@synopackageland/cli 0.6.0 → 0.7.0

package/dist/templates/native-go-delegate/backend/internal/delegate/long_running_routes.go

@@ -0,0 +1,92 @@
+package delegate
+
+import (
+	"bytes"
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"net/http"
+)
+
+// The immutable SDK role map is assembled by W1. No route accepts a caller
+// chosen owner/UID, nor can an HTTP request use the sessionless daemon facade.
+func (s *Service) longRunningRoutes() []api.Route {
+	routes := []api.Route{}
+	for _, method := range []string{"delegate.example.export", "delegate.destination", "delegate.select_destination", "delegate.move_from_staging", "delegate.operations.list", "delegate.operations.get", "delegate.operations.cancel", "delegate.disable", "delegate.enable", "delegate.audit"} {
+		name := method
+		routes = append(routes, api.HandleRequest(name, func(ctx context.Context, caller api.Caller, r *http.Request, raw json.RawMessage) (any, error) {
+			if !caller.Authenticated() {
+				return nil, fail("session_required")
+			}
+			auth, err := api.DSMSession(r)
+			if err != nil {
+				return nil, err
+			}
+			switch name {
+			case "delegate.example.export":
+				var in struct {
+					Key   string `json:"key"`
+					JobID string `json:"job_id"`
+				}
+				if err = strict(raw, &in); err != nil {
+					return nil, err
+				}
+				return s.ExportExample(ctx, caller, r, in.Key, in.JobID)
+			case "delegate.destination":
+				var in struct {
+					Key string `json:"key"`
+				}
+				if err = strict(raw, &in); err != nil {
+					return nil, err
+				}
+				return s.Destination(ctx, caller, r, in.Key)
+			case "delegate.operations.list":
+				if bytes.Equal(bytes.TrimSpace(raw), []byte("null")) {
+					return nil, api.BadRequest("empty parameters required")
+				}
+				if err = strict(raw, &struct{}{}); err != nil {
+					return nil, err
+				}
+				return s.listOperations(ctx, caller, auth)
+			case "delegate.select_destination":
+				var in SelectDestinationParams
+				if err = strict(raw, &in); err != nil {
+					return nil, err
+				}
+				return s.SelectDestination(ctx, caller, r, in)
+			case "delegate.move_from_staging":
+				var in MoveParams
+				if err = strict(raw, &in); err != nil {
+					return nil, err
+				}
+				if err = validateMove(in); err != nil {
+					return nil, err
+				}
+				if err = s.verifyOperationOwner(ctx, caller, auth, in.DelegationID); err != nil {
+					return nil, err
+				}
+				return s.admitStaging(ctx, auth, in)
+			case "delegate.operations.get", "delegate.operations.cancel":
+				var in OperationRef
+				if err = strict(raw, &in); err != nil {
+					return nil, err
+				}
+				if name == "delegate.operations.cancel" {
+					return s.CancelOperation(ctx, auth, in)
+				}
+				return s.OperationStatus(ctx, auth, in)
+			default:
+				if (name == "delegate.disable" || name == "delegate.enable") && !caller.Admin() {
+					return nil, fail("admin_required")
+				}
+				if err = strict(raw, &struct{}{}); err != nil {
+					return nil, err
+				}
+				var out json.RawMessage
+				err = s.Client.Call(ctx, name, auth, nil, &out)
+				return out, err
+			}
+		}))
+	}
+	return routes
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/long_running_routes_test.go

@@ -0,0 +1,99 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func longRPC(t *testing.T, s *Service, user, method, raw, token string) map[string]any {
+	t.Helper()
+	methods := map[string]string{}
+	// SDK routes use the shipped SDK roles, including the administrator floor.
+	policy, _ := json.Marshal(map[string]any{"schema": 1, "default": "administrators", "methods": methods})
+	server, err := api.NewServerWithPermissions(identity{user}, policy, s.Routes()...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest("POST", "/", strings.NewReader(`{"method":"`+method+`","params":`+raw+`}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(&http.Cookie{Name: "id", Value: "fake-cookie"})
+	req.Header.Set("X-SYNO-TOKEN", token)
+	recorder := httptest.NewRecorder()
+	server.ServeHTTP(recorder, req)
+	var out map[string]any
+	if json.Unmarshal(recorder.Body.Bytes(), &out) != nil {
+		t.Fatal(recorder.Body.String())
+	}
+	return out
+}
+func TestOperationRoutesForwardOwnerSessionAndRejectForgedIdentity(t *testing.T) {
+	s := service(t, nil)
+	calls := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
+		calls++
+		if op != "files.operationStatus" && op != "files.cancelOperation" {
+			t.Fatal(op)
+		}
+		if auth["dsm_synotoken"] != "alice-token" {
+			return fail("DELEGATION_DENIED")
+		}
+		return json.Unmarshal([]byte(`{"job_id":"export-1","state":"canceled"}`), out)
+	})
+	for _, method := range []string{"delegate.operations.get", "delegate.operations.cancel"} {
+		raw := `{"delegation_id":"grant","job_id":"export-1"}`
+		if out := longRPC(t, s, "alice", method, raw, "alice-token"); out["success"] != true {
+			t.Fatal(out)
+		}
+		if out := longRPC(t, s, "bob", method, raw, "bob-token"); out["success"] != false {
+			t.Fatal("other owner admitted", out)
+		}
+		before := calls
+		if out := longRPC(t, s, "alice", method, `{"delegation_id":"grant","job_id":"export-1","uid":0}`, "alice-token"); out["success"] != false || calls != before {
+			t.Fatal("forged UID reached executor", out)
+		}
+		if out := longRPC(t, s, "alice", method, raw, ""); out["success"] != false || calls != before {
+			t.Fatal("sessionless HTTP operation", out)
+		}
+	}
+	for _, method := range []string{"delegate.disable", "delegate.enable"} {
+		before := calls
+		if out := longRPC(t, s, "alice", method, `{}`, "alice-token"); out["success"] != false || calls != before {
+			t.Fatal("nonadmin management call", out)
+		}
+	}
+}
+
+func TestMoveRouteCannotReserveOtherOwnersMirror(t *testing.T) {
+	s, in := stagedService(t)
+	raw, _ := json.Marshal(in)
+	calls := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, _ any, out any) error {
+		switch op {
+		case "delegate.list":
+			if auth["dsm_synotoken"] == "bob-token" {
+				return json.Unmarshal([]byte(`{"delegations":[]}`), out)
+			}
+			return json.Unmarshal([]byte(`{"delegations":[{"delegation_id":"grant","subject":{"username":"alice","uid":1205}}]}`), out)
+		case "files.moveFromStaging":
+			calls++
+			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
+		default:
+			t.Fatal(op)
+			return nil
+		}
+	})
+	if out := longRPC(t, s, "bob", "delegate.move_from_staging", string(raw), "bob-token"); out["success"] != false {
+		t.Fatal(out)
+	}
+	if bindings, err := s.Store.PendingMoves(context.Background()); err != nil || len(bindings) != 0 || calls != 0 {
+		t.Fatal("other user reserved job", bindings, err, calls)
+	}
+	if out := longRPC(t, s, "alice", "delegate.move_from_staging", string(raw), "alice-token"); out["success"] != true || calls != 1 {
+		t.Fatal(out, calls)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/move.go

@@ -0,0 +1,348 @@
+package delegate
+
+import (
+	"bytes"
+	"context"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"errors"
+	"os"
+	"path"
+	"regexp"
+	"time"
+)
+
+const MaxMoveBytes int64 = 16 << 30
+
+// An operation the executor does not know is admitted again at most
+// maxMoveAdmissions times, waiting admissionBackoff after each such send.
+const (
+	maxMoveAdmissions     = 10
+	firstAdmissionBackoff = 2 * time.Second
+	maxAdmissionBackoff   = 5 * time.Minute
+)
+
+func admissionBackoff(attempts int) time.Duration {
+	delay := firstAdmissionBackoff
+	for ; attempts > 1 && delay < maxAdmissionBackoff; attempts-- {
+		delay *= 2
+	}
+	return min(delay, maxAdmissionBackoff)
+}
+
+type MoveParams struct {
+	DelegationID string `json:"delegation_id"`
+	JobID        string `json:"job_id"`
+	Staging      string `json:"staging"`
+	Name         string `json:"name"`
+	Size         int64  `json:"size"`
+}
+type OperationRef struct {
+	DelegationID string `json:"delegation_id"`
+	JobID        string `json:"job_id"`
+}
+type Receipt struct {
+	Path string `json:"path"`
+	Size int64  `json:"size"`
+}
+
+func (r *Receipt) UnmarshalJSON(data []byte) error {
+	var wire struct {
+		Path *string `json:"path"`
+		Size *int64  `json:"size"`
+	}
+	if json.Unmarshal(data, &wire) != nil || wire.Path == nil || wire.Size == nil {
+		return fail("EXECUTOR_PROTOCOL")
+	}
+	r.Path, r.Size = *wire.Path, *wire.Size
+	return nil
+}
+
+type OperationResult struct {
+	JobID   string   `json:"job_id"`
+	State   string   `json:"state"`
+	Receipt *Receipt `json:"receipt,omitempty"`
+	Code    string   `json:"code,omitempty"`
+	Reason  string   `json:"reason,omitempty"`
+}
+
+var operationToken = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
+
+func validRef(in OperationRef) bool {
+	return operationToken.MatchString(in.DelegationID) && operationToken.MatchString(in.JobID)
+}
+func validMove(in MoveParams) bool {
+	return validRef(OperationRef{in.DelegationID, in.JobID}) && validStaging(in.Staging) && validName(in.Name) && in.Size >= 0 && in.Size <= MaxMoveBytes
+}
+func validateMove(in MoveParams) error {
+	if in.Size < 0 || in.Size > MaxMoveBytes {
+		return fail("invalid-size")
+	}
+	if !validMove(in) {
+		return fail("invalid-request")
+	}
+	return nil
+}
+
+func validOperation(out OperationResult, ref OperationRef) bool {
+	if out.JobID != ref.JobID || (out.Code != "" && !stableCode.MatchString(out.Code)) || (out.Reason != "" && !stableCode.MatchString(out.Reason)) {
+		return false
+	}
+	switch out.State {
+	case "queued", "copying", "canceled", "interrupted", "uncertain":
+		return out.Receipt == nil
+	case "committed":
+		return out.Receipt != nil && validPath(out.Receipt.Path) && out.Receipt.Path != "/" && out.Receipt.Size >= 0 && out.Receipt.Size <= MaxMoveBytes
+	default:
+		return false
+	}
+}
+
+// MoveFromStaging is the package backend/daemon completion hook. It never
+// accepts a destination path, owner or UID, and does not require a live session.
+type OperationAdmission struct {
+	JobID string `json:"job_id"`
+	State string `json:"state"`
+}
+
+func (s *Service) admitStaging(ctx context.Context, auth map[string]string, in MoveParams) (OperationAdmission, error) {
+	out, err := s.moveFromStaging(ctx, auth, in)
+	if err != nil {
+		return OperationAdmission{}, err
+	}
+	return OperationAdmission{JobID: out.JobID, State: out.State}, nil
+}
+
+func (s *Service) MoveFromStaging(ctx context.Context, in MoveParams) (OperationAdmission, error) {
+	return s.admitStaging(ctx, nil, in)
+}
+func (s *Service) moveFromStaging(ctx context.Context, auth map[string]string, in MoveParams) (OperationResult, error) {
+	if background.RefuseRoot(os.Geteuid()) != nil {
+		return OperationResult{}, fail("STAGING_UNAVAILABLE")
+	}
+	if s.Lifetime != "until-revoked" || !contains(s.Operations, "files.moveFromStaging") {
+		return OperationResult{}, fail("unsupported")
+	}
+	if err := validateMove(in); err != nil {
+		return OperationResult{}, err
+	}
+	if s.Store == nil {
+		return OperationResult{}, fail("STAGING_UNAVAILABLE")
+	}
+	params, _ := json.Marshal(in)
+	ref := OperationRef{in.DelegationID, in.JobID}
+	binding, err := s.Store.MoveBinding(ctx, in.JobID)
+	fresh := false
+	if errors.Is(err, os.ErrNotExist) {
+		source, err := pinSource(s.StagingDir, in.Staging, in.Size)
+		if err != nil {
+			return OperationResult{}, err
+		}
+		binding, fresh, err = s.Store.ReserveMove(ctx, background.MoveBinding{JobID: in.JobID, DelegationID: in.DelegationID, Params: params, Source: source, Phase: background.MoveReserved})
+		if err != nil {
+			if errors.Is(err, background.ErrKeyConflict) {
+				return OperationResult{}, fail("operation-conflict")
+			}
+			return s.journalUnavailable(ctx, auth, ref, err)
+		}
+	} else if err != nil {
+		return s.journalUnavailable(ctx, auth, ref, err)
+	}
+	if binding.DelegationID != in.DelegationID || !bytes.Equal(binding.Params, params) {
+		return OperationResult{}, fail("operation-conflict")
+	}
+	if binding.Refusal != "" {
+		return OperationResult{}, fail(binding.Refusal)
+	}
+	if binding.CancelRequested {
+		// A canceled reference is never admitted again; the cancel is forwarded.
+		return s.operation(ctx, auth, ref, "files.cancelOperation")
+	}
+	// A request that may have been sent is looked up first. Only an operation the
+	// executor does not know is admitted again with the original params; the
+	// executor deduplicates the exact tuple, so a racing original is not copied twice.
+	queried := false
+	if !fresh && binding.Phase != background.MoveReserved {
+		out, err := s.OperationStatus(ctx, auth, ref)
+		if errorCode(err) != "operation-not-found" || binding.Phase == background.MoveAccepted || binding.Settled || binding.CleanupDone {
+			return out, err
+		}
+		queried = true
+	}
+	if !fresh {
+		if source, err := pinSource(s.StagingDir, in.Staging, in.Size); err != nil || source != binding.Source {
+			return OperationResult{}, fail("STAGING_CHANGED")
+		}
+	}
+	binding, claimed, err := s.Store.ClaimAdmission(ctx, in.JobID, s.clockNow(), maxMoveAdmissions, admissionBackoff)
+	if err != nil {
+		return s.journalUnavailable(ctx, auth, ref, err)
+	}
+	if !claimed {
+		return s.unclaimedAdmission(ctx, auth, ref, binding, queried)
+	}
+	return s.sendAdmission(ctx, auth, in)
+}
+
+// journalUnavailable answers a same-ref call the journal could not serve. An
+// operation the executor already has is reported read-only; anything else keeps
+// the retryable store code, so nothing is admitted without a durable reservation.
+// An unsafe or corrupt spool stays terminal.
+func (s *Service) journalUnavailable(ctx context.Context, auth map[string]string, ref OperationRef, err error) (OperationResult, error) {
+	err = jobError(err)
+	if code := errorCode(err); code != "jobs_busy" && code != "canceled" && code != "jobs_unavailable" {
+		return OperationResult{}, err
+	}
+	if out, found := s.OperationStatus(ctx, auth, ref); found == nil {
+		return out, nil
+	}
+	return OperationResult{}, err
+}
+
+// unclaimedAdmission answers a caller that may not send now: another caller
+// holds the send, its backoff has not ended, or the bound is spent.
+func (s *Service) unclaimedAdmission(ctx context.Context, auth map[string]string, ref OperationRef, binding background.MoveBinding, queried bool) (OperationResult, error) {
+	if binding.Refusal != "" {
+		return OperationResult{}, fail(binding.Refusal)
+	}
+	if !queried {
+		out, err := s.OperationStatus(ctx, auth, ref)
+		if errorCode(err) != "operation-not-found" {
+			return out, err
+		}
+	}
+	if binding.Attempts >= maxMoveAdmissions {
+		return OperationResult{}, fail("ADMISSION_EXHAUSTED")
+	}
+	return OperationResult{}, fail("ADMISSION_PENDING")
+}
+
+func (s *Service) sendAdmission(ctx context.Context, auth map[string]string, in MoveParams) (OperationResult, error) {
+	ref := OperationRef{in.DelegationID, in.JobID}
+	// Mirror writes survive a caller deadline that ended the request.
+	persist, done := context.WithTimeout(context.Background(), 10*time.Second)
+	defer done()
+	var out OperationResult
+	err := s.Client.Call(ctx, "files.moveFromStaging", auth, in, &out)
+	if err != nil {
+		var dial *dialFailure
+		code := errorCode(err)
+		switch {
+		case errors.As(err, &dial) || code == "EXECUTOR_PAUSED" || code == "queue-full":
+			// Proven not admitted: no connection, or refused before an operation existed.
+			_ = s.Store.ReleaseAdmission(persist, in.JobID)
+			return OperationResult{}, err
+		case code == "EXECUTOR_UNAVAILABLE" || code == "EXECUTOR_TIMEOUT" || code == "EXECUTOR_PROTOCOL" || code == "STORAGE_ERROR" || code == "canceled":
+			// The request might have arrived; inspect only the original operation.
+			out, err = s.OperationStatus(ctx, auth, ref)
+			if errorCode(err) == "operation-not-found" {
+				return OperationResult{}, fail("ADMISSION_PENDING")
+			}
+			return out, err
+		}
+		_ = s.Store.FinishMoveMirror(persist, in.JobID, false, code)
+		return OperationResult{}, err
+	}
+	// Admission promises a reference/state only; a committed receipt is obtained
+	// by status and is never invented from the requested name or size.
+	if out.JobID != in.JobID {
+		return OperationResult{}, fail("EXECUTOR_PROTOCOL")
+	}
+	_ = s.Store.AcceptMove(persist, in.JobID)
+	switch out.State {
+	case "queued", "copying", "canceled", "interrupted", "uncertain":
+		if out.Receipt != nil {
+			return OperationResult{}, fail("EXECUTOR_PROTOCOL")
+		}
+		return out, nil
+	case "committed":
+		return s.OperationStatus(ctx, auth, ref)
+	default:
+		return OperationResult{}, fail("EXECUTOR_PROTOCOL")
+	}
+}
+
+func (s *Service) operation(ctx context.Context, auth map[string]string, ref OperationRef, op string) (OperationResult, error) {
+	var out OperationResult
+	if !validRef(ref) {
+		return out, fail("invalid-request")
+	}
+	err := s.Client.Call(ctx, op, auth, ref, &out)
+	if err != nil {
+		return OperationResult{}, err
+	}
+	if !validOperation(out, ref) {
+		return OperationResult{}, fail("EXECUTOR_PROTOCOL")
+	}
+	if s.Store != nil {
+		// A found operation is never admitted again, even if history is later lost.
+		_ = s.Store.AcceptMove(ctx, ref.JobID)
+	}
+	if out.State == "committed" && s.Store != nil {
+		binding, err := s.Store.MoveBinding(ctx, ref.JobID)
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return out, nil
+		}
+		if err == nil && binding.DelegationID == ref.DelegationID && !binding.CleanupDone {
+			var input MoveParams
+			if json.Unmarshal(binding.Params, &input) != nil || input.JobID != ref.JobID || out.Receipt.Size != input.Size || path.Base(out.Receipt.Path) != input.Name {
+				return OperationResult{}, fail("EXECUTOR_PROTOCOL")
+			}
+			// A cleanup failure leaves source and mirror available for package retry.
+			// Committed remains committed and its protected receipt remains the result.
+			if cleanupSource(s.StagingDir, input.Staging, binding.Source) == nil {
+				_ = s.Store.FinishMoveMirror(ctx, ref.JobID, true, "")
+			}
+		}
+	}
+	if s.Store != nil && (out.State == "canceled" || out.State == "interrupted" || out.State == "uncertain") {
+		_ = s.Store.SettleMoveMirror(ctx, ref.JobID)
+	}
+	return out, nil
+}
+func (s *Service) OperationStatus(ctx context.Context, auth map[string]string, ref OperationRef) (OperationResult, error) {
+	return s.operation(ctx, auth, ref, "files.operationStatus")
+}
+
+// CancelOperation acknowledges a copy in flight with state copying and code
+// CANCEL_REQUESTED; poll OperationStatus for the terminal state. A producer
+// (no session) cancel is made durable in the mirror first, so the SDK's
+// admission recovery forwards it instead of sending the admission. A mirror
+// write failure does not hold the cancel back: the executor stays authoritative.
+func (s *Service) CancelOperation(ctx context.Context, auth map[string]string, ref OperationRef) (OperationResult, error) {
+	if len(auth) == 0 && s.Store != nil && validRef(ref) {
+		_ = s.Store.RequestMoveCancel(ctx, ref.JobID, ref.DelegationID)
+	}
+	return s.operation(ctx, auth, ref, "files.cancelOperation")
+}
+
+// SweepMoves queries mirrors using the package peer identity after logout/boot.
+// An operation the executor does not know is recovered like a repeated
+// MoveFromStaging call. It never revokes a reusable destination grant.
+func (s *Service) SweepMoves(ctx context.Context) error {
+	if s.Store == nil {
+		return nil
+	}
+	bindings, err := s.Store.PendingMoves(ctx)
+	if err != nil {
+		return err
+	}
+	var result error
+	for _, binding := range bindings {
+		var in MoveParams
+		var out OperationResult
+		if json.Unmarshal(binding.Params, &in) == nil {
+			out, err = s.moveFromStaging(ctx, nil, in)
+		} else {
+			out, err = s.OperationStatus(ctx, nil, OperationRef{binding.DelegationID, binding.JobID})
+		}
+		if err == nil && out.State == "committed" {
+			mirror, readErr := s.Store.MoveBinding(ctx, binding.JobID)
+			if readErr != nil || !mirror.CleanupDone {
+				err = fail("STAGING_CLEANUP_PENDING")
+			}
+		}
+		result = errors.Join(result, err)
+	}
+	return result
+}