@synopackageland/cli 0.5.3 → 0.6.1

package/templates/native-go/README.md

@@ -9,7 +9,7 @@ DSM main menu → DSM window (ui/app.js)
                    │  ctx.call("greeting.get")  same-origin POST + DSM session
                    ▼
    /webman/3rdparty/__PACKAGE__/cgi/api.cgi   (backend/, runs as package user)
-      1. transport guards: POST, JSON, same origin, ≤ 1 MiB
+      1. transport guards: POST, JSON, same origin, ≤ 1 MiB, bounded JSON complexity
       2. one DSM authentication (unless the route is Public)
       3. route policy: User or Admin  → refusal before any handler
       4. your handler (backend/internal/app)
@@ -17,12 +17,12 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Quick start
 
-Needs Node.js with `synopkgland` installed, and Go 1.24+.
+Needs Node.js with `synopkgland` installed, and Go 1.25+.
 
 ```bash
 (cd backend && go test ./...)   # auth policy + route tests
-synopkgland build-spk           # → dist/__PACKAGE__-0.1.0-0001-{x86_64,aarch64}.spk
-synopkgland inspect --spk dist/__PACKAGE__-0.1.0-0001-x86_64.spk
+synopkgland build           # → dist/__PACKAGE__-0.1.0-0001-{x86_64,aarch64}.spk
+synopkgland inspect dist/__PACKAGE__-0.1.0-0001-x86_64.spk
 ```
 
 Install: Package Center → Settings → General → Trust Level "Any publisher",
@@ -31,6 +31,29 @@ then Manual Install with the SPK for your NAS's CPU. Open
 as, what the backend reports, and (for administrators) a form that stores a
 greeting in the package's data folder.
 
+## Capabilities and schema 2
+
+`dsm-package.yaml` requires `schema: 2` and `backend: {kind: go, dir: backend}`.
+Declare `capabilities.files: session` for interactive File Station access,
+`capabilities.jobs: true` for persistent package-account jobs,
+`capabilities.identity: standalone` for independent DSM login, and
+`capabilities.rootOps: true` for administrator-approved fixed executor operations.
+`init --with files,jobs,login,root-ops` supports plain and Vue UI.
+Jobs and `daemon` are mutually exclusive; `delegate` is not implemented until P2.
+
+```sh
+synopkgland add files jobs login
+synopkgland check --json
+synopkgland status --host my-nas --json
+```
+
+`add` writes SDK overlay files and updates capabilities. Your handlers/pages and
+application entry files remain app-owned. Differing existing overlay files and
+modified SDK placeholders cause `ADD_FILE_CONFLICT` with the conflicting paths;
+resolve them before retrying. Already-declared capabilities are a no-op.
+`check`, `build`, `inspect`, `deploy`, `status` emit one stdout object with
+`--json`; failures include `code`, `message`, `hint`.
+
 ## Project layout
 
 | Path | What it is | Edit it? |
@@ -46,23 +69,24 @@ greeting in the package's data folder.
 | `backend/cmd/app/` | Wires the above together | Rarely |
 | `dist/` | Built SPKs (ignored by git) | No |
 
-`build-spk` generates everything else: `INFO`, `conf/privilege`
+`build` generates everything else: `INFO`, `conf/privilege`
 (`run-as: package`), no-op lifecycle scripts, icons, the DSM window wrapper
 (`ui/config`, `ui/window-<build>.js`) and the CGI at `ui/cgi/api.cgi`.
 
 ## Add an API operation
 
-Add a route in `backend/internal/app/routes.go`. The policy is part of the
-route, so you cannot register a handler without one:
+Add a handler in `backend/internal/app/routes.go`. Every method defaults to
+DSM administrator membership, resolved by its native SDK. All access rules live in
+`backend/internal/api/permissions.json`, including launcher access:
 
 ```go
 func Routes(cfg Config) []api.Route {
 	return []api.Route{
-		api.User("app.status", cfg.status),
-		api.User("greeting.get", cfg.getGreeting),
-		api.Admin("greeting.set", cfg.setGreeting),
-		api.User("notes.list", cfg.listNotes),   // new: any signed-in user
-		api.Admin("notes.purge", cfg.purgeNotes), // new: administrators only
+		api.Handle("app.status", cfg.status),
+		api.Handle("greeting.get", cfg.getGreeting),
+		api.Handle("greeting.set", cfg.setGreeting),
+		api.Handle("notes.list", cfg.listNotes),   // new: administrators by default
+		api.Handle("notes.purge", cfg.purgeNotes), // new: administrators by default
 	}
 }
 
@@ -77,7 +101,7 @@ func (cfg Config) listNotes(ctx context.Context, caller api.Caller, params json.
 
 Then add the method's valid params to `sampleParams` in `routes_test.go`; the
 test fails until you do, and once you do it proves the new route refuses
-callers without a session (and non-admins, for `api.Admin`) without touching
+callers without a session and ordinary users without touching
 the data folder.
 
 Call it from the UI with `ctx.call("notes.list", { limit: 20 })`. Errors
@@ -86,12 +110,31 @@ reject with `{ code, message }`, for example `session_required`,
 
 ### Who can call what
 
-| Declared with | No session | Signed-in user | Administrator |
+The shipped policy is:
+
+```json
+{"schema": 1, "default": "administrators", "methods": {}}
+```
+
+The default must remain `administrators`. An intentional exception belongs in
+`methods`, for example `"notes.list": "authenticated"`; `"public"` explicitly
+allows anonymous calls. Such exceptions also enable ordinary-user launcher
+access. The template ships no exceptions and sets DSM `allUsers` to `false`.
+
+| JSON rule | No session | Ordinary user | Administrators group member |
 | --- | --- | --- | --- |
-| `api.User` | `session_required` | runs | runs |
-| `api.Admin` | `session_required` | `admin_required` | runs |
-| `api.Public` | runs | runs | runs |
-| not registered | `session_required` | `unknown_method` | `unknown_method` |
+| absent or `administrators` | `session_required` | `admin_required` | runs |
+| explicit `authenticated` | `session_required` | runs | runs |
+| explicit `public` | runs | runs | runs |
+| unregistered method | `session_required` | `admin_required` | `unknown_method` |
+
+Missing or invalid JSON, duplicate keys, unknown permissions and rules for
+unregistered methods fail closed. The CLI validates the file and binds its
+SHA-256 digest to the compiled CGI, which checks it at startup before migration.
+Changing policy requires rebuilding the SPK; request parameters cannot alter it.
+Legacy `api.User`, `api.Admin` and `api.Public` constructors remain compatibility
+aliases for handler registration and do not grant access. Use `api.Handle` for
+new routes. Binary reads cannot be configured as anonymous.
 
 Every reply, error or not, is HTTP 200 with `{"success": false, "error":
 {"code", "message"}}` on failure, the same convention as DSM's own WebAPI.
@@ -99,15 +142,36 @@ DSM's web server replaces the body of any CGI reply with status 403, 404 or
 5xx by its own HTML error page, so a status-coded error would never reach your
 UI.
 
+JSON replies include an exact `Content-Length` in bytes, including refusal and
+serialization-failure envelopes. This avoids truncated chunk framing on DSM's
+CGI bridge; serialization failures retain HTTP 200 and return `internal`.
+
+`filestation.UploadStream` streams an application-selected reader under the
+current caller's File Station session, capped at 16 GiB and twenty minutes.
+Its upload transport has a separate bounded response-header deadline; ordinary
+metadata requests retain their shorter deadline. No overwrite, retries, parent
+creation or saved credentials are added. A missing commit receipt remains
+`commit-uncertain` and requires reconciliation before another write.
+
 - Handlers get an `api.Caller` the server built after authenticating; code
   outside `internal/api` cannot construct an authenticated one.
-- `api.Public` runs with **no** DSM login. Use it only for data you would show
-  anyone who can reach DSM's port; the template ships none.
-- "Administrator" means a member of DSM's `administrators` group, read fresh
-  from `/etc/group` on every request.
+- A JSON `public` exception runs with **no** DSM login; the template ships none.
+- "Administrator" is DSM's native administrator decision, including local, AD
+  and LDAP accounts. `dsm.IsAdministrator` invokes `SLIBGroupIsAdminGroupMem`
+  with real-time checking on every authenticated request. No group-name or
+  account-name comparison, UID shortcut, SDK cache, or `/etc/group` fallback
+  grants access. Unknown/error/timeout results refuse access.
 
 ## How authentication works (and its limits)
 
+Before decoding JSON, the CGI parsers reject nesting deeper than 32
+containers or more than 65,536 structural bytes (`{}[],:` outside strings).
+The shared scanner uses constant memory; strings still obey the body's byte
+limit. This bounds JSON allocation amplification even for anonymous callers
+and explicitly public routes. It does not replace authentication or network
+rate limiting. Existing generated projects need to adopt the updated backend
+files; rebuilding the CLI alone does not update their source.
+
 The CGI hands only the session carriers (`Cookie`, `X-SYNO-TOKEN`, client
 address) to DSM's own `/usr/syno/synoman/webman/modules/authenticate.cgi`,
 which prints the signed-in user name. The backend never parses the session
@@ -126,9 +190,16 @@ Known limits:
   per-request `X-SYNO-HASH` proof. Verifying that proof needs private,
   version-specific DSM libraries through a C bridge, so it is not part of this
   template.
-- Users from a directory service (LDAP/AD) who are administrators only
-  through directory groups are not listed in `/etc/group`, so they count as
-  ordinary users. This errs towards refusal.
+- Directory reachability and DSM name-service freshness affect native role
+  checks. The bridge bypasses DSM's administrator-role cache but cannot force
+  an upstream directory replica to be current. It refuses unknown results.
+- The static Go CGI embeds a minimal native bridge for Linux amd64/arm64,
+  reproduced with Zig 0.16.0 from `internal/dsm/native/admin_check.c`. The bridge
+  runs from a sealed memory file with a clean environment, a 3-second deadline
+  and bounded output; no runtime Zig, compiler, writable executable or root
+  privilege is required. The ELF files and build/source hashes are recorded in
+  `native/provenance.json`. DSM must expose the native SDK symbol; otherwise
+  authentication refuses access.
 
 ## Customize the UI
 
@@ -216,8 +287,7 @@ ui:
 ```
 
 The build must emit `app.js` (one script that registers `mount`) and
-`app.css`. The public `@synopackageland/ui@0.5.7` package on
-`https://registry.npmjs.org` gives Vue components with DSM 7 styling;
+`app.css`. The installed `@synopackageland/ui` package gives Vue components with DSM 7 styling;
 import its `themes/dsm7-embedded.css` for use inside a DSM window.
 
 ## Languages
@@ -230,7 +300,7 @@ English. The window follows DSM's own language setting (`_S("lang")`).
   `ctx.t("greeting.setBy", { text, user })` in the UI; `{name}` is a
   placeholder, and `ctx.t("files", { count: 3 })` picks `files.one` or
   `files.other`. Missing keys fall back to English, then to the key itself.
-  `build-spk` embeds the catalogs in the DSM window script, so there is no
+  `build` embeds the catalogs in the DSM window script, so there is no
   extra request.
 - **Errors**: the backend returns a `code`; the UI shows
   `error.<code>` from the catalogs and uses the backend's English text only for
@@ -244,7 +314,7 @@ English. The window follows DSM's own language setting (`_S("lang")`).
 - **Package Center text**: `i18n.info` in `dsm-package.yaml` writes INFO
   `displayname_<lang>` / `description_<lang>` (for example `description_cht`).
 
-`synopkgland validate` and `build-spk` refuse a language file with missing or
+`synopkgland check` and `build` refuse a language file with missing or
 extra keys, a translation that drops a `{placeholder}`, an unsupported
 language, or a listed message that drifts from the glossary.
 
@@ -261,7 +331,8 @@ stays central), or replace the CGI with your own executable:
 ```yaml
 arches: [x86_64]
 backend:
-  binary:
+  kind: binary
+  files:
     x86_64: prebuilt/api-x86_64
 ```
 
@@ -316,92 +387,34 @@ delete the app data listed above** (`pkgwizard_remove_additional`), unchecked by
 default. Ticked, `postuninst` empties `@appdata/<package>` and `@apphome/<package>`
 and nothing else: not `@appconf`, Shared Folders, the package account or other
 packages. An upgrade never deletes anything. Do not write your own `postuninst`;
-`synopkgland inspect --spk` flags a deleting script that lacks the upgrade guard
+`synopkgland inspect` flags a deleting script that lacks the upgrade guard
 or deletes outside the package's own folders.
 
-A package with a root integration (the helper) also warns in its uninstall
-wizard: disable the integration in the App first. While it stays enabled,
-`preuninst` refuses the uninstall and writes the reason to
-`SYNOPKG_TEMP_LOGFILE`, which Package Center shows.
-
-## Root access
-
-By default (`privilege: none`) nothing in this package ever runs as root, and
-that is the right choice for almost every app. Lifecycle scripts and the CGI
-run as the package account, and nothing the package account can write is ever
-run as root.
-
-If your app truly needs root for a few fixed actions, create the project with
-`synopkgland init -t native-go --privilege root`. That sets `privilege: root`
-and adds:
-
-- `root/whoami.sh`: one root operation. Each `root/<name>.sh` (lowercase name,
-  `#!/bin/sh`, at most 16 KiB) is one operation. The demo only reports the
-  user ID it runs as (`{"euid":0}`). Replace it with your own fixed actions.
-- `backend/internal/app/root.go`: the `root.output` route (administrators
-  only) that returns an operation's last result.
-
-How it works, with no keys or signing involved:
-
-1. `build-spk` embeds each operation's exact task text in the DSM window. The
-   SPK payload carries no root script, and the package still runs as its own
-   account.
-2. The window shows an authorization panel above your app, in the user's
-   DSM language. A DSM administrator clicks **Authorize** and confirms with
-   their DSM password in DSM's own dialog. DSM then creates one **disabled**
-   root task in Task Scheduler, named `<package> root: <name>`. The
-   DSM 7.2+ uses its one-use password token for that task and never stores it.
-   DSM 7.1 uses the client-side confirmation described below.
-3. **Run** checks that the task is still exactly the approved text, runs it
-   with the administrator's session and shows its result. The task writes
-   only to `/run/synopkgland-<package>/<name>.out`, which root owns and your
-   backend can only read.
-4. The task text includes the package version, so after an upgrade the panel
-   shows "needs authorization again" and the old task never runs. A
-   same-named task that the panel did not create is never run, replaced or
-   deleted.
-5. **Remove** deletes the task, also an outdated one, without asking for the
-   password. Remove it before uninstalling the package, because DSM keeps
-   Task Scheduler tasks after an uninstall.
-
-Root templates keep a minimum of **DSM 7.1-42661**. Init, validation and build
-reject a root-package minimum below that version. DSM 7.0 has not been verified.
-The window probes TaskScheduler `list v3` once per access instance; only DSM
-error 103 selects the legacy API matrix. Permission, session and network errors
-do not trigger a fallback, and create/run requests are never automatically
-resent with another API version.
-
-| Operation | DSM 7.1 | DSM 7.2+ |
-| --- | --- | --- |
-| List / detail | `list v2` (offset/limit) / `get v3` | `list v3` (start/limit) / `get v4` |
-| Create | `TaskScheduler.create v3` | `TaskScheduler.Root.create v4` + `SynoConfirmPWToken` |
-| Run / delete | `run v2` / `delete v2` | `run v2` / `delete v2` |
-| Completion | `view v1` | `get_history_status_list v1` |
-
-**DSM 7.1 security difference:** DSM's PasswordConfirmDialog is still required
-in the window, but root-task creation has **no server-side password token**.
-Any authenticated administrator session can call `create v3` to create root
-tasks without this client dialog. The client confirmation records the user's
-intent; it does not provide the server-enforced fresh password proof of the
-7.2+ Root API. Both paths verify task name, root owner/real owner, disabled
-script type and the exact approved action text before run or removal.
-
-The legacy path saves the existing history before run and requires one new,
-completed record with a valid `stop_time`, integer `exit_code: 0` and
-`exit_type: normal`. It checks task identity again before returning output.
-An accepted run request or old output never proves completion. Calls and polls
-share a 30-second deadline (at most 60 polls, 500 ms apart); a timeout does not
-cancel a task that DSM already started. Concurrent calls in one window share
-one run. Existing running tasks, malformed or ambiguous history, and incomplete
-scheduler lists are refused. List/history snapshots are limited to 500 entries.
-Second-resolution history cannot identify same-second reruns reliably; those
-runs may time out rather than reuse an old success record.
-
-Non-administrators see DSM's "Only administrator accounts can perform this
-operation." and nothing else. HTTP requests can never choose what runs as
-root: the only root code is the fixed text an administrator approved. Your app
-can also use `ctx.root` (`state`, `authorize`, `run`, `remove`, `output`) to
-drive the same flow from its own UI.
+## Executor setup and delegation
+
+`init --with delegate` enables persistent jobs and offline file operations.
+`init --with root-ops` adds fixed `root/<name>.sh` operations for administrators.
+Both use one digest-pinned executor, with no SAS dependency. The package CGI and
+background worker run as the package account.
+
+An administrator confirms their DSM password once to create a root boot task
+and disabled control task. Exact task readback and socket status establish
+readiness. Reboot starts the protected executor without a browser session.
+Executor, policy or root-script changes require approval again; UI and package
+version changes do not. DSM 105 blocks setup without automatic retry.
+
+The Vue setup provider wraps `ctx.executor.status()`, `.authorize(password)` and
+`.control('start'|'stop'|'purge')`. Password confirmation goes to DSM; credentials
+are never persisted by the executor. Plain UI uses the window setup panel.
+Users submit downloads, choose a destination using their current DSM session,
+and revoke their own delegations. Offline writes recheck subject, UID, AppPriv,
+operation, scope and expiry, then write as the subject without overwriting.
+
+SPKs include `executor/executor` and `executor/policy.json`. Protected runtime
+and delegations live below `/usr/local/etc/synopkgland/<package>/` with root-only
+permissions. Purge removes these copies; removing DSM tasks remains an admin
+setup/lifecycle operation. Full installed-package lifecycle acceptance requires
+DSM testing.
 
 ## Support matrix
 
@@ -409,29 +422,5 @@ drive the same flow from its own UI.
 | --- | --- |
 | Build hosts | macOS, Linux (any OS with Go and Node) |
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each) |
-| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build-spk --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
+| DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | 32-bit ARM, DSM 6, running anything as root without an administrator's approval |
-
-### Shared root authorization (explicit opt-in)
-
-`init -t native-go --privilege root` adds `authorization.status`,
-`authorization.request` and `authorization.revoke` to the same package CGI URL.
-The Vue shell includes a centered authorization gate. Request/revoke return fixed
-plans; the host completes DSM PasswordConfirm/scheduler operations and reads status
-back before showing success. No password is sent to the package CGI.
-
-Each root SPK contains a SHA-256-pinned `authorization/bootstrap` and a v2 build
-inventory. The disabled native task copies bootstrap into a root-private directory
-and verifies the copied bytes before running a compiled fixed operation. The
-bootstrap verifies UI build hashes; helper control scripts retain their helper pins.
-Changing root code, helper or UI requires rebuilding and fresh authorization.
-`inspect --spk` checks bootstrap/CGI/window/inventory bindings; missing pins fail.
-The default `privilege: none` has no bootstrap or authorization routes, and all
-lifecycle scripts and CGI continue to use the package account.
-
-Before upgrading a helper integration, revoke/disable its current grant and verify
-cleanup. The existing pre-upgrade guard refuses a live helper; a new build never
-activates root automatically. Plain UI keeps its per-operation result controls.
-A non-Go prebuilt CGI must implement its own adapter and cannot use this generated
-root authorization contract. Native-layout products such as Reclaim retain their
-own privileged runtime until they explicitly migrate their adapters.

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,4 +1,4 @@
-DSM integration helper build dependencies
+Native Go package build dependencies
 
 github.com/godbus/dbus/v5 v5.2.3-0.20260924123156-0ea052abeb82 (BSD-2-Clause)
 Pinned upstream commit: 0ea052abeb820894f944095b3c2dc125cef0df85

package/templates/native-go/backend/cmd/app/main.go

@@ -1,5 +1,3 @@
-//go:build !synopkgland_sdk_workers
-
 // Command app is the package backend. DSM runs it as a CGI (ui/cgi/api.cgi in
 // the package) under the package account, once per request.
 //
@@ -7,9 +5,9 @@
 package main
 
 import (
-	"encoding/json"
 	"fmt"
 	"log"
+	"net/http"
 	"net/http/cgi"
 	"os"
 
@@ -17,19 +15,20 @@ import (
 	"dsmapp/internal/app"
 	"dsmapp/internal/dsm"
 	"dsmapp/internal/filestation"
-	"dsmapp/internal/helper"
+	standaloneidentity "dsmapp/internal/identity"
 )
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	rootAuthorization = ""
-	packageID         = "dev"
-	version           = "0.0.0"
-	helperInventory   = ""
-	// "package" when the project has an integration but no privileged helper.
-	integrationMode = ""
+	delegateScope  = ""
+	executorDigest = ""
+	policyDigest   = ""
+	packageID      = "dev"
+	version        = "0.0.0"
 	// "session" when the project opted into the interactive File Station adapter.
 	fileStation = ""
+	// "standalone" enables the SDK identity adapter; the runtime owns authentication.
+	identity = ""
 )
 
 func main() {
@@ -40,29 +39,37 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		RootAuthorization: rootAuthorization,
-		PackageID:         packageID,
-		Version:           version,
-		DataDir:           "/var/packages/" + packageID + "/var",
-
-		PackageIntegration: integrationMode == "package",
+		DelegateScope:  delegateScope,
+		ExecutorDigest: executorDigest, PolicyDigest: policyDigest,
+		PackageID: packageID,
+		Version:   version,
+		DataDir:   "/var/packages/" + packageID + "/var",
+	}
+	if app.SessionFilesEnabled(fileStation) {
+		cfg.SessionFiles = filestation.Local(cfg.DataDir)
 	}
-	if helperInventory != "" {
-		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {
-			cfg.HelperInventory = helper.Inventory{Package: packageID}
+	var auth api.Authenticator = dsm.NewAuthenticator()
+	var standalone *standaloneidentity.Service
+	if identity == "standalone" {
+		var err error
+		standalone, err = app.StandaloneIdentity(cfg, os.Getenv("SCRIPT_NAME"))
+		if err != nil {
+			log.Fatal("identity configuration unavailable")
 		}
+		auth = standalone
+	}
+	srv, err := api.NewServer(auth, app.Routes(cfg)...)
+	if err != nil {
+		log.Fatal(err)
 	}
 	if err := app.Migrate(cfg); err != nil {
 		log.Fatalf("schema migration failed: %v", err)
 	}
-	if app.SessionFilesEnabled(cfg.HelperInventory, fileStation) {
-		cfg.SessionFiles = filestation.Local(cfg.DataDir)
-	}
-	srv, err := api.NewServer(dsm.NewAuthenticator(), app.Routes(cfg)...)
-	if err != nil {
-		log.Fatal(err)
+	var handler http.Handler = srv
+	if standalone != nil {
+		handler = standalone.Wrap(handler)
 	}
-	if err := cgi.Serve(srv); err != nil {
+	if err := cgi.Serve(api.WithRequestDeadline(handler)); err != nil {
 		log.Fatal(err)
 	}
 }

package/templates/native-go/backend/internal/api/cgi_framing_test.go

@@ -0,0 +1,32 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+)
+
+func TestJSONHasExactCGIResponseLength(t *testing.T) {
+	for _, value := range []any{map[string]any{"success": true, "data": "\u8cc7\u6599\u593e"}, map[string]any{"success": false, "error": "denied"}, make(chan int)} {
+		w := httptest.NewRecorder()
+		writeJSON(w, http.StatusOK, value)
+		if w.Header().Get("Content-Length") != strconv.Itoa(w.Body.Len()) {
+			t.Fatalf("CGI response missing exact byte length: %v", w.Header())
+		}
+		if !json.Valid(w.Body.Bytes()) {
+			t.Fatal("invalid JSON response")
+		}
+		if _, unsupported := value.(chan int); unsupported {
+			var fallback struct {
+				Success bool
+				Error   struct{ Code string }
+			}
+			_ = json.Unmarshal(w.Body.Bytes(), &fallback)
+			if w.Code != http.StatusOK || fallback.Success || fallback.Error.Code != "internal" {
+				t.Fatal("serialization failure lost DSM JSON refusal envelope")
+			}
+		}
+	}
+}

package/templates/native-go/backend/internal/api/cookie_review_test.go

@@ -0,0 +1,28 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+)
+
+func TestReviewInvalidDuplicateIDMustNotBeDiscarded(t *testing.T) {
+	r := httptest.NewRequest("POST", "/", nil)
+	r.Header.Set("Cookie", "id=session; id=invalid\tvalue")
+	r.Header.Set("X-SYNO-TOKEN", "token")
+	if _, err := DSMSession(r); err == nil {
+		t.Fatal("duplicate id silently dropped; accepted request")
+	}
+}
+func TestCookieRejectsEveryASCIIControl(t *testing.T) {
+	for c := 0; c <= 127; c++ {
+		if c >= 32 && c != 127 {
+			continue
+		}
+		r := httptest.NewRequest("POST", "/", nil)
+		r.Header.Set("Cookie", "id=sess"+string(rune(c))+"ion")
+		r.Header.Set("X-SYNO-TOKEN", "token")
+		if _, err := DSMSession(r); err == nil {
+			t.Errorf("accepted control %d", c)
+		}
+	}
+}

package/templates/native-go/backend/internal/api/deadline_test.go

@@ -0,0 +1,114 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+type deadlineAuth struct {
+	t   *testing.T
+	ctx context.Context
+}
+
+func (a *deadlineAuth) Authenticate(r *http.Request) (Identity, error) {
+	a.t.Helper()
+	d, ok := r.Context().Deadline()
+	if !ok || time.Until(d) > 20*time.Second || time.Until(d) <= 0 {
+		a.t.Fatalf("authentication deadline: %v %v", d, ok)
+	}
+	a.ctx = r.Context()
+	return Identity{User: "alice", Admin: true}, nil
+}
+func TestRequestDeadlineReachesAuthenticationAndAllHandlers(t *testing.T) {
+	for _, kind := range []string{"json", "request", "response", "stream"} {
+		t.Run(kind, func(t *testing.T) {
+			auth := &deadlineAuth{t: t}
+			called := false
+			check := func(ctx context.Context, r *http.Request) {
+				t.Helper()
+				called = true
+				if ctx != auth.ctx || (r != nil && r.Context() != ctx) {
+					t.Fatal("context not propagated")
+				}
+			}
+			var route Route
+			switch kind {
+			case "json":
+				route = Handle("demo.deadline", func(ctx context.Context, _ Caller, _ json.RawMessage) (any, error) { check(ctx, nil); return nil, nil })
+			case "request":
+				route = HandleRequest("demo.deadline", func(ctx context.Context, _ Caller, r *http.Request, _ json.RawMessage) (any, error) {
+					check(ctx, r)
+					return nil, nil
+				})
+			case "response":
+				route = HandleResponse("demo.deadline", func(ctx context.Context, _ Caller, _ http.ResponseWriter, r *http.Request, _ json.RawMessage) error {
+					check(ctx, r)
+					return nil
+				})
+			case "stream":
+				route = HandleStream("demo.deadline", func(ctx context.Context, _ Caller, _ http.ResponseWriter, r *http.Request) error {
+					check(ctx, r)
+					return nil
+				})
+			}
+			srv := newTestServer(t, auth, route)
+			target := "/api.cgi"
+			if kind == "stream" {
+				target += "?method=demo.deadline"
+			}
+			r := httptest.NewRequest("POST", target, strings.NewReader(`{"method":"demo.deadline"}`))
+			r.Header.Set("Content-Type", "application/json")
+			srv.ServeHTTP(httptest.NewRecorder(), r)
+			if !called || auth.ctx.Err() != context.Canceled {
+				t.Fatalf("called=%v context=%v", called, auth.ctx)
+			}
+		})
+	}
+}
+func TestEarlierRequestDeadlinePreserved(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	srv := newTestServer(t, &fakeAuth{admin: true}, Handle("demo.wait", func(c context.Context, _ Caller, _ json.RawMessage) (any, error) {
+		want, _ := ctx.Deadline()
+		got, ok := c.Deadline()
+		if !ok || !got.Equal(want) {
+			t.Fatal("earlier deadline lost")
+		}
+		<-c.Done()
+		return nil, c.Err()
+	}))
+	r := httptest.NewRequest("POST", "/api.cgi", strings.NewReader(`{"method":"demo.wait"}`)).WithContext(ctx)
+	r.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	srv.ServeHTTP(w, r)
+	if !strings.Contains(w.Body.String(), `"bad_response"`) {
+		t.Fatal(w.Body.String())
+	}
+}
+
+func TestCGIDeadlineIncludesOuterIdentityMiddleware(t *testing.T) {
+	var outerDeadline time.Time
+	srv := newTestServer(t, &fakeAuth{admin: true}, Handle("demo.deadline", func(ctx context.Context, _ Caller, _ json.RawMessage) (any, error) {
+		d, _ := ctx.Deadline()
+		if !d.Equal(outerDeadline) {
+			t.Fatal("API restarted the outer CGI budget")
+		}
+		return nil, nil
+	}))
+	outer := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var ok bool
+		outerDeadline, ok = r.Context().Deadline()
+		if !ok || time.Until(outerDeadline) > 20*time.Second {
+			t.Fatal("outer middleware has no CGI deadline")
+		}
+		srv.ServeHTTP(w, r)
+	})
+	r := httptest.NewRequest("POST", "/api.cgi", strings.NewReader(`{"method":"demo.deadline"}`))
+	r.Header.Set("Content-Type", "application/json")
+	WithRequestDeadline(outer).ServeHTTP(httptest.NewRecorder(), r)
+}