@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/api/sdk-permissions.json

@@ -0,0 +1,46 @@
+{
+  "files": {
+    "nas.session.status": "authenticated",
+    "nas.files.shares": "authenticated",
+    "nas.files.list": "authenticated",
+    "nas.files.info": "authenticated",
+    "nas.files.create_folder": "authenticated",
+    "nas.files.download": "authenticated",
+    "nas.files.upload": "authenticated"
+  },
+  "jobs": {
+    "bg.status": "authenticated",
+    "bg.browse": "authenticated",
+    "bg.jobs.submit": "authenticated",
+    "bg.jobs.list": "authenticated",
+    "bg.jobs.get": "authenticated",
+    "bg.jobs.cancel": "authenticated",
+    "bg.jobs.result": "authenticated",
+    "bg.schedules.list": "authenticated",
+    "bg.schedules.create": "authenticated",
+    "bg.schedules.disable": "authenticated",
+    "bg.schedules.delete": "authenticated",
+    "bg.jobs.purge": "administrators",
+    "bg.schedules.enable": "administrators"
+  },
+  "identity": {
+    "identity.status": "public",
+    "identity.login": "public",
+    "identity.session": "public",
+    "identity.logout": "public"
+  },
+  "rootOps": {
+    "executor.status": "authenticated",
+    "executor.control": "administrators",
+    "root.run": "administrators"
+  },
+  "delegate": {
+    "delegate.status": "authenticated",
+    "delegate.create": "authenticated",
+    "delegate.list": "authenticated",
+    "delegate.revoke": "authenticated",
+    "delegate.jobs.submit": "authenticated",
+    "delegate.jobs.list": "authenticated",
+    "delegate.jobs.cancel": "authenticated"
+  }
+}

package/dist/templates/native-go/backend/internal/api/sdk_policy_test.go

@@ -0,0 +1,31 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+func TestSDKPolicyCannotBeOverridden(t *testing.T) {
+	h := func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil }
+	for _, method := range []string{"nas.files.list", "bg.jobs.purge", "identity.login"} {
+		for _, permission := range []string{"public", "authenticated", "administrators"} {
+			raw := []byte(`{"schema":1,"default":"administrators","methods":{"` + method + `":"` + permission + `"}}`)
+			if _, err := NewServerWithPermissions(&fakeAuth{}, raw, Handle(method, h)); err == nil {
+				t.Fatalf("accepted override %s %s", method, permission)
+			}
+		}
+	}
+}
+func TestSDKPolicyKeepsBothUserAndAdminBoundaries(t *testing.T) {
+	h := func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil }
+	s, err := NewServer(&fakeAuth{}, Handle("nas.files.list", h), Handle("bg.jobs.purge", h), Handle("identity.login", h), Handle("app.private", h))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, want := range map[string]policy{"nas.files.list": policyUser, "bg.jobs.purge": policyAdmin, "identity.login": policyPublic, "app.private": policyAdmin} {
+		if s.routes[name].policy != want {
+			t.Fatal(name)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/api/server.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"io"
@@ -9,12 +10,33 @@ import (
 	"mime"
 	"net/http"
 	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"dsmapp/internal/jsonlimits"
 )
 
 // MaxRequestBytes bounds the request body the CGI reads (CONTENT_LENGTH is
 // caller-controlled).
 const MaxRequestBytes = 1 << 20
 
+// RequestTimeout bounds cooperative CGI work even after a browser disconnect:
+// net/http/cgi does not add a deadline. Leave headroom before a 25-second client
+// timeout (observed in the live diagnosis) for framing and delivering the reply.
+const RequestTimeout = 20 * time.Second
+
+// WithRequestDeadline wraps the complete CGI handler, including middleware
+// that runs before Server. Server also bounds direct uses of its HTTP handler;
+// context.WithTimeout preserves the earlier outer deadline in that case.
+func WithRequestDeadline(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx, cancel := context.WithTimeout(r.Context(), RequestTimeout)
+		defer cancel()
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
 // ErrNoSession means the request carries no valid DSM session.
 var ErrNoSession = errors.New("no valid DSM session")
 
@@ -32,6 +54,24 @@ type Server struct {
 // NewServer refuses an empty authenticator and any route that is not usable,
 // so a mistake fails at startup instead of opening a route.
 func NewServer(auth Authenticator, routes ...Route) (*Server, error) {
+	p, err := bundledPolicy()
+	if err != nil {
+		return nil, err
+	}
+	return newServer(auth, p, routes...)
+}
+
+// NewServerWithPermissions accepts a trusted startup policy, never request
+// parameters. Production scaffolds use NewServer and the embedded JSON file.
+func NewServerWithPermissions(auth Authenticator, raw []byte, routes ...Route) (*Server, error) {
+	p, err := parsePermissions(raw)
+	if err != nil {
+		return nil, err
+	}
+	return newServer(auth, p, routes...)
+}
+
+func newServer(auth Authenticator, p permissions, routes ...Route) (*Server, error) {
 	if auth == nil {
 		return nil, errors.New("api.NewServer needs an Authenticator")
 	}
@@ -39,6 +79,21 @@ func NewServer(auth Authenticator, routes ...Route) (*Server, error) {
 	if err != nil {
 		return nil, err
 	}
+	for method := range p.methods {
+		if _, owned := sdkPolicy(method); owned {
+			return nil, errors.New("App policy cannot override SDK route: " + method)
+		}
+		if _, known := registry[method]; !known {
+			return nil, errors.New("permission configured for unregistered API method: " + method)
+		}
+	}
+	for method, route := range registry {
+		route.policy = p.forMethod(method)
+		if rule, owned := sdkPolicy(method); owned {
+			route.policy = rule
+		}
+		registry[method] = route
+	}
 	return &Server{auth: auth, routes: registry}, nil
 }
 
@@ -48,6 +103,9 @@ type request struct {
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), RequestTimeout)
+	defer cancel()
+	r = r.WithContext(ctx)
 	// DSM's CGI gateway cuts the reply short if the CGI exits with request
 	// bytes unread, so drain whatever the handling below did not consume.
 	defer io.Copy(io.Discard, r.Body)
@@ -57,6 +115,29 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			writeError(w, internalError)
 		}
 	}()
+	if method := r.URL.Query().Get("method"); method != "" {
+		if !sameOrigin(r) {
+			writeError(w, &Error{"cross_origin", "cross-origin request refused"})
+			return
+		}
+		if e := PrepareTransferRequest(w, r); e != nil {
+			writeError(w, e)
+			return
+		}
+		caller, route, e := s.authorize(r, method)
+		if e != nil {
+			writeError(w, e)
+			return
+		}
+		if route.streamHandler == nil {
+			writeError(w, BadRequest("not an HTTP transfer method"))
+			return
+		}
+		if err := route.streamHandler(r.Context(), caller, w, r); err != nil {
+			writeError(w, asRequestError(ctx, err))
+		}
+		return
+	}
 	req, apiErr := readRequest(w, r)
 	if apiErr != nil {
 		writeError(w, apiErr)
@@ -67,8 +148,14 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		writeError(w, apiErr)
 		return
 	}
-	if route.binary != nil {
-		serveBoundedRead(w, r, caller, req.Params, route.binary)
+	if route.streamHandler != nil {
+		writeError(w, BadRequest("use HTTP transfer endpoint"))
+		return
+	}
+	if route.responseHandler != nil {
+		if err := route.responseHandler(r.Context(), caller, w, r, req.Params); err != nil {
+			writeError(w, asRequestError(ctx, err))
+		}
 		return
 	}
 	var data any
@@ -79,12 +166,37 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		data, err = route.handler(r.Context(), caller, req.Params)
 	}
 	if err != nil {
-		writeError(w, asError(err))
+		writeError(w, asRequestError(ctx, err))
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"success": true, "data": data})
 }
 
+// PrepareTransferRequest forwards a native download form's token to the same
+// authenticator as JSON requests. Raw upload bodies remain untouched.
+func PrepareTransferRequest(w http.ResponseWriter, r *http.Request) *Error {
+	media, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type"))
+	if r.Method != http.MethodPost || media != "application/x-www-form-urlencoded" {
+		return nil
+	}
+	r.Body = http.MaxBytesReader(w, r.Body, 8192)
+	if err := r.ParseForm(); err != nil {
+		return BadRequest("invalid transfer form")
+	}
+	tokens := r.PostForm["SynoToken"]
+	if len(tokens) > 1 {
+		return BadRequest("invalid transfer token")
+	}
+	if len(tokens) == 1 {
+		token := tokens[0]
+		if len(token) > 4096 || strings.ContainsAny(token, "\r\n\x00") {
+			return BadRequest("invalid transfer token")
+		}
+		r.Header.Set("X-SYNO-TOKEN", token)
+	}
+	return nil
+}
+
 // authorize is the single access decision. Public routes skip authentication;
 // everything else, including unknown methods, authenticates exactly once
 // first, so anonymous callers cannot probe which methods exist.
@@ -94,6 +206,9 @@ func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Erro
 		return Caller{}, route, nil
 	}
 	identity, err := s.auth.Authenticate(r)
+	if r.Context().Err() != nil {
+		return Caller{}, Route{}, asError(r.Context().Err())
+	}
 	if errors.Is(err, ErrNoSession) {
 		return Caller{}, Route{}, &Error{"session_required", "sign in to DSM again"}
 	}
@@ -101,13 +216,15 @@ func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Erro
 		log.Printf("authentication unavailable: %v", err)
 		return Caller{}, Route{}, &Error{"auth_unavailable", "DSM authentication is unavailable"}
 	}
+	// Unknown methods inherit the fixed administrators default before revealing
+	// whether a handler exists. Route constructors never grant permission.
+	if (!known || route.policy == policyAdmin) && !identity.Admin {
+		return Caller{}, Route{}, &Error{"admin_required", "this action needs the DSM administrators group"}
+	}
 	if !known {
 		return Caller{}, Route{}, &Error{"unknown_method", "unknown method"}
 	}
 	caller := Caller{identity: identity, authenticated: true}
-	if route.policy == policyAdmin && !caller.Admin() {
-		return Caller{}, Route{}, &Error{"admin_required", "this action needs a DSM administrator"}
-	}
 	return caller, route, nil
 }
 
@@ -123,7 +240,7 @@ func readRequest(w http.ResponseWriter, r *http.Request) (request, *Error) {
 		return req, &Error{"cross_origin", "cross-origin request refused"}
 	}
 	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, MaxRequestBytes))
-	if err != nil {
+	if err != nil || !jsonlimits.WithinLimits(body) {
 		return req, &Error{"request_too_large", "request body too large"}
 	}
 	dec := json.NewDecoder(bytes.NewReader(body))
@@ -149,12 +266,22 @@ func sameOrigin(r *http.Request) bool {
 }
 
 func writeJSON(w http.ResponseWriter, status int, body any) {
+	var payload bytes.Buffer
+	if err := json.NewEncoder(&payload).Encode(body); err != nil {
+		// DSM replaces CGI 5xx bodies with HTML; preserve the API envelope.
+		status = http.StatusOK
+		payload.Reset()
+		payload.WriteString(`{"success":false,"error":{"code":"internal","message":"Response unavailable"}}`)
+	}
 	h := w.Header()
 	h.Set("Content-Type", "application/json")
 	h.Set("Cache-Control", "no-store")
 	h.Set("X-Content-Type-Options", "nosniff")
+	// DSM's CGI bridge can terminate chunked responses without a final chunk.
+	// Exact byte lengths frame successful and refused responses consistently.
+	h.Set("Content-Length", strconv.Itoa(payload.Len()))
 	w.WriteHeader(status)
-	_ = json.NewEncoder(w).Encode(body)
+	_, _ = w.Write(payload.Bytes())
 }
 
 func writeError(w http.ResponseWriter, e *Error) {

package/dist/templates/native-go/backend/internal/api/testdata/permissions-cases.json

@@ -0,0 +1,172 @@
+[
+  {
+    "name": "default",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {}}",
+    "valid": true
+  },
+  {
+    "name": "explicit exceptions",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"greeting.get\": \"authenticated\", \"health.ping\": \"public\", \"root.output\": \"administrators\"}}",
+    "valid": true
+  },
+  {
+    "name": "schema numeric equivalent",
+    "json": "{\"schema\":1.0,\"default\":\"administrators\",\"methods\":{}}",
+    "valid": true
+  },
+  {
+    "name": "empty",
+    "json": "",
+    "valid": false
+  },
+  {
+    "name": "non JSON",
+    "json": "schema: 1",
+    "valid": false
+  },
+  {
+    "name": "missing default",
+    "json": "{\"schema\": 1, \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "missing methods",
+    "json": "{\"schema\": 1, \"default\": \"administrators\"}",
+    "valid": false
+  },
+  {
+    "name": "weak default",
+    "json": "{\"schema\": 1, \"default\": \"authenticated\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "public default",
+    "json": "{\"schema\": 1, \"default\": \"public\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "username is not group",
+    "json": "{\"schema\": 1, \"default\": \"admin\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "singular group",
+    "json": "{\"schema\": 1, \"default\": \"administrator\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "default null",
+    "json": "{\"schema\": 1, \"default\": null, \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "schema null",
+    "json": "{\"schema\": null, \"default\": \"administrators\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "schema bool",
+    "json": "{\"schema\": true, \"default\": \"administrators\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "schema string",
+    "json": "{\"schema\": \"1\", \"default\": \"administrators\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "unknown field",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {}, \"scope\": \"admin\"}",
+    "valid": false
+  },
+  {
+    "name": "case alias",
+    "json": "{\"Schema\": 1, \"default\": \"administrators\", \"methods\": {}}",
+    "valid": false
+  },
+  {
+    "name": "null methods",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": null}",
+    "valid": false
+  },
+  {
+    "name": "array methods",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": []}",
+    "valid": false
+  },
+  {
+    "name": "role null",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\": null}}",
+    "valid": false
+  },
+  {
+    "name": "role alias",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\": \"admin\"}}",
+    "valid": false
+  },
+  {
+    "name": "role array",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\": [\"administrators\"]}}",
+    "valid": false
+  },
+  {
+    "name": "method uppercase",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"App.status\": \"public\"}}",
+    "valid": false
+  },
+  {
+    "name": "method trailing newline",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\\n\": \"public\"}}",
+    "valid": false
+  },
+  {
+    "name": "method no namespace",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"status\": \"public\"}}",
+    "valid": false
+  },
+  {
+    "name": "method too long",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\": \"public\"}}",
+    "valid": false
+  },
+  {
+    "name": "duplicates",
+    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{\"app.status\":\"authenticated\",\"app.status\":\"public\"}}",
+    "valid": false
+  },
+  {
+    "name": "escaped duplicate",
+    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{\"app.status\":\"authenticated\",\"app.\\u0073tatus\":\"public\"}}",
+    "valid": false
+  },
+  {
+    "name": "duplicate default",
+    "json": "{\"schema\":1,\"default\":\"administrators\",\"default\":\"administrators\",\"methods\":{}}",
+    "valid": false
+  },
+  {
+    "name": "trailing",
+    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {}}{}",
+    "valid": false
+  },
+  {
+    "name": "trailing comma",
+    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{},}",
+    "valid": false
+  },
+  {
+    "name": "comment",
+    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{}/*x*/}",
+    "valid": false
+  },
+  {
+    "name": "truncated",
+    "json": "{\"schema\":1",
+    "valid": false
+  },
+  {
+    "name": "UTF-8 BOM refuses consistently",
+    "json": "\ufeff{\"schema\":1,\"default\":\"administrators\",\"methods\":{}}",
+    "valid": false
+  }
+]

package/dist/templates/native-go/backend/internal/app/background.go

@@ -42,32 +42,30 @@ type backgroundAPI struct {
 }
 
 // BackgroundRoutes is the production assembly of the opt-in background jobs
-// API. `synopkgland init --background` wires it in through background.go's
+// API. `synopkgland init --with jobs` wires it in through background.go's
 // replacement of background_none.go; nothing else references it.
 func BackgroundRoutes(dataDir string) []api.Route {
-	return newBackgroundRoutes(background.NewStore(filepath.Join(dataDir, "background")), filestation.Local(dataDir))
+	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), filestation.Local(dataDir))
 }
 
-// Every request authenticates against DSM afresh. Owner routes are opt-in for
-// ordinary users; configuration and owner cleanup remain administrator-only.
+// Every request authenticates against DSM afresh. Owner routes are available
+// to signed-in users; schedule reapproval and owner cleanup are admin-only.
 func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.Route {
 	b := backgroundAPI{store: store, files: files}
 	return []api.Route{
-		api.UserRequest("bg.status", b.owner(b.status)),
-		api.UserRequest("bg.schedules.list", b.owner(b.schedules)),
-		api.UserRequest("bg.schedules.create", b.owner(b.createSchedule)),
-		api.UserRequest("bg.schedules.disable", b.owner(b.disableSchedule)),
-		api.UserRequest("bg.schedules.delete", b.owner(b.deleteSchedule)),
-		api.UserRequest("bg.schedules.enable", b.admin(b.enableSchedule)),
-		api.UserRequest("bg.mode.set", b.admin(b.setMode)),
-		api.UserRequest("bg.users.set", b.admin(b.setUsers)),
-		api.UserRequest("bg.jobs.purge", b.admin(b.purge)),
-		api.UserRequest("bg.browse", b.owner(b.browse)),
-		api.UserRequest("bg.jobs.submit", b.owner(b.submit)),
-		api.UserRequest("bg.jobs.list", b.owner(b.list)),
-		api.UserRequest("bg.jobs.get", b.owner(b.get)),
-		api.UserRequest("bg.jobs.cancel", b.owner(b.cancel)),
-		api.UserRequest("bg.jobs.result", b.owner(b.result)),
+		api.HandleRequest("bg.status", b.owner(b.status)),
+		api.HandleRequest("bg.schedules.list", b.owner(b.schedules)),
+		api.HandleRequest("bg.schedules.create", b.owner(b.createSchedule)),
+		api.HandleRequest("bg.schedules.disable", b.owner(b.disableSchedule)),
+		api.HandleRequest("bg.schedules.delete", b.owner(b.deleteSchedule)),
+		api.HandleRequest("bg.schedules.enable", b.admin(b.enableSchedule)),
+		api.HandleRequest("bg.jobs.purge", b.admin(b.purge)),
+		api.HandleRequest("bg.browse", b.owner(b.browse)),
+		api.HandleRequest("bg.jobs.submit", b.owner(b.submit)),
+		api.HandleRequest("bg.jobs.list", b.owner(b.list)),
+		api.HandleRequest("bg.jobs.get", b.owner(b.get)),
+		api.HandleRequest("bg.jobs.cancel", b.owner(b.cancel)),
+		api.HandleRequest("bg.jobs.result", b.owner(b.result)),
 	}
 }
 
@@ -104,7 +102,7 @@ func (b backgroundAPI) status(ctx context.Context, _ api.Caller, _ *http.Request
 			"revision": st.Worker.Revision, "at": st.Worker.At, "alive": workerAlive(*st.Worker, time.Now())}
 	}
 	return map[string]any{
-		"owner": accessFrom(ctx).Owner, "supported": true, "enabled": st.Enabled, "admin": accessFrom(ctx).Admin, "allowOrdinaryUsers": st.AllowOrdinaryUsers, "algorithm": st.Algorithm, "revision": st.Revision,
+		"owner": accessFrom(ctx).Owner, "supported": true, "admin": accessFrom(ctx).Admin, "algorithm": st.Algorithm, "revision": st.Revision,
 		"queued": st.Queued, "running": st.Running, "worker": worker,
 		"limits": map[string]any{"maxInputBytes": background.MaxInputBytes, "maxQueued": background.MaxQueued,
 			"maxSchedules": background.MaxSchedules, "intervalSeconds": []int{3600, 86400, 604800}, "maxTotalBytes": background.MaxTotalBytes, "maxOwnerPending": background.MaxOwnerPending, "maxOwnerBytes": background.MaxOwnerBytes, "jobTimeoutSeconds": int(background.JobTimeout / time.Second)},
@@ -115,19 +113,6 @@ func workerAlive(w background.WorkerInfo, now time.Time) bool {
 	return now.Sub(w.At) <= workerFresh
 }
 
-func (b backgroundAPI) setMode(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
-	var in struct {
-		Enabled *bool `json:"enabled"`
-	}
-	if err := decodeParams(params, &in); err != nil || in.Enabled == nil {
-		return nil, api.BadRequest("enabled must be true or false")
-	}
-	if err := b.store.SetEnabled(ctx, *in.Enabled); err != nil {
-		return nil, backgroundError(err)
-	}
-	return map[string]bool{"enabled": *in.Enabled}, nil
-}
-
 // browse lists what the caller's own File Station session can see, so
 // the panel can pick a file instead of typing a path. It grants nothing:
 // submit still reads through the same session.
@@ -157,12 +142,6 @@ func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request
 	if in.Key == "" || in.Folder == "" || in.Relative == "" {
 		return nil, api.BadRequest("key, folder and relative are required")
 	}
-	// Refuse before touching the NAS when the mode is off.
-	if st, err := b.store.Status(ctx); err != nil {
-		return nil, backgroundError(err)
-	} else if !st.Enabled {
-		return nil, backgroundError(background.ErrDisabled)
-	}
 	access := accessFrom(ctx)
 	if !access.Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
@@ -172,7 +151,7 @@ func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request
 		return nil, err
 	}
 	job, duplicate, err := b.store.Submit(ctx, background.SubmitRequest{
-		Key: in.Key, Name: path.Base(in.Relative), Data: data, Submitter: access.Owner, Admin: access.Admin,
+		Key: in.Key, Name: path.Base(in.Relative), Data: data, Submitter: access.Owner,
 	})
 	if err != nil {
 		return nil, backgroundError(err)
@@ -240,18 +219,18 @@ func (b backgroundAPI) result(ctx context.Context, _ api.Caller, _ *http.Request
 
 func backgroundError(err error) error {
 	switch {
+	case errors.Is(err, background.ErrBusy):
+		return &api.Error{Code: "jobs_busy", Message: "background jobs are busy; retry later"}
+	case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+		return err
 	case errors.Is(err, background.ErrScheduleFull):
 		return &api.Error{Code: "schedule-full", Message: "the schedule limit has been reached"}
 	case errors.Is(err, background.ErrInputUnavailable):
 		return &api.Error{Code: "input-unavailable", Message: "import the private copy again"}
-	case errors.Is(err, background.ErrOrdinaryDisabled):
-		return &api.Error{Code: "unsupported", Message: "ordinary background users are disabled"}
 	case errors.Is(err, background.ErrOwnerQueueFull):
 		return &api.Error{Code: "owner-queue-full", Message: "your pending job limit has been reached"}
 	case errors.Is(err, background.ErrOwnerQuota):
 		return &api.Error{Code: "owner-quota-exceeded", Message: "your background storage limit has been reached"}
-	case errors.Is(err, background.ErrDisabled):
-		return &api.Error{Code: "disabled", Message: "background mode is off"}
 	case errors.Is(err, background.ErrInvalid):
 		return api.BadRequest("invalid background request")
 	case errors.Is(err, background.ErrTooLarge):

package/dist/templates/native-go/backend/internal/app/background_owner.go

@@ -16,15 +16,6 @@ func accessFrom(ctx context.Context) background.Access {
 func (b backgroundAPI) owner(h backgroundHandler) api.RequestHandler {
 	return func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
 		access := background.Access{Admin: c.Admin()}
-		if !c.Admin() {
-			st, err := b.store.Status(ctx)
-			if err != nil {
-				return nil, backgroundError(err)
-			}
-			if !st.AllowOrdinaryUsers {
-				return nil, &api.Error{Code: "unsupported", Message: "ordinary background users are disabled"}
-			}
-		}
 		access.Owner = background.Submitter{User: c.User(), UID: lookupSubmitterUID(c.User())}
 		if !access.Admin && !access.Owner.Valid() {
 			return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
@@ -32,18 +23,6 @@ func (b backgroundAPI) owner(h backgroundHandler) api.RequestHandler {
 		return h(context.WithValue(ctx, backgroundAccessKey{}, access), c, r, params)
 	}
 }
-func (b backgroundAPI) setUsers(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
-	var in struct {
-		Allow *bool `json:"allowOrdinaryUsers"`
-	}
-	if err := decodeParams(params, &in); err != nil || in.Allow == nil {
-		return nil, api.BadRequest("allowOrdinaryUsers must be true or false")
-	}
-	if err := b.store.SetOrdinaryUsers(ctx, *in.Allow); err != nil {
-		return nil, backgroundError(err)
-	}
-	return map[string]bool{"allowOrdinaryUsers": *in.Allow}, nil
-}
 func (b backgroundAPI) purge(ctx context.Context, c api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
 	var in struct {
 		Owner *background.Submitter `json:"owner"`