@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/app/background_owner_test.go

@@ -21,10 +21,6 @@ func ordinaryEnv(t *testing.T) *bgEnv {
 		}
 		return ""
 	}
-	e.enable()
-	if code, out := e.call(alice, "bg.users.set", `{"allowOrdinaryUsers":true}`); code != "" {
-		t.Fatalf("enable ordinary users: %s %v", code, out)
-	}
 	return e
 }
 
@@ -98,10 +94,10 @@ func TestBackgroundOwnerResultAndUIDChangeFailClosed(t *testing.T) {
 		t.Fatal(code)
 	}
 }
-func TestBackgroundOrdinaryGateAndPersonalQuota(t *testing.T) {
+func TestBackgroundPersonalQuotaAndAdminPurge(t *testing.T) {
 	e := ordinaryEnv(t)
-	for _, method := range []string{"bg.mode.set", "bg.users.set", "bg.jobs.purge"} {
-		if code, _ := e.call(bob, method, `{}`); code != "unsupported" {
+	for _, method := range []string{"bg.jobs.purge"} {
+		if code, _ := e.call(bob, method, `{}`); code != "admin_required" {
 			t.Fatalf("%s: %s", method, code)
 		}
 	}
@@ -111,21 +107,7 @@ func TestBackgroundOrdinaryGateAndPersonalQuota(t *testing.T) {
 		t.Fatal(code)
 	}
 	ownerSubmit(t, e, carol, "one")
-	if code, _ := e.call(alice, "bg.users.set", `{"allowOrdinaryUsers":false}`); code != "" {
-		t.Fatal(code)
-	}
-	before := e.files.calls
-	for _, method := range []string{"bg.status", "bg.browse", "bg.jobs.submit", "bg.jobs.list", "bg.jobs.result"} {
-		if code, _ := e.call(bob, method, bgSample[method]); code != "unsupported" {
-			t.Fatalf("closed gate %s: %s", method, code)
-		}
-	}
-	if e.files.calls != before {
-		t.Fatal("closed gate touched NAS")
-	}
-	if code, _ := e.call(alice, "bg.users.set", `{"allowOrdinaryUsers":true,"owner":"bob"}`); code != "bad_request" {
-		t.Fatal(code)
-	}
+
 }
 func TestBackgroundPurgeRequiresAdminAndExactOwner(t *testing.T) {
 	e := ordinaryEnv(t)
@@ -143,3 +125,39 @@ func TestBackgroundPurgeRequiresAdminAndExactOwner(t *testing.T) {
 		t.Fatal("purge touched another owner")
 	}
 }
+
+func TestFreshOrdinaryUserJobsNeedNoAdminSetup(t *testing.T) {
+	e := newBgEnv(t)
+	lookupSubmitterUID = func(name string) string {
+		if name == "bob" {
+			return "1025"
+		}
+		return "1026"
+	}
+	code, out := e.call(bob, "bg.status", `{}`)
+	if code != "" {
+		t.Fatalf("fresh status: %s %v", code, out)
+	}
+	for _, key := range []string{"enabled", "allowOrdinaryUsers"} {
+		if _, exists := data(out)[key]; exists {
+			t.Fatalf("obsolete status switch %s", key)
+		}
+	}
+	id := ownerSubmit(t, e, bob, "fresh")
+	for _, method := range []string{"bg.jobs.get", "bg.jobs.cancel"} {
+		if code, _ := e.call(carol, method, `{"id":"`+id+`"}`); code != "not_found" {
+			t.Fatalf("other owner %s: %s", method, code)
+		}
+	}
+	if code, _ := e.call(bob, "bg.jobs.get", `{"id":"`+id+`"}`); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(bob, "bg.jobs.cancel", `{"id":"`+id+`"}`); code != "" {
+		t.Fatal(code)
+	}
+	for _, method := range []string{"bg.mode.set", "bg.users.set"} {
+		if code, _ := e.call(alice, method, `{}`); code != "unknown_method" {
+			t.Fatalf("obsolete route %s: %s", method, code)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/app/background_schedule.go

@@ -23,11 +23,6 @@ func (b backgroundAPI) createSchedule(ctx context.Context, _ api.Caller, _ *http
 	if err := decodeParams(p, &in); err != nil {
 		return nil, err
 	}
-	if st, err := b.store.Status(ctx); err != nil {
-		return nil, backgroundError(err)
-	} else if !st.Enabled {
-		return nil, backgroundError(background.ErrDisabled)
-	}
 	if !accessFrom(ctx).Owner.Valid() {
 		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
 	}

package/dist/templates/native-go/backend/internal/app/background_schedule_test.go

@@ -40,7 +40,7 @@ func TestBackgroundScheduleRoutesConsentOwnerAndAdmin(t *testing.T) {
 			t.Fatal(code)
 		}
 	}
-	if code, _ := e.call(bob, "bg.schedules.enable", fmt.Sprintf(`{"id":%q,"consent":true}`, sid)); code != "unsupported" {
+	if code, _ := e.call(bob, "bg.schedules.enable", fmt.Sprintf(`{"id":%q,"consent":true}`, sid)); code != "admin_required" {
 		t.Fatal(code)
 	}
 	if code, _ := e.call(alice, "bg.schedules.disable", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {

package/dist/templates/native-go/backend/internal/app/background_test.go

@@ -55,7 +55,9 @@ func newBgEnv(t *testing.T) *bgEnv {
 
 func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map[string]any) {
 	e.t.Helper()
-	srv, err := api.NewServer(auth, newBackgroundRoutes(e.store, e.files)...)
+	// SDK policy provides owner routes immediately.
+	routes := newBackgroundRoutes(e.store, e.files)
+	srv, err := api.NewServerWithPermissions(auth, []byte(`{"schema":1,"default":"administrators","methods":{}}`), routes...)
 	if err != nil {
 		e.t.Fatal(err)
 	}
@@ -74,13 +76,6 @@ func (e *bgEnv) call(auth api.Authenticator, method, params string) (string, map
 	return code, out
 }
 
-func (e *bgEnv) enable() {
-	e.t.Helper()
-	if code, out := e.call(alice, "bg.mode.set", `{"enabled":true}`); code != "" {
-		e.t.Fatalf("%s %v", code, out)
-	}
-}
-
 func data(out map[string]any) map[string]any { return out["data"].(map[string]any) }
 
 var bgSample = map[string]string{
@@ -90,9 +85,7 @@ var bgSample = map[string]string{
 	"bg.schedules.delete":  `{"id":"missing"}`,
 	"bg.schedules.enable":  `{"id":"missing","consent":true}`,
 	"bg.status":            `{}`,
-	"bg.users.set":         `{"allowOrdinaryUsers":true}`,
 	"bg.jobs.purge":        `{"owner":{"user":"bob","uid":"1025"}}`,
-	"bg.mode.set":          `{"enabled":true}`,
 	"bg.browse":            `{"folder":"/share","offset":0}`,
 	"bg.jobs.submit":       `{"key":"k1","folder":"/share","relative":"a.txt"}`,
 	"bg.jobs.list":         `{}`,
@@ -101,7 +94,7 @@ var bgSample = map[string]string{
 	"bg.jobs.result":       `{"id":"` + strings.Repeat("a", 32) + `"}`,
 }
 
-func TestBackgroundRoutesAreAdminOnlyByUnsupportedForOrdinaryUsers(t *testing.T) {
+func TestBackgroundSDKPoliciesAuthenticateEveryRoute(t *testing.T) {
 	e := newBgEnv(t)
 	routes := newBackgroundRoutes(e.store, e.files)
 	if len(routes) != len(bgSample) {
@@ -115,23 +108,25 @@ func TestBackgroundRoutesAreAdminOnlyByUnsupportedForOrdinaryUsers(t *testing.T)
 		if !ok {
 			t.Fatalf("no sample for %s", r.Method())
 		}
-		if code, _ := e.call(bob, r.Method(), params); code != "unsupported" {
-			t.Errorf("%s as an ordinary user: %q", r.Method(), code)
+		code, _ := e.call(bob, r.Method(), params)
+		if r.Method() == "bg.jobs.purge" || r.Method() == "bg.schedules.enable" {
+			if code != "admin_required" {
+				t.Errorf("%s as ordinary user: %q", r.Method(), code)
+			}
+		} else if code == "admin_required" || code == "unsupported" || code == "disabled" {
+			t.Errorf("%s unexpectedly blocked: %q", r.Method(), code)
 		}
 		if code, _ := e.call(nobody, r.Method(), params); code != "session_required" {
 			t.Errorf("%s without a session: %q", r.Method(), code)
 		}
 	}
-	if e.files.calls != 0 {
-		t.Fatal("an ordinary user must not trigger a NAS read")
-	}
 }
 
-func TestBackgroundStatusReportsModeLimitsAndWorker(t *testing.T) {
+func TestBackgroundStatusReportsLimitsAndWorker(t *testing.T) {
 	e := newBgEnv(t)
 	code, out := e.call(alice, "bg.status", `{}`)
 	d := data(out)
-	if code != "" || d["enabled"] != false || d["algorithm"] != "sha256-v1" || d["worker"] != nil {
+	if code != "" || d["algorithm"] != "sha256-v1" || d["worker"] != nil {
 		t.Fatalf("%s %v", code, out)
 	}
 	limits := d["limits"].(map[string]any)
@@ -148,17 +143,16 @@ func TestBackgroundStatusReportsModeLimitsAndWorker(t *testing.T) {
 	}
 }
 
-func TestBackgroundSubmitRefusedWhileOffAndDoesNotReadNAS(t *testing.T) {
+func TestBackgroundSubmitAvailableOnFreshStore(t *testing.T) {
 	e := newBgEnv(t)
 	code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"])
-	if code != "disabled" || e.files.calls != 0 {
+	if code != "" || e.files.calls != 1 {
 		t.Fatalf("%q, NAS reads %d", code, e.files.calls)
 	}
 }
 
 func TestBackgroundSubmitImportsSelectedFileAndIsIdempotent(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	params := `{"key":"k1","folder":"/share","relative":"docs/a.txt"}`
 	code, out := e.call(alice, "bg.jobs.submit", params)
 	job := data(out)["job"].(map[string]any)
@@ -184,7 +178,6 @@ func TestBackgroundSubmitImportsSelectedFileAndIsIdempotent(t *testing.T) {
 
 func TestBackgroundSubmitPassesAdapterRefusalsThrough(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	e.files.err = &api.Error{Code: "limit-exceeded", Message: "x"}
 	if code, _ := e.call(alice, "bg.jobs.submit", bgSample["bg.jobs.submit"]); code != "limit-exceeded" {
 		t.Fatalf("%q", code)
@@ -196,7 +189,6 @@ func TestBackgroundSubmitPassesAdapterRefusalsThrough(t *testing.T) {
 
 func TestBackgroundSubmitValidatesParams(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	for _, p := range []string{
 		`{}`, `{"key":"k","folder":"/share","relative":"a","extra":1}`, `{"key":"bad key","folder":"/share","relative":"a"}`,
 		`{"key":"k","folder":"/share","relative":""}`,
@@ -209,7 +201,6 @@ func TestBackgroundSubmitValidatesParams(t *testing.T) {
 
 func TestBackgroundQueueFullAndQuotaErrorsHaveStableCodes(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	for i := 0; i < background.MaxQueued; i++ {
 		lookupSubmitterUID = func(string) string { return fmt.Sprint(1024 + i/2) }
 		key := "k" + string(rune('a'+i))
@@ -225,7 +216,6 @@ func TestBackgroundQueueFullAndQuotaErrorsHaveStableCodes(t *testing.T) {
 
 func TestBackgroundListGetCancelAndResult(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
 	id := data(out)["job"].(map[string]any)["id"].(string)
 	idp := `{"id":"` + id + `"}`
@@ -264,7 +254,6 @@ func TestBackgroundListGetCancelAndResult(t *testing.T) {
 
 func TestBackgroundCancelQueuedJob(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
 	id := data(out)["job"].(map[string]any)["id"].(string)
 	code, out := e.call(alice, "bg.jobs.cancel", `{"id":"`+id+`"}`)
@@ -273,20 +262,6 @@ func TestBackgroundCancelQueuedJob(t *testing.T) {
 	}
 }
 
-func TestBackgroundModeOffCancelsQueuedWork(t *testing.T) {
-	e := newBgEnv(t)
-	e.enable()
-	_, out := e.call(alice, "bg.jobs.submit", `{"key":"k1","folder":"/share","relative":"a.txt"}`)
-	id := data(out)["job"].(map[string]any)["id"].(string)
-	if code, _ := e.call(alice, "bg.mode.set", `{"enabled":false}`); code != "" {
-		t.Fatal(code)
-	}
-	_, out = e.call(alice, "bg.jobs.get", `{"id":"`+id+`"}`)
-	if job := data(out)["job"].(map[string]any); job["state"] != "canceled" || job["errorCode"] != "disabled" {
-		t.Fatalf("%v", job)
-	}
-}
-
 func TestBackgroundWorkerAliveExpires(t *testing.T) {
 	if workerAlive(background.WorkerInfo{At: time.Now().Add(-time.Minute)}, time.Now()) || !workerAlive(background.WorkerInfo{At: time.Now()}, time.Now()) {
 		t.Fatal("a stale heartbeat is not alive")
@@ -337,7 +312,6 @@ func TestBackgroundBrowseValidatesParamsAndPassesRefusalsThrough(t *testing.T) {
 
 func TestBackgroundListWithoutJobsIsAnEmptyArray(t *testing.T) {
 	e := newBgEnv(t)
-	e.enable()
 	_, out := e.call(alice, "bg.jobs.list", `{}`)
 	jobs, ok := data(out)["jobs"].([]any)
 	if !ok || len(jobs) != 0 {

package/dist/templates/native-go/backend/internal/app/delegate_none.go

@@ -0,0 +1,5 @@
+package app
+
+import "dsmapp/internal/api"
+
+func (Config) delegateRoutes() []api.Route { return nil }

package/dist/templates/native-go/backend/internal/app/identity.go

@@ -0,0 +1,20 @@
+package app
+
+import (
+	"errors"
+	"path"
+	"strings"
+
+	"dsmapp/internal/identity"
+)
+
+// StandaloneIdentity registers identity.status/session/login/logout through
+// Service.Wrap. Business routes keep their permissions.json policies. Call only
+// for capabilities.identity=standalone; the path comes from the CGI environment.
+func StandaloneIdentity(cfg Config, scriptName string) (*identity.Service, error) {
+	if !strings.HasPrefix(scriptName, "/") || strings.HasPrefix(scriptName, "//") || path.Clean(scriptName) != scriptName || !strings.HasSuffix(scriptName, "/cgi/api.cgi") {
+		return nil, errors.New("identity requires an absolute CGI script path")
+	}
+	cookiePath := strings.TrimSuffix(path.Dir(path.Dir(scriptName)), "/") + "/"
+	return identity.New(identity.Config{DataDir: cfg.DataDir, CookiePath: cookiePath})
+}

package/dist/templates/native-go/backend/internal/app/identity_test.go

@@ -0,0 +1,15 @@
+package app
+
+import "testing"
+
+func TestIdentityApplicationPath(t *testing.T) {
+	for _, tc := range []struct {
+		script string
+		valid  bool
+	}{{"/webman/3rdparty/test/cgi/api.cgi", true}, {"/cgi/api.cgi", true}, {"", false}, {"cgi/api.cgi", false}, {"//evil/cgi/api.cgi", false}} {
+		_, err := StandaloneIdentity(Config{DataDir: t.TempDir()}, tc.script)
+		if (err == nil) != tc.valid {
+			t.Errorf("script %q: %v", tc.script, err)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/app/routes.go

@@ -1,8 +1,7 @@
-//go:build !synopkgland_sdk_workers
-
 // Package app holds this package's business operations. Add a route here and
-// pick its policy: api.User (any signed-in DSM user), api.Admin (DSM
-// administrators only) or, rarely, api.Public (no sign-in at all).
+// register its handler here. App permissions live in internal/api/permissions.json; SDK capability routes
+// use the immutable SDK policy.
+// unlisted methods require membership in DSM's administrators group.
 //
 //line dsmapp/internal/app/routes.go:1
 package app
@@ -13,7 +12,6 @@ import (
 	"encoding/json"
 	"errors"
 	"io/fs"
-	"net/http"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -22,23 +20,17 @@ import (
 
 	"dsmapp/internal/api"
 	"dsmapp/internal/filestation"
-	"dsmapp/internal/helper"
 )
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
-	RootAuthorization string
+	DelegateScope                string
+	ExecutorDigest, PolicyDigest string
 
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
-	SessionFiles    *filestation.Service
-	PackageID       string
-	Version         string
-	HelperInventory helper.Inventory
-	// PackageIntegration marks an integration built without a privileged
-	// helper: its features run as the package account and are ready by themselves.
-	PackageIntegration bool
-	// Staged trusted adapter. Nil refuses; no production data transport is installed.
-	NASBinaryRead api.BinaryReadHandler
+	SessionFiles *filestation.Service
+	PackageID    string
+	Version      string
 	// DataDir is the package's persistent, package-owned directory
 	// (/var/packages/<package>/var). It survives upgrades.
 	DataDir string
@@ -47,26 +39,17 @@ type Config struct {
 }
 
 func Routes(cfg Config) []api.Route {
-	routes := cfg.authorizationRoutes()
+	routes := cfg.delegateRoutes()
 	routes = append(routes, []api.Route{
-		api.User("integration.status", cfg.integrationStatus),
-		api.BoundedRead(cfg.binaryRead),
-		api.User("app.status", cfg.status),
-		api.User("greeting.get", cfg.getGreeting),
-		api.Admin("greeting.set", cfg.setGreeting),
+		api.Handle("app.status", cfg.status),
+		api.Handle("greeting.get", cfg.getGreeting),
+		api.Handle("greeting.set", cfg.setGreeting),
 	}...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)
 	return append(routes, cfg.rootRoutes()...)
 }
 
-func (cfg Config) integrationStatus(ctx context.Context, _ api.Caller, params json.RawMessage) (any, error) {
-	if err := decodeParams(params, &struct{}{}); err != nil {
-		return nil, err
-	}
-	return cfg.integrationState(ctx), nil
-}
-
 func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage) (any, error) {
 	return cfg.withSharedFolders(map[string]any{
 		"package":    cfg.PackageID,
@@ -146,10 +129,3 @@ func writeFileAtomic(path string, data []byte) error {
 	}
 	return os.Rename(tmp.Name(), path)
 }
-
-func (cfg Config) binaryRead(ctx context.Context, c api.Caller, r *http.Request, p json.RawMessage) (api.BinaryRead, error) {
-	if cfg.NASBinaryRead == nil {
-		return api.BinaryRead{}, &api.Error{Code: "unsupported", Message: "NAS binary read is unavailable"}
-	}
-	return cfg.NASBinaryRead(ctx, c, r, p)
-}

package/dist/templates/native-go/backend/internal/app/routes_test.go

@@ -23,9 +23,15 @@ func testConfig(t *testing.T) Config {
 }
 
 // call returns the envelope's error code ("" on success) and the envelope.
-func call(t *testing.T, cfg Config, auth api.Authenticator, method, params string) (string, map[string]any) {
+func call(t *testing.T, cfg Config, auth api.Authenticator, method, params string, permissionJSON ...[]byte) (string, map[string]any) {
 	t.Helper()
+	previous := lookupSubmitterUID
+	lookupSubmitterUID = func(string) string { return "1024" }
+	defer func() { lookupSubmitterUID = previous }()
 	srv, err := api.NewServer(auth, Routes(cfg)...)
+	if len(permissionJSON) != 0 {
+		srv, err = api.NewServerWithPermissions(auth, permissionJSON[0], Routes(cfg)...)
+	}
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -57,39 +63,9 @@ var (
 // sampleParams holds valid params for every route, so the denial test below
 // proves the refusal came from the policy and not from bad input.
 var sampleParams = map[string]string{
-	"integration.status":    `{}`,
-	"nas.files.read.binary": `{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `"}`,
-	"app.status":            `{}`,
-	"greeting.get":          `{}`,
-	"greeting.set":          `{"text":"Hi"}`,
-}
-
-// sampleOutcome is the error code an administrator gets from a route's sample
-// params; routes that are not listed (and not jobs.*) succeed.
-var sampleOutcome = map[string]string{"nas.files.read.binary": "unsupported"}
-
-func TestIntegrationStatusIsReadableByOrdinaryUsers(t *testing.T) {
-	code, out := call(t, testConfig(t), bob, "integration.status", `{}`)
-	if code != "" || out["data"].(map[string]any)["state"] != "not-enabled" {
-		t.Fatalf("%s: %v", code, out)
-	}
-	code, _ = call(t, testConfig(t), bob, "integration.status", `{"state":"ready"}`)
-	if code != "bad_request" {
-		t.Fatal("browser cannot supply readiness")
-	}
-}
-
-func TestPackageOnlyIntegrationIsReadyWithoutAHelper(t *testing.T) {
-	cfg := testConfig(t)
-	cfg.PackageIntegration = true
-	code, out := call(t, cfg, bob, "integration.status", `{}`)
-	data, _ := out["data"].(map[string]any)
-	if code != "" || data["state"] != "ready" || data["reason"] != "package-only" || data["scheduler"] != "not-required" || data["packageRunning"] != "running" {
-		t.Fatalf("%s: %v", code, out)
-	}
-	if _, cleanup := data["cleanup"]; cleanup {
-		t.Fatal("no helper means no cleanup state")
-	}
+	"app.status":   `{}`,
+	"greeting.get": `{}`,
+	"greeting.set": `{"text":"Hi"}`,
 }
 
 func TestEveryRouteHasSampleParamsAndNoneIsPublic(t *testing.T) {
@@ -118,7 +94,7 @@ func TestEveryRouteRefusesCallersWithoutASessionAndChangesNothing(t *testing.T)
 	}
 }
 
-func TestEveryAdminRouteRefusesOrdinaryUsersAndChangesNothing(t *testing.T) {
+func TestAdministratorRoutesRefuseOrdinaryUsersAndChangeNothing(t *testing.T) {
 	for _, r := range Routes(testConfig(t)) {
 		if !r.AdminOnly() {
 			continue
@@ -135,7 +111,7 @@ func TestEveryAdminRouteRefusesOrdinaryUsersAndChangesNothing(t *testing.T) {
 func TestEveryRouteSucceedsForAnAdmin(t *testing.T) {
 	for _, r := range Routes(testConfig(t)) {
 		code, out := call(t, testConfig(t), alice, r.Method(), sampleParams[r.Method()])
-		want := sampleOutcome[r.Method()]
+		want := ""
 		if strings.HasPrefix(r.Method(), "jobs.") {
 			want = "unavailable"
 		}
@@ -146,23 +122,23 @@ func TestEveryRouteSucceedsForAnAdmin(t *testing.T) {
 }
 
 func TestStatusReportsPackageAndCaller(t *testing.T) {
-	code, out := call(t, testConfig(t), bob, "app.status", `{}`)
+	code, out := call(t, testConfig(t), alice, "app.status", `{}`)
 	data := out["data"].(map[string]any)
-	if code != "" || data["package"] != "HelloGo" || data["version"] != "0.1.0-0001" || data["user"] != "bob" || data["admin"] != false {
+	if code != "" || data["package"] != "HelloGo" || data["version"] != "0.1.0-0001" || data["user"] != "alice" || data["admin"] != true {
 		t.Fatalf("got %q %v", code, out)
 	}
 }
 
 func TestGreetingDefaultsAndAdminCanChangeIt(t *testing.T) {
 	cfg := testConfig(t)
-	_, out := call(t, cfg, bob, "greeting.get", `{}`)
+	_, out := call(t, cfg, alice, "greeting.get", `{}`)
 	if got := out["data"].(map[string]any)["text"]; got != "Hello" {
 		t.Fatalf("default greeting = %v", got)
 	}
 	if code, out := call(t, cfg, alice, "greeting.set", `{"text":"Hi from DSM"}`); code != "" {
 		t.Fatalf("set: %q %v", code, out)
 	}
-	_, out = call(t, cfg, bob, "greeting.get", `{}`)
+	_, out = call(t, cfg, alice, "greeting.get", `{}`)
 	data := out["data"].(map[string]any)
 	if data["text"] != "Hi from DSM" || data["updated_by"] != "alice" {
 		t.Fatalf("after set: %v", data)

package/dist/templates/native-go/backend/internal/app/session_files.go

@@ -1,15 +1,9 @@
 package app
 
-import "dsmapp/internal/helper"
-
-// FileStationSession is the build-time value that selects the package-account
-// interactive File Station adapter without a helper.
+// FileStationSession selects the interactive File Station adapter using the caller’s DSM session.
 const FileStationSession = "session"
 
-// SessionFilesEnabled reports whether the build installs the interactive File
-// Station adapter: for a protocol 2 helper inventory, or when the project opted
-// in with fileStation: session. Both inputs are fixed at build time, never from
-// a request; any other fileStation value refuses.
-func SessionFilesEnabled(inventory helper.Inventory, fileStation string) bool {
-	return inventory.Protocol == 2 || fileStation == FileStationSession
+// SessionFilesEnabled accepts only the fixed build-time session setting.
+func SessionFilesEnabled(fileStation string) bool {
+	return fileStation == FileStationSession
 }

package/dist/templates/native-go/backend/internal/app/session_files_test.go

@@ -1,26 +1,14 @@
 package app
 
-import (
-	"testing"
+import "testing"
 
-	"dsmapp/internal/helper"
-)
-
-func TestSessionFilesEnabledByEitherTrustedBuildSetting(t *testing.T) {
-	for name, tc := range map[string]struct {
-		inventory   helper.Inventory
-		fileStation string
-		want        bool
-	}{
-		"nothing selected":             {helper.Inventory{}, "", false},
-		"helper protocol 1":            {helper.Inventory{Protocol: 1}, "", false},
-		"helper protocol 2":            {helper.Inventory{Protocol: 2}, "", true},
-		"package-only file station":    {helper.Inventory{}, "session", true},
-		"unknown build value refuses":  {helper.Inventory{}, "yes", false},
-		"protocol 1 plus file station": {helper.Inventory{Protocol: 1}, "session", true},
-	} {
-		if got := SessionFilesEnabled(tc.inventory, tc.fileStation); got != tc.want {
-			t.Errorf("%s: got %v, want %v", name, got, tc.want)
+func TestSessionFilesEnabledByTrustedBuildSetting(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  bool
+	}{{"", false}, {"session", true}, {"yes", false}} {
+		if got := SessionFilesEnabled(tc.value); got != tc.want {
+			t.Errorf("%q: got %v, want %v", tc.value, got, tc.want)
 		}
 	}
 }

package/dist/templates/native-go/backend/internal/app/shared_folder_test.go

@@ -100,7 +100,7 @@ func TestResolveSharedFolderIgnoresAFileOfThatName(t *testing.T) {
 }
 
 func TestStatusOmitsSharedFoldersWhenNoneConfigured(t *testing.T) {
-	_, out := call(t, testConfig(t), bob, "app.status", `{}`)
+	_, out := call(t, testConfig(t), alice, "app.status", `{}`)
 	if _, present := out["data"].(map[string]any)["shared_folders"]; present {
 		t.Fatalf("unexpected shared_folders: %v", out)
 	}
@@ -111,7 +111,7 @@ func TestStatusReportsEachConfiguredSharedFolder(t *testing.T) {
 	cfg.VolumeRoot = t.TempDir()
 	os.MkdirAll(filepath.Join(cfg.VolumeRoot, "volume1", "Photos"), 0o755)
 	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Photos","gone":"Missing"}}`)
-	_, out := call(t, cfg, bob, "app.status", `{}`)
+	_, out := call(t, cfg, alice, "app.status", `{}`)
 	rows := out["data"].(map[string]any)["shared_folders"].([]any)
 	if len(rows) != 2 {
 		t.Fatalf("rows: %v", rows)
@@ -141,7 +141,7 @@ func TestStatusReportsAFolderThePackageAccountCannotWrite(t *testing.T) {
 	os.Chmod(dir, 0o555)
 	t.Cleanup(func() { os.Chmod(dir, 0o755) })
 	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Locked"}}`)
-	_, out := call(t, cfg, bob, "app.status", `{}`)
+	_, out := call(t, cfg, alice, "app.status", `{}`)
 	row := out["data"].(map[string]any)["shared_folders"].([]any)[0].(map[string]any)
 	if row["exists"] != true || row["readable"] != true || row["writable"] != false {
 		t.Fatalf("row: %v", row)
@@ -151,7 +151,7 @@ func TestStatusReportsAFolderThePackageAccountCannotWrite(t *testing.T) {
 func TestStatusReportsACorruptConfigWithoutFailing(t *testing.T) {
 	cfg := testConfig(t)
 	writeConfig(t, cfg.DataDir, `not json`)
-	code, out := call(t, cfg, bob, "app.status", `{}`)
+	code, out := call(t, cfg, alice, "app.status", `{}`)
 	if code != "" || out["data"].(map[string]any)["shared_folders_error"] == nil {
 		t.Fatalf("%q %v", code, out)
 	}