want := sampleOutcome[r.Method()]');p.write_text(s)
+PYCODE
+(cd "$fixture/backend" && go test -race -json ./... > "$overlay/.go-results.json" && go vet ./... && GOOS=linux GOARCH=amd64 go vet ./... && GOOS=linux GOARCH=arm64 go vet ./... && test -z "$(gofmt -l .)")

package/dist/templates/native-go-jobs/BACKGROUND.md

@@ -0,0 +1,108 @@
+# Background jobs
+
+This package opted in with `synopkgland init -t native-go --with jobs`. `dsm-package.yaml` has
+`schema: 2` and `capabilities.jobs: true`. The build adds a package-user worker that DSM
+runs as a systemd user unit. Nothing runs as root, and the CGI never starts a
+process in the background.
+
+## What runs
+
+- `conf/resource` is `{"systemd-user-unit":{}}` and `conf/systemd/pkguser-<Package>-background.service`
+  starts `target/background/worker`. `start-stop-status` only calls `synosystemctl`.
+- The worker is fixed: `sha256-v1` reads one imported file and writes its SHA-256.
+  Replace it by editing `backend/internal/background/runner.go` and bump `WorkerRevision`
+  (queued jobs of an older revision become `interrupted`, never replayed).
+- The spool is `/var/packages/<Package>/var/background` (dirs `0700`, files `0600`).
+  Limits: 1 job at a time, 16 queued, 512 KiB per file, 16 MiB total, 60 s per job.
+- Job states: `queued → running → succeeded | failed | canceled | interrupted`.
+  After a crash or forced stop a running job becomes `interrupted` and is not run again.
+
+## API and ownership
+
+`bg.status`, `bg.jobs.purge {owner: {user, uid}}`, `bg.browse {folder?, offset?}`, `bg.jobs.submit {key, folder, relative}`,
+`bg.jobs.list`, `bg.jobs.get {id}`, `bg.jobs.cancel {id}`, `bg.jobs.result {id}`.
+
+The panel's **Choose a file** button opens the shared File Station picker, which lists shares and folders
+with `bg.browse`: read-only metadata from the signed-in caller's own DSM session. A pick stores no
+grant and adds no permission; `submit` still re-reads the file through the same session.
+
+`submit` copies `relative` below the shared `folder` through the caller's File Station session, so the signed-in
+caller's own DSM permissions decide what can be imported. The job ID is returned
+only after the journal is durable, and `key` makes a retry return the same job.
+No cookie, SynoToken or password is stored. Closing the window or signing out does not
+cancel a job; sign in as the same owner again to read, download or cancel it.
+
+## Access
+
+SDK-owned route policies come from `internal/api/sdk-permissions.json`; App
+`permissions.json` cannot override them. Owner routes are authenticated, while
+owner purge and schedule re-enable remain administrators-only.
+
+Declaring `capabilities.jobs` makes jobs immediately available to signed-in users;
+no administrator setup is required.
+
+## Ordinary users
+
+Signed-in users browse through **their own live File Station session**, import a
+copy, and list/get/cancel/download only their own jobs. Administrators can see and
+cancel all jobs; `bg.jobs.purge` remains admin-only.
+
+Owners are matched by both authenticated username and freshly resolved numeric UID.
+An unknown UID refuses owner access and submission with `identity_unavailable`.
+Legacy jobs with an unknown UID remain admin-only. Recreated same-name accounts
+with different UIDs cannot access old jobs. This does not detect reuse of the same
+username **and** UID. Account disablement is enforced by DSM session authentication;
+this feature does not provide a separate account-lifecycle directory service.
+
+Idempotency keys are scoped to that owner. Cross-owner and missing IDs both return
+`not_found`. Queue/running counts for ordinary users include only their own jobs.
+Per-owner limits (including administrators): 2 queued/running jobs, 1 MiB of pending
+and retained imported inputs, schedule copies, plus 512 bytes reserved for each pending or retained result. The 16-job/16-MiB
+global bounds and 64 finished-job history remain. Two full 512-KiB inputs exceed the
+owner byte limit because of their result reservations. `owner-queue-full` and
+`owner-quota-exceeded` are distinct from global `queue-full`/`quota-exceeded`.
+
+An administrator may explicitly clear an exact owner `{user, uid}` (including
+unknown legacy UIDs). This removes saved results and queued inputs, requests cancel
+for running jobs, and hides those jobs until Finish/Recover drains them. A bounded
+64-entry audit stores actor, exact owner, time and counts in the durable journal;
+it contains no credentials or input contents. Uninstall retains data by default;
+the existing explicit delete-data wizard remains available.
+
+The package copy/result is not recalled when source-file permissions change.
+Offline access under a user's ACL, AD/LDAP UID stability and DSM reboot recovery
+are not claimed. No user credentials are stored.
+
+## Private-copy schedules (S1-a)
+
+Import a file and wait for its success, then choose **Schedule this copy** and
+explicitly consent. The package pins a separate copy and digest, without accessing
+File Station offline. `bg.schedules.create {key, jobId, intervalSeconds, consent:true}`
+accepts only 3600, 86400 or 604800 seconds; up to 8 schedules per package.
+`key` is scoped to username/UID and retries the exact definition.
+`bg.schedules.list`, `bg.schedules.disable {id}`, `bg.schedules.delete {id}` are
+owner-scoped; administrators see and can disable/delete all. Only an administrator
+can call `bg.schedules.enable {id, consent:true}` after reviewing the current revision.
+An administrator cannot create a schedule from another owner's imported copy.
+
+Successful manual inputs are retained with the bounded 64-job history. Old U1
+results whose input was deleted cannot be scheduled: import again. Copies and
+schedule pins count toward the 1-MiB owner/16-MiB global storage limits; a full
+512-KiB source plus its pinned copy exceeds the owner limit, so use smaller inputs.
+A scheduled run also needs input/result quota and shares the 2-pending-owner limit.
+At least 4 global queue positions remain available for manual jobs.
+
+The package-user worker ticks its journal; no root task, crontab or global service
+is created. `nextAt` and the run's `scheduleId`/`scheduledAt` commit atomically.
+Completed jobs never replay. Each start records overdue ticks as `missed` and
+advances to the next future period. Delays over 5 seconds, a full quota/queue, and
+multi-period gaps are also missed; no catch-up. The latest missed time/reason and
+aggregate missed count are retained, not an unbounded event log. This is neither
+an exact-time nor exactly-once guarantee.
+
+Disabling/deleting cancels queued runs and requests running cancellation/drain;
+finished results remain. Clearing an owner also deletes that owner's schedules/pins and drains running jobs. A worker
+revision mismatch disables the schedule (`worker-changed`) and requires explicit
+administrator re-enable; a package build +1 with the same worker revision preserves
+compatible definitions/results. Changed or missing pinned bytes disable the schedule.
+No S1-b share authorization or offline personal ACL reading is provided.

package/dist/templates/native-go-jobs/backend/internal/app/background_routes_test.go

@@ -0,0 +1,90 @@
+package app
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"errors"
+	"golang.org/x/sys/unix"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// Expected domain errors in the SDK policy test for a fresh job store.
+var sampleOutcome = map[string]string{}
+
+func init() {
+	// The generic route tests need valid params for every background route.
+	// The fixture has no DSM cookie; import is refused before reading a file.
+	// No jobs or schedules exist in its fresh data directory.
+	const id = `{"id":"missing"}`
+	sampleParams["bg.jobs.purge"] = `{"owner":{"user":"missing","uid":"9999"}}`
+	sampleParams["bg.schedules.list"] = `{}`
+	sampleParams["bg.schedules.create"] = `{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}`
+	sampleParams["bg.schedules.disable"] = id
+	sampleParams["bg.schedules.delete"] = id
+	sampleParams["bg.schedules.enable"] = `{"id":"missing","consent":true}`
+	sampleOutcome["bg.schedules.create"] = "not_found"
+	sampleOutcome["bg.schedules.disable"] = "not_found"
+	sampleOutcome["bg.schedules.delete"] = "not_found"
+	sampleOutcome["bg.schedules.enable"] = "not_found"
+	sampleParams["bg.status"] = `{}`
+	sampleParams["bg.browse"] = `{}`
+	sampleParams["bg.jobs.submit"] = `{"key":"k1","folder":"/share","relative":"a.bin"}`
+	sampleParams["bg.jobs.list"] = `{}`
+	sampleParams["bg.jobs.get"] = id
+	sampleParams["bg.jobs.cancel"] = id
+	sampleParams["bg.jobs.result"] = id
+	sampleOutcome["bg.browse"] = "session_required"
+	sampleOutcome["bg.jobs.submit"] = "session_required"
+	sampleOutcome["bg.jobs.get"] = "not_found"
+	sampleOutcome["bg.jobs.cancel"] = "not_found"
+	sampleOutcome["bg.jobs.result"] = "not_found"
+}
+
+func TestBackgroundBusyErrorCode(t *testing.T) {
+	err := backgroundError(background.ErrBusy)
+	var e *api.Error
+	if !errors.As(err, &e) || e.Code != "jobs_busy" {
+		t.Fatalf("busy mapping: %v", err)
+	}
+}
+
+func TestBackgroundRequestSubmitBusyAndProductionConstruction(t *testing.T) {
+	e := newBgEnv(t)
+	dir := filepath.Join(t.TempDir(), "background")
+	e.store = background.NewRequestStore(dir)
+	if _, err := e.store.List(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.OpenFile(filepath.Join(dir, "lock"), os.O_RDWR, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	if err := unix.Flock(int(f.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+		t.Fatal(err)
+	}
+	defer unix.Flock(int(f.Fd()), unix.LOCK_UN)
+	start := time.Now()
+	code, out := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"])
+	if code != "jobs_busy" || time.Since(start) > background.RequestLockTimeout+time.Second {
+		t.Fatalf("busy submit: %s %+v", code, out)
+	}
+	// The actual production assembly must use the same bounded wait policy.
+	srv, err := api.NewServerWithPermissions(alice, []byte(`{"schema":1,"default":"administrators","methods":{}}`), BackgroundRoutes(filepath.Dir(dir))...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := httptest.NewRequest("POST", "/api.cgi", strings.NewReader(`{"method":"bg.jobs.list","params":{}}`))
+	r.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	srv.ServeHTTP(w, r)
+	if !strings.Contains(w.Body.String(), `"jobs_busy"`) {
+		t.Fatal(w.Body.String())
+	}
+}