@synopackageland/cli 0.6.0 → 0.7.0

package/templates/_executor/README.md

@@ -7,9 +7,16 @@ including newline at most 65536 bytes). Socket access additionally requires exac
 Linux SO_PEERCRED UID equality, even for another member of the package group.
 Non-Linux builds support portable tests and refuse privileged service operations.
 
+Fixed writer children verify `no_new_privs` with `PR_GET_NO_NEW_PRIVS` on their
+locked Linux thread. DSM kernel 4.4 supports this flag but omits its proc status
+field; a failed syscall or a value other than one still refuses the write.
+Saved IDs and zero capabilities remain mandatory. The parent passes the pinned
+package-owned private source as a read-only FD; destination creation and publish
+remain under the subject UID, and source cleanup runs under the package UID.
+
 ## Protected inventory and policy
 
-Setup must copy the digest-pinned executor, policy and root scripts into:
+Setup must copy the INFO-anchored executor, policy-pinned policy and root scripts into:
 
 ```
 /usr/local/etc/synopkgland/<package>/             root:root 0700
@@ -74,7 +81,7 @@ operations and policy-excluded operations are rejected. Replies follow §2.4.
 
 | Operation | Parameters | Result |
 | --- | --- | --- |
-| status | none | executor_digest, policy_digest, version, ready |
+| status | none | executor_digest, policy_digest, version, ready, disabled |
 | delegate.create | job_id, ops[], scope, path, ttl_seconds | delegation_id, subject {username, uid}, expires_at (RFC3339) |
 | delegate.list | none | delegations[] with public metadata, including revoked/expired records |
 | delegate.revoke | delegation_id; job_id required without cookie | revoked |
@@ -86,7 +93,7 @@ operations and policy-excluded operations are rejected. Replies follow §2.4.
 Create/list require a cookie and SynoToken. Revoke accepts the subject/admin session pair or a matching
 package job ID. Root operations require the session pair independently verified as an
 active administrators member. Delegated operations recheck the account, UID,
-expired=`normal`, non-admin membership, App and File Station privileges, scope,
+expired=`normal`, App and File Station privileges, scope,
 job, operation, expiry and revocation. UIDs below 1024 are excluded as system
 accounts. TTL must be 1–2592000 seconds. No cookie/SynoToken/SID/password is persisted.
 
@@ -94,22 +101,26 @@ Paths use File Station spellings `/home[/...]` or `/<share>[/...]`. A delegation
 binds the requested directory's canonical path. Symlinks resolving outside that
 directory are denied. `files.write` opens package-owned, singly linked regular
 staging files with no symlink components; its fresh child checks setgroups,
-setresgid and setresuid in order, then all real/effective IDs and groups. The child
+setresgid and setresuid in order, then real/effective/saved/filesystem IDs and groups, empty capability sets and
+`no_new_privs`. Admin users retain their own nonzero UID and current groups. The child
 opens the destination after dropping identity, verifies its pinned directory and
 scope, and copies into an exclusive hidden `.synopkgland-<job_id>-<random>.part`
 file. After fsync it publishes the complete file with a hard link, then removes
 the temporary name. Existing files and symlinks are never overwritten. The
 executor cleans the exact temporary name as the subject user after a canceled or
 killed child, using a retained directory descriptor; startup performs no scan.
-Successful writes delete staging. DSM ACL inheritance can
+Successful writes request exact source cleanup in a separate package-UID child;
+cleanup failure retains the source and never downgrades a committed receipt. DSM ACL inheritance can
 produce a mode different from the requested 0600 (observed 0711 on vt-nas).
 
 File Station CheckPermission uses v3 with a fixed non-overwriting probe filename
 and size zero; it creates no file. Missing/failed API data is denied. DSM output
 and root script output are capped at 1 MiB; commands have 20-second deadlines,
 connection read/write deadlines are 15/5 seconds and request execution is bounded
-by 30 seconds. At most 16 connections are admitted. Execution/revocation are
-serialized. Linux command timeouts kill the entire command process group.
+by 30 seconds. At most 16 connections are admitted. Legacy runner APIs use short
+admission leases; revoke/disable persist the fence then drain accepted legacy
+calls outside the commit lock before acknowledging. Bulk copy holds no commit
+lock. Linux command timeouts kill the entire command process group.
 
 File Station APIs resolve path strings inside DSM after executor scope validation;
 there is no atomic DSM API for binding that subsequent lookup to our directory
@@ -122,13 +133,20 @@ items, not assertions of complete race freedom.
 
 ```
 executor serve --package com.example.downloader
+executor supervise --package com.example.downloader
 executor control start --package com.example.downloader
 executor control stop --package com.example.downloader
 executor control purge --package com.example.downloader
 ```
 
 Root control start launches asynchronously; the caller reads socket status to
-establish readiness. A held flock pidfile refuses duplicate serve. Root's pinned
+establish readiness. It starts `executor supervise`, a root supervisor that runs
+`serve` as its child and restarts it after an abnormal end (signal or non-zero
+exit) with a 1 s backoff doubling to 60 s, reset after a minute of healthy run.
+A restarted `serve --revived` honors a `stop` already in the mailbox. Exit 0
+(root replacement, shutdown, purge), exit 3 (another monitor holds the pidfile)
+or a removed runtime end supervision. A held flock pidfile refuses duplicate
+serve. Root's pinned
 boot/control start can validate and terminate a previous monitor before launching
 its replacement; package-account start only writes the mailbox and cannot replace
 runtime. Stop pauses the listener while the monitor continues. Purge removes this
@@ -136,7 +154,8 @@ package's protected state and deletes only its verified recorded scheduler tasks
 
 Run `go test -race ./...` and `bash scripts/ci/gate.sh native-go`. The gate adds
 Linux amd64/arm64 vet, static binary builds and test compilation. Linux-specific
-syscall tests also run on vt-nas from a cross-compiled test executable. The
+syscall tests require a disposable Linux root fixture. This revision was tested
+on a Linux VM; DSM ACL, logout and reboot behavior remain unverified. The
 `testdata/live_probe.py` harness expects isolated disposable accounts and a
 manually copied runtime, reads passwords only from stdin, and logs no credentials.
 The live harness uses DSM's registered `SYNO.Desktop` AppPriv ID as a stand-in for
@@ -148,12 +167,17 @@ an installed App; installed-package AppPriv integration belongs to setup testing
 Package-account hooks atomically write `stop` before upgrades/stops, `start` on
 install/upgrade completion and package start, and `purge` before uninstall.
 `stop` cancels/drains requests and removes the listener without ending the root
-monitor. `start` resumes only if both package executor and policy hashes equal
-the approved runtime pins; otherwise the service stays paused for administrator
-approval. Only root's pinned boot/control path can replace a monitor or runtime.
+monitor. `start` resumes if both package executor and policy hashes equal the approved
+runtime pins. If only the executor changed, the policy hash is unchanged and the
+executor hash equals the single `synopkgland_executor_sha256` key in the
+root-owned `/var/packages/<package>/INFO`, the root monitor copies it into
+`runtime/`, verifies the copy and runs root `control start`, which replaces the
+monitor without reapproval. Any other change stays paused for administrator
+approval. Only root's pinned boot/control path or this anchored install can
+replace a monitor or runtime.
 
 At start, scheduler readback must exactly match the canonical lifecycle scripts
-regenerated from the package identity and approved executor/policy pins. Package
+regenerated from the package identity and approved policy pin. Package
 setup metadata supplies hints only. The verified names, pins and script hashes
 are stored in root:root 0600 `runtime/tasks.json`. Purge regenerates the scripts
 and revalidates each current definition before EventScheduler v1
@@ -188,9 +212,10 @@ and `purge` clears state immediately. A root-approved new monitor ignores the
 stop file already present at startup; that exception ends after an absence.
 
 The boot task checks pending purge/package disappearance before accessing source.
-It verifies retained pins and protected copies again before offline purge. Normal
-boot installs verified copies and calls root control start to replace a previous
-monitor. Scripts stay within 1 KiB with no percent characters, including the
+It verifies the retained policy pin before offline purge from the root-only
+runtime. Normal boot verifies the copies against the policy pin and the INFO
+executor anchor, installs them and calls root control start to replace a
+previous monitor. Scripts stay within 1 KiB with no percent characters, including the
 longest package name. Partial/tampered retained state requires administrator
 review. All nine uninstall wizard locales name the two tasks and disclose the
 retained DSM storage/infrastructure. `inspect`/`status` cleanup guidance is
@@ -202,3 +227,89 @@ a directory descriptor and verified with fstat, so boot umask 0077 cannot reduce
 validated and never repaired/adopted. The package directory must already have
 root/package-group ownership. The socket is set to root/package-group 0660 and
 verified using Linux O_PATH + fstat on its filesystem inode.
+
+## Explicit long-running v1 extension
+
+The pinned policy opts in with top-level `destinations: ["save"]` and
+`lifetime: "until-revoked"`, together with `files.moveFromStaging` in the
+operation allowlist. Destination keys match `^[a-z][a-z0-9_-]{0,63}$`; unknown
+keys/lifetimes fail closed. Legacy policies/TTL grants never become permanent.
+The existing v1 envelope, peer UID check, protected runtime and session verifier
+remain unchanged. `root.run` is independent and is never a writer fallback.
+
+| Operation | Parameters | Result |
+| --- | --- | --- |
+| delegate.create (permanent) | scope, ops:[files.moveFromStaging], path, destination, lifetime:until-revoked | delegation_id, subject, path, destination, lifetime; zero expiry |
+| files.moveFromStaging | delegation_id, job_id, staging, name, size | job_id, state |
+| files.operationStatus | original delegation_id, job_id | job_id, state, optional code/receipt |
+| files.cancelOperation | original delegation_id, job_id | current operation state |
+| delegate.disable / delegate.enable | none; live administrator session | disabled |
+| delegate.audit | none; live owner/admin session | latest bounded events |
+
+Permanent create needs the current user's cookie and SynoToken and a successful
+File Station write check. The executor derives username/UID and exact directory
+identity itself. Permanent revoke is owner-bound even for administrators; admins
+can disable the entire package. Auth-less operation submission/status/cancel is
+for the trusted package producer holding the grant reference and original job ID.
+If credentials are supplied, both must verify and the owner must match; failed
+caller auth never falls back to offline authority. A compromised package backend
+can use all valid grants it holds, as documented in the approved trust model.
+
+Grants survive service restart in the protected store. The disabled flag also
+survives; mailbox start/boot never clears it. Disable persists first and revokes
+all legacy/permanent grants. Enable checks the live admin session and completes
+revocation before clearing the flag; it never restores old grants. Repeated enable
+while already enabled is a no-op.
+
+Operations are separate `operation-<sha256(job_id)>.record` files, root:root 0600.
+They bind immutable grant/job/staging/name/size and move through queued, copying,
+committed, canceled, interrupted or uncertain. Queued resumes without credentials;
+copying becomes interrupted on restart, or uncertain after durable publish intent.
+Neither state is replayed. Changed input for the same job is `operation-conflict`.
+Committed status alone includes `receipt:{path,size}`. Cleanup failures retain
+committed and add `CLEANUP_PENDING`. No same-name/hash guessing establishes receipt.
+
+Limits: 16 GiB per file, actual size+1 read, 16 queued, one active copy per package,
+24-hour attempt, 10 MiB operation metadata. Full journals reject new admissions;
+terminal records are retained to prevent replay. Bulk input bypasses job spools
+and the old 64 MiB wrapper limit. Long copies revalidate account/AppPriv/ACL/path
+with five-second polling and bounded checks; publish revalidates again. A failed
+identity/ACL/path check invalidates the grant and requires a new selection.
+
+The fixed child drops identity before opening the destination and creating any
+inode. Every component uses FD-relative O_NOFOLLOW; ancestors use O_PATH so only
+search rights are required. Source is package-owned, regular and singly linked;
+destination is the exact granted device/inode, never a caller-supplied path.
+Part metadata is durable before copying. Publish links the open part inode with
+no replacement, refusing files/symlinks/FIFOs at the final name. Revoke, disable
+and publish share the commit lock. Lost/malformed publish replies drain the child
+before releasing that lock and produce uncertain; a confirmed no-side-effect
+refusal such as `destination-exists` remains interrupted. The lock covers bounded
+publish handshake/fsync, never the bulk copy. During the copy the child watches
+its control pipe: if `serve` dies the pipe closes, so the child stops within one
+1 MiB chunk and unlinks its part (no `PR_SET_PDEATHSIG`, which the identity drop
+clears; works on kernel 3.10). Kernel-blocked filesystem I/O can
+still delay draining; it cannot be declared safely complete by a timeout.
+Legacy `files.write` uses this same child and publish handshake; the executor
+has no other writer, so no child can publish after `serve` is gone.
+
+Destination/part cleanup runs as the owner; source cleanup runs as package UID.
+Restart cleans only journaled exact part identity as the current eligible owner;
+changed/missing/inaccessible directories are retained for review, never scanned
+or deleted as root. Subject-controlled directory moves after the final check
+can still complete in the pinned directory object. DSM ACL changes and publication
+are not atomic, and silent UID/inode reuse is not universally detected. A subject
+who owns the destination can mutate its own output; this is not a content sandbox.
+
+Structured audit lives in protected `audit.jsonl`/`audit.previous`, at most 50 MiB
+combined, separate from authority. Events include package, username/UID, operation,
+job, location and result; no session credentials. Owner queries are filtered,
+admins can view this package's events. Replies contain at most 256 events/1 MiB.
+Admission events are labeled `admitting` because a subsequent durable write can
+fail. The operation journal, not an admission audit event, establishes completion.
+
+The existing status operation reads `Store.Disabled`; protected-store errors set
+`ready:false` rather than assuming enabled. Backend `delegate.status` exposes the
+verified boolean and `disabled` capability state. Backend `delegate.operations.list`
+is strictly empty-params, freshly owner/UID-filtered move-mirror metadata; it is
+not an executor operation. Live completion remains `files.operationStatus`.

package/templates/_executor/anchor.go

@@ -0,0 +1,146 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"syscall"
+)
+
+// Package Center writes the SPK INFO as root. The package account cannot change
+// it, so its executor digest authorizes executor-only upgrades under the
+// administrator-approved policy without a new PasswordConfirm.
+const executorAnchorKey = "synopkgland_executor_sha256"
+
+var anchorRE = regexp.MustCompile(`^"([a-f0-9]{64})"$`)
+
+type pinState int
+
+const (
+	pinsDiffer pinState = iota
+	pinsMatch
+	pinsAnchored
+)
+
+func executorAnchor(info string, trusted func(os.FileInfo) bool) (string, error) {
+	b, stat, err := readLifecycleFile(info, 65536)
+	if err != nil {
+		return "", err
+	}
+	if !trusted(stat) {
+		return "", errors.New("untrusted package INFO")
+	}
+	anchor := ""
+	for _, line := range strings.Split(string(b), "\n") {
+		value, ok := strings.CutPrefix(line, executorAnchorKey+"=")
+		if !ok {
+			continue
+		}
+		m := anchorRE.FindStringSubmatch(value)
+		if m == nil || anchor != "" {
+			return "", errors.New("executor anchor")
+		}
+		anchor = m[1]
+	}
+	if anchor == "" {
+		return "", errors.New("executor anchor")
+	}
+	return anchor, nil
+}
+
+func rootOwnedReadOnly(info os.FileInfo) bool {
+	return ownedByRoot(info) && info.Mode().Perm()&0022 == 0
+}
+
+func packagePins(ctx context.Context, dir, info string, trusted func(os.FileInfo) bool, executorDigest, policyDigest string) pinState {
+	if samePackagePins(ctx, dir, executorDigest, policyDigest) {
+		return pinsMatch
+	}
+	dir, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		return pinsDiffer
+	}
+	if pd, err := digestFile(ctx, dir+"/policy.json", maxPolicyBytes); err != nil || pd != policyDigest {
+		return pinsDiffer
+	}
+	anchor, err := executorAnchor(info, trusted)
+	if err != nil {
+		return pinsDiffer
+	}
+	if ed, err := digestFile(ctx, dir+"/executor", maxExecutorBytes); err != nil || ed != anchor {
+		return pinsDiffer
+	}
+	return pinsAnchored
+}
+
+// The policy is unchanged, so root scripts (pinned by policy digests) stay too.
+// Verify the protected copy, never the package-reachable source.
+func installAnchored(ctx context.Context, source, info string, trusted func(os.FileInfo) bool, runtime string) error {
+	anchor, err := executorAnchor(info, trusted)
+	if err != nil {
+		return err
+	}
+	src, err := openRegular(filepath.Join(source, "executor"))
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+	stat, err := src.Stat()
+	if err != nil || stat.Size() > maxExecutorBytes {
+		return errors.New("executor size")
+	}
+	staged, err := os.CreateTemp(runtime, ".executor-")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(staged.Name())
+	err = copyExact(staged, src, stat.Size())
+	if err == nil {
+		err = staged.Chmod(0700)
+	}
+	if err == nil {
+		err = staged.Sync()
+	}
+	if closeErr := staged.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return err
+	}
+	if digest, err := digestFile(ctx, staged.Name(), maxExecutorBytes); err != nil || digest != anchor {
+		return errors.New("executor anchor mismatch")
+	}
+	return os.Rename(staged.Name(), filepath.Join(runtime, "executor"))
+}
+
+// Root control start replaces this monitor with the newly installed runtime.
+func startInstalled(runtime, pkg string) error {
+	cmd := exec.Command(filepath.Join(runtime, "executor"), "control", "start", "--package", pkg)
+	cmd.Env = []string{"PATH=/usr/bin:/bin", "LANG=C"}
+	cmd.Dir = "/"
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	return cmd.Process.Release()
+}
+
+func approvedPins(state pinState, install, start func() error, log func(string)) bool {
+	if state != pinsAnchored {
+		return state == pinsMatch
+	}
+	if err := install(); err != nil {
+		log("executor upgrade refused: INFO-anchored executor could not be installed")
+		return false
+	}
+	if err := start(); err != nil {
+		log("executor upgrade installed; root start failed")
+		return false
+	}
+	log("executor upgrade: INFO-anchored executor installed under the approved policy")
+	return false
+}

package/templates/_executor/anchor_test.go

@@ -0,0 +1,126 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func trustAll(os.FileInfo) bool { return true }
+
+// anchoredPackage writes a target executor/policy pair and the package INFO.
+func anchoredPackage(t *testing.T, executor, policy string, anchors ...string) (target, info string) {
+	t.Helper()
+	pkg := realTestPath(t, t.TempDir())
+	target = filepath.Join(pkg, "target", "executor")
+	os.MkdirAll(target, 0755)
+	os.WriteFile(filepath.Join(target, "executor"), []byte(executor), 0755)
+	os.WriteFile(filepath.Join(target, "policy.json"), []byte(policy), 0644)
+	text := "package=\"TestApp\"\n"
+	for _, a := range anchors {
+		text += "synopkgland_executor_sha256=\"" + a + "\"\n"
+	}
+	info = filepath.Join(pkg, "INFO")
+	os.WriteFile(info, []byte(text), 0644)
+	return target, info
+}
+
+func TestExecutorAnchorRequiresOneLowercaseDigestInTrustedINFO(t *testing.T) {
+	digest := hashBytes([]byte("new executor"))
+	_, info := anchoredPackage(t, "new executor", "policy", digest)
+	if got, err := executorAnchor(info, trustAll); err != nil || got != digest {
+		t.Fatal("anchor", got, err)
+	}
+	if _, err := executorAnchor(info, func(os.FileInfo) bool { return false }); err == nil {
+		t.Fatal("package-writable INFO accepted")
+	}
+	for name, anchors := range map[string][]string{"missing": nil, "duplicate": {digest, digest}, "uppercase": {strings.ToUpper(digest)}, "short": {digest[:63]}} {
+		_, info := anchoredPackage(t, "new executor", "policy", anchors...)
+		if _, err := executorAnchor(info, trustAll); err == nil {
+			t.Fatal(name, "anchor accepted")
+		}
+	}
+}
+
+func TestPackagePinsAcceptAnExecutorUpgradeOnlyUnderTheApprovedPolicyAndINFOAnchor(t *testing.T) {
+	ctx := context.Background()
+	ed, pd := hashBytes([]byte("approved executor")), hashBytes([]byte("approved policy"))
+	upgraded := hashBytes([]byte("new executor"))
+	for _, tc := range []struct {
+		name, executor, policy string
+		anchors                []string
+		want                   pinState
+	}{
+		{"same bytes", "approved executor", "approved policy", nil, pinsMatch},
+		{"anchored executor", "new executor", "approved policy", []string{upgraded}, pinsAnchored},
+		{"unanchored executor", "new executor", "approved policy", nil, pinsDiffer},
+		{"different anchor", "new executor", "approved policy", []string{ed}, pinsDiffer},
+		{"changed policy", "new executor", "wider policy", []string{upgraded}, pinsDiffer},
+		{"changed policy only", "approved executor", "wider policy", []string{ed}, pinsDiffer},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			target, info := anchoredPackage(t, tc.executor, tc.policy, tc.anchors...)
+			if got := packagePins(ctx, target, info, trustAll, ed, pd); got != tc.want {
+				t.Fatal("pin state", got)
+			}
+		})
+	}
+}
+
+func TestInstallAnchoredReplacesOnlyTheProtectedExecutorWithVerifiedBytes(t *testing.T) {
+	ctx := context.Background()
+	for _, anchored := range []bool{true, false} {
+		t.Run(map[bool]string{true: "anchored", false: "swapped after check"}[anchored], func(t *testing.T) {
+			anchor := hashBytes([]byte("new executor"))
+			target, info := anchoredPackage(t, "new executor", "approved policy", anchor)
+			if !anchored {
+				os.WriteFile(filepath.Join(target, "executor"), []byte("package swapped"), 0755)
+			}
+			runtime := realTestPath(t, t.TempDir())
+			os.WriteFile(filepath.Join(runtime, "executor"), []byte("approved executor"), 0700)
+			os.WriteFile(filepath.Join(runtime, "policy.json"), []byte("approved policy"), 0600)
+			err := installAnchored(ctx, target, info, trustAll, runtime)
+			b, _ := os.ReadFile(filepath.Join(runtime, "executor"))
+			if anchored && (err != nil || string(b) != "new executor") {
+				t.Fatal("anchored executor not installed", err, string(b))
+			}
+			if !anchored && (err == nil || string(b) != "approved executor") {
+				t.Fatal("unanchored executor installed", err, string(b))
+			}
+			if info, err := os.Stat(filepath.Join(runtime, "executor")); err != nil || info.Mode().Perm() != 0700 {
+				t.Fatal("protected executor mode", err)
+			}
+			entries, _ := os.ReadDir(runtime)
+			if len(entries) != 2 {
+				t.Fatal("staging copy left in runtime", entries)
+			}
+		})
+	}
+}
+
+func TestApprovedPinsHandOverAnAnchoredUpgradeToRootStart(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		state      pinState
+		installErr error
+		open       bool
+		installs   int
+		starts     int
+	}{
+		{"match", pinsMatch, nil, true, 0, 0},
+		{"differ", pinsDiffer, nil, false, 0, 0},
+		{"anchored", pinsAnchored, nil, false, 1, 1},
+		{"install failed", pinsAnchored, errors.New("digest"), false, 1, 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			installs, starts := 0, 0
+			open := approvedPins(tc.state, func() error { installs++; return tc.installErr }, func() error { starts++; return nil }, func(string) {})
+			if open != tc.open || installs != tc.installs || starts != tc.starts {
+				t.Fatal("handover", open, installs, starts)
+			}
+		})
+	}
+}

package/templates/_executor/apppriv_review_test.go

@@ -20,7 +20,7 @@ func TestReviewAppPrivRejectsAmbiguousOrError(t *testing.T) {
 	for name, reply := range cases {
 		t.Run(name, func(t *testing.T) {
 			d := &liveDSM{Command: &cmdStub{reply: reply}}
-			if d.Allow(context.Background(), Subject{Username: "alice"}, "app") == nil {
+			if d.Allow(context.Background(), Subject{Username: "alice"}, "app", "") == nil {
 				t.Fatal("unsafe AppPriv response allowed")
 			}
 		})