@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/background/store.go

@@ -35,6 +35,9 @@ const (
 	MaxPurgeAudit   = 64
 	MaxTotalBytes   = 16 << 20
 	JobTimeout      = 60 * time.Second
+	// RequestLockTimeout leaves room within the 20-second CGI budget for DSM
+	// authentication, file import and the response. Workers have no lock cap.
+	RequestLockTimeout = 5 * time.Second
 	// MaxHistory bounds finished jobs kept for reading results and for key reuse.
 	MaxHistory = 64
 
@@ -58,19 +61,18 @@ const (
 func (s State) terminal() bool { return s != StateQueued && s != StateRunning }
 
 var (
-	ErrOrdinaryDisabled = errors.New("ordinary background users are disabled")
-	ErrOwnerQueueFull   = errors.New("owner pending quota reached")
-	ErrOwnerQuota       = errors.New("owner storage quota reached")
-	ErrDisabled         = errors.New("background mode is off")
-	ErrInvalid          = errors.New("invalid background request")
-	ErrTooLarge         = errors.New("input is larger than the per-file limit")
-	ErrQueueFull        = errors.New("background queue is full")
-	ErrQuota            = errors.New("background spool quota reached")
-	ErrKeyConflict      = errors.New("idempotency key already used for another input")
-	ErrNotFound         = errors.New("job not found")
-	ErrNotCancelable    = errors.New("job already finished")
-	ErrNotRunning       = errors.New("job is not running")
-	ErrUnsafeSpool      = errors.New("background spool is not private to the package account")
+	ErrBusy           = errors.New("background journal is busy; retry later")
+	ErrOwnerQueueFull = errors.New("owner pending quota reached")
+	ErrOwnerQuota     = errors.New("owner storage quota reached")
+	ErrInvalid        = errors.New("invalid background request")
+	ErrTooLarge       = errors.New("input is larger than the per-file limit")
+	ErrQueueFull      = errors.New("background queue is full")
+	ErrQuota          = errors.New("background spool quota reached")
+	ErrKeyConflict    = errors.New("idempotency key already used for another input")
+	ErrNotFound       = errors.New("job not found")
+	ErrNotCancelable  = errors.New("job already finished")
+	ErrNotRunning     = errors.New("job is not running")
+	ErrUnsafeSpool    = errors.New("background spool is not private to the package account")
 )
 
 // Submitter binds visibility to a fresh DSM username and UID. It never grants
@@ -86,29 +88,30 @@ type Result struct {
 }
 
 type Job struct {
-	CopyRetained    bool      `json:"copyRetained,omitempty"`
-	ScheduleID      string    `json:"scheduleId,omitempty"`
-	ScheduledAt     time.Time `json:"scheduledAt,omitzero"`
-	ID              string    `json:"id"`
-	Key             string    `json:"key"`
-	Name            string    `json:"name"`
-	State           State     `json:"state"`
-	PurgeRequested  bool      `json:"purgeRequested,omitempty"`
-	CancelRequested bool      `json:"cancelRequested,omitempty"`
-	Submitter       Submitter `json:"submitter"`
-	Worker          string    `json:"worker"`
-	WorkerRevision  int       `json:"workerRevision"`
-	InputDigest     string    `json:"inputDigest"`
-	InputBytes      int       `json:"inputBytes"`
-	SubmittedAt     time.Time `json:"submittedAt"`
-	StartedAt       time.Time `json:"startedAt,omitzero"`
-	FinishedAt      time.Time `json:"finishedAt,omitzero"`
-	ErrorCode       string    `json:"errorCode,omitempty"`
-	Result          *Result   `json:"result,omitempty"`
+	AdmissionPending bool      `json:"admission_pending,omitempty"`
+	DelegationID     string    `json:"delegation_id,omitempty"`
+	CopyRetained     bool      `json:"copyRetained,omitempty"`
+	ScheduleID       string    `json:"scheduleId,omitempty"`
+	ScheduledAt      time.Time `json:"scheduledAt,omitzero"`
+	ID               string    `json:"id"`
+	Key              string    `json:"key"`
+	Name             string    `json:"name"`
+	State            State     `json:"state"`
+	PurgeRequested   bool      `json:"purgeRequested,omitempty"`
+	CancelRequested  bool      `json:"cancelRequested,omitempty"`
+	Submitter        Submitter `json:"submitter"`
+	Worker           string    `json:"worker"`
+	WorkerRevision   int       `json:"workerRevision"`
+	InputDigest      string    `json:"inputDigest"`
+	InputBytes       int       `json:"inputBytes"`
+	SubmittedAt      time.Time `json:"submittedAt"`
+	StartedAt        time.Time `json:"startedAt,omitzero"`
+	FinishedAt       time.Time `json:"finishedAt,omitzero"`
+	ErrorCode        string    `json:"errorCode,omitempty"`
+	Result           *Result   `json:"result,omitempty"`
 }
 
 type SubmitRequest struct {
-	Admin     bool // trusted request policy, not a client-supplied field
 	Key       string
 	Name      string
 	Data      []byte
@@ -131,38 +134,55 @@ type WorkerInfo struct {
 }
 
 type Status struct {
-	AllowOrdinaryUsers bool        `json:"allowOrdinaryUsers"`
-	Enabled            bool        `json:"enabled"`
-	Algorithm          string      `json:"algorithm"`
-	Revision           int         `json:"revision"`
-	Queued             int         `json:"queued"`
-	Running            int         `json:"running"`
-	Worker             *WorkerInfo `json:"worker,omitempty"`
+	Algorithm string      `json:"algorithm"`
+	Revision  int         `json:"revision"`
+	Queued    int         `json:"queued"`
+	Running   int         `json:"running"`
+	Worker    *WorkerInfo `json:"worker,omitempty"`
 }
 
 type Limits struct{ MaxTotalBytes int64 }
 
 type journal struct {
-	Schedules          []Schedule   `json:"schedules,omitempty"`
-	AllowOrdinaryUsers bool         `json:"allowOrdinaryUsers,omitempty"`
-	PurgeAudit         []PurgeAudit `json:"purgeAudit,omitempty"`
-	Schema             int          `json:"schema"`
-	Revision           int          `json:"workerRevision"`
-	Enabled            bool         `json:"enabled"`
-	Jobs               []Job        `json:"jobs"`
+	Schedules  []Schedule   `json:"schedules,omitempty"`
+	PurgeAudit []PurgeAudit `json:"purgeAudit,omitempty"`
+	Schema     int          `json:"schema"`
+	Revision   int          `json:"workerRevision"`
+	Jobs       []Job        `json:"jobs"`
 }
 
-// Store is safe for concurrent use by several processes: every operation runs
-// under an exclusive flock and commits the journal with write, fsync, rename.
+// Store is safe for concurrent use by several processes: journal operations run
+// under an exclusive flock and commit with write, fsync, rename. Schedule input
+// verification runs outside that lock and rechecks its snapshot before commit.
 type Store struct {
-	dir      string
-	limits   Limits
-	revision int
-	now      func() time.Time
+	dir              string
+	limits           Limits
+	revision         int
+	now              func() time.Time
+	lockTimeout      time.Duration
+	readScheduleCopy func(context.Context, *os.Root, string, string, int) ([]byte, error)
 }
 
 func NewStore(dir string) *Store {
-	return &Store{dir: dir, limits: Limits{MaxTotalBytes: MaxTotalBytes}, revision: WorkerRevision, now: time.Now}
+	return &Store{dir: dir, limits: Limits{MaxTotalBytes: MaxTotalBytes}, revision: WorkerRevision, now: time.Now,
+		readScheduleCopy: func(ctx context.Context, root *os.Root, id, digest string, size int) ([]byte, error) {
+			if err := ctx.Err(); err != nil {
+				return nil, err
+			}
+			data, err := readCopy(root, id, digest, size)
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			return data, err
+		}}
+}
+
+// NewRequestStore bounds every CGI journal acquisition, including reads and
+// cancellation. NewStore remains the worker's context-controlled wait policy.
+func NewRequestStore(dir string) *Store {
+	s := NewStore(dir)
+	s.lockTimeout = RequestLockTimeout
+	return s
 }
 
 var (
@@ -186,12 +206,20 @@ func validName(name string) bool {
 // withJournal runs fn on the journal under the spool lock. fn reports whether
 // it changed anything; only then is the journal rewritten.
 func (s *Store) withJournal(ctx context.Context, fn func(root *os.Root, j *journal) (bool, error)) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
 	root, err := s.openRoot()
 	if err != nil {
 		return err
 	}
 	defer root.Close()
-	lock, err := root.OpenFile("lock", os.O_CREATE|os.O_RDWR|unix.O_NOFOLLOW, 0o600)
+	// Exclusive creation avoids first-use OpenFile(O_CREATE) races on Darwin.
+	// The lock is never removed; other processes open the existing inode.
+	lock, err := root.OpenFile("lock", os.O_CREATE|os.O_EXCL|os.O_RDWR|unix.O_NOFOLLOW, 0o600)
+	if errors.Is(err, os.ErrExist) {
+		lock, err = root.OpenFile("lock", os.O_RDWR|unix.O_NOFOLLOW, 0o600)
+	}
 	if err != nil {
 		return err
 	}
@@ -199,7 +227,22 @@ func (s *Store) withJournal(ctx context.Context, fn func(root *os.Root, j *journ
 	if err := checkPrivate(lock); err != nil {
 		return err
 	}
+	lockCtx := ctx
+	if s.lockTimeout > 0 {
+		var cancel context.CancelFunc
+		lockCtx, cancel = context.WithTimeout(ctx, s.lockTimeout)
+		defer cancel()
+	}
 	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		if lockCtx.Err() != nil {
+			if err := ctx.Err(); err != nil {
+				return err
+			}
+			return ErrBusy
+		}
 		err = unix.Flock(int(lock.Fd()), unix.LOCK_EX|unix.LOCK_NB)
 		if err == nil {
 			break
@@ -208,12 +251,18 @@ func (s *Store) withJournal(ctx context.Context, fn func(root *os.Root, j *journ
 			return err
 		}
 		select {
-		case <-ctx.Done():
-			return ctx.Err()
+		case <-lockCtx.Done():
+			if err := ctx.Err(); err != nil {
+				return err
+			}
+			return ErrBusy
 		case <-time.After(10 * time.Millisecond):
 		}
 	}
 	defer unix.Flock(int(lock.Fd()), unix.LOCK_UN)
+	if err := ctx.Err(); err != nil {
+		return err
+	}
 	j, err := s.readJournal(root)
 	if err != nil {
 		return err
@@ -398,30 +447,6 @@ func (s *Store) removeInput(root *os.Root, id string) {
 	_ = root.Remove(inputs + "/" + id)
 }
 
-func (s *Store) SetEnabled(ctx context.Context, enabled bool) error {
-	return s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		if j.Enabled == enabled {
-			return false, nil
-		}
-		j.Enabled = enabled
-		if !enabled {
-			for i := range j.Schedules {
-				j.Schedules[i].Enabled = false
-				j.Schedules[i].Reason = "disabled"
-			}
-			for i := range j.Jobs {
-				switch job := &j.Jobs[i]; job.State {
-				case StateQueued:
-					s.finishJob(root, job, StateCanceled, "disabled")
-				case StateRunning:
-					job.CancelRequested = true
-				}
-			}
-		}
-		return true, nil
-	})
-}
-
 func (s *Store) finishJob(root *os.Root, job *Job, state State, code string) {
 	job.State, job.ErrorCode, job.FinishedAt = state, code, s.now().UTC()
 	if state != StateSucceeded {
@@ -443,12 +468,6 @@ func (s *Store) Submit(ctx context.Context, req SubmitRequest) (Job, bool, error
 	var created Job
 	var duplicate bool
 	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		if !j.Enabled {
-			return false, ErrDisabled
-		}
-		if !req.Admin && !j.AllowOrdinaryUsers {
-			return false, ErrOrdinaryDisabled
-		}
 		for _, job := range j.Jobs {
 			if job.Submitter == req.Submitter && job.Key == req.Key && !job.PurgeRequested {
 				if job.InputDigest != digest {
@@ -573,20 +592,17 @@ func (s *Store) CancelFor(ctx context.Context, id string, access Access) (Job, e
 }
 
 // Claim hands the oldest queued job to the worker, or nil when there is none,
-// the mode is off or another job is still running.
+// or another job is still running.
 func (s *Store) Claim(ctx context.Context) (*Job, error) {
 	var out *Job
 	err := s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) {
-		if !j.Enabled {
-			return false, nil
-		}
 		var next *Job
 		for i := range j.Jobs {
 			switch job := &j.Jobs[i]; job.State {
 			case StateRunning:
 				return false, nil
 			case StateQueued:
-				if next == nil {
+				if next == nil && !job.AdmissionPending {
 					next = job
 				}
 			}
@@ -636,6 +652,12 @@ func (s *Store) Recover(ctx context.Context) error {
 		for i := range j.Jobs {
 			job := &j.Jobs[i]
 			switch {
+			case job.AdmissionPending:
+				job.AdmissionPending = false
+				if !job.State.terminal() {
+					s.finishJob(root, job, StateInterrupted, "admission-interrupted")
+				}
+				changed = true
 			case job.State == StateRunning && job.CancelRequested:
 				s.finishJob(root, job, StateCanceled, "")
 				changed = true
@@ -647,7 +669,7 @@ func (s *Store) Recover(ctx context.Context) error {
 			}
 		}
 		j.removePurged()
-		changed = s.reconcileSchedules(root, j, true) || changed
+		changed = s.reconcileSchedules(root, j, true, nil) || changed
 		j.Revision = s.revision
 		s.removeOrphanInputs(root, j)
 		return changed, nil
@@ -698,7 +720,6 @@ func (s *Store) Status(ctx context.Context) (Status, error) {
 func (s *Store) StatusFor(ctx context.Context, access Access) (Status, error) {
 	st := Status{Algorithm: WorkerSHA256V1, Revision: s.revision}
 	err := s.withJournal(ctx, func(root *os.Root, j *journal) (bool, error) {
-		st.Enabled, st.AllowOrdinaryUsers = j.Enabled, j.AllowOrdinaryUsers
 		for _, job := range j.Jobs {
 			if !access.sees(job) {
 				continue
@@ -752,11 +773,6 @@ func sha256hex(b []byte) string {
 	return hex.EncodeToString(sum[:])
 }
 
-// SetOrdinaryUsers is independent of background mode, and defaults off when
-// reading an A0 journal. A submission rechecks it under the same flock as enqueue.
-func (s *Store) SetOrdinaryUsers(ctx context.Context, allow bool) error {
-	return s.withJournal(ctx, func(_ *os.Root, j *journal) (bool, error) { j.AllowOrdinaryUsers = allow; return true, nil })
-}
 func (j *journal) removePurged() {
 	kept := j.Jobs[:0]
 	for _, job := range j.Jobs {

package/dist/templates/native-go/backend/internal/background/store_test.go

@@ -20,15 +20,12 @@ func newStore(t *testing.T) (*Store, string) {
 	t.Helper()
 	dir := filepath.Join(t.TempDir(), "background")
 	s := NewStore(dir)
-	if err := s.SetEnabled(context.Background(), true); err != nil {
-		t.Fatal(err)
-	}
 	return s, dir
 }
 
 func submit(t *testing.T, s *Store, key string, data []byte) Job {
 	t.Helper()
-	job, _, err := s.Submit(context.Background(), SubmitRequest{Key: key, Name: "a.txt", Data: data, Submitter: admin, Admin: true})
+	job, _, err := s.Submit(context.Background(), SubmitRequest{Key: key, Name: "a.txt", Data: data, Submitter: admin})
 	if err != nil {
 		t.Fatalf("submit %q: %v", key, err)
 	}
@@ -37,14 +34,6 @@ func submit(t *testing.T, s *Store, key string, data []byte) Job {
 
 func digest(b []byte) string { h := sha256.Sum256(b); return hex.EncodeToString(h[:]) }
 
-func TestSubmitIsDisabledByDefault(t *testing.T) {
-	s := NewStore(filepath.Join(t.TempDir(), "background"))
-	_, _, err := s.Submit(context.Background(), SubmitRequest{Key: "k1", Name: "a", Data: []byte("x"), Submitter: admin, Admin: true})
-	if !errors.Is(err, ErrDisabled) {
-		t.Fatalf("want ErrDisabled, got %v", err)
-	}
-}
-
 func TestSubmitWritesDurableQueuedJobBeforeReturningID(t *testing.T) {
 	s, dir := newStore(t)
 	data := []byte("hello")
@@ -86,14 +75,14 @@ func TestSpoolRefusesWidePermissionsAndSymlinks(t *testing.T) {
 		t.Fatal(err)
 	}
 	s := NewStore(dir)
-	if err := s.SetEnabled(context.Background(), true); err == nil {
+	if _, err := s.Status(context.Background()); err == nil {
 		t.Fatal("a world-readable spool must be refused")
 	}
 	link := filepath.Join(root, "link")
 	if err := os.Symlink(root, link); err != nil {
 		t.Fatal(err)
 	}
-	if err := NewStore(link).SetEnabled(context.Background(), true); err == nil {
+	if _, err := NewStore(link).Status(context.Background()); err == nil {
 		t.Fatal("a symlinked spool must be refused")
 	}
 }
@@ -101,11 +90,11 @@ func TestSpoolRefusesWidePermissionsAndSymlinks(t *testing.T) {
 func TestSubmitIdempotencyKey(t *testing.T) {
 	s, _ := newStore(t)
 	first := submit(t, s, "same-key", []byte("one"))
-	again, dup, err := s.Submit(context.Background(), SubmitRequest{Key: "same-key", Name: "a.txt", Data: []byte("one"), Submitter: admin, Admin: true})
+	again, dup, err := s.Submit(context.Background(), SubmitRequest{Key: "same-key", Name: "a.txt", Data: []byte("one"), Submitter: admin})
 	if err != nil || !dup || again.ID != first.ID {
 		t.Fatalf("duplicate: %+v dup=%v err=%v", again, dup, err)
 	}
-	_, _, err = s.Submit(context.Background(), SubmitRequest{Key: "same-key", Name: "a.txt", Data: []byte("two"), Submitter: admin, Admin: true})
+	_, _, err = s.Submit(context.Background(), SubmitRequest{Key: "same-key", Name: "a.txt", Data: []byte("two"), Submitter: admin})
 	if !errors.Is(err, ErrKeyConflict) {
 		t.Fatalf("different input under the same key: %v", err)
 	}
@@ -118,7 +107,7 @@ func TestSubmitIdempotencyKey(t *testing.T) {
 func TestSubmitLimits(t *testing.T) {
 	s, _ := newStore(t)
 	ctx := context.Background()
-	if _, _, err := s.Submit(ctx, SubmitRequest{Key: "big", Name: "a", Data: make([]byte, MaxInputBytes+1), Submitter: admin, Admin: true}); !errors.Is(err, ErrTooLarge) {
+	if _, _, err := s.Submit(ctx, SubmitRequest{Key: "big", Name: "a", Data: make([]byte, MaxInputBytes+1), Submitter: admin}); !errors.Is(err, ErrTooLarge) {
 		t.Fatalf("oversize: %v", err)
 	}
 	for _, bad := range []SubmitRequest{
@@ -135,12 +124,12 @@ func TestSubmitLimits(t *testing.T) {
 		}
 	}
 	for i := 0; i < MaxQueued; i++ {
-		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "a", Data: []byte("x"), Admin: true, Submitter: Submitter{User: "admin", UID: fmt.Sprint(2000 + i)}})
+		_, _, err := s.Submit(ctx, SubmitRequest{Key: fmt.Sprint(i), Name: "a", Data: []byte("x"), Submitter: Submitter{User: "admin", UID: fmt.Sprint(2000 + i)}})
 		if err != nil {
 			t.Fatal(err)
 		}
 	}
-	if _, _, err := s.Submit(ctx, SubmitRequest{Key: "one-more", Name: "a", Data: []byte("x"), Submitter: admin, Admin: true}); !errors.Is(err, ErrQueueFull) {
+	if _, _, err := s.Submit(ctx, SubmitRequest{Key: "one-more", Name: "a", Data: []byte("x"), Submitter: admin}); !errors.Is(err, ErrQueueFull) {
 		t.Fatalf("queue full: %v", err)
 	}
 }
@@ -149,7 +138,7 @@ func TestSubmitTotalQuota(t *testing.T) {
 	s, _ := newStore(t)
 	s.limits.MaxTotalBytes = 10 + resultReserve
 	submit(t, s, "k1", []byte("123456"))
-	if _, _, err := s.Submit(context.Background(), SubmitRequest{Key: "k2", Name: "a", Data: []byte("123456"), Submitter: admin, Admin: true}); !errors.Is(err, ErrQuota) {
+	if _, _, err := s.Submit(context.Background(), SubmitRequest{Key: "k2", Name: "a", Data: []byte("123456"), Submitter: admin}); !errors.Is(err, ErrQuota) {
 		t.Fatalf("quota: %v", err)
 	}
 }
@@ -175,17 +164,6 @@ func TestClaimRunsOneJobAtATimeInSubmissionOrder(t *testing.T) {
 	}
 }
 
-func TestClaimDoesNothingWhileDisabled(t *testing.T) {
-	s, _ := newStore(t)
-	submit(t, s, "k", []byte("x"))
-	if err := s.SetEnabled(context.Background(), false); err != nil {
-		t.Fatal(err)
-	}
-	if got, err := s.Claim(context.Background()); err != nil || got != nil {
-		t.Fatalf("disabled claim: %+v %v", got, err)
-	}
-}
-
 func TestFinishRecordsResultAndRetainsPrivateCopy(t *testing.T) {
 	s, dir := newStore(t)
 	ctx := context.Background()
@@ -270,26 +248,6 @@ func TestUnknownJobIsNotFound(t *testing.T) {
 	}
 }
 
-func TestDisableCancelsQueuedAndRequestsStopOfRunning(t *testing.T) {
-	s, _ := newStore(t)
-	ctx := context.Background()
-	running := submit(t, s, "k1", []byte("1"))
-	queued := submit(t, s, "k2", []byte("2"))
-	_, _ = s.Claim(ctx)
-	if err := s.SetEnabled(ctx, false); err != nil {
-		t.Fatal(err)
-	}
-	if got, _ := s.Get(ctx, queued.ID); got.State != StateCanceled || got.ErrorCode != "disabled" {
-		t.Fatalf("queued: %+v", got)
-	}
-	if got, _ := s.Get(ctx, running.ID); got.State != StateRunning || !got.CancelRequested {
-		t.Fatalf("running: %+v", got)
-	}
-	if _, _, err := s.Submit(ctx, SubmitRequest{Key: "k3", Name: "a", Data: []byte("x"), Submitter: admin, Admin: true}); !errors.Is(err, ErrDisabled) {
-		t.Fatalf("submit while disabled: %v", err)
-	}
-}
-
 func TestRecoverMarksRunningInterruptedWithoutReplay(t *testing.T) {
 	s, dir := newStore(t)
 	ctx := context.Background()
@@ -394,7 +352,7 @@ func TestStatusReportsWorkerHeartbeat(t *testing.T) {
 	s, _ := newStore(t)
 	ctx := context.Background()
 	st, _ := s.Status(ctx)
-	if !st.Enabled || st.Worker != nil || st.Revision != WorkerRevision || st.Algorithm != WorkerSHA256V1 {
+	if st.Worker != nil || st.Revision != WorkerRevision || st.Algorithm != WorkerSHA256V1 {
 		t.Fatalf("status: %+v", st)
 	}
 	if err := s.Heartbeat(ctx, WorkerInfo{PID: 42, UID: 255853, Username: "SynologyApp"}); err != nil {

package/dist/templates/native-go/backend/internal/dsm/admin.go

@@ -0,0 +1,70 @@
+package dsm
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os/exec"
+	"time"
+)
+
+// IsAdministrator is the single DSM role provider. The native SDK owns group
+// names, domain/LDAP membership and real-time checks. Unknown results refuse.
+func IsAdministrator(ctx context.Context, principal string) (bool, error) {
+	if !validPrincipal(principal) {
+		return false, errors.New("invalid DSM principal")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	return nativeAdministrator(ctx, principal)
+}
+
+var errNativeRole = errors.New("DSM administrator verification unavailable")
+var errOutputLimit = errors.New("DSM authentication output limit exceeded")
+
+type boundedOutput struct {
+	buffer bytes.Buffer
+	limit  int
+}
+
+func (b *boundedOutput) Write(p []byte) (int, error) {
+	if len(p) > b.limit-b.Len() {
+		return 0, errOutputLimit
+	}
+	return b.buffer.Write(p)
+}
+
+func (b *boundedOutput) Len() int      { return b.buffer.Len() }
+func (b *boundedOutput) Bytes() []byte { return b.buffer.Bytes() }
+
+func commandOutput(cmd *exec.Cmd, limit int) ([]byte, error) {
+	var out = boundedOutput{limit: limit}
+	var stderr = boundedOutput{limit: 1024}
+	cmd.Stdout, cmd.Stderr = &out, &stderr
+	cmd.WaitDelay = 250 * time.Millisecond
+	configureCommand(cmd)
+	if err := cmd.Run(); err != nil {
+		return nil, err
+	}
+	return out.Bytes(), nil
+}
+
+func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path)
+	cmd.Env = env
+	return commandOutput(cmd, 1026)
+}
+
+func parseNativeRole(out []byte, err error) (bool, error) {
+	if err != nil {
+		return false, errNativeRole
+	}
+	switch string(out) {
+	case "1\n":
+		return true, nil
+	case "0\n":
+		return false, nil
+	default:
+		return false, errNativeRole
+	}
+}

package/dist/templates/native-go/backend/internal/dsm/admin_linux.go

@@ -0,0 +1,80 @@
+//go:build linux
+
+package dsm
+
+import (
+	"context"
+	_ "embed"
+	"errors"
+	"os"
+	"os/exec"
+	"runtime"
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// The bridge is compiled reproducibly from native/admin_check.c. Embedding
+// binds it to the CGI's build; no writable helper path or runtime library path.
+//
+//go:embed native/admin-x86_64.elf
+var adminAMD64 []byte
+
+//go:embed native/admin-aarch64.elf
+var adminARM64 []byte
+
+func nativeAdministrator(ctx context.Context, principal string) (bool, error) {
+	var payload []byte
+	switch runtime.GOARCH {
+	case "amd64":
+		payload = adminAMD64
+	case "arm64":
+		payload = adminARM64
+	default:
+		return false, errNativeRole
+	}
+	file, err := sealedBridge(payload)
+	if err != nil {
+		return false, errNativeRole
+	}
+	defer file.Close()
+	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", principal)
+	cmd.ExtraFiles = []*os.File{file}
+	// In particular, never inherit LD_PRELOAD/LD_LIBRARY_PATH or credentials.
+	cmd.Env = []string{"LANG=C", "LC_ALL=C"}
+	out, err := commandOutput(cmd, 16)
+	return parseNativeRole(out, err)
+}
+
+func sealedBridge(payload []byte) (*os.File, error) {
+	fd, err := unix.MemfdCreate("synopkgland-admin", unix.MFD_CLOEXEC|unix.MFD_ALLOW_SEALING)
+	if err != nil {
+		return nil, err
+	}
+	file := os.NewFile(uintptr(fd), "synopkgland-admin")
+	fail := func(err error) (*os.File, error) { file.Close(); return nil, err }
+	if _, err = file.Write(payload); err != nil {
+		return fail(err)
+	}
+	if err = unix.Fchmod(fd, 0500); err != nil {
+		return fail(err)
+	}
+	if _, err = unix.FcntlInt(file.Fd(), unix.F_ADD_SEALS, unix.F_SEAL_WRITE|unix.F_SEAL_GROW|unix.F_SEAL_SHRINK|unix.F_SEAL_SEAL); err != nil {
+		return fail(err)
+	}
+	if _, err = file.Seek(0, 0); err != nil {
+		return fail(err)
+	}
+	return file, nil
+}
+
+func configureCommand(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error {
+		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		if errors.Is(err, syscall.ESRCH) {
+			return os.ErrProcessDone
+		}
+		return err
+	}
+}