@synopackageland/cli 0.5.3 → 0.6.1

package/templates/_executor/dsm_test.go

@@ -0,0 +1,196 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+type accountsStub struct {
+	s   Subject
+	err error
+}
+
+func (a accountsStub) Lookup(string) (Subject, error) { return a.s, a.err }
+
+type cmdStub struct {
+	reply string
+	args  []string
+	path  string
+	err   error
+}
+
+func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
+	c.path = p
+	c.args = args
+	return []byte(c.reply), c.err
+}
+func TestDSMAccountFailClosed(t *testing.T) {
+	for _, tc := range []struct {
+		name, reply string
+		pass        bool
+	}{
+		{"valid", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"normal"}]}}`, true},
+		{"success empty", `{"success":true,"data":{}}`, false},
+		{"success no user", `{"success":true,"data":{"users":[]}}`, false},
+		{"missing expiry", `{"success":true,"data":{"users":[{"name":"alice","uid":1200}]}}`, false},
+		{"disabled", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"now"}]}}`, false},
+		{"uid mismatch", `{"success":true,"data":{"users":[{"name":"alice","uid":1201,"expired":"normal"}]}}`, false},
+		{"name mismatch", `{"success":true,"data":{"users":[{"name":"bob","uid":1200,"expired":"normal"}]}}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := &cmdStub{reply: tc.reply}
+			d := &liveDSM{Command: c, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200}}}
+			_, err := d.Account(context.Background(), "alice")
+			if (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+func TestDSMAppPrivilege(t *testing.T) {
+	for _, tc := range []struct {
+		name, reply string
+		pass        bool
+	}{
+		{"allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`, true},
+		{"deny", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`, false},
+		{"custom", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"custom"}]}}`, false},
+		{"default allow", `{"success":true,"data":{"applications":[]}}`, true},
+		{"missing applications", `{"success":true,"data":{}}`, false},
+		{"null applications", `{"success":true,"data":{"applications":null}}`, false},
+		{"deny overrides allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"deny"}]}}`, false},
+		{"duplicate", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"allow"}]}}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := &cmdStub{reply: tc.reply}
+			d := &liveDSM{Command: c}
+			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app")
+			if (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+			if !reflect.DeepEqual(c.args, []string{"--exec", "api=SYNO.Core.AppPriv.App", "method=preview", "version=2", `username="alice"`}) {
+				t.Fatal(c.args)
+			}
+		})
+	}
+}
+func TestDSMVerify(t *testing.T) {
+	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			c, err := r.Cookie("id")
+			if err != nil || c.Value != "cookie" || r.Header.Get("X-SYNO-TOKEN") != "token" {
+				t.Error("cookie")
+			}
+			w.Write([]byte(reply))
+		}))
+		d := &liveDSM{HTTP: srv.Client(), Endpoint: srv.URL}
+		name, err := d.Verify(context.Background(), "cookie", "token")
+		srv.Close()
+		if strings.Contains(reply, `"alice"`) {
+			if err != nil || name != "alice" {
+				t.Fatal(name, err)
+			}
+		} else if err == nil {
+			t.Fatal("invalid identity accepted")
+		}
+	}
+}
+func TestDSMArgvAndEmbeddedError(t *testing.T) {
+	c := &cmdStub{reply: `{"success":true,"data":{"files":[{"error":{"code":407}}]}}`}
+	d := &liveDSM{Command: c}
+	_, err := d.API(context.Background(), "alice", "files.createFolder", map[string]any{"path": "/home", "name": "$(touch nope);`x`"})
+	if err == nil || c.path != "/usr/syno/bin/synowebapi" || !contains(c.args, "runner=alice") {
+		t.Fatal(err, c)
+	}
+	if !contains(c.args, `name="$(touch nope);`+"`x`"+`"`) {
+		t.Fatal(c.args)
+	}
+	c.err = errors.New("unavailable")
+	if _, err = d.API(context.Background(), "alice", "files.list", map[string]any{"path": "/home"}); err == nil {
+		t.Fatal("command error")
+	}
+}
+
+type rootStub struct {
+	calls int
+	err   error
+}
+
+func (r *rootStub) Run(context.Context, string, string) (string, error) {
+	r.calls++
+	return "root", r.err
+}
+func TestRootRequiresVerifiedAdmin(t *testing.T) {
+	e, f, _ := setup(t)
+	r := &rootStub{}
+	e.Runner = r
+	e.Policy.Root = map[string]string{"whoami": strings.Repeat("a", 64)}
+	out := request(e, "root.run", map[string]any{"name": "whoami"})
+	if out.Code != "ADMIN_REQUIRED" || r.calls != 0 {
+		t.Fatal(out)
+	}
+	f.user.Admin = true
+	if out = request(e, "root.run", map[string]any{"name": "whoami"}); !out.OK || r.calls != 1 {
+		t.Fatal(out)
+	}
+	if out = request(e, "root.run", map[string]any{"name": "other"}); out.Code != "POLICY_DENIED" {
+		t.Fatal(out)
+	}
+}
+func TestSubdirectoryBinding(t *testing.T) {
+	e, f, _ := setup(t)
+	f.root = t.TempDir()
+	f.root = realTestPath(t, f.root)
+	if err := makeTestDir(f.root + "/downloads"); err != nil {
+		t.Fatal(err)
+	}
+	out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home/downloads", "ttl_seconds": 60})
+	if !out.OK {
+		t.Fatal(out)
+	}
+}
+
+func TestDSMEmptyOperationDataDenied(t *testing.T) {
+	for _, op := range []string{"files.list", "files.info", "files.createFolder", "files.checkPermission"} {
+		c := &cmdStub{reply: `{"success":true,"data":{}}`}
+		d := &liveDSM{Command: c}
+		if _, err := d.API(context.Background(), "alice", op, map[string]any{"path": "/home", "name": "new"}); err == nil {
+			t.Fatal(op, "empty success accepted")
+		}
+	}
+}
+
+type eligibilityCommand struct{ expired, deniedApp string }
+
+func (c eligibilityCommand) Exec(_ context.Context, _ string, args []string) ([]byte, error) {
+	if contains(args, "api=SYNO.Core.User") {
+		return []byte(`{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"` + c.expired + `"}]}}`), nil
+	}
+	if c.deniedApp != "" {
+		return []byte(`{"success":true,"data":{"applications":[{"app_id":"` + c.deniedApp + `","privilelge":"deny"}]}}`), nil
+	}
+	return []byte(`{"success":true,"data":{"applications":[]}}`), nil
+}
+func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *testing.T) {
+	for _, tc := range []struct{ name, expiry, deny, want string }{
+		{"ordinary defaults", "normal", "", ""},
+		{"explicit App deny", "normal", "app", "APP_DENIED"},
+		{"explicit File Station deny", "normal", "SYNO.SDS.App.FileStation3.Instance", "APP_DENIED"},
+		{"disabled with default Apps", "now", "", "INELIGIBLE"},
+		{"unknown account state", "", "", "INELIGIBLE"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			e, _, _ := setup(t)
+			e.DSM = &liveDSM{Command: eligibilityCommand{expired: tc.expiry, deniedApp: tc.deny}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
+			_, code := e.eligible(context.Background(), "alice", 1200, true)
+			if code != tc.want {
+				t.Fatal(code, tc.want)
+			}
+		})
+	}
+}