@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/api/dsm-session.go

@@ -0,0 +1,54 @@
+package api
+
+import (
+	"net/http"
+	"strings"
+	"unicode"
+)
+
+// DSMSession forwards only the current request's DSM authentication material.
+// Identical X-SYNO-TOKEN and SynoToken aliases are allowed; conflicting values
+// or multiple values for either header are refused. Tokens are never accepted
+// from request params or environment variables.
+func DSMSession(r *http.Request) (map[string]string, error) {
+	if r == nil {
+		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+	}
+	// Inspect raw headers before net/http can silently discard malformed values.
+	ids := 0
+	for _, line := range r.Header.Values("Cookie") {
+		if strings.ContainsFunc(line, func(r rune) bool { return r < 0x20 || r == 0x7f }) {
+			return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+		}
+		for _, part := range strings.Split(line, ";") {
+			name, _, _ := strings.Cut(strings.TrimSpace(part), "=")
+			if strings.TrimSpace(name) == "id" {
+				ids++
+			}
+		}
+	}
+	if ids != 1 {
+		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+	}
+	cookies := r.CookiesNamed("id")
+	if len(cookies) != 1 || cookies[0].Value == "" || len(cookies[0].Value) > 4096 || (strings.Contains(cookies[0].Value, ";") || strings.ContainsFunc(cookies[0].Value, func(r rune) bool { return r < 0x20 || r == 0x7f })) {
+		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+	}
+	token := ""
+	for _, name := range []string{"X-SYNO-TOKEN", "SynoToken"} {
+		values := r.Header.Values(name)
+		if len(values) > 1 {
+			return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+		}
+		if len(values) == 1 && values[0] != "" {
+			if token != "" && token != values[0] {
+				return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+			}
+			token = values[0]
+		}
+	}
+	if token == "" || len(token) > 4096 || strings.ContainsFunc(token, unicode.IsControl) {
+		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
+	}
+	return map[string]string{"dsm_cookie": cookies[0].Value, "dsm_synotoken": token}, nil
+}

package/dist/templates/native-go/backend/internal/api/dsm-session_test.go

@@ -0,0 +1,51 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestDSMSessionRequiresRequestCookieAndToken(t *testing.T) {
+	t.Setenv("HTTP_X_SYNO_TOKEN", "environment-token")
+	for _, tc := range []struct {
+		name    string
+		headers map[string][]string
+		cookies []string
+		pass    bool
+	}{
+		{"x header", map[string][]string{"X-SYNO-TOKEN": {"request-token"}}, []string{"session"}, true},
+		{"SynoToken", map[string][]string{"SynoToken": {"request-token"}}, []string{"session"}, true},
+		{"same aliases", map[string][]string{"X-SYNO-TOKEN": {"request-token"}, "SynoToken": {"request-token"}}, []string{"session"}, true},
+		{"no token", nil, []string{"session"}, false},
+		{"no cookie", map[string][]string{"X-SYNO-TOKEN": {"request-token"}}, nil, false},
+		{"duplicate cookie", map[string][]string{"X-SYNO-TOKEN": {"request-token"}}, []string{"a", "b"}, false},
+		{"duplicate header", map[string][]string{"X-SYNO-TOKEN": {"a", "b"}}, []string{"session"}, false},
+		{"conflicting aliases", map[string][]string{"X-SYNO-TOKEN": {"a"}, "SynoToken": {"b"}}, []string{"session"}, false},
+		{"oversize", map[string][]string{"X-SYNO-TOKEN": {strings.Repeat("a", 4097)}}, []string{"session"}, false},
+		{"control characters", map[string][]string{"X-SYNO-TOKEN": {"secret\r\nInjected: value"}}, []string{"session"}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("POST", "/api.cgi?SynoToken=query-token", nil)
+			for k, values := range tc.headers {
+				for _, v := range values {
+					r.Header.Add(k, v)
+				}
+			}
+			for _, v := range tc.cookies {
+				r.AddCookie(&http.Cookie{Name: "id", Value: v})
+			}
+			got, err := DSMSession(r)
+			if (err == nil) != tc.pass {
+				t.Fatal("unexpected acceptance", err)
+			}
+			if tc.pass && (got["dsm_cookie"] != "session" || got["dsm_synotoken"] != "request-token" || len(got) != 2) {
+				t.Fatal("wrong request credentials")
+			}
+			if err != nil && strings.Contains(err.Error(), "secret") {
+				t.Fatal("credential leak")
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/api/errors.go

@@ -1,6 +1,7 @@
 package api
 
 import (
+	"context"
 	"errors"
 	"log"
 )
@@ -24,6 +25,12 @@ func BadRequest(message string) *Error {
 var internalError = &Error{"internal", "internal error"}
 
 func asError(err error) *Error {
+	if errors.Is(err, context.DeadlineExceeded) {
+		return &Error{"bad_response", "request timed out; retry later"}
+	}
+	if errors.Is(err, context.Canceled) {
+		return &Error{"bad_response", "request canceled"}
+	}
 	var apiErr *Error
 	if errors.As(err, &apiErr) {
 		return apiErr
@@ -31,3 +38,10 @@ func asError(err error) *Error {
 	log.Printf("handler error: %v", err)
 	return internalError
 }
+
+func asRequestError(ctx context.Context, err error) *Error {
+	if ctx.Err() != nil {
+		return asError(ctx.Err())
+	}
+	return asError(err)
+}

package/dist/templates/native-go/backend/internal/api/permissions.go

@@ -0,0 +1,161 @@
+package api
+
+import (
+	"bytes"
+	"crypto/sha256"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"io"
+	"unicode/utf8"
+)
+
+// AdministratorPermission names a policy rule. DSM's native SDK decides the
+// role; this token is never compared with a group or account name.
+const AdministratorPermission = "administrators"
+const MaxPermissionsBytes = 65536
+const MaxPermissionMethods = 1024
+
+//go:embed permissions.json
+var bundledPermissions []byte
+
+// SDK rules are immutable; App JSON only configures App methods.
+//
+//go:embed sdk-permissions.json
+var sdkPermissionsJSON []byte
+
+func sdkPolicy(method string) (policy, bool) {
+	var capabilities map[string]map[string]string
+	if err := json.Unmarshal(sdkPermissionsJSON, &capabilities); err != nil {
+		panic(err)
+	}
+	for _, methods := range capabilities {
+		if value, ok := methods[method]; ok {
+			rule, valid := permissionValue(value)
+			if !valid {
+				panic("invalid SDK policy")
+			}
+			return rule, true
+		}
+	}
+	return policyUnset, false
+}
+
+// Set by the CLI to bind the exact policy used for launcher generation to the
+// compiled CGI. Empty is permitted for direct Go development builds only.
+var expectedPermissionsDigest string
+var expectedSDKPermissionsDigest string
+
+type permissions struct {
+	methods map[string]policy
+}
+
+func permissionValue(value string) (policy, bool) {
+	switch value {
+	case AdministratorPermission:
+		return policyAdmin, true
+	case "authenticated":
+		return policyUser, true
+	case "public":
+		return policyPublic, true
+	}
+	return policyUnset, false
+}
+
+func (p permissions) forMethod(method string) policy {
+	if rule, ok := p.methods[method]; ok {
+		return rule
+	}
+	return policyAdmin
+}
+
+// Parse only this fixed JSON shape; aliases, duplicates, missing fields and
+// unknown permission names must fail closed instead of falling back to User.
+func parsePermissions(raw []byte) (permissions, error) {
+	invalid := func() (permissions, error) { return permissions{}, fmt.Errorf("invalid API permissions JSON") }
+	if len(raw) > MaxPermissionsBytes || !utf8.Valid(raw) {
+		return invalid()
+	}
+	d := json.NewDecoder(bytes.NewReader(raw))
+	if token, err := d.Token(); err != nil || token != json.Delim('{') {
+		return invalid()
+	}
+	p := permissions{methods: map[string]policy{}}
+	seen := map[string]bool{}
+	for d.More() {
+		token, err := d.Token()
+		key, ok := token.(string)
+		if err != nil || !ok || seen[key] {
+			return invalid()
+		}
+		seen[key] = true
+		switch key {
+		case "schema":
+			var schema float64
+			if d.Decode(&schema) != nil || schema != 1 {
+				return invalid()
+			}
+		case "default":
+			var value string
+			if d.Decode(&value) != nil || value != AdministratorPermission {
+				return invalid()
+			}
+		case "methods":
+			if token, err := d.Token(); err != nil || token != json.Delim('{') {
+				return invalid()
+			}
+			for d.More() {
+				token, err := d.Token()
+				method, ok := token.(string)
+				if err != nil || !ok || len(method) > 128 || !methodName.MatchString(method) || len(p.methods) >= MaxPermissionMethods {
+					return invalid()
+				}
+				if _, duplicate := p.methods[method]; duplicate {
+					return invalid()
+				}
+				var value string
+				if d.Decode(&value) != nil {
+					return invalid()
+				}
+				rule, ok := permissionValue(value)
+				if !ok {
+					return invalid()
+				}
+				p.methods[method] = rule
+			}
+			if token, err := d.Token(); err != nil || token != json.Delim('}') {
+				return invalid()
+			}
+		default:
+			return invalid()
+		}
+	}
+	if token, err := d.Token(); err != nil || token != json.Delim('}') || len(seen) != 3 || d.Decode(new(any)) != io.EOF {
+		return invalid()
+	}
+	return p, nil
+}
+
+func bundledPolicy() (permissions, error) {
+	if expectedSDKPermissionsDigest != "" && fmt.Sprintf("%x", sha256.Sum256(sdkPermissionsJSON)) != expectedSDKPermissionsDigest {
+		return permissions{}, fmt.Errorf("SDK policy does not match package build policy")
+	}
+	if expectedPermissionsDigest != "" && fmt.Sprintf("%x", sha256.Sum256(bundledPermissions)) != expectedPermissionsDigest {
+		return permissions{}, fmt.Errorf("API permissions do not match package build policy")
+	}
+	return parsePermissions(bundledPermissions)
+}
+
+func (r Route) declaredPermission() policy {
+	if r.policy != policyUnset {
+		return r.policy
+	}
+	p, err := bundledPolicy()
+	if err != nil {
+		return policyAdmin
+	}
+	if rule, ok := sdkPolicy(r.method); ok {
+		return rule
+	}
+	return p.forMethod(r.method)
+}

package/dist/templates/native-go/backend/internal/api/permissions.json

@@ -0,0 +1,5 @@
+{
+  "schema": 1,
+  "default": "administrators",
+  "methods": {}
+}

package/dist/templates/native-go/backend/internal/api/permissions_test.go

@@ -0,0 +1,113 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+func TestDefaultPermissionsRequireAdministratorGroup(t *testing.T) {
+	for _, makeRoute := range []func(string, Handler) Route{User, Public, Admin} {
+		for _, method := range []string{"future.read", "future.unknown"} {
+			executed := 0
+			auth := &fakeAuth{user: "admin"} // Name alone confers no group membership.
+			srv, err := NewServer(auth, makeRoute("future.read", func(context.Context, Caller, json.RawMessage) (any, error) {
+				executed++
+				return nil, nil
+			}))
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, env := post(t, srv, `{"method":"`+method+`","params":{"admin":true,"groups":["administrators"]}}`)
+			if env.Error == nil || env.Error.Code != "admin_required" || executed != 0 || auth.calls != 1 {
+				t.Fatalf("method=%s error=%+v executed=%d auth=%d", method, env.Error, executed, auth.calls)
+			}
+		}
+	}
+}
+
+func TestCentralPermissionsAreTheOnlyAccessDecision(t *testing.T) {
+	called := 0
+	h := func(context.Context, Caller, json.RawMessage) (any, error) { called++; return nil, nil }
+	// A public constructor is unable to widen the default. The JSON explicitly
+	// opens only these two methods; an admin constructor cannot override it.
+	raw := []byte(`{"schema":1,"default":"administrators","methods":{"demo.user":"authenticated","demo.ping":"public"}}`)
+	auth := &fakeAuth{user: "bob"}
+	srv, err := NewServerWithPermissions(auth, raw, Admin("demo.user", h), Handle("demo.ping", h), Public("demo.private", h))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct{ method, code string }{
+		{"demo.user", ""}, {"demo.ping", ""}, {"demo.private", "admin_required"}, {"future.unknown", "admin_required"},
+	} {
+		_, env := post(t, srv, `{"method":"`+tc.method+`"}`)
+		if tc.code == "" {
+			if !env.Success {
+				t.Fatalf("%s: %+v", tc.method, env.Error)
+			}
+		} else if env.Error == nil || env.Error.Code != tc.code {
+			t.Fatalf("%s: %+v", tc.method, env.Error)
+		}
+	}
+	if called != 2 || auth.calls != 3 {
+		t.Fatalf("called=%d auth=%d", called, auth.calls)
+	}
+	auth.err = ErrNoSession
+	if _, env := post(t, srv, `{"method":"demo.user"}`); env.Error == nil || env.Error.Code != "session_required" {
+		t.Fatal(env)
+	}
+}
+
+func TestPermissionsRefuseUnknownMethods(t *testing.T) {
+	s, err := NewServerWithPermissions(&fakeAuth{}, []byte(`{"schema":1,"default":"administrators","methods":{"typo.method":"authenticated"}}`))
+	if err == nil || s != nil {
+		t.Fatal("accepted unregistered permission")
+	}
+}
+
+func TestAdministratorGroupMembershipDoesNotDependOnAccountName(t *testing.T) {
+	auth := &fakeAuth{user: "alice", admin: true}
+	s, err := NewServer(auth, Handle("demo.read", func(_ context.Context, c Caller, _ json.RawMessage) (any, error) { return c.User(), nil }))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, env := post(t, s, `{"method":"demo.read"}`); !env.Success {
+		t.Fatal(env)
+	}
+	auth.admin = false
+	if _, env := post(t, s, `{"method":"demo.read"}`); env.Error == nil || env.Error.Code != "admin_required" {
+		t.Fatal(env)
+	}
+}
+
+func TestBuildPolicyDigestMismatchFailsClosed(t *testing.T) {
+	before := expectedPermissionsDigest
+	t.Cleanup(func() { expectedPermissionsDigest = before })
+	expectedPermissionsDigest = "mismatch"
+	if srv, err := NewServer(&fakeAuth{}, Handle("demo.read", func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil })); err == nil || srv != nil {
+		t.Fatal("digest mismatch accepted")
+	}
+}
+
+func TestPermissionParserSharedContract(t *testing.T) {
+	raw, err := os.ReadFile("testdata/permissions-cases.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var cases []struct {
+		Name, JSON string
+		Valid      bool
+	}
+	if err = json.Unmarshal(raw, &cases); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range cases {
+		t.Run(tc.Name, func(t *testing.T) {
+			_, err := parsePermissions([]byte(tc.JSON))
+			if (err == nil) != tc.Valid {
+				t.Fatalf("valid=%v error=%v", tc.Valid, err)
+			}
+		})
+	}
+}

package/dist/templates/native-go/backend/internal/api/policy_fixture_test.go

@@ -0,0 +1,8 @@
+package api
+
+// API unit tests register synthetic demo/future methods rather than App routes.
+// Use an empty App policy for these isolated registries. Tests in internal/app
+// and internal/delegate still exercise the actual bundled package policy.
+func init() {
+	bundledPermissions = []byte(`{"schema":1,"default":"administrators","methods":{}}`)
+}

package/dist/templates/native-go/backend/internal/api/registry.go

@@ -1,14 +1,11 @@
 // Package api is the package's one HTTP entry point. Every request passes the
-// same transport guards and, unless its route was explicitly declared Public,
-// one DSM authentication before any handler runs. The policy is part of the
-// route itself: a Route can only be made through User, Admin or Public, so a
-// handler cannot be registered without saying who may call it.
+// same transport guards and the centralized permissions.json policy before
+// any handler runs. Unlisted methods require DSM administrators membership.
 package api
 
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -27,39 +24,64 @@ const (
 // verified and the raw `params` object; it decodes params itself.
 type Handler func(ctx context.Context, caller Caller, params json.RawMessage) (any, error)
 
-// Route binds a method name to its handler and access policy. Its fields are
-// private: build routes with User, Admin or Public.
+// Route binds a method name to its handler. Permissions come from JSON only.
 type Route struct {
-	method         string
-	policy         policy
-	handler        Handler
-	binary         BinaryReadHandler
-	requestHandler RequestHandler
+	method          string
+	policy          policy
+	handler         Handler
+	requestHandler  RequestHandler
+	responseHandler ResponseHandler
+	streamHandler   StreamHandler
 }
 
-// User declares an operation any signed-in DSM user may call.
+// Handle registers an operation without scattering permissions among handlers.
+func Handle(method string, h Handler) Route {
+	return Route{method: method, handler: h}
+}
+
+// User is a compatibility alias. Deprecated: use Handle and permissions.json.
+// This constructor does not grant access to ordinary users.
 func User(method string, h Handler) Route {
-	return Route{method: method, policy: policyUser, handler: h}
+	return Handle(method, h)
 }
 
 // RequestHandler receives the original request after the normal transport and
 // authentication guards. Credentials must remain request-scoped.
 type RequestHandler func(context.Context, Caller, *http.Request, json.RawMessage) (any, error)
 
-// UserRequest declares a session-aware operation for a signed-in DSM user.
+// HandleRequest registers an operation needing the authenticated HTTP request.
+func HandleRequest(method string, h RequestHandler) Route {
+	return Route{method: method, requestHandler: h}
+}
+
+// UserRequest is a compatibility alias. Deprecated: use HandleRequest.
 func UserRequest(method string, h RequestHandler) Route {
-	return Route{method: method, policy: policyUser, requestHandler: h}
+	return HandleRequest(method, h)
 }
 
-// Admin declares an operation only members of DSM's administrators group may call.
+// Admin is a compatibility alias. Deprecated: use Handle and permissions.json.
 func Admin(method string, h Handler) Route {
-	return Route{method: method, policy: policyAdmin, handler: h}
+	return Handle(method, h)
 }
 
-// Public declares an operation that runs WITHOUT a DSM session. Use it only for
-// data that is safe to show anyone who can reach the NAS's DSM port.
+// Public is a compatibility alias. Deprecated: use Handle and permissions.json.
+// This constructor cannot bypass the JSON policy or create an anonymous route.
 func Public(method string, h Handler) Route {
-	return Route{method: method, policy: policyPublic, handler: h}
+	return Handle(method, h)
+}
+
+// ResponseHandler can set cookies or stream a response after central authorization.
+type ResponseHandler func(context.Context, Caller, http.ResponseWriter, *http.Request, json.RawMessage) error
+
+func HandleResponse(method string, h ResponseHandler) Route {
+	return Route{method: method, responseHandler: h}
+}
+
+// StreamHandler handles a query-selected HTTP transfer without reading JSON.
+type StreamHandler func(context.Context, Caller, http.ResponseWriter, *http.Request) error
+
+func HandleStream(method string, h StreamHandler) Route {
+	return Route{method: method, streamHandler: h}
 }
 
 // Identity is what an Authenticator established about the requester.
@@ -85,16 +107,10 @@ var methodName = regexp.MustCompile(`^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$`)
 func buildRegistry(routes []Route) (map[string]Route, error) {
 	registry := make(map[string]Route, len(routes))
 	for _, r := range routes {
-		if r.policy == policyUnset {
-			return nil, errors.New("route without access policy: build it with api.User, api.Admin or api.Public")
-		}
 		if !methodName.MatchString(r.method) {
 			return nil, fmt.Errorf("route %q: method must look like \"area.action\" (lowercase)", r.method)
 		}
-		if r.binary != nil && (r.method != "nas.files.read.binary" || r.policy != policyUser || r.handler != nil || r.requestHandler != nil) {
-			return nil, errors.New("binary read must use the fixed authenticated route")
-		}
-		if r.handler == nil && r.binary == nil && r.requestHandler == nil {
+		if r.handler == nil && r.requestHandler == nil && r.responseHandler == nil && r.streamHandler == nil {
 			return nil, fmt.Errorf("route %q has no handler", r.method)
 		}
 		if _, dup := registry[r.method]; dup {
@@ -108,8 +124,8 @@ func buildRegistry(routes []Route) (map[string]Route, error) {
 // Method is the route's method name, e.g. "greeting.set".
 func (r Route) Method() string { return r.method }
 
-// Public reports whether the route was declared with Public.
-func (r Route) Public() bool { return r.policy == policyPublic }
+// Public reports the centralized permission, not the constructor's name.
+func (r Route) Public() bool { return r.declaredPermission() == policyPublic }
 
-// AdminOnly reports whether the route was declared with Admin.
-func (r Route) AdminOnly() bool { return r.policy == policyAdmin }
+// AdminOnly reports the centralized permission. Unlisted routes default here.
+func (r Route) AdminOnly() bool { return r.declaredPermission() == policyAdmin }

package/dist/templates/native-go/backend/internal/api/registry_test.go

@@ -65,7 +65,22 @@ func countingRoutes(counter *int) []Route {
 
 func newTestServer(t *testing.T, auth Authenticator, routes ...Route) *Server {
 	t.Helper()
-	srv, err := NewServer(auth, routes...)
+	// Explicit fixture policy exercises opt-in user/public behavior. Production
+	// defaults and constructor bypasses are covered independently.
+	methods := map[string]string{}
+	for _, route := range routes {
+		switch route.Method() {
+		case "demo.user", "demo.invalid", "demo.crash", "demo.panic":
+			methods[route.Method()] = "authenticated"
+		case "demo.ping":
+			methods[route.Method()] = "public"
+		}
+	}
+	raw, err := json.Marshal(map[string]any{"schema": 1, "default": "administrators", "methods": methods})
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv, err := NewServerWithPermissions(auth, raw, routes...)
 	if err != nil {
 		t.Fatal(err)
 	}

package/dist/templates/native-go/backend/internal/api/resource_limits_test.go

@@ -0,0 +1,87 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestJSONResourceLimitsBeforeAuthenticationAndDispatch(t *testing.T) {
+	for name, params := range map[string]string{
+		"wide": "[" + strings.Repeat("0,", 65536) + "0]",
+		"deep": strings.Repeat("[", 33) + "0" + strings.Repeat("]", 33),
+	} {
+		for _, access := range []string{"admin", "public"} {
+			t.Run(name+"/"+access, func(t *testing.T) {
+				executed := 0
+				auth := &fakeAuth{user: "alice", admin: true}
+				h := func(context.Context, Caller, json.RawMessage) (any, error) {
+					executed++
+					return nil, nil
+				}
+				route := Admin("demo.limit", h)
+				if access == "public" {
+					route = Public("demo.limit", h)
+				}
+				srv, err := NewServer(auth, route)
+				if access == "public" {
+					srv, err = NewServerWithPermissions(auth, []byte(`{"schema":1,"default":"administrators","methods":{"demo.limit":"public"}}`), route)
+				}
+				if err != nil {
+					t.Fatal(err)
+				}
+				_, env := post(t, srv, `{"method":"demo.limit","params":`+params+`}`)
+				if env.Error == nil || env.Error.Code != "request_too_large" || executed != 0 || auth.calls != 0 {
+					t.Fatalf("error=%+v executed=%d auth=%d", env.Error, executed, auth.calls)
+				}
+			})
+		}
+	}
+}
+
+func TestJSONResourceLimitsAllowLargeStringsAndPathSelections(t *testing.T) {
+	for name, params := range map[string]any{
+		"text":  strings.Repeat(`[]{}:,\"\\`, 10000),
+		"paths": strings.Split(strings.Repeat("/volume1/share/file,", 999)+"/volume1/share/last", ","),
+	} {
+		t.Run(name, func(t *testing.T) {
+			executed := 0
+			srv := newTestServer(t, &fakeAuth{user: "alice", admin: true}, Admin("demo.limit", func(_ context.Context, c Caller, p json.RawMessage) (any, error) {
+				executed++
+				if !c.Admin() || !json.Valid(p) {
+					t.Fatal("invalid caller or params")
+				}
+				return nil, nil
+			}))
+			body, err := json.Marshal(map[string]any{"method": "demo.limit", "params": params})
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, env := post(t, srv, string(body))
+			if !env.Success || executed != 1 {
+				t.Fatalf("error=%+v executed=%d", env.Error, executed)
+			}
+		})
+	}
+}
+
+func TestJSONParamsCannotOverrideAdminPolicy(t *testing.T) {
+	for name, auth := range map[string]*fakeAuth{
+		"anonymous":   {err: ErrNoSession},
+		"normal user": {user: "bob"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			executed := 0
+			srv := newTestServer(t, auth, countingRoutes(&executed)...)
+			_, env := post(t, srv, `{"method":"demo.admin","params":{"admin":true,"user":"root","roles":["admin"],"scope":"admin"}}`)
+			code := "admin_required"
+			if auth.err != nil {
+				code = "session_required"
+			}
+			if env.Error == nil || env.Error.Code != code || executed != 0 || auth.calls != 1 {
+				t.Fatalf("error=%+v executed=%d auth=%d", env.Error, executed, auth.calls)
+			}
+		})
+	}
+}