@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/_authorization/main_test.go

@@ -1,35 +0,0 @@
-package main
-
-import (
-	"crypto/sha256"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestInventoryRejectsReplacementAndSymlinkEscape(t *testing.T) {
-	dir := t.TempDir()
-	body := []byte("approved bytes")
-	os.WriteFile(filepath.Join(dir, "file"), body, 0600)
-	raw := fmt.Sprintf(`{"schema":2,"files":[{"path":"file","size":%d,"sha256":"%x"}]}`, len(body), sha256.Sum256(body))
-	if e := verifyFiles(dir, []byte(raw)); e != nil {
-		t.Fatal(e)
-	}
-	os.WriteFile(filepath.Join(dir, "file"), []byte("altered bytes!"), 0600)
-	if e := verifyFiles(dir, []byte(raw)); e == nil {
-		t.Fatal("accepted replacement")
-	}
-	os.Remove(filepath.Join(dir, "file"))
-	outside := filepath.Join(t.TempDir(), "file")
-	os.WriteFile(outside, body, 0600)
-	os.Symlink(outside, filepath.Join(dir, "file"))
-	if e := verifyFiles(dir, []byte(raw)); e == nil {
-		t.Fatal("accepted external symlink")
-	}
-}
-func TestUnknownOperationNeverRuns(t *testing.T) {
-	if e := run([]string{"arbitrary"}); e == nil {
-		t.Fatal("accepted unknown operation")
-	}
-}

package/dist/templates/_shared/notice-overrides/index.json

@@ -1,14 +0,0 @@
-{
-  "@better-auth/utils@0.4.2": {
-    "integrity": "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==",
-    "file": "utils-0.4.2-LICENSE",
-    "source": "https://github.com/better-auth/utils/blob/ef522888b7b2ff77ca13f0afb476dfae8f297862/LICENSE",
-    "provenance": "Release manifests declare MIT but omit license text; retained upstream project license added in commit ef522888b7b2ff77ca13f0afb476dfae8f297862"
-  },
-  "@better-auth/utils@0.5.0": {
-    "integrity": "sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==",
-    "file": "utils-0.5.0-LICENSE",
-    "source": "https://github.com/better-auth/utils/blob/ef522888b7b2ff77ca13f0afb476dfae8f297862/LICENSE",
-    "provenance": "Release manifests declare MIT but omit license text; retained upstream project license added in commit ef522888b7b2ff77ca13f0afb476dfae8f297862"
-  }
-}

package/dist/templates/_shared/notice-overrides/utils-0.4.2-LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2024 - present, Bereket Engida
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/templates/_shared/notice-overrides/utils-0.5.0-LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2024 - present, Bereket Engida
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/templates/binary/native.yaml

@@ -1,16 +0,0 @@
-schema: 1
-
-targets:
-  x86_64:
-    path: ./dist/app-x86_64.tar.gz
-    strip_components: 1
-  aarch64:
-    path: ./dist/app-aarch64.tar.gz
-    strip_components: 1
-
-service:
-  exec: bin/app
-  args:
-    - "-data=${SYNOPKG_PKGVAR}"
-  env:
-    TMPDIR: ${SYNOPKG_PKGVAR}/tmp

package/dist/templates/binary/synology-app.yaml

@@ -1,7 +0,0 @@
-schema: 1
-package: com.example.binary-app
-version: 0.1.0
-displayname: Binary App
-description: A minimal Syno Package Land app that runs one prebuilt binary.
-maintainer: Syno Package Land
-os_min_ver: "7.1-42661"

package/dist/templates/compose-import/compose.yaml

@@ -1,10 +0,0 @@
-services:
-  app:
-    image: hello-world:latest@sha256:5e23090353324d887c48ad5e5c56d294eab81588df9605b07d1afe895f9cc8f8
-    volumes:
-      - "${MEDIA_SHARE}:/media"
-      - "${BACKUP_SHARE}:/backup"
-      - "upstream_data:/var/lib/upstream"
-
-volumes:
-  upstream_data:

package/dist/templates/compose-import/synology-app.yaml

@@ -1,15 +0,0 @@
-schema: 1
-package: com.synology.compose.import
-version: 0.1.0
-displayname: Compose Import
-description: Start from an existing Compose file and select two Shared Folders at install time.
-maintainer: Syno Package Land
-os_min_ver: "7.2.1-69057"
-
-install:
-  MEDIA_SHARE:
-    type: shared_folder
-  BACKUP_SHARE:
-    type: shared_folder
-  RUN_AS:
-    type: dsm_user

package/dist/templates/native-go/backend/cmd/app/sdk_main.go

@@ -1,62 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-// Command app is the package backend. DSM runs it as a CGI (ui/cgi/api.cgi in
-// the package) under the package account, once per request.
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"log"
-	"net/http/cgi"
-	"os"
-
-	"dsmapp/internal/api"
-	"dsmapp/internal/app"
-	"dsmapp/internal/dsm"
-	"dsmapp/internal/filestation"
-	"dsmapp/internal/helper"
-)
-
-// Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
-var (
-	rootAuthorization = ""
-	packageID         = "dev"
-	version           = "0.0.0"
-	helperInventory   = ""
-	// "session" when the project opted into the interactive File Station adapter.
-	fileStation = ""
-)
-
-func main() {
-	log.SetFlags(0)
-	log.SetPrefix(packageID + ": ")
-	if os.Getenv("GATEWAY_INTERFACE") == "" {
-		fmt.Fprintf(os.Stderr, "%s %s: this program runs as the package's DSM CGI; open the app from the DSM main menu.\n", packageID, version)
-		os.Exit(2)
-	}
-	cfg := app.Config{
-		RootAuthorization: rootAuthorization,
-		PackageID:         packageID,
-		Version:           version,
-		DataDir:           "/var/packages/" + packageID + "/var",
-	}
-	if helperInventory != "" {
-		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {
-			cfg.HelperInventory = helper.Inventory{Package: packageID}
-		}
-	}
-	if err := app.Migrate(cfg); err != nil {
-		log.Fatalf("schema migration failed: %v", err)
-	}
-	if app.SessionFilesEnabled(cfg.HelperInventory, fileStation) {
-		cfg.SessionFiles = filestation.Local(cfg.DataDir)
-	}
-	srv, err := api.NewServer(dsm.NewAuthenticator(), app.Routes(cfg)...)
-	if err != nil {
-		log.Fatal(err)
-	}
-	if err := cgi.Serve(app.SDKHandler(srv)); err != nil {
-		log.Fatal(err)
-	}
-}

package/dist/templates/native-go/backend/cmd/dsm-readonly-probe/main_linux.go

@@ -1,46 +0,0 @@
-// A standalone evidence-only static probe. No helper activation or mutation.
-package main
-
-import (
-	"context"
-	"dsmapp/internal/dsmprobe"
-	"encoding/json"
-	"golang.org/x/sys/unix"
-	"io"
-	"os"
-	"runtime"
-	"time"
-)
-
-func main() {
-	if len(os.Args) != 2 || os.Args[1] != "--wire-v1" {
-		os.Exit(2)
-	}
-	// Watchdog owns this bounded observation; no children or services are created.
-	go func() { time.Sleep(8 * time.Second); os.Exit(124) }()
-	runtime.LockOSThread()
-	if unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != nil || unix.Prctl(unix.PR_SET_DUMPABLE, 0, 0, 0, 0) != nil {
-		os.Exit(3)
-	}
-	data, e := io.ReadAll(io.LimitReader(os.Stdin, dsmprobe.MaxRequestBytes+1))
-	if e != nil {
-		os.Exit(2)
-	}
-	request, e := dsmprobe.DecodeRequest(data)
-	if e != nil {
-		os.Exit(2)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 7*time.Second)
-	defer cancel()
-	out, e := dsmprobe.Collect(ctx, request)
-	if e != nil {
-		out.Status = "unsupported"
-	}
-	data, e = json.Marshal(out)
-	if e != nil || len(data) > dsmprobe.MaxResponseBytes {
-		os.Exit(3)
-	}
-	if _, e = os.Stdout.Write(append(data, '\n')); e != nil {
-		os.Exit(3)
-	}
-}

package/dist/templates/native-go/backend/cmd/helper/main.go

@@ -1,64 +0,0 @@
-// Built only when dsm-package.yaml explicitly opts into integration.
-package main
-
-import (
-	"context"
-	"dsmapp/internal/helper"
-	"encoding/json"
-	"fmt"
-	"os"
-)
-
-var helperInventory string
-
-func main() {
-	var i helper.Inventory
-	if len(os.Args) != 2 || json.Unmarshal([]byte(helperInventory), &i) != nil {
-		os.Exit(2)
-	}
-	if os.Args[1] == "revoke" || os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
-		c, err := helper.LocalClient(i)
-		if err != nil {
-			os.Exit(1)
-		}
-		if os.Args[1] == "diagnose-startup" {
-			diagnostic, err := c.StartupDiagnostic()
-			if err != nil {
-				fmt.Fprintln(os.Stderr, "startup diagnostic unavailable")
-				os.Exit(1)
-			}
-			json.NewEncoder(os.Stdout).Encode(diagnostic)
-			return
-		}
-		if os.Args[1] == "diagnose" {
-			json.NewEncoder(os.Stdout).Encode(c.Status(context.Background()))
-			return
-		}
-		if os.Args[1] == "revoke" {
-			if c.Revoke(context.Background()) != nil {
-				os.Exit(1)
-			}
-			return
-		}
-		if c.CheckStopped(context.Background()) != nil {
-			os.Exit(1)
-		}
-		return
-	}
-	if os.Args[1] == "purge" {
-		if os.Geteuid() != 0 {
-			os.Exit(1)
-		}
-		c, err := helper.LocalClient(i)
-		if err != nil || c.Purge() != nil {
-			os.Exit(1)
-		}
-		fmt.Println(`{"success":true}`)
-		return
-	}
-	if err := helper.RunLinux(i, os.Args[1]); err != nil {
-		fmt.Fprintln(os.Stderr, "helper lifecycle refused")
-		os.Exit(1)
-	}
-	fmt.Println(`{"success":true}`)
-}

package/dist/templates/native-go/backend/cmd/helper/sdk_registry.go

@@ -1,19 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package main
-
-import (
-	"dsmapp/internal/helper"
-	"encoding/json"
-	"os"
-)
-
-// Linker-bound source-validated registry, never package-writable JSON.
-var sdkWorkerRegistry string
-
-func init() {
-	var inventory helper.Inventory
-	if json.Unmarshal([]byte(helperInventory), &inventory) != nil || helper.InstallSDKRegistry(inventory, sdkWorkerRegistry) != "" {
-		os.Exit(2)
-	}
-}

package/dist/templates/native-go/backend/internal/api/binary.go

@@ -1,154 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"regexp"
-	"strconv"
-	"sync"
-	"time"
-)
-
-const MaxBinaryReadBytes = 1 << 20
-const BinaryReadTimeout = 10 * time.Second
-
-// Control IDs are not bearer authority. The trusted adapter must revalidate
-// the original caller/session, epoch, grant revision and every chunk ticket.
-// The fixed route accepts no path, offset, range, URL, filename or MIME type.
-type BinaryReadRequest struct {
-	OperationID string `json:"operationId"`
-	Epoch       string `json:"epoch"`
-	Token       string `json:"token"`
-}
-
-// Body must implement Close concurrently with Read and unblock it on Close.
-// Close releases/cancels the helper transfer; it is not itself a Q receipt.
-type BinaryRead struct {
-	Body        io.ReadCloser
-	Bytes       uint64
-	OperationID string
-}
-type BinaryReadHandler func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error)
-
-func BoundedRead(h BinaryReadHandler) Route {
-	return Route{method: "nas.files.read.binary", policy: policyUser, binary: h}
-}
-
-var binaryReference = regexp.MustCompile(`^[a-f0-9]{64}$`)
-
-func serveBoundedRead(w http.ResponseWriter, r *http.Request, c Caller, params json.RawMessage, h BinaryReadHandler) {
-	if r.Context().Err() != nil {
-		writeError(w, &Error{"canceled", "read canceled"})
-		return
-	}
-	if r.Header.Get("Range") != "" {
-		writeError(w, BadRequest("ranges are unsupported"))
-		return
-	}
-	in, ok := decodeBinaryReadControl(params)
-	if !ok {
-		writeError(w, BadRequest("invalid binary read control"))
-		return
-	}
-	ctx, cancel := context.WithTimeout(r.Context(), BinaryReadTimeout)
-	defer cancel()
-	result, err := h(ctx, c, r, params)
-	if err != nil {
-		if result.Body != nil {
-			result.Body.Close()
-		}
-		writeError(w, asError(err))
-		return
-	}
-	if result.Body == nil {
-		writeError(w, internalError)
-		return
-	}
-	var once sync.Once
-	var closeErr error
-	closeBody := func() { once.Do(func() { closeErr = result.Body.Close() }) }
-	defer closeBody()
-	if result.Bytes > MaxBinaryReadBytes || result.OperationID != in.OperationID {
-		writeError(w, BadRequest("invalid bounded read result"))
-		return
-	}
-	stop := make(chan struct{})
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		select {
-		case <-ctx.Done():
-			closeBody()
-		case <-stop:
-		}
-	}()
-	// Materialize only the bounded response so short/error/overlong transfers
-	// cannot become successful binary responses. Helper relay still leases at
-	// most one 64KiB chunk. Long CGI streaming remains disabled pending DSM proof.
-	body, readErr := io.ReadAll(io.LimitReader(result.Body, int64(result.Bytes)+1))
-	closeBody()
-	close(stop)
-	<-done
-	if ctx.Err() != nil {
-		writeError(w, &Error{"canceled", "read expired or canceled"})
-		return
-	}
-	if readErr != nil || closeErr != nil || uint64(len(body)) != result.Bytes {
-		writeError(w, &Error{"read_failed", "binary read failed"})
-		return
-	}
-	headers := w.Header()
-	headers.Set("Content-Type", "application/octet-stream")
-	headers.Set("Content-Length", strconv.FormatUint(result.Bytes, 10))
-	headers.Set("Cache-Control", "no-store")
-	headers.Set("X-Content-Type-Options", "nosniff")
-	w.WriteHeader(http.StatusOK)
-	// Go CGI may buffer or block stdout. All helper resources have already been
-	// released; there is no long-stream readiness claim from this bounded write.
-	_, _ = w.Write(body)
-}
-
-// Fixed shape with duplicate-key rejection, so two parsers cannot bind a token
-// to different operations. Controls never grow the existing ctx.call envelope.
-func decodeBinaryReadControl(raw json.RawMessage) (BinaryReadRequest, bool) {
-	var in BinaryReadRequest
-	if len(raw) > 16*1024 {
-		return in, false
-	}
-	d := json.NewDecoder(bytes.NewReader(raw))
-	first, e := d.Token()
-	if e != nil || first != json.Delim('{') {
-		return in, false
-	}
-	seen := map[string]bool{}
-	for d.More() {
-		token, e := d.Token()
-		key, ok := token.(string)
-		if e != nil || !ok || seen[key] {
-			return in, false
-		}
-		seen[key] = true
-		var value string
-		if d.Decode(&value) != nil {
-			return in, false
-		}
-		switch key {
-		case "operationId":
-			in.OperationID = value
-		case "epoch":
-			in.Epoch = value
-		case "token":
-			in.Token = value
-		default:
-			return in, false
-		}
-	}
-	end, e := d.Token()
-	if e != nil || end != json.Delim('}') || d.Decode(new(any)) != io.EOF {
-		return in, false
-	}
-	return in, binaryReference.MatchString(in.OperationID) && binaryReference.MatchString(in.Epoch) && binaryReference.MatchString(in.Token)
-}

package/dist/templates/native-go/backend/internal/api/binary_test.go

@@ -1,165 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/cgi"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-type binarySource struct {
-	io.Reader
-	closed bool
-}
-
-func (s *binarySource) Close() error { s.closed = true; return nil }
-func TestBoundedReadBinaryGuardAndBody(t *testing.T) {
-	for _, kind := range []string{"valid", "anonymous", "cross-origin", "oversize", "short", "nil", "cancel"} {
-		t.Run(kind, func(t *testing.T) {
-			auth := &fakeAuth{user: "normal1"}
-			if kind == "anonymous" {
-				auth.err = ErrNoSession
-			}
-			src := &binarySource{Reader: bytes.NewReader([]byte{0, 1, 255, 10})}
-			called := false
-			srv, e := NewServer(auth, BoundedRead(func(ctx context.Context, c Caller, r *http.Request, params json.RawMessage) (BinaryRead, error) {
-				called = true
-				if !c.Authenticated() || c.User() != "normal1" {
-					t.Fatal(c)
-				}
-				n := uint64(4)
-				if kind == "oversize" {
-					n = MaxBinaryReadBytes + 1
-				}
-				if kind == "short" {
-					n = 5
-				}
-				if kind == "nil" {
-					return BinaryRead{}, nil
-				}
-				return BinaryRead{Body: src, Bytes: n, OperationID: strings.Repeat("a", 64)}, nil
-			}))
-			if e != nil {
-				t.Fatal(e)
-			}
-			r := httptest.NewRequest("POST", "http://nas.local/cgi/api.cgi", strings.NewReader(`{"method":"nas.files.read.binary","params":{"operationId":"`+strings.Repeat("a", 64)+`","epoch":"`+strings.Repeat("b", 64)+`","token":"`+strings.Repeat("c", 64)+`"}}`))
-			r.Header.Set("Content-Type", "application/json")
-			if kind == "cross-origin" {
-				r.Header.Set("Origin", "http://evil.local")
-			}
-			if kind == "cancel" {
-				ctx, cancel := context.WithCancel(r.Context())
-				cancel()
-				r = r.WithContext(ctx)
-			}
-			w := httptest.NewRecorder()
-			srv.ServeHTTP(w, r)
-			if kind == "valid" {
-				if w.Header().Get("Content-Type") != "application/octet-stream" || !bytes.Equal(w.Body.Bytes(), []byte{0, 1, 255, 10}) || w.Header().Get("Content-Length") != "4" || !src.closed {
-					t.Fatal(w.Body.String(), w.Header())
-				}
-			} else {
-				if w.Header().Get("Content-Type") != "application/json" {
-					t.Fatal("invalid binary escaped")
-				}
-				if (kind == "anonymous" || kind == "cross-origin" || kind == "cancel") && called {
-					t.Fatal("handler called before guards")
-				}
-				if called && kind != "nil" && !src.closed {
-					t.Fatal("source not closed")
-				}
-			}
-		})
-	}
-}
-
-type blockedBinarySource struct {
-	done chan struct{}
-	once sync.Once
-}
-
-func (s *blockedBinarySource) Read([]byte) (int, error) { <-s.done; return 0, io.ErrClosedPipe }
-func (s *blockedBinarySource) Close() error             { s.once.Do(func() { close(s.done) }); return nil }
-func TestBoundedBinaryDisconnectCancelsSource(t *testing.T) {
-	src := &blockedBinarySource{done: make(chan struct{})}
-	started := make(chan struct{})
-	srv, e := NewServer(&fakeAuth{user: "normal1"}, BoundedRead(func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error) {
-		close(started)
-		return BinaryRead{Body: src, Bytes: 1, OperationID: strings.Repeat("a", 64)}, nil
-	}))
-	if e != nil {
-		t.Fatal(e)
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	r := httptest.NewRequest("POST", "http://nas.local/cgi/api.cgi", strings.NewReader(`{"method":"nas.files.read.binary","params":{"operationId":"`+strings.Repeat("a", 64)+`","epoch":"`+strings.Repeat("b", 64)+`","token":"`+strings.Repeat("c", 64)+`"}}`)).WithContext(ctx)
-	r.Header.Set("Content-Type", "application/json")
-	done := make(chan struct{})
-	go func() { defer close(done); srv.ServeHTTP(httptest.NewRecorder(), r) }()
-	<-started
-	cancel()
-	select {
-	case <-done:
-	case <-time.After(time.Second):
-		t.Fatal("disconnect did not release bounded source")
-	}
-}
-func TestBoundedBinaryRejectsCallerPathsAndTransferSubstitution(t *testing.T) {
-	calls := 0
-	srv, e := NewServer(&fakeAuth{user: "normal1"}, BoundedRead(func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error) {
-		calls++
-		return BinaryRead{}, nil
-	}))
-	if e != nil {
-		t.Fatal(e)
-	}
-	for _, params := range []string{`{}`, `{"operationId":"x"}`, `{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `","path":"/secret"}`} {
-		_, env := post(t, srv, `{"method":"nas.files.read.binary","params":`+params+`}`)
-		if env.Success || env.Error == nil || env.Error.Code != "bad_request" {
-			t.Fatal(env)
-		}
-	}
-	if calls != 0 {
-		t.Fatal("invalid control reached adapter")
-	}
-}
-
-func TestBoundedBinaryRealCGIWire(t *testing.T) {
-	requestBody := `{"method":"nas.files.read.binary","params":{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `"}}`
-	h := &cgi.Handler{Path: os.Args[0], Args: []string{"-test.run=TestBoundedBinaryCGIProcessFixture"}, Env: []string{"S6_CGI_FIXTURE=1"}}
-	r := httptest.NewRequest("POST", "http://nas.local/cgi/api.cgi", strings.NewReader(requestBody))
-	r.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, r)
-	if w.Code != http.StatusOK || w.Header().Get("Content-Type") != "application/octet-stream" || w.Header().Get("Content-Length") != "1048576" || !bytes.Equal(w.Body.Bytes(), bytes.Repeat([]byte{0, 255, 10, 13}, MaxBinaryReadBytes/4)) {
-		t.Fatal(w.Code, w.Header(), w.Body.Len())
-	}
-}
-func TestBoundedBinaryCGIProcessFixture(t *testing.T) {
-	if os.Getenv("S6_CGI_FIXTURE") != "1" {
-		t.Skip("spawned CGI-only process")
-	}
-	srv, e := NewServer(&fakeAuth{user: "normal1"}, BoundedRead(func(context.Context, Caller, *http.Request, json.RawMessage) (BinaryRead, error) {
-		return BinaryRead{Body: io.NopCloser(bytes.NewReader(bytes.Repeat([]byte{0, 255, 10, 13}, MaxBinaryReadBytes/4))), Bytes: MaxBinaryReadBytes, OperationID: strings.Repeat("a", 64)}, nil
-	}))
-	if e != nil {
-		os.Exit(1)
-	}
-	if cgi.Serve(srv) != nil {
-		os.Exit(1)
-	}
-	os.Exit(0)
-}
-func TestBinaryControlRejectsDuplicates(t *testing.T) {
-	raw := `{"operationId":"` + strings.Repeat("a", 64) + `","epoch":"` + strings.Repeat("b", 64) + `","token":"` + strings.Repeat("c", 64) + `","token":"` + strings.Repeat("d", 64) + `"}`
-	if _, ok := decodeBinaryReadControl(json.RawMessage(raw)); ok {
-		t.Fatal("duplicate transfer token")
-	}
-}

package/dist/templates/native-go/backend/internal/app/authorization_none.go

@@ -1,5 +0,0 @@
-package app
-
-import "dsmapp/internal/api"
-
-func (Config) authorizationRoutes() []api.Route { return nil }