@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/backend/internal/helper/dsm_acl_syscall_linux.go

@@ -1,95 +0,0 @@
-package helper
-
-import (
-	"context"
-	"golang.org/x/sys/unix"
-	"runtime"
-	"strconv"
-	"syscall"
-	"time"
-	"unsafe"
-)
-
-// Private trusted certification input; no environment/JSON/RPC can assert it.
-// Source layout alone is insufficient: actual target/build/masks must be proven.
-type dsmACLRuntimeProof struct {
-	Architecture, BuildRef, BootRef string
-	LayoutVerified, MasksVerified   bool
-	CheckedAt                       time.Time
-}
-type dsmACLSyscallBridge struct {
-	proof func(context.Context) (dsmACLRuntimeProof, Code)
-	now   func() time.Time
-	call  func(uintptr, uintptr, uintptr, uintptr) (uintptr, syscall.Errno)
-}
-
-func newDSMACLSyscallBridge(p func(context.Context) (dsmACLRuntimeProof, Code)) *dsmACLSyscallBridge {
-	return &dsmACLSyscallBridge{proof: p, now: time.Now, call: func(n, a, b, c uintptr) (uintptr, syscall.Errno) { r, _, e := syscall.Syscall(n, a, b, c); return r, e }}
-}
-
-// Source layout: DSM7-4 linux-4.4.x 29003c4, generic + x86-64 table.
-// The same numbers do not imply support on ordinary Linux or another DSM build.
-const dsmACLCheckSyscall = 812
-const dsmACLSupportSyscall = 813
-
-func (b *dsmACLSyscallBridge) Check(ctx context.Context, fd int, alias string, mask uint32) (nativeFDACLObservation, Code) {
-	empty := nativeFDACLObservation{}
-	if b == nil || b.proof == nil || b.call == nil || b.now == nil {
-		return empty, ErrUnsupported
-	}
-	if c := nativeContextCode(ctx); c != "" {
-		return empty, c
-	}
-	p, c := b.proof(ctx)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return empty, c
-	}
-	if (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") || p.Architecture != runtime.GOARCH || !p.LayoutVerified || !p.MasksVerified || !allReferences(p.BuildRef, p.BootRef) || !nativeFresh(p.CheckedAt, b.now()) {
-		return empty, ErrUnsupported
-	}
-	if fd < 0 || alias != "/proc/self/fd/"+strconv.Itoa(fd) || mask == 0 || mask & ^(nativeACLExec|nativeACLRead|nativeACLReadAttr) != 0 {
-		return empty, ErrInvalid
-	}
-	errorCode := func(e syscall.Errno) Code {
-		if e == unix.ENOSYS || e == unix.EOPNOTSUPP {
-			return ErrUnsupported
-		}
-		return ErrUnavailable
-	}
-	name, err := unix.BytePtrFromString(alias)
-	if err != nil {
-		return empty, ErrInvalid
-	}
-	defer runtime.KeepAlive(name)
-	// Positive FD support is mandatory. With WINACL compiled out this returns 0,
-	// which MUST refuse before the check syscall's misleading zero-success stub.
-	// Kernel fget excludes O_PATH: resolve the SAME fixed alias for support too.
-	// No original pathname, readable reopen, or POSIX fallback is introduced.
-	for _, tag := range []uintptr{1, 2} {
-		supported, e := b.call(dsmACLSupportSyscall, uintptr(unsafe.Pointer(name)), uintptr(fd), tag)
-		if e != 0 {
-			return empty, errorCode(e)
-		}
-		if supported != 1 {
-			return empty, ErrUnsupported
-		}
-		if c := nativeContextCode(ctx); c != "" {
-			return empty, c
-		}
-	}
-	result, e := b.call(dsmACLCheckSyscall, uintptr(unsafe.Pointer(name)), uintptr(mask), 0)
-	runtime.KeepAlive(name)
-	if c := nativeContextCode(ctx); c != "" {
-		return empty, c
-	}
-	if e != 0 && e != unix.EACCES && e != unix.EPERM {
-		return empty, errorCode(e)
-	}
-	if e == 0 && result != 0 {
-		return empty, ErrUnavailable
-	}
-	if !nativeFresh(p.CheckedAt, b.now()) {
-		return empty, ErrStale
-	}
-	return nativeFDACLObservation{FilesystemSupported: true, ObjectSupported: true, MasksVerified: true, Allowed: e == 0, CheckedAt: p.CheckedAt}, ""
-}

package/templates/native-go/backend/internal/helper/dsm_acl_syscall_linux_test.go

@@ -1,56 +0,0 @@
-package helper
-
-import (
-	"context"
-	"runtime"
-	"syscall"
-	"testing"
-	"time"
-)
-
-func TestDSMNativeSyscallsRequirePositiveProofAndSupport(t *testing.T) {
-	now := time.Now()
-	calls := 0
-	b := newDSMACLSyscallBridge(func(context.Context) (dsmACLRuntimeProof, Code) { return dsmACLRuntimeProof{}, "" })
-	b.call = func(uintptr, uintptr, uintptr, uintptr) (uintptr, syscall.Errno) { calls++; return 0, 0 }
-	if _, c := b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead); c != ErrUnsupported || calls != 0 {
-		t.Fatal("unknown target invoked custom syscall", c, calls)
-	}
-	b.proof = func(context.Context) (dsmACLRuntimeProof, Code) {
-		return dsmACLRuntimeProof{Architecture: runtime.GOARCH, BuildRef: grantRef('a'), BootRef: grantRef('b'), LayoutVerified: true, MasksVerified: true, CheckedAt: now}, ""
-	}
-	b.now = func() time.Time { return now }
-	if _, c := b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead); c != ErrUnsupported || calls != 1 {
-		t.Fatal("no-WINACL zero treated as Allow", c, calls)
-	}
-	b.call = func(n, a1, a2, a3 uintptr) (uintptr, syscall.Errno) {
-		calls++
-		if n == 813 {
-			if a1 == 0 || (a3 != 1 && a3 != 2) {
-				t.Fatal("O_PATH support must resolve the pinned alias, not fget")
-			}
-			return 1, 0
-		}
-		if n != 812 {
-			t.Fatal(n)
-		}
-		return 0, 0
-	}
-	o, c := b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead|nativeACLReadAttr)
-	if c != "" || !o.Allowed || !o.ObjectSupported {
-		t.Fatal(c, o)
-	}
-	if _, c = b.Check(context.Background(), 5, "/proc/self/fd/6", nativeACLRead); c == "" {
-		t.Fatal("alias substitution")
-	}
-	b.call = func(n, a1, a2, a3 uintptr) (uintptr, syscall.Errno) {
-		if n == 813 {
-			return 1, 0
-		}
-		return 0, syscall.EACCES
-	}
-	o, c = b.Check(context.Background(), 5, "/proc/self/fd/5", nativeACLRead)
-	if c != "" || o.Allowed {
-		t.Fatal("native deny", c, o)
-	}
-}

package/templates/native-go/backend/internal/helper/dsm_bridge_linux.go

@@ -1,144 +0,0 @@
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/dsmprobe"
-	"runtime"
-	"slices"
-	"time"
-)
-
-// Certificates are private root-side audit input, never probe/browser flags.
-// No certificate or bridge is installed in shipped supervisor adapters.
-type dsmBridgeCertificate struct {
-	Architecture, DSMBuild, Kernel, Fingerprint, BootRef string
-	NativeGettersAudited, LayoutAudited, MasksAudited    bool
-}
-type dsmProbeTransport interface {
-	Observe(context.Context, dsmprobe.Request) (dsmprobe.Response, Code)
-}
-type dsmNativeBridge struct {
-	transport   dsmProbeTransport
-	certificate *dsmBridgeCertificate
-	now         func() time.Time
-}
-type dsmShareObservation struct {
-	Principal                            Principal
-	SessionRef, Name, Path               string
-	Available, VolumeProven, ReadAllowed bool
-	CheckedAt                            time.Time
-}
-
-func newDSMNativeBridge(t dsmProbeTransport, c *dsmBridgeCertificate) *dsmNativeBridge {
-	b := &dsmNativeBridge{transport: t, now: time.Now}
-	if c != nil {
-		copy := *c
-		b.certificate = &copy
-	}
-	return b
-}
-func (b *dsmNativeBridge) observe(ctx context.Context, actor *NativeActor) (dsmprobe.Response, time.Time, Code) {
-	var zero dsmprobe.Response
-	if b == nil || b.transport == nil || b.certificate == nil || b.now == nil {
-		return zero, time.Time{}, ErrUnsupported
-	}
-	cert := *b.certificate
-	if !allReferences(cert.Fingerprint, cert.BootRef) || cert.Architecture == "" || cert.DSMBuild == "" || cert.Kernel == "" {
-		return zero, time.Time{}, ErrUnsupported
-	}
-	started := b.now()
-	ctx, cancel := context.WithTimeout(ctx, NativeProofFreshness)
-	defer cancel()
-	nonce, c := randomGrantID()
-	if c != "" {
-		return zero, started, c
-	}
-	request := dsmprobe.Request{Version: dsmprobe.Protocol, Nonce: nonce, Kind: "runtime", Groups: []uint32{}}
-	if actor != nil {
-		if !actor.valid || actor.Principal().Kind != "local" || !actor.account.Enabled || !nativeFresh(actor.account.CheckedAt, started) {
-			return zero, started, ErrDenied
-		}
-		request.Kind = "metadata"
-		request.Username = actor.Username()
-		request.UID = actor.UID()
-		request.GID = actor.GID()
-		request.Groups = actor.Groups()
-	}
-	out, c := b.transport.Observe(ctx, request)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return zero, started, c
-	}
-	if !nativeFresh(started, b.now()) {
-		return zero, started, ErrStale
-	}
-	if out.Version != dsmprobe.Protocol || out.Nonce != nonce || out.Status != "ok" || out.Runtime.Architecture != cert.Architecture || out.Runtime.DSMBuild != cert.DSMBuild || out.Runtime.Kernel != cert.Kernel || out.Runtime.Fingerprint != cert.Fingerprint || out.Runtime.BootRef != cert.BootRef {
-		return zero, started, ErrUnsupported
-	}
-	if actor != nil {
-		a := out.Account
-		identity := out.Identity
-		if !cert.NativeGettersAudited || !a.NativeKnown || !a.Local || !a.Enabled || !a.GroupsKnown || a.Username != actor.Username() || a.UID != actor.UID() || a.GID != actor.GID() || !slices.Equal(a.Groups, actor.Groups()) || identity.UID != actor.UID() || identity.GID != actor.GID() || !slices.Equal(identity.Groups, actor.Groups()) || !identity.NoNewPrivs || !identity.NonDumpable {
-			return zero, started, ErrDenied
-		}
-		if !nativeFresh(actor.account.CheckedAt, b.now()) {
-			return zero, started, ErrStale
-		}
-	}
-	return out, started, ""
-}
-func nativeShareFacts(s dsmprobe.Share) Code {
-	if !s.NativeKnown || !s.VolumeKnown || !s.PermissionKnown {
-		return ErrUnsupported
-	}
-	if !s.Available || !s.ReadAllowed {
-		return ErrDenied
-	}
-	if ValidateRelativeSegments([]string{s.Name}, false) != "" {
-		return ErrInvalid
-	}
-	return (readOnlyWork{RootPath: s.Path, Action: ActionStat, Segments: []string{}}).validate()
-}
-func (b *dsmNativeBridge) ObserveOwnHome(ctx context.Context, a NativeActor) (ownHomeObservation, Code) {
-	out, at, c := b.observe(ctx, &a)
-	if c != "" {
-		return ownHomeObservation{}, c
-	}
-	if c = nativeShareFacts(out.Share); c != "" {
-		return ownHomeObservation{}, c
-	}
-	if !out.Home.StatusKnown {
-		return ownHomeObservation{}, ErrUnsupported
-	}
-	if !out.Home.Enabled || out.Share.Name != "homes" || out.Share.Path != out.Home.HomesPath || out.Account.Home != "/var/services/homes/"+a.Username() {
-		return ownHomeObservation{}, ErrDenied
-	}
-	return ownHomeObservation{Principal: a.Principal(), SessionRef: a.SessionRef(), Home: out.Account.Home, HomesPath: out.Home.HomesPath, Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: at}, ""
-}
-func (b *dsmNativeBridge) ObserveShare(ctx context.Context, a NativeActor, name string) (dsmShareObservation, Code) {
-	if name != "homes" {
-		return dsmShareObservation{}, ErrUnsupported
-	} // This slice certifies only the own-home native homes share.
-	out, at, c := b.observe(ctx, &a)
-	if c != "" {
-		return dsmShareObservation{}, c
-	}
-	if out.Share.Name != name {
-		return dsmShareObservation{}, ErrStale
-	}
-	if c = nativeShareFacts(out.Share); c != "" {
-		return dsmShareObservation{}, c
-	}
-	return dsmShareObservation{Principal: a.Principal(), SessionRef: a.SessionRef(), Name: name, Path: out.Share.Path, Available: true, VolumeProven: true, ReadAllowed: true, CheckedAt: at}, ""
-}
-func (b *dsmNativeBridge) ACLRuntimeProof(ctx context.Context) (dsmACLRuntimeProof, Code) {
-	out, at, c := b.observe(ctx, nil)
-	if c != "" {
-		return dsmACLRuntimeProof{}, c
-	}
-	cert := *b.certificate
-	if cert.Architecture != runtime.GOARCH || (runtime.GOARCH != "amd64" && runtime.GOARCH != "arm64") || !cert.LayoutAudited || !cert.MasksAudited {
-		return dsmACLRuntimeProof{}, ErrUnsupported
-	}
-	// An ACL sample's result/certified flag is never native action certification.
-	return dsmACLRuntimeProof{Architecture: out.Runtime.Architecture, BuildRef: cert.Fingerprint, BootRef: cert.BootRef, LayoutVerified: true, MasksVerified: true, CheckedAt: at}, ""
-}

package/templates/native-go/backend/internal/helper/dsm_bridge_linux_test.go

@@ -1,89 +0,0 @@
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/dsmprobe"
-	"runtime"
-	"testing"
-	"time"
-)
-
-type nativeProbeFake struct {
-	response dsmprobe.Response
-	code     Code
-	change   func(*dsmprobe.Response)
-}
-
-func (f *nativeProbeFake) Observe(_ context.Context, r dsmprobe.Request) (dsmprobe.Response, Code) {
-	v := f.response
-	v.Nonce = r.Nonce
-	v.Version = 1
-	if f.change != nil {
-		f.change(&v)
-	}
-	return v, f.code
-}
-func bridgeFixture(t *testing.T) (*dsmNativeBridge, NativeActor, *nativeProbeFake) {
-	t.Helper()
-	p, _, _, carriers, now := nativeFixture()
-	actor, c := p.Resolve(context.Background(), carriers)
-	if c != "" {
-		t.Fatal(c)
-	}
-	actor.account.Username = "normal3"
-	f := &nativeProbeFake{response: dsmprobe.Response{Version: 1, Status: "ok", Runtime: dsmprobe.Runtime{Architecture: runtime.GOARCH, DSMBuild: "7.4-90069", Kernel: "4.4.302+", BootRef: grantRef('b'), Fingerprint: grantRef('f')}, Identity: dsmprobe.Identity{UID: actor.UID(), GID: actor.GID(), Groups: actor.Groups(), NoNewPrivs: true, NonDumpable: true}, Account: dsmprobe.Account{Username: actor.Username(), UID: actor.UID(), GID: actor.GID(), Groups: actor.Groups(), Home: "/var/services/homes/normal3", NativeKnown: true, Local: true, Enabled: true, GroupsKnown: true}, Home: dsmprobe.Home{HomesPath: "/volume1/homes", StatusKnown: true, Enabled: true}, Share: dsmprobe.Share{Name: "homes", Path: "/volume1/homes", NativeKnown: true, Available: true, VolumeKnown: true, PermissionKnown: true, ReadAllowed: true}}}
-	cert := &dsmBridgeCertificate{Architecture: runtime.GOARCH, DSMBuild: "7.4-90069", Kernel: "4.4.302+", Fingerprint: grantRef('f'), BootRef: grantRef('b'), NativeGettersAudited: true, LayoutAudited: true, MasksAudited: true}
-	b := &dsmNativeBridge{transport: f, certificate: cert, now: func() time.Time { return now }}
-	return b, actor, f
-}
-func TestDSMNativeBridgeRequiresIndependentNativeFacts(t *testing.T) {
-	b, a, f := bridgeFixture(t)
-	o, c := b.ObserveOwnHome(context.Background(), a)
-	if c != "" || o.Home != "/var/services/homes/normal3" || !o.ShareAllowed {
-		t.Fatal(c, o)
-	}
-	for _, change := range []func(*dsmprobe.Response){func(r *dsmprobe.Response) { r.Share.PermissionKnown = false }, func(r *dsmprobe.Response) { r.Account.GroupsKnown = false }, func(r *dsmprobe.Response) { r.Home.StatusKnown = false }, func(r *dsmprobe.Response) { r.Share.VolumeKnown = false }, func(r *dsmprobe.Response) { r.Account.UID++ }, func(r *dsmprobe.Response) { r.Runtime.Fingerprint = grantRef('e') }, func(r *dsmprobe.Response) { r.Identity.NoNewPrivs = false }} {
-		f.change = change
-		if _, c := b.ObserveOwnHome(context.Background(), a); c == "" {
-			t.Fatal("unknown proof accepted")
-		}
-	}
-	f.change = nil
-	b.certificate = nil
-	if _, c := b.ObserveOwnHome(context.Background(), a); c == "" {
-		t.Fatal("no audit certificate accepted")
-	}
-}
-func TestDSMNativeBridgeACLProofNeverUsesProbeAllowFlag(t *testing.T) {
-	b, _, f := bridgeFixture(t)
-	p, c := b.ACLRuntimeProof(context.Background())
-	if c != "" || !p.LayoutVerified || !p.MasksVerified {
-		t.Fatal(c, p)
-	}
-	f.response.ACL.Certified = true
-	f.response.ACL.CheckResult = 0
-	b.certificate.MasksAudited = false
-	if _, c = b.ACLRuntimeProof(context.Background()); c == "" {
-		t.Fatal("unknown masks accepted")
-	}
-	b.certificate.MasksAudited = true
-	f.change = func(r *dsmprobe.Response) { r.Runtime.BootRef = grantRef('d') }
-	if _, c = b.ACLRuntimeProof(context.Background()); c == "" {
-		t.Fatal("different boot accepted")
-	}
-}
-
-func TestDSMNativeShareBridgeIsOwnHomesOnlyAndProofBound(t *testing.T) {
-	b, a, f := bridgeFixture(t)
-	o, c := b.ObserveShare(context.Background(), a, "homes")
-	if c != "" || o.Path != "/volume1/homes" || o.Principal != a.Principal() || o.SessionRef != a.SessionRef() {
-		t.Fatal(c, o)
-	}
-	if _, c = b.ObserveShare(context.Background(), a, "public"); c != ErrUnsupported {
-		t.Fatal("unreviewed share", c)
-	}
-	f.change = func(r *dsmprobe.Response) { r.Share.ReadAllowed = false }
-	if _, c = b.ObserveShare(context.Background(), a, "homes"); c != ErrDenied {
-		t.Fatal(c)
-	}
-}

package/templates/native-go/backend/internal/helper/dsm_home_linux.go

@@ -1,107 +0,0 @@
-package helper
-
-import (
-	"context"
-	"golang.org/x/sys/unix"
-	"strings"
-	"time"
-)
-
-// This read-only observation must use fresh local pw_dir + home status + native
-// homes mapping; never HomePathGet/prepare-folder, NSS, or guessed volume paths.
-type ownHomeObservation struct {
-	Principal                           Principal
-	SessionRef, Home, HomesPath         string
-	Enabled, ShareAllowed, VolumeProven bool
-	CheckedAt                           time.Time
-}
-type ownHomeBridge interface {
-	ObserveOwnHome(context.Context, NativeActor) (ownHomeObservation, Code)
-}
-type dsmOwnHomeResolver struct {
-	native ownHomeBridge
-	now    func() time.Time
-}
-
-func (r *dsmOwnHomeResolver) Resolve(ctx context.Context, actor NativeActor) (*pinnedReadOnlyRoot, Code) {
-	if r == nil || r.native == nil || r.now == nil {
-		return nil, ErrUnavailable
-	}
-	if !actor.valid || !nativeFresh(actor.account.CheckedAt, r.now()) {
-		return nil, ErrDenied
-	}
-	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
-	defer cancel()
-	before, c := r.native.ObserveOwnHome(ctx, actor)
-	if c = nativeObservationCode(ctx, c); c != "" {
-		return nil, c
-	}
-	validate := func(o ownHomeObservation) Code {
-		if o.Principal != actor.Principal() || o.SessionRef != actor.SessionRef() || !o.Enabled || !o.ShareAllowed {
-			return ErrDenied
-		}
-		if !o.VolumeProven {
-			return ErrUnsupported
-		}
-		if !nativeFresh(o.CheckedAt, r.now()) || !nativeFresh(actor.account.CheckedAt, r.now()) {
-			return ErrStale
-		}
-		// Only the fixed native alias is recognized. No generic realpath or symlink
-		// exception enters S5; physical HomesPath comes from the trusted native map.
-		suffix, ok := strings.CutPrefix(o.Home, "/var/services/homes/")
-		if !ok || suffix != actor.Username() || ValidateRelativeSegments([]string{suffix}, false) != "" {
-			return ErrUnsupported
-		}
-		w := readOnlyWork{RootPath: o.HomesPath, Action: ActionStat, Segments: []string{}}
-		if c := w.validate(); c != "" {
-			return c
-		}
-		return ""
-	}
-	if c = validate(before); c != "" {
-		return nil, c
-	}
-	pin, c := pinReadOnlyRoot(before.HomesPath + "/" + actor.Username())
-	if c != "" {
-		return nil, c
-	}
-	after, c := r.native.ObserveOwnHome(ctx, actor)
-	if c = nativeObservationCode(ctx, c); c == "" {
-		c = validate(after)
-	}
-	copyBefore, copyAfter := before, after
-	copyBefore.CheckedAt = time.Time{}
-	copyAfter.CheckedAt = time.Time{}
-	if c != "" || copyBefore != copyAfter {
-		pin.Close()
-		if c != "" {
-			return nil, c
-		}
-		return nil, ErrStale
-	}
-	// Bracket path/object continuity as well as native mapping metadata.
-	check, c := pinReadOnlyRoot(pin.path)
-	if c != "" {
-		pin.Close()
-		return nil, c
-	}
-	var first, second unix.Stat_t
-	same := unix.Fstat(int(pin.file.Fd()), &first) == nil && unix.Fstat(int(check.file.Fd()), &second) == nil && sameReadOnlyObject(first, second)
-	firstMount, mc := readOnlyMountID(int(pin.file.Fd()))
-	secondMount, nc := readOnlyMountID(int(check.file.Fd()))
-	same = same && mc == "" && nc == "" && firstMount == secondMount
-	check.Close()
-	if !same {
-		pin.Close()
-		return nil, ErrStale
-	}
-	if c := nativeContextCode(ctx); c != "" {
-		pin.Close()
-		return nil, c
-	}
-	if !nativeFresh(after.CheckedAt, r.now()) || !nativeFresh(actor.account.CheckedAt, r.now()) {
-		pin.Close()
-		return nil, ErrStale
-	}
-	return pin, ""
-}

package/templates/native-go/backend/internal/helper/dsm_home_linux_test.go

@@ -1,82 +0,0 @@
-package helper
-
-import (
-	"context"
-	"os"
-	"testing"
-	"time"
-)
-
-type homeNativeFake struct {
-	value ownHomeObservation
-	code  Code
-	calls int
-	after func()
-}
-
-func (f *homeNativeFake) ObserveOwnHome(context.Context, NativeActor) (ownHomeObservation, Code) {
-	f.calls++
-	if f.after != nil {
-		f.after()
-	}
-	return f.value, f.code
-}
-func TestDSMHomeExistingOnlyAndBrackets(t *testing.T) {
-	p, _, _, c, now := nativeFixture()
-	actor, code := p.Resolve(context.Background(), c)
-	if code != "" {
-		t.Fatal(code)
-	}
-	root := t.TempDir()
-	if err := os.Mkdir(root+"/alice", 0700); err != nil {
-		t.Fatal(err)
-	}
-	native := &homeNativeFake{value: ownHomeObservation{Principal: actor.Principal(), SessionRef: actor.SessionRef(), Home: "/var/services/homes/alice", HomesPath: root, Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: now}}
-	resolver := &dsmOwnHomeResolver{native: native, now: func() time.Time { return now }}
-	pin, code := resolver.Resolve(context.Background(), actor)
-	if code != "" || native.calls != 2 {
-		t.Fatal(code, native.calls)
-	}
-	pin.Close()
-	for _, home := range []string{"/var/services/homes/bob", "/var/services/homes/../alice", "/volume1/arbitrary/alice"} {
-		native.value.Home = home
-		if pin, code = resolver.Resolve(context.Background(), actor); code == "" || pin != nil {
-			t.Fatal(home, code)
-		}
-	}
-	native.value.Home = "/var/services/homes/alice"
-	os.Remove(root + "/alice")
-	if pin, code = resolver.Resolve(context.Background(), actor); code == "" || pin != nil {
-		t.Fatal("missing home accepted")
-	}
-	if _, err := os.Stat(root + "/alice"); !os.IsNotExist(err) {
-		t.Fatal("created missing home")
-	}
-	os.Symlink(root, root+"/alice")
-	if pin, code = resolver.Resolve(context.Background(), actor); code == "" || pin != nil {
-		t.Fatal("symlink accepted")
-	}
-}
-func TestDSMHomeUnknownAndChangedMappingRefuse(t *testing.T) {
-	p, _, _, c, now := nativeFixture()
-	actor, _ := p.Resolve(context.Background(), c)
-	for _, change := range []func(*ownHomeObservation){func(o *ownHomeObservation) { o.Enabled = false }, func(o *ownHomeObservation) { o.ShareAllowed = false }, func(o *ownHomeObservation) { o.VolumeProven = false }, func(o *ownHomeObservation) { o.CheckedAt = time.Time{} }, func(o *ownHomeObservation) { o.SessionRef = grantRef('e') }} {
-		f := &homeNativeFake{value: ownHomeObservation{Principal: actor.Principal(), SessionRef: actor.SessionRef(), Home: "/var/services/homes/alice", HomesPath: t.TempDir(), Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: now}}
-		change(&f.value)
-		pin, code := (&dsmOwnHomeResolver{native: f, now: func() time.Time { return now }}).Resolve(context.Background(), actor)
-		if code == "" || pin != nil {
-			t.Fatal("unknown metadata accepted")
-		}
-	}
-	root := t.TempDir()
-	os.Mkdir(root+"/alice", 0700)
-	f := &homeNativeFake{value: ownHomeObservation{Principal: actor.Principal(), SessionRef: actor.SessionRef(), Home: "/var/services/homes/alice", HomesPath: root, Enabled: true, ShareAllowed: true, VolumeProven: true, CheckedAt: now}}
-	f.after = func() {
-		if f.calls == 2 {
-			f.value.ShareAllowed = false
-		}
-	}
-	if pin, code := (&dsmOwnHomeResolver{native: f, now: func() time.Time { return now }}).Resolve(context.Background(), actor); code == "" || pin != nil {
-		t.Fatal("changed observation leaked pin")
-	}
-}