@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/sdk_session_test.go

@@ -1,475 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/filestation"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"os/user"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-type sessionFilesFake struct {
-	mu                     sync.Mutex
-	denied, revoked, admin bool
-	calls                  int
-	block                  chan struct{}
-	uid                    string
-}
-
-func (f *sessionFilesFake) CheckSession(ctx context.Context, _ api.Authenticator, r *http.Request) (filestation.SessionIdentity, error) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.denied || ctx.Err() != nil {
-		return filestation.SessionIdentity{}, api.ErrNoSession
-	}
-	c, _ := r.Cookie("id")
-	if c == nil {
-		return filestation.SessionIdentity{}, api.ErrNoSession
-	}
-	name := "alice"
-	uid := "1000"
-	if strings.HasPrefix(c.Value, "bob") {
-		name = "bob"
-		uid = "1001"
-	}
-	if f.uid != "" {
-		uid = f.uid
-	}
-	return filestation.SessionIdentity{User: name, UID: uid, Admin: f.admin}, nil
-}
-func (f *sessionFilesFake) JobSelection(context.Context, filestation.SessionIdentity, string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.revoked {
-		return &api.Error{Code: "denied"}
-	}
-	return nil
-}
-func (f *sessionFilesFake) JobStep(ctx context.Context, _ *http.Request, _ filestation.SessionIdentity, _ string, _ jobcontract.Step) (jobcontract.Result, error) {
-	f.mu.Lock()
-	f.calls++
-	block := f.block
-	f.mu.Unlock()
-	if block != nil {
-		select {
-		case <-ctx.Done():
-			return jobcontract.Result{}, &api.Error{Code: "canceled"}
-		case <-block:
-		}
-	}
-	return jobcontract.Result{ResultSchema: 1, CompletedSteps: 1, Entries: 1}, nil
-}
-func sessionFixture(t *testing.T) (*sdkJobTestFixture, *sessionFilesFake, *time.Duration) {
-	t.Helper()
-	f := sdkJobFixture(t)
-	files := &sessionFilesFake{}
-	now := time.Duration(0)
-	f.o.attachNow = func() time.Duration { return now }
-	s, c := newSDKSessionJobs(f.o, files, nil)
-	if c != "" {
-		t.Fatal(c)
-	}
-	f.o.session = s
-	f.carriers = SessionCarriers{Cookie: "id=alice-session", ClientAddress: "127.0.0.1"}
-	return f, files, &now
-}
-func sessionCall(f *sdkJobTestFixture, method string, args any) sdkWireResponse {
-	raw, _ := json.Marshal(args)
-	n, _ := sdkRandomRef()
-	wire, _ := json.Marshal(sdkWireRequest{Inventory: f.c.inventory, Nonce: n, Method: method, Carriers: grantCarriers{Cookie: f.carriers.Cookie, SynoToken: f.carriers.SynoToken, ClientAddress: f.carriers.ClientAddress}, Args: raw})
-	return f.o.dispatchSDK(context.Background(), operationPeer{42, 0}, wire)
-}
-func sessionSubmit(t *testing.T, f *sdkJobTestFixture) sdkAttachReceipt {
-	t.Helper()
-	r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{Worker: f.r.Control.Binding.Worker, Parent: jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, Input: f.r.Input})
-	if r.Code != "" {
-		t.Fatal("prepare", r.Code)
-	}
-	var p sdkPrepared
-	if json.Unmarshal(r.Data, &p) != nil {
-		t.Fatal("prepare decode")
-	}
-	r = sessionCall(f, "jobs.submit", sdkSubmitArgs{IntentID: p.IntentID, SummaryDigest: p.SummaryDigest})
-	if r.Code != "" {
-		t.Fatal("submit", r.Code)
-	}
-	var receipt sdkAttachReceipt
-	if json.Unmarshal(r.Data, &receipt) != nil {
-		t.Fatal("receipt")
-	}
-	return receipt
-}
-func TestSDKSessionJobsCompleteWithoutNativeProof(t *testing.T) {
-	f, files, now := sessionFixture(t)
-	f.native.sessionCode = ErrUnavailable
-	a := sessionSubmit(t, f)
-	if a.TTLMS != 6000 || a.RenewAfterMS != 2000 {
-		t.Fatal("lease changed")
-	}
-	for range 100 {
-		if c := f.o.poll(context.Background()); c != "" {
-			t.Fatal(c)
-		}
-		if f.o.session.jobs[a.JobID].terminal {
-			break
-		}
-		time.Sleep(time.Millisecond)
-	}
-	j := f.o.session.jobs[a.JobID]
-	if j.receipt.Job.State != jobcontract.Succeeded || !j.receipt.Job.Drained {
-		t.Fatal("no successful terminal", j.receipt.Job.State)
-	}
-	if j.carriers.Cookie != "" {
-		t.Fatal("credential retained")
-	}
-	*now += time.Second
-	r := sessionCall(f, "jobs.result", sdkResultArgs{JobID: a.JobID})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	f.carriers.Cookie = "id=bob-session"
-	r = sessionCall(f, "jobs.result", sdkResultArgs{JobID: a.JobID})
-	if r.Code != ErrDenied {
-		t.Fatal("foreign result", r.Code)
-	}
-	files.mu.Lock()
-	files.denied = true
-	files.mu.Unlock()
-	if r = sessionCall(f, "jobs.status", sdkStatusArgs{}); r.Code == "" {
-		t.Fatal("expired identity accepted")
-	}
-	if len(f.children) != 0 {
-		t.Fatal("native/POSIX child used")
-	}
-}
-func TestSDKSessionAttachBindingsAndExpiry(t *testing.T) {
-	f, _, now := sessionFixture(t)
-	a := sessionSubmit(t, f)
-	for _, cookie := range []string{"id=bob-session", "id=alice-other-session"} {
-		*now += time.Second
-		f.carriers.Cookie = cookie
-		if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrDenied {
-			t.Fatal("foreign attach", r.Code)
-		}
-	}
-	f.carriers.Cookie = "id=alice-session"
-	*now = 6 * time.Second
-	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrExpired {
-		t.Fatal("late renew", r.Code)
-	}
-	if !f.o.session.jobs[a.JobID].receipt.Job.CancelRequested || f.journal.cancels == 0 {
-		t.Fatal("no durable cancel")
-	}
-}
-func TestSDKSessionAdminAndOwnerCancel(t *testing.T) {
-	f, files, now := sessionFixture(t)
-	a := sessionSubmit(t, f)
-	f.carriers.Cookie = "id=bob-session"
-	if r := sessionCall(f, "jobs.admin.status", sdkStatusArgs{}); r.Code != ErrDenied {
-		t.Fatal("nonadmin", r.Code)
-	}
-	if r := sessionCall(f, "jobs.cancel", sdkCancelArgs{a.JobID, a.Revision}); r.Code != ErrDenied {
-		t.Fatal("foreign cancel", r.Code)
-	}
-	files.mu.Lock()
-	files.admin = true
-	files.mu.Unlock()
-	*now += time.Second
-	r := sessionCall(f, "jobs.admin.status", sdkStatusArgs{})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	for _, private := range []string{"progress", "knownEffects", "alice", "input", "session", "scope"} {
-		if strings.Contains(string(r.Data), private) {
-			t.Fatal("admin data leak", private)
-		}
-	}
-	if r = sessionCall(f, "jobs.admin.cancel", sdkCancelArgs{a.JobID, f.o.session.revision}); r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	files.mu.Lock()
-	files.admin = false
-	files.mu.Unlock()
-	if r = sessionCall(f, "jobs.admin.cancel", sdkCancelArgs{a.JobID, f.o.session.revision}); r.Code != ErrDenied {
-		t.Fatal("stale admin", r.Code)
-	}
-}
-func TestSDKSessionRejectsStreamsRevokedAndReplay(t *testing.T) {
-	f, files, _ := sessionFixture(t)
-	in := f.r.Input
-	size := uint64(1024)
-	in.Steps = []jobcontract.Step{{Action: jobcontract.ReadStream, Segments: []string{"x"}, MaxBytes: &size}}
-	if r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, in}); r.Code != ErrUnsupported {
-		t.Fatal("stream", r.Code)
-	}
-	r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, f.r.Input})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	var p sdkPrepared
-	json.Unmarshal(r.Data, &p)
-	files.mu.Lock()
-	files.revoked = true
-	files.mu.Unlock()
-	if r = sessionCall(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}); r.Code != ErrDenied {
-		t.Fatal("revoked submit", r.Code)
-	}
-	if r = sessionCall(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest}); r.Code != ErrReplay {
-		t.Fatal("replay", r.Code)
-	}
-	if len(f.journal.intents) != 0 {
-		t.Fatal("refused job reserved")
-	}
-}
-
-func TestSDKSessionJournalFormatAndNoCredentialPersistence(t *testing.T) {
-	f, _, _ := sessionFixture(t)
-	a := sessionSubmit(t, f)
-	i := f.journal.intents[a.JobID]
-	raw, c := encodeSDKJournal(sdkJournalRecord{Schema: 1, Intent: i, State: "pending"})
-	if c != "" {
-		t.Fatal("invalid reserved record", c)
-	}
-	if strings.Contains(string(raw), "alice-session") || strings.Contains(string(raw), f.o.session.jobs[a.JobID].session) {
-		t.Fatal("credential or keyed session binding persisted")
-	}
-	for range 100 {
-		if c = f.o.poll(context.Background()); c != "" {
-			t.Fatal(c)
-		}
-		if f.o.session.jobs[a.JobID].terminal {
-			break
-		}
-		time.Sleep(time.Millisecond)
-	}
-	r := f.journal.receipts[a.JobID]
-	if _, c = encodeSDKJournal(sdkJournalRecord{Schema: 1, Intent: i, State: "finished", Receipt: &r}); c != "" {
-		t.Fatal("invalid completion record", c)
-	}
-}
-func TestSDKSessionCancelInFlightKeepsRemoteQUnknown(t *testing.T) {
-	f, files, now := sessionFixture(t)
-	files.block = make(chan struct{})
-	a := sessionSubmit(t, f)
-	if c := f.o.poll(context.Background()); c != "" {
-		t.Fatal(c)
-	}
-	*now = 6 * time.Second
-	if c := f.o.poll(context.Background()); c != "" {
-		t.Fatal(c)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	if c := f.o.session.shutdown(ctx); c != "" {
-		t.Fatal(c)
-	}
-	j := f.o.session.jobs[a.JobID]
-	if !j.terminal || !j.receipt.Job.CancelRequested || j.receipt.Job.Drained || !j.receipt.Job.EffectsUnknown || j.carriers.Cookie != "" || j.done != nil {
-		t.Fatal("in-flight cancellation claimed remote Q")
-	}
-	if _, ok := f.journal.receipts[a.JobID]; ok {
-		t.Fatal("persisted false Q")
-	}
-}
-func TestSDKSessionRechecksAfterDurabilityAndSelectionWait(t *testing.T) {
-	f, files, now := sessionFixture(t)
-	f.journal.afterReserve = func() { *now = 30 * time.Second }
-	r := sessionCall(f, "jobs.prepare", sdkPrepareArgs{f.r.Control.Binding.Worker, jobcontract.RevisionRef{ID: f.g.ID, Revision: 1}, f.r.Input})
-	if r.Code != "" {
-		t.Fatal(r.Code)
-	}
-	var p sdkPrepared
-	json.Unmarshal(r.Data, &p)
-	r = sessionCall(f, "jobs.submit", sdkSubmitArgs{p.IntentID, p.SummaryDigest})
-	if r.Code != ErrExpired {
-		t.Fatal("expired after journal", r.Code)
-	}
-	files.mu.Lock()
-	defer files.mu.Unlock()
-	if files.calls != 0 {
-		t.Fatal("expired plan ran")
-	}
-}
-func TestSDKSessionUIDChangeAndAdminSessionHaveNoOwnerBypass(t *testing.T) {
-	f, files, now := sessionFixture(t)
-	a := sessionSubmit(t, f)
-	files.mu.Lock()
-	files.uid = "1002"
-	files.mu.Unlock()
-	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrDenied {
-		t.Fatal("UID changed", r.Code)
-	}
-	files.mu.Lock()
-	files.uid = ""
-	files.admin = true
-	files.mu.Unlock()
-	f.carriers.Cookie = "id=bob-session"
-	*now += time.Second
-	if r := sessionCall(f, "jobs.cancel", sdkCancelArgs{a.JobID, a.Revision}); r.Code != ErrDenied {
-		t.Fatal("admin bypassed owner route", r.Code)
-	}
-}
-func TestSDKSessionLeaseRollbackAndTotalDeadline(t *testing.T) {
-	for _, kind := range []string{"rollback", "total"} {
-		t.Run(kind, func(t *testing.T) {
-			f, _, now := sessionFixture(t)
-			a := sessionSubmit(t, f)
-			if kind == "rollback" {
-				*now = -time.Nanosecond
-			} else {
-				for n := 1; n < 60; n++ {
-					*now = time.Duration(n) * 2 * time.Second
-					if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != "" {
-						t.Fatal(r.Code)
-					}
-				}
-				*now = 120 * time.Second
-			}
-			if c := f.o.poll(context.Background()); c != "" {
-				t.Fatal(c)
-			}
-			if !f.o.session.jobs[a.JobID].terminal {
-				t.Fatal("deadline extended")
-			}
-		})
-	}
-}
-func TestSDKSessionJournalFailureClosesCredentialsAndAdmission(t *testing.T) {
-	f, _, _ := sessionFixture(t)
-	a := sessionSubmit(t, f)
-	f.journal.cancelCode = ErrUnavailable
-	if r := sessionCall(f, "jobs.cancel", sdkCancelArgs{a.JobID, a.Revision}); r.Code != ErrCleanupRequired {
-		t.Fatal(r.Code)
-	}
-	j := f.o.session.jobs[a.JobID]
-	if !j.terminal || j.carriers.Cookie != "" || j.receipt.Job.Drained {
-		t.Fatal("failed cancel left admission open")
-	}
-	if r := sessionCall(f, "jobs.attach", sdkAttachArgs{a.JobID, a.AttachID}); r.Code != ErrExpired {
-		t.Fatal(r.Code)
-	}
-}
-
-// Exercise the real M2 transport, NSS lookup and selection repository through
-// the fixed supervisor wire. Only DSM authenticate.cgi/WebAPI are local fakes.
-type sessionHTTPAuth struct{ user string }
-
-func (a sessionHTTPAuth) Authenticate(r *http.Request) (api.Identity, error) {
-	c, e := r.Cookie("id")
-	if e != nil || c.Value != "alice-session" {
-		return api.Identity{}, api.ErrNoSession
-	}
-	return api.Identity{User: a.user}, nil
-}
-func TestSDKSessionWireToFileStation(t *testing.T) {
-	native, e := user.Current()
-	if e != nil {
-		t.Fatal(e)
-	}
-	if native.Uid == "0" {
-		native, e = user.Lookup("nobody")
-		if e != nil {
-			t.Skip("requires an NSS non-root fixture")
-		}
-	}
-	var gets, stats atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		cookie, e := r.Cookie("id")
-		if e != nil || cookie.Value != "alice-session" || r.Header.Get("Authorization") != "" {
-			t.Error("incorrect session transport")
-			return
-		}
-		r.ParseForm()
-		switch r.Form.Get("api") {
-		case "SYNO.Core.NormalUser":
-			gets.Add(1)
-			json.NewEncoder(w).Encode(map[string]any{"success": true, "data": map[string]string{"username": native.Username}})
-		case "SYNO.FileStation.List":
-			stats.Add(1)
-			if r.Form.Get("path") != `["/sdk-session-fixture/fixture"]` {
-				t.Error("wrong selection path")
-			}
-			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/sdk-session-fixture/fixture","name":"fixture","isdir":false}]}}`)
-		default:
-			t.Error("unexpected API")
-		}
-	}))
-	defer server.Close()
-	client, e := filestation.NewClient(server.URL)
-	if e != nil {
-		t.Fatal(e)
-	}
-	repo := filestation.NewGrantRepository(t.TempDir())
-	g, e := repo.Confirm(context.Background(), native.Username, native.Uid, "/sdk-session-fixture", false)
-	if e != nil {
-		t.Fatal(e)
-	}
-	f, _, _ := sessionFixture(t)
-	f.g.ID = g.ID
-	var c Code
-	f.o.session, c = newSDKSessionJobs(f.o, filestation.NewService(client, repo), sessionHTTPAuth{native.Username})
-	if c != "" {
-		t.Fatal(c)
-	}
-	a := sessionSubmit(t, f)
-	for range 500 {
-		if c = f.o.poll(context.Background()); c != "" {
-			t.Fatal(c)
-		}
-		if f.o.session.jobs[a.JobID].terminal {
-			break
-		}
-		time.Sleep(time.Millisecond)
-	}
-	j := f.o.session.jobs[a.JobID]
-	if j.receipt.Job.State != jobcontract.Succeeded || stats.Load() != 1 || gets.Load() < 4 {
-		t.Fatal("wire did not complete File Station plan", j.receipt.Job.State, gets.Load(), stats.Load())
-	}
-	raw, _ := json.Marshal(f.journal.intents[a.JobID])
-	if strings.Contains(string(raw), "alice-session") {
-		t.Fatal("credential in journal")
-	}
-}
-func TestSDKSessionRetainedHistoryKeepsKnownEffectsAcrossReopen(t *testing.T) {
-	f, _, _ := sessionFixture(t)
-	a := sessionSubmit(t, f)
-	for range 100 {
-		if c := f.o.poll(context.Background()); c != "" {
-			t.Fatal(c)
-		}
-		if f.o.session.jobs[a.JobID].terminal {
-			break
-		}
-		time.Sleep(time.Millisecond)
-	}
-	receipt := f.journal.receipts[a.JobID]
-	if receipt.Result == nil || receipt.Result.CompletedSteps != 1 {
-		t.Fatal("fixture persisted no result", receipt.Result)
-	}
-	journal := &sdkMemoryJournal{sdkJobTestJournal: *f.journal, records: []sdkJournalRecord{{Schema: 1, Intent: f.journal.intents[a.JobID], State: "finished", Receipt: &receipt}}}
-	f.o.services.Journal = journal
-	reopened, c := newSDKSessionJobs(f.o, &sessionFilesFake{}, nil)
-	if c != "" {
-		t.Fatal(c)
-	}
-	page, c := reopened.page(filestation.SessionIdentity{User: "alice", UID: "1000"}, "", "", false)
-	if c != "" {
-		t.Fatal(c)
-	}
-	raw, _ := json.Marshal(page)
-	var decoded sdkJobPage
-	if json.Unmarshal(raw, &decoded) != nil || len(decoded.Items) != 1 || decoded.Items[0].KnownEffects != *receipt.Result {
-		t.Fatalf("known effects lost across reopen: %s want %+v", raw, *receipt.Result)
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_supervisor_frame.go

@@ -1,78 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bufio"
-	"bytes"
-	"encoding/json"
-	"io"
-	"net"
-	"time"
-)
-
-type supervisorRequest struct {
-	Process Process         `json:"process"`
-	Op      string          `json:"op"`
-	Nonce   string          `json:"nonce"`
-	Data    json.RawMessage `json:"data,omitempty"`
-}
-
-// Legacy M1 requests do not half-close; grant controls MUST half-close. Count
-// the entire v2 frame (including whitespace), reject duplicates and trailing
-// frames, and bound both time and memory. The outer process binds this socket.
-func decodeSupervisorRequest(reader io.Reader) (supervisorRequest, Code) {
-	var req supervisorRequest
-	limited := &io.LimitedReader{R: reader, N: MaxControlBytes + 1}
-	d := json.NewDecoder(limited)
-	var raw json.RawMessage
-	if d.Decode(&raw) != nil {
-		return req, ErrInvalid
-	}
-	if code := decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); code != "" {
-		return req, code
-	}
-	if req.Op == "grants" || req.Op == "jobs" {
-		rest, err := io.ReadAll(io.MultiReader(d.Buffered(), limited))
-		if err != nil {
-			return req, ErrInvalid
-		}
-		if limited.N <= 0 {
-			return req, ErrLimit
-		}
-		if len(bytes.TrimSpace(rest)) != 0 {
-			return req, ErrInvalid
-		}
-	} else if d.InputOffset() > 4096 || len(req.Data) > 0 {
-		return req, ErrInvalid
-	}
-	if !allReferences(req.Nonce) || (req.Op != "admit" && req.Op != "stop" && req.Op != "grants" && req.Op != "jobs") {
-		return req, ErrInvalid
-	}
-	return req, ""
-}
-
-const supervisorAttestationWait = time.Second
-const supervisorFrameBudget = 100 * time.Millisecond
-
-// The caller sends no frame bytes until its full post-connect hash succeeds.
-// Separate the bounded wait for that computation from the fixed frame budget.
-func receiveSupervisorRequest(conn net.Conn) (supervisorRequest, Code) {
-	firstDeadline := time.Now().Add(supervisorAttestationWait)
-	if err := conn.SetReadDeadline(firstDeadline); err != nil {
-		return supervisorRequest{}, ErrInvalid
-	}
-	reader := bufio.NewReader(conn)
-	if _, err := reader.Peek(1); err != nil || !time.Now().Before(firstDeadline) {
-		return supervisorRequest{}, ErrInvalid
-	}
-	frameDeadline := time.Now().Add(supervisorFrameBudget)
-	if err := conn.SetDeadline(frameDeadline); err != nil {
-		return supervisorRequest{}, ErrInvalid
-	}
-	req, code := decodeSupervisorRequest(reader)
-	if !time.Now().Before(frameDeadline) {
-		return supervisorRequest{}, ErrInvalid
-	}
-	return req, code
-}