@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/backend/internal/helper/write_operation_linux.go

@@ -1,245 +0,0 @@
-package helper
-
-import (
-	"context"
-	"io"
-	"net"
-	"os"
-	"time"
-)
-
-type linuxWriteOperation struct {
-	*linuxOperation
-	writeWork      writeWork
-	receipt        MutationReceipt
-	resultCode     Code
-	ready          bool
-	resultReleased bool
-}
-
-func startLinuxWriteOperation(c Client, binary string, a NativeActor, b operationBinding, pin *pinnedReadOnlyRoot, w writeWork, input net.Conn) (operationProcess, error) {
-	if w.validate() != "" || pin == nil || pin.path != w.RootPath {
-		return nil, ErrDenied
-	}
-	w.Segments = append([]string{}, w.Segments...)
-	return startLinuxOperationWork(c, binary, a, b, input, pin, nil, &w)
-}
-func (p *linuxWriteOperation) idle() (bool, error) {
-	idle, e := p.linuxOperation.idle()
-	if p.result != nil && p.result.Mutation != nil {
-		p.receipt = *p.result.Mutation
-		p.resultCode = p.result.Code
-		p.ready = true
-		p.result = nil
-	}
-	return idle, e
-}
-func (p *linuxWriteOperation) mutationResult() (MutationReceipt, Code, bool) {
-	idle, e := p.idle()
-	if e != nil {
-		return p.receipt, ErrCleanupRequired, false
-	}
-	return p.receipt, p.resultCode, p.ready && idle
-}
-func (p *linuxWriteOperation) chunk(n uint32) error { return p.chunkWithActor(n, NativeActor{}) }
-func (p *linuxWriteOperation) chunkWithActor(n uint32, a NativeActor) error {
-	if !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) {
-		return ErrStale
-	}
-	return p.beginWrite(a, n, false)
-}
-func (p *linuxWriteOperation) commitWithActor(a NativeActor) error { return p.beginWrite(a, 0, true) }
-func (p *linuxWriteOperation) beginWrite(a NativeActor, n uint32, commit bool) error {
-	idle, e := p.idle()
-	if e != nil {
-		return e
-	}
-	if !idle || p.closed || !p.ready || p.resultCode != "" || p.finishSent || !a.valid || !nativeFresh(a.account.CheckedAt, time.Now()) || !commit && (n == 0 || n > MaxChunkBytes) {
-		return errTrust
-	}
-	p.proofDeadline = a.account.CheckedAt.Add(NativeProofFreshness)
-	p.sequence++
-	lease := operationLease{Token: p.token, Sequence: p.sequence, Bytes: n, SubjectRef: a.Principal().SubjectRef, SessionRef: a.SessionRef(), ProofDeadline: p.proofDeadline.UnixNano(), Commit: commit}
-	info, e := openOperationFDInfo(p.process.Pid)
-	if e != nil {
-		return e
-	}
-	done := make(chan operationRelayOutcome, 1)
-	p.pending = done
-	p.ready = false
-	control, data, input := p.control, p.data, p.output
-	boot, w := p.bootstrap, p.writeWork
-	sequence, mounts, deadline := p.sequence, p.mountSequence, p.proofDeadline
-	previous := p.receipt
-	results := make(chan readOnlyPacketOutcome, 1)
-	p.resultPending = results
-	// One outstanding lease. Read only the admitted bytes from the fixed binary
-	// input, then hand them to the actor. No bytes or file descriptors enter JSON.
-	go func() {
-		var e error
-		if !commit {
-			e = input.SetReadDeadline(deadline)
-			buffer := make([]byte, n)
-			if e == nil {
-				_, e = io.ReadFull(input, buffer)
-			}
-			if e == nil {
-				e = writeOperationPacket(control, lease)
-			}
-			if e == nil {
-				var written int
-				written, e = data.Write(buffer)
-				if e == nil && written != len(buffer) {
-					e = io.ErrShortWrite
-				}
-			}
-		} else {
-			e = writeOperationPacket(control, lease)
-		}
-		outcome := readOnlyPacketOutcome{}
-		if e == nil {
-			outcome = receiveWriteProof(control, info, boot, w, p.process.Pid, mounts, sequence, time.Until(deadline))
-			e = outcome.err
-			if e == nil {
-				m := outcome.result.Mutation
-				upper := previous.BytesWritten + uint64(n)
-				if commit {
-					upper = previous.BytesWritten
-				}
-				if m.BytesWritten < previous.BytesWritten || m.BytesWritten > upper || outcome.result.Code == "" && m.BytesWritten != upper || !commit && (m.Published || m.Committed) {
-					e = errTrust
-				}
-			}
-		}
-		if closeErr := info.Close(); e == nil {
-			e = closeErr
-		}
-		outcome.err = e
-		results <- outcome
-		done <- operationRelayOutcome{err: e, mountSequence: outcome.mountSequence}
-	}()
-	if commit {
-		p.finishSent = true
-	}
-	return nil
-}
-func receiveWriteProof(control *net.UnixConn, info *os.File, boot operationBootstrap, w writeWork, pid int, mounts, sequence uint64, timeout time.Duration) readOnlyPacketOutcome {
-	deadline := time.Now().Add(timeout)
-	for {
-		var packet readOnlyPacket
-		cred, e := readOperationPacketBound(control, &packet, MaxControlBytes, time.Until(deadline))
-		if e != nil {
-			return readOnlyPacketOutcome{err: e}
-		}
-		if cred == nil || int(cred.Pid) != pid || cred.Uid != boot.UID || cred.Gid != boot.GID || packet.Binding != boot.Binding || packet.Token != boot.Token {
-			return readOnlyPacketOutcome{err: errTrust}
-		}
-		if packet.Result != nil {
-			r := packet.Result
-			m := r.Mutation
-			if packet.MountFD != nil || packet.MountSequence != 0 || packet.ChunkSequence != sequence || m == nil || m.EffectsUnknown || m.BytesWritten > w.MaxBytes || m.Committed && !m.Published || m.Published && !m.Created || r.Bytes != 0 || r.Entry != nil || r.List != nil || r.Code != "" && !r.Code.Valid() {
-				return readOnlyPacketOutcome{err: errTrust}
-			}
-			return readOnlyPacketOutcome{result: r, mountSequence: mounts}
-		}
-		if packet.MountFD == nil || packet.ChunkSequence != 0 || packet.MountSequence != mounts+1 || mounts >= maxReadOnlyMountQueries {
-			return readOnlyPacketOutcome{err: errTrust}
-		}
-		mounts++
-		id, c := operationFDInfoMount(info, *packet.MountFD)
-		if e := writeOperationPacket(control, readOnlyMountReply{Token: boot.Token, Sequence: mounts, Mount: id, Code: c}); e != nil {
-			return readOnlyPacketOutcome{err: e}
-		}
-	}
-}
-func operationWriteChild(ctx context.Context, control *net.UnixConn, boot operationBootstrap) error {
-	w := *boot.Write
-	witness := os.NewFile(6, "write-root-witness")
-	if witness == nil {
-		return errTrust
-	}
-	defer witness.Close()
-	input := os.NewFile(5, "write-input")
-	if input == nil {
-		return errTrust
-	}
-	defer input.Close()
-	operationMountIDFallback = operationMountIDProxy(control, boot)
-	pin := &pinnedReadOnlyRoot{path: w.RootPath, file: witness}
-	x, c := openActorWriteTransfer(ctx, pin, w, operationReadOnlyACL)
-	receipt := MutationReceipt{}
-	if x != nil {
-		defer x.Close()
-		receipt = x.Receipt()
-	}
-	send := func(sequence uint64, r MutationReceipt, c Code) error {
-		return writeOperationPacketBound(control, readOnlyPacket{Binding: boot.Binding, Token: boot.Token, ChunkSequence: sequence, Result: &readOnlyResult{Code: c, Mutation: &r}}, MaxControlBytes)
-	}
-	if e := send(0, receipt, c); e != nil {
-		return e
-	}
-	if c != "" {
-		return awaitReadOnlyFinish(control, boot.Token)
-	}
-	var sequence, total uint64
-	for {
-		var lease operationLease
-		timeout := BoundedTimeout
-		if w.Staged {
-			timeout = StreamIdleTimeout
-		}
-		if deadline, ok := ctx.Deadline(); ok && time.Until(deadline) < timeout {
-			timeout = time.Until(deadline)
-		}
-		if _, e := readOperationPacketBound(control, &lease, MaxHealthBytes, timeout); e != nil {
-			return e
-		}
-		if lease.Token != boot.Token || lease.Sequence != sequence+1 || lease.SubjectRef != boot.SubjectRef || lease.SessionRef != boot.SessionRef || lease.ProofDeadline == 0 {
-			return errTrust
-		}
-		proofDeadline := time.Unix(0, lease.ProofDeadline)
-		if !time.Now().Before(proofDeadline) || time.Until(proofDeadline) > NativeProofFreshness {
-			return ErrStale
-		}
-		proofCtx, cancel := context.WithDeadline(ctx, proofDeadline)
-		sequence++
-		var r MutationReceipt
-		if lease.Commit {
-			if lease.Bytes != 0 {
-				cancel()
-				return errTrust
-			}
-			r, c = x.Commit(proofCtx)
-		} else {
-			if lease.Bytes == 0 || lease.Bytes > MaxChunkBytes || total+uint64(lease.Bytes) > w.MaxBytes {
-				cancel()
-				return errTrust
-			}
-			b := make([]byte, lease.Bytes)
-			input.SetReadDeadline(proofDeadline)
-			if _, e := io.ReadFull(input, b); e != nil {
-				cancel()
-				return e
-			}
-			total += uint64(lease.Bytes)
-			r, c = x.WriteChunk(proofCtx, b)
-		}
-		cancel()
-		if e := send(sequence, r, c); e != nil {
-			return e
-		}
-		// Retain lifetime/FDs until parent acknowledges or drains; receipt available
-		// even for partial effects. No named file is automatically cleaned up.
-		if lease.Commit || c != "" {
-			return awaitReadOnlyFinish(control, boot.Token)
-		}
-	}
-}
-
-func (p *linuxWriteOperation) releaseWriteResult() error {
-	if p.resultReleased {
-		return nil
-	}
-	p.resultReleased = true
-	return writeOperationPacket(p.control, operationReadOnlyFinish{Token: p.token})
-}

package/templates/native-go/backend/internal/helper/write_test.go

@@ -1,53 +0,0 @@
-package helper
-
-import "testing"
-
-func TestWriteGatesDefaultDenyAndPublishIsIndependent(t *testing.T) {
-	for _, tc := range []struct {
-		gates   writeGates
-		action  Action
-		allowed bool
-	}{
-		{writeGates{}, ActionCreate, false}, {writeGates{}, ActionWriteStream, false},
-		{writeGates{Create: true}, ActionCreate, true}, {writeGates{Create: true}, ActionWriteStream, false},
-		{writeGates{Stream: true}, ActionWriteStream, false}, {writeGates{Create: true, Stream: true}, ActionWriteStream, false},
-		{writeGates{Create: true, Stream: true, Publish: true}, ActionWriteStream, true},
-		{writeGates{Publish: true}, ActionPublish, false}, {writeGates{Create: true, Publish: true}, ActionPublish, true},
-	} {
-		if tc.gates.allows(tc.action) != tc.allowed {
-			t.Fatal(tc)
-		}
-	}
-}
-func TestWriteWorkRejectsPathsLimitsAndUngatedStage(t *testing.T) {
-	valid := writeWork{RootPath: "/trusted/root", Action: ActionCreate, Segments: []string{"file"}, MaxBytes: MaxBoundedBytes}
-	if c := valid.validate(); c != "" {
-		t.Fatal(c)
-	}
-	for _, kind := range []string{"root", "escape", "zero", "limit", "action", "stage"} {
-		w := valid
-		switch kind {
-		case "root":
-			w.RootPath = "/"
-		case "escape":
-			w.Segments = []string{"..", "file"}
-		case "zero":
-			w.MaxBytes = 0
-		case "limit":
-			w.MaxBytes++
-		case "action":
-			w.Action = ActionRead
-		case "stage":
-			w.Staged = true
-		}
-		if c := w.validate(); c == "" {
-			t.Fatal("accepted", kind)
-		}
-	}
-}
-
-func TestWriteProofPacketDoesNotBecomeReadMetadata(t *testing.T) {
-	if (readOnlyResult{Mutation: &MutationReceipt{Created: true}}).validFor(readOnlyWork{Action: ActionRead, MaxBytes: 10}) {
-		t.Fatal("write receipt accepted as read metadata")
-	}
-}

package/templates/native-go-authorization/backend/internal/app/authorization.go

@@ -1,298 +0,0 @@
-package app
-
-import (
-	"context"
-	"crypto/sha256"
-	"dsmapp/internal/api"
-	"encoding/base64"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/url"
-	"os"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// Compiled into the CGI. Package-owned JSON is never the source of trust.
-type authorizationTask struct {
-	Op     string `json:"op"`
-	Name   string `json:"name"`
-	Header string `json:"header"`
-	Script string `json:"script"`
-	Output bool   `json:"output"`
-}
-type authorizationBuild struct {
-	Schema    int    `json:"schema"`
-	Package   string `json:"package"`
-	Version   string `json:"version"`
-	Pin       string `json:"bootstrapSha256"`
-	Inventory struct {
-		Files []struct {
-			Path string `json:"path"`
-			Size int64  `json:"size"`
-			Hash string `json:"sha256"`
-		} `json:"files"`
-	} `json:"inventory"`
-	Tasks []authorizationTask `json:"tasks"`
-}
-
-func (cfg Config) authorizationRoutes() []api.Route {
-	if cfg.RootAuthorization == "" {
-		return nil
-	}
-	return []api.Route{api.UserRequest("authorization.status", cfg.authorizationStatus), api.Admin("authorization.request", cfg.authorizationRequest), api.Admin("authorization.revoke", cfg.authorizationRevoke)}
-}
-func authorizationDocument(state string, reason any) any {
-	return map[string]any{"command": "authorization", "schema_version": 1, "state": state, "reason": reason}
-}
-func (cfg Config) authorizationPlan() (authorizationBuild, error) {
-	var p authorizationBuild
-	raw, decode := base64.StdEncoding.DecodeString(cfg.RootAuthorization)
-	if decode != nil || json.Unmarshal(raw, &p) != nil || p.Schema != 2 || p.Package != cfg.PackageID || p.Version != cfg.Version || len(p.Tasks) == 0 || len(p.Pin) != 64 {
-		return p, errors.New("invalid build authorization")
-	}
-	if b, e := hex.DecodeString(p.Pin); e != nil || len(b) != 32 {
-		return p, errors.New("invalid bootstrap pin")
-	}
-	return p, nil
-}
-func (cfg Config) authorizationRequest(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
-	if e := decodeParams(params, &struct{}{}); e != nil {
-		return nil, e
-	}
-	p, e := cfg.authorizationPlan()
-	if e != nil {
-		return nil, e
-	}
-	if cfg.authorizationTrusted(p) != nil {
-		return nil, &api.Error{Code: "authorization_required", Message: "Build payload cannot be trusted; reinstall this package"}
-	}
-	ops := []string{}
-	for _, t := range p.Tasks {
-		if t.Op == "helper_enable" {
-			ops = []string{t.Op}
-			break
-		}
-		ops = append(ops, t.Op)
-	}
-	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "run": cfg.HelperInventory.Package != ""}, nil
-}
-func (cfg Config) authorizationRevoke(_ context.Context, _ api.Caller, params json.RawMessage) (any, error) {
-	if e := decodeParams(params, &struct{}{}); e != nil {
-		return nil, e
-	}
-	p, e := cfg.authorizationPlan()
-	if e != nil {
-		return nil, e
-	}
-	// Root task still pins bootstrap. Corrupt UI must not prevent safe cleanup.
-	ops := []string{}
-	purge := false
-	for _, t := range p.Tasks {
-		ops = append(ops, t.Op)
-		if cfg.HelperInventory.Package != "" && t.Op == "helper_purge" {
-			purge = true
-		}
-	}
-	return map[string]any{"command": "authorization", "schema_version": 1, "phase": "plan", "operations": ops, "disable": cfg.HelperInventory.Package != "", "purge": purge}, nil
-}
-func (cfg Config) authorizationTrusted(p authorizationBuild) error {
-	root, e := os.OpenRoot("/var/packages/" + cfg.PackageID + "/target")
-	if e != nil {
-		return e
-	}
-	defer root.Close()
-	verify := func(path string, size int64, want string) error {
-		f, e := root.Open(path)
-		if e != nil {
-			return e
-		}
-		defer f.Close()
-		st, e := f.Stat()
-		if e != nil || !st.Mode().IsRegular() || st.Size() > 64<<20 || size >= 0 && st.Size() != size {
-			return errors.New("untrusted payload")
-		}
-		h := sha256.New()
-		_, e = io.Copy(h, io.LimitReader(f, (64<<20)+1))
-		if e != nil || hex.EncodeToString(h.Sum(nil)) != want {
-			return errors.New("untrusted payload")
-		}
-		return nil
-	}
-	if e = verify("authorization/bootstrap", -1, p.Pin); e != nil {
-		return e
-	}
-	for _, f := range p.Inventory.Files {
-		if e = verify(f.Path, f.Size, f.Hash); e != nil {
-			return e
-		}
-	}
-	return nil
-}
-func (cfg Config) authorizationStatus(ctx context.Context, caller api.Caller, r *http.Request, params json.RawMessage) (any, error) {
-	if e := decodeParams(params, &struct{}{}); e != nil {
-		return nil, e
-	}
-	p, e := cfg.authorizationPlan()
-	if e != nil {
-		return authorizationDocument("unavailable", "service_unavailable"), nil
-	}
-	if cfg.authorizationTrusted(p) != nil {
-		return authorizationDocument("authorization_required", "helper_untrusted"), nil
-	}
-	if cfg.HelperInventory.Package != "" {
-		s := cfg.integrationState(ctx)
-		if s.State == "ready" {
-			return authorizationDocument("ready", nil), nil
-		}
-		if !caller.Admin() {
-			return authorizationDocument("not_admin", "not_admin"), nil
-		}
-		switch s.State {
-		case "incompatible":
-			return authorizationDocument("authorization_required", "grant_incompatible"), nil
-		case "pending":
-			return authorizationDocument("unavailable", "health_probe_timeout"), nil
-		case "failed":
-			return authorizationDocument("unavailable", "service_unavailable"), nil
-		}
-	}
-	if !caller.Admin() {
-		return authorizationDocument("not_admin", "not_admin"), nil
-	}
-	state, reason := authorizationScheduler(ctx, r, p.Tasks)
-	if cfg.HelperInventory.Package != "" && state == "ready" {
-		state = "authorization_required"
-		reason = "grant_missing"
-	}
-	return authorizationDocument(state, reason), nil
-}
-
-// Read-only scheduler observations; never accept caller-selected URLs or task IDs.
-// One modern probe; legacy fallback only for explicit missing method (103).
-func authorizationScheduler(ctx context.Context, r *http.Request, tasks []authorizationTask) (string, any) {
-	return authorizationSchedulerAt(ctx, r, tasks, "http://127.0.0.1:5000")
-}
-func authorizationSchedulerAt(ctx context.Context, r *http.Request, tasks []authorizationTask, endpoint string) (string, any) {
-	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, DisableCompression: true, ResponseHeaderTimeout: 5 * time.Second, MaxResponseHeaderBytes: 32 << 10}
-	defer tr.CloseIdleConnections()
-	client := &http.Client{Transport: tr, Timeout: 8 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
-	ctx, cancel := context.WithTimeout(ctx, 15*time.Second)
-	defer cancel()
-	call := func(method string, version int, params url.Values) (json.RawMessage, int, error) {
-		params.Set("api", "SYNO.Core.TaskScheduler")
-		params.Set("method", method)
-		params.Set("version", strconv.Itoa(version))
-		req, e := http.NewRequestWithContext(ctx, "GET", endpoint+"/webapi/entry.cgi?"+params.Encode(), nil)
-		if e != nil {
-			return nil, 0, e
-		}
-		cookies := r.CookiesNamed("id")
-		if len(cookies) != 1 {
-			return nil, 0, errors.New("session")
-		}
-		req.AddCookie(cookies[0])
-		req.Header.Set("X-SYNO-TOKEN", r.Header.Get("X-SYNO-TOKEN"))
-		response, e := client.Do(req)
-		if e != nil {
-			return nil, 0, e
-		}
-		defer response.Body.Close()
-		b, e := io.ReadAll(io.LimitReader(response.Body, (1<<20)+1))
-		if e != nil || len(b) > 1<<20 || response.StatusCode != 200 {
-			return nil, 0, errors.New("scheduler unavailable")
-		}
-		var wire struct {
-			Success bool            `json:"success"`
-			Data    json.RawMessage `json:"data"`
-			Error   struct {
-				Code int `json:"code"`
-			} `json:"error"`
-		}
-		if json.Unmarshal(b, &wire) != nil {
-			return nil, 0, errors.New("scheduler schema")
-		}
-		if !wire.Success {
-			return nil, wire.Error.Code, errors.New("scheduler refused")
-		}
-		return wire.Data, 0, nil
-	}
-	data, code, e := call("list", 3, url.Values{"start": {"0"}, "limit": {"500"}})
-	legacy := code == 103
-	if legacy {
-		data, code, e = call("list", 2, url.Values{"offset": {"0"}, "limit": {"500"}})
-	}
-	if e != nil {
-		if code == 106 || code == 107 || code == 119 {
-			return "session_expired", "session_expired"
-		}
-		return "unavailable", "scheduler_unavailable"
-	}
-	type item struct {
-		ID        json.Number `json:"id"`
-		Name      string      `json:"name"`
-		Owner     string      `json:"owner"`
-		RealOwner string      `json:"real_owner"`
-		Enable    *bool       `json:"enable"`
-		Type      string      `json:"type"`
-		Extra     struct {
-			Script string `json:"script"`
-		} `json:"extra"`
-	}
-	var list struct {
-		Tasks []item `json:"tasks"`
-		Total *int   `json:"total"`
-	}
-	if json.Unmarshal(data, &list) != nil || list.Total == nil || *list.Total != len(list.Tasks) || len(list.Tasks) > 500 {
-		return "unavailable", "scheduler_unavailable"
-	}
-	for _, expected := range tasks {
-		// Helper control tasks are individually approved on demand. Enable is the
-		// activation anchor; live helper health remains required separately.
-		if strings.HasPrefix(expected.Op, "helper_") && expected.Op != "helper_enable" {
-			continue
-		}
-		var found *item
-		for n := range list.Tasks {
-			if list.Tasks[n].Name == expected.Name {
-				if found != nil {
-					return "authorization_required", "maintenance_task_mismatch"
-				}
-				found = &list.Tasks[n]
-			}
-		}
-		if found == nil {
-			return "authorization_required", "grant_missing"
-		}
-		valid := func(t item) bool {
-			return t.Owner == "root" && t.RealOwner == "root" && t.Enable != nil && !*t.Enable && t.Type == "script"
-		}
-		if !valid(*found) {
-			return "authorization_required", "maintenance_task_mismatch"
-		}
-		version := 4
-		if legacy {
-			version = 3
-		}
-		detail, _, e := call("get", version, url.Values{"id": {string(found.ID)}, "real_owner": {"root"}})
-		if e != nil {
-			return "unavailable", "scheduler_unavailable"
-		}
-		var full item
-		if json.Unmarshal(detail, &full) != nil || full.ID != found.ID || full.Name != expected.Name || !valid(full) {
-			return "authorization_required", "maintenance_task_mismatch"
-		}
-		if full.Extra.Script != expected.Script {
-			if strings.HasPrefix(full.Extra.Script, expected.Header) {
-				return "authorization_required", "grant_incompatible"
-			}
-			return "authorization_required", "maintenance_task_mismatch"
-		}
-	}
-	return "ready", nil
-}

package/templates/native-go-authorization/backend/internal/app/authorization_test.go

@@ -1,96 +0,0 @@
-package app
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"testing"
-)
-
-func TestAuthorizationFailClosed(t *testing.T) {
-	cfg := Config{PackageID: "RootDemo", Version: "0.1.0-0001", RootAuthorization: `{"schema":2}`}
-	if _, e := cfg.authorizationPlan(); e == nil {
-		t.Fatal("accepted missing pin")
-	}
-	if _, e := cfg.authorizationRequest(context.Background(), api.Caller{}, json.RawMessage(`{"op":"arbitrary"}`)); e == nil {
-		t.Fatal("accepted arbitrary params")
-	}
-	if len((Config{}).authorizationRoutes()) != 0 {
-		t.Fatal("default registered root routes")
-	}
-}
-func TestAuthorizationDocuments(t *testing.T) {
-	for _, state := range []string{"ready", "authorization_required", "not_admin", "unavailable"} {
-		b, e := json.Marshal(authorizationDocument(state, nil))
-		if e != nil {
-			t.Fatal(e)
-		}
-		var d map[string]any
-		json.Unmarshal(b, &d)
-		if d["command"] != "authorization" || d["schema_version"] != float64(1) || d["state"] != state {
-			t.Fatal(string(b))
-		}
-	}
-}
-
-func TestSchedulerRejectsChangedTaskAndFallsBackOnlyOn103(t *testing.T) {
-	for _, legacy := range []bool{false, true} {
-		altered := false
-		var versions []string
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			q := r.URL.Query()
-			versions = append(versions, q.Get("method")+":"+q.Get("version"))
-			if q.Get("method") == "list" && q.Get("version") == "3" && legacy {
-				io.WriteString(w, `{"success":false,"error":{"code":103}}`)
-				return
-			}
-			script := "approved"
-			if altered {
-				script = "unapproved"
-			}
-			item := map[string]any{"id": 1, "name": "RootDemo root: whoami", "owner": "root", "real_owner": "root", "enable": false, "type": "script", "extra": map[string]string{"script": script}}
-			var data any = item
-			if q.Get("method") == "list" {
-				data = map[string]any{"tasks": []any{item}, "total": 1}
-			}
-			json.NewEncoder(w).Encode(map[string]any{"success": true, "data": data})
-		}))
-		request := httptest.NewRequest("POST", "/", nil)
-		request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
-		tasks := []authorizationTask{{Op: "whoami", Name: "RootDemo root: whoami", Script: "approved", Header: "header"}}
-		state, _ := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
-		if state != "ready" {
-			t.Fatal(state)
-		}
-		if legacy && !slices.Contains(versions, "get:3") {
-			t.Fatal(versions)
-		}
-		if !legacy && slices.Contains(versions, "get:3") {
-			t.Fatal(versions)
-		}
-		altered = true
-		state, reason := authorizationSchedulerAt(context.Background(), request, tasks, server.URL)
-		if state != "authorization_required" || reason != "maintenance_task_mismatch" {
-			t.Fatal(state, reason)
-		}
-		server.Close()
-	}
-}
-func TestSchedulerPermissionFailureIsNotLegacyFallback(t *testing.T) {
-	calls := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		calls++
-		io.WriteString(w, `{"success":false,"error":{"code":105}}`)
-	}))
-	defer server.Close()
-	request := httptest.NewRequest("POST", "/", nil)
-	request.AddCookie(&http.Cookie{Name: "id", Value: "fixture-session"})
-	state, _ := authorizationSchedulerAt(context.Background(), request, nil, server.URL)
-	if state != "unavailable" || calls != 1 {
-		t.Fatal(state, calls)
-	}
-}