@synopackageland/cli 0.6.0 → 0.7.0

package/templates/native-go/backend/internal/dsm/entry_test.go

@@ -0,0 +1,315 @@
+package dsm
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+type fixedAuth struct {
+	id  api.Identity
+	err error
+}
+
+func (f fixedAuth) Authenticate(*http.Request) (api.Identity, error) { return f.id, f.err }
+
+type lookup struct {
+	calls         int
+	user, app, ip string
+	allowed       bool
+	err           error
+}
+
+func (l *lookup) check(_ context.Context, user, app, ip string) (bool, error) {
+	l.calls++
+	l.user, l.app, l.ip = user, app, ip
+	return l.allowed && l.err == nil, l.err
+}
+
+func newTestGate(t *testing.T, mode string, next api.Authenticator, l *lookup) (*EntryGate, *time.Time) {
+	t.Helper()
+	auth, err := NewEntryGate(next, mode, "DemoApp", t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate := auth.(*EntryGate)
+	now := time.Unix(1_700_000_000, 0)
+	gate.now = func() time.Time { return now }
+	gate.allowed = l.check
+	return gate, &now
+}
+
+func ordinary(user string) fixedAuth { return fixedAuth{id: api.Identity{User: user}} }
+
+func TestUndeclaredEntryKeepsTheAuthenticatorUnchanged(t *testing.T) {
+	next := ordinary("bob")
+	got, err := NewEntryGate(next, "", "DemoApp", t.TempDir())
+	if err != nil || got != api.Authenticator(next) {
+		t.Fatalf("legacy entry wrapped the authenticator: %T %v", got, err)
+	}
+}
+
+func TestUnknownEntryModeFailsAtStartup(t *testing.T) {
+	for _, mode := range []string{"all-users", "users", "App-Privilege", "admin"} {
+		if _, err := NewEntryGate(ordinary("bob"), mode, "DemoApp", t.TempDir()); err == nil {
+			t.Fatalf("accepted entry mode %q", mode)
+		}
+	}
+	if _, err := NewEntryGate(nil, EntryAppPrivilege, "DemoApp", t.TempDir()); err == nil {
+		t.Fatal("accepted a missing authenticator")
+	}
+	if _, err := NewEntryGate(ordinary("bob"), EntryAppPrivilege, "Demo.App", t.TempDir()); err == nil {
+		t.Fatal("accepted an invalid package ID")
+	}
+}
+
+func TestAdministratorsEnterWithoutAppPrivilegeLookup(t *testing.T) {
+	for _, mode := range []string{EntryAdminOnly, EntryAppPrivilege} {
+		l := &lookup{}
+		gate, _ := newTestGate(t, mode, fixedAuth{id: api.Identity{User: "alice", Admin: true}}, l)
+		id, err := gate.Authenticate(sessionRequest())
+		if err != nil || !id.Admin || id.User != "alice" || l.calls != 0 {
+			t.Fatalf("%s: %+v %v calls=%d", mode, id, err, l.calls)
+		}
+	}
+}
+
+func TestAdminOnlyEntryRefusesOrdinaryUsers(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAdminOnly, ordinary("bob"), l)
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAdminRequired) || l.calls != 0 {
+		t.Fatalf("err=%v calls=%d", err, l.calls)
+	}
+}
+
+func TestAppPrivilegeEntryAsksDSMForTheRegisteredAppAndClientAddress(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary(`CORP\bob`), l)
+	id, err := gate.Authenticate(sessionRequest())
+	if err != nil || id.User != `CORP\bob` || id.Admin {
+		t.Fatalf("%+v %v", id, err)
+	}
+	if l.user != `CORP\bob` || l.app != "SYNO.SDS.DemoApp.Instance" || l.ip != "192.0.2.7" {
+		t.Fatalf("lookup got user=%q app=%q ip=%q", l.user, l.app, l.ip)
+	}
+}
+
+func TestAppPrivilegeDenialAndLookupFailureBothRefuse(t *testing.T) {
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), &lookup{allowed: false})
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAppPrivilegeDenied) {
+		t.Fatalf("denied: %v", err)
+	}
+	gate, _ = newTestGate(t, EntryAppPrivilege, ordinary("bob"), &lookup{err: errors.New("bridge exited 2")})
+	_, err := gate.Authenticate(sessionRequest())
+	if err == nil || errors.Is(err, api.ErrAppPrivilegeDenied) || errors.Is(err, api.ErrNoSession) {
+		t.Fatalf("lookup failure must surface as unavailable: %v", err)
+	}
+}
+
+func TestUnparseableClientAddressRefusesWithoutLookup(t *testing.T) {
+	for _, addr := range []string{"", "not-an-ip", "192.0.2.300:1", "[::1"} {
+		l := &lookup{allowed: true}
+		gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+		r := sessionRequest()
+		r.RemoteAddr = addr
+		if _, err := gate.Authenticate(r); err == nil || l.calls != 0 {
+			t.Fatalf("%q: err=%v calls=%d", addr, err, l.calls)
+		}
+	}
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	r := sessionRequest()
+	r.RemoteAddr = "[2001:db8::7]:443"
+	if _, err := gate.Authenticate(r); err != nil || l.ip != "2001:db8::7" {
+		t.Fatalf("IPv6: %v %q", err, l.ip)
+	}
+}
+
+func TestSessionAndAuthenticationFailuresPassThroughUnchanged(t *testing.T) {
+	for _, want := range []error{api.ErrNoSession, errors.New("authenticate.cgi unavailable")} {
+		l := &lookup{allowed: true}
+		gate, _ := newTestGate(t, EntryAppPrivilege, fixedAuth{err: want}, l)
+		if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, want) || l.calls != 0 {
+			t.Fatalf("err=%v calls=%d", err, l.calls)
+		}
+	}
+}
+
+func TestDecisionsAreCachedBrieflyPerUserAppAndAddress(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, now := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	for range 3 {
+		if _, err := gate.Authenticate(sessionRequest()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if l.calls != 1 {
+		t.Fatalf("cached decision looked up %d times", l.calls)
+	}
+	l.allowed = false
+	*now = now.Add(EntryCacheTTL - time.Second)
+	if _, err := gate.Authenticate(sessionRequest()); err != nil || l.calls != 1 {
+		t.Fatalf("within TTL: %v calls=%d", err, l.calls)
+	}
+	*now = now.Add(2 * time.Second)
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAppPrivilegeDenied) || l.calls != 2 {
+		t.Fatalf("after TTL: %v calls=%d", err, l.calls)
+	}
+	r := sessionRequest()
+	r.RemoteAddr = "198.51.100.4:1"
+	gate.Authenticate(r)
+	if l.calls != 3 {
+		t.Fatalf("another address reused a cached decision: calls=%d", l.calls)
+	}
+}
+
+func TestCacheSurvivesAcrossCGIProcessesAndIgnoresFutureEntries(t *testing.T) {
+	dir := t.TempDir()
+	l := &lookup{allowed: true}
+	first, err := NewEntryGate(ordinary("bob"), EntryAppPrivilege, "DemoApp", dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Unix(1_700_000_000, 0)
+	g1 := first.(*EntryGate)
+	g1.now = func() time.Time { return now }
+	g1.allowed = l.check
+	g1.Authenticate(sessionRequest())
+	second, _ := NewEntryGate(ordinary("bob"), EntryAppPrivilege, "DemoApp", dir)
+	g2 := second.(*EntryGate)
+	g2.now = func() time.Time { return now.Add(time.Second) }
+	g2.allowed = g1.allowed
+	g2.Authenticate(sessionRequest())
+	if l.calls != 1 {
+		t.Fatalf("a new process ignored the shared cache: calls=%d", l.calls)
+	}
+	g2.now = func() time.Time { return now.Add(-time.Minute) }
+	g2.Authenticate(sessionRequest())
+	if l.calls != 2 {
+		t.Fatalf("an entry from the future was trusted: calls=%d", l.calls)
+	}
+	info, err := os.Stat(filepath.Join(dir, "entry", entryCacheFile))
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("cache file: %v %v", info, err)
+	}
+}
+
+func TestFailuresAreNeverCached(t *testing.T) {
+	l := &lookup{err: errors.New("bridge exited 2")}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	gate.Authenticate(sessionRequest())
+	l.err, l.allowed = nil, true
+	if _, err := gate.Authenticate(sessionRequest()); err != nil || l.calls != 2 {
+		t.Fatalf("err=%v calls=%d", err, l.calls)
+	}
+}
+
+func TestCacheIsBoundedAndToleratesCorruption(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	for i := range EntryCacheMaxEntries + 20 {
+		r := sessionRequest()
+		r.RemoteAddr = "10.0." + strconv.Itoa(i/250) + "." + strconv.Itoa(i%250) + ":1"
+		if _, err := gate.Authenticate(r); err != nil {
+			t.Fatal(err)
+		}
+	}
+	entries, err := gate.readCache()
+	if err != nil || len(entries) > EntryCacheMaxEntries {
+		t.Fatalf("cache holds %d entries: %v", len(entries), err)
+	}
+	if err := os.WriteFile(filepath.Join(gate.dir, entryCacheFile), []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	before := l.calls
+	if _, err := gate.Authenticate(sessionRequest()); err != nil || l.calls != before+1 {
+		t.Fatalf("corrupt cache: %v calls=%d", err, l.calls-before)
+	}
+}
+
+func TestUnwritableCacheStillDecides(t *testing.T) {
+	l := &lookup{allowed: false}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	gate.dir = filepath.Join(t.TempDir(), "missing", "nested")
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAppPrivilegeDenied) {
+		t.Fatal(err)
+	}
+}
+
+func TestAppPrivilegeRefusesMalformedInputsBeforeTheBridge(t *testing.T) {
+	for _, app := range []string{"", "SYNO", "SYNO.SDS.Demo App.Instance", "SYNO..Instance", "SYNO.SDS.Demo.Instance\n"} {
+		if appID.MatchString(app) {
+			t.Fatalf("accepted app ID %q", app)
+		}
+	}
+	if !appID.MatchString("SYNO.SDS.DemoApp.Instance") {
+		t.Fatal("refused the generated app ID")
+	}
+	for _, args := range [][3]string{{"", "SYNO.SDS.Demo.Instance", "10.0.0.5"}, {"bob", "SYNO.SDS.Demo.Instance", "10.0.0.05"}, {"bob", "SYNO.SDS.Demo.Instance", "fe80::1%eth0"}, {"bob", "bad", "10.0.0.5"}} {
+		if ok, err := AppPrivilege(context.Background(), args[0], args[1], args[2]); ok || err == nil {
+			t.Fatalf("%q: %v %v", args, ok, err)
+		}
+	}
+}
+
+// admin-only is the floor of every route: SDK routes the policy marks
+// authenticated (nas.files.list, bg.jobs.submit, delegate.status) refuse an
+// ordinary user exactly like app routes, while administrators reach them.
+func TestAdminOnlyEntryFloorsSDKRoutesAtAdministrators(t *testing.T) {
+	sdkRoutes := []string{"nas.files.list", "bg.jobs.submit", "delegate.status", "portal.status", "executor.status"}
+	for _, tc := range []struct {
+		id   api.Identity
+		code string
+	}{
+		{api.Identity{User: "bob"}, "admin_required"},
+		{api.Identity{User: "alice", Admin: true}, ""},
+	} {
+		executed := 0
+		var routes []api.Route
+		for _, method := range sdkRoutes {
+			routes = append(routes, api.Handle(method, func(context.Context, api.Caller, json.RawMessage) (any, error) {
+				executed++
+				return map[string]bool{"ok": true}, nil
+			}))
+		}
+		gate, _ := newTestGate(t, EntryAdminOnly, fixedAuth{id: tc.id}, &lookup{allowed: true})
+		srv, err := api.NewServerWithPermissions(gate, []byte(`{"schema":1,"default":"administrators","methods":{}}`), routes...)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, method := range sdkRoutes {
+			req := httptest.NewRequest(http.MethodPost, "http://nas.local/webman/3rdparty/DemoApp/cgi/api.cgi", strings.NewReader(`{"method":"`+method+`"}`))
+			req.Header.Set("Content-Type", "application/json")
+			rec := httptest.NewRecorder()
+			srv.ServeHTTP(rec, req)
+			var env struct {
+				Error *struct {
+					Code string `json:"code"`
+				} `json:"error"`
+			}
+			if err := json.Unmarshal(rec.Body.Bytes(), &env); err != nil {
+				t.Fatalf("%s: %q", method, rec.Body.String())
+			}
+			got := ""
+			if env.Error != nil {
+				got = env.Error.Code
+			}
+			if got != tc.code {
+				t.Fatalf("%s as %+v: code %q, want %q", method, tc.id, got, tc.code)
+			}
+		}
+		if want := map[bool]int{true: len(sdkRoutes), false: 0}[tc.id.Admin]; executed != want {
+			t.Fatalf("%+v executed %d handlers, want %d", tc.id, executed, want)
+		}
+	}
+}

package/templates/native-go/backend/internal/dsm/native/apppriv_check.c

@@ -0,0 +1,33 @@
+// Minimal DSM SDK bridge for Application Privileges. DSM evaluates its own
+// user, group and everyone rules, allow/deny precedence and IP ranges; this
+// bridge only passes the verified principal, the registered app ID and the
+// client address, and prints DSM's exact decision.
+#include <dlfcn.h>
+#include <stdio.h>
+#include <string.h>
+
+#ifndef DSM_SDK_LIBRARY
+#define DSM_SDK_LIBRARY "/usr/lib/libsynosdk.so"
+#endif
+
+// ABI measured on DSM 7.4 (vt-nas, kernel 4.4): int (const char *user,
+// const char *app, const char *ip) returning 1 (allowed) or 0 (refused).
+// A NULL address refuses every account, so the address is mandatory.
+typedef int (*apppriv_check_fn)(const char *, const char *, const char *);
+_Static_assert(sizeof(int) == 4, "DSM BOOL ABI requires a 32-bit int");
+
+static int bounded(const char *value, size_t max) {
+    return value[0] != '\0' && strlen(value) <= max;
+}
+
+int main(int argc, char **argv) {
+    if (argc != 4 || !bounded(argv[1], 1024) || !bounded(argv[2], 128) || !bounded(argv[3], 64)) return 2;
+    void *library = dlopen(DSM_SDK_LIBRARY, RTLD_NOW | RTLD_LOCAL);
+    if (!library) return 2;
+    apppriv_check_fn check = (apppriv_check_fn)dlsym(library, "SLIBAppPrivUserHas");
+    if (!check) { dlclose(library); return 2; }
+    int result = check(argv[1], argv[2], argv[3]);
+    dlclose(library);
+    if (result != 0 && result != 1) return 2;
+    return printf("%d\n", result) == 2 ? 0 : 2;
+}

package/templates/native-go/backend/internal/dsm/native/build.sh

@@ -1,9 +1,18 @@
 #!/bin/sh
 set -eu
 # Zig 0.16.0 cross-compiles this small libc/dlopen bridge. No proprietary SDK
-# headers or libraries are distributed. GNU ABI 2.17 covers both DSM targets.
+# headers or libraries are distributed. GNU ABI 2.17 covers every DSM target.
 cd "$(dirname "$0")"
 [ "$(zig version)" = "0.16.0" ] || { echo 'requires Zig 0.16.0' >&2; exit 2; }
-for arch in x86_64 aarch64; do
-  zig cc admin_check.c -target "$arch-linux-gnu.2.17" -std=c11 -O2 -Wall -Wextra -Werror -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro,-z,now -Wl,--build-id=none -s -ldl -o "admin-$arch.elf"
-done
+build() { # <arch> <zig target> [compiler flags]
+  arch=$1 target=$2
+  shift 2
+  for bridge in admin apppriv; do
+    zig cc "${bridge}_check.c" -target "$target" "$@" -std=c11 -O2 -Wall -Wextra -Werror -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro,-z,now -Wl,--build-id=none -s -ldl -o "$bridge-$arch.elf"
+  done
+}
+build x86_64 x86_64-linux-gnu.2.17
+build aarch64 aarch64-linux-gnu.2.17
+# ARMv7-A, VFPv3 and NEON, no integer divide: the Cortex-A9 (armada38x,
+# monaco) and Cortex-A15 (alpine, alpine4k) models both run it.
+build armv7 arm-linux-gnueabihf.2.17 -mcpu=baseline

package/templates/native-go/backend/internal/dsm/native/provenance.json

@@ -3,10 +3,16 @@
   "abi": "GNU libc 2.17",
   "files": {
     "admin_check.c": "87dbc9be7742f52bdde6ed3bf73ea79facc6f0708b317696eff03624b4c3276b",
-    "build.sh": "deae3f75b53882efbf6c0d31197892a8571f1b20ae42c92f99ee6782e3286d1e",
+    "apppriv_check.c": "08249e0a7d3e03fbb02da43f8c7323af11b914448d4a5928f99d39bb430a553c",
+    "build.sh": "89f05d98b60b4d28113f8faa97897ac18a7a5387afef3e85cfa47fa98b13629a",
     "admin-x86_64.elf": "cb14c60b74a59847f14d27e9361f874f82d99f6416407df861655b742c3a976c",
-    "admin-aarch64.elf": "2a8f33a8c31837bfc498a486baf78ac9b0549f743a9adf89de6d094db61e8baa"
+    "admin-aarch64.elf": "2a8f33a8c31837bfc498a486baf78ac9b0549f743a9adf89de6d094db61e8baa",
+    "apppriv-x86_64.elf": "62b62a00d2b7bb725d4e10a3aecfd59005f943f98355a129cb418213a4595363",
+    "apppriv-aarch64.elf": "8ef803709f0bb775cac607833f1d45f3025371da268297ec6c0253f7431a9167",
+    "admin-armv7.elf": "da4a0f986adcb66ab7d09d1e8478ee8b22ae9d6ccb1461ea4552789a7663f1f8",
+    "apppriv-armv7.elf": "19d86118414f0d04f0806b5f3e199f26092b5521f24e70847093532a2b84b2a7"
   },
   "sdkSymbol": "SLIBGroupIsAdminGroupMem",
-  "sdkRealtime": true
+  "sdkRealtime": true,
+  "appPrivSymbol": "SLIBAppPrivUserHas"
 }

package/templates/native-go/backend/internal/filestation/check_permission.go

@@ -0,0 +1,71 @@
+package filestation
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"net/http"
+	"time"
+)
+
+// CheckPermission is an online write check with the current user's session.
+// It creates no probe file and does not grant any offline authority.
+func (c *Client) CheckPermission(ctx context.Context, r *http.Request, path string) error {
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return err
+	}
+	r = r.Clone(ctx)
+	r.Header.Set("X-SYNO-TOKEN", auth["dsm_synotoken"])
+	if !validPath(path) {
+		return fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.CheckPermission", "write", "3")
+	v.Set("path", path)
+	v.Set("filename", ".synopkgland-permission-probe")
+	v.Set("overwrite", "false")
+	v.Set("size", "0")
+	var data map[string]json.RawMessage
+	if err := c.call(ctx, r, v, &data); err != nil {
+		return err
+	}
+	var skip *bool
+	if json.Unmarshal(data["blSkip"], &skip) != nil || skip == nil || *skip {
+		return fail("denied")
+	}
+	// File Station can return per-file refusal inside a success envelope.
+	for _, key := range []string{"error", "errors"} {
+		if raw := data[key]; len(raw) != 0 && string(raw) != "null" && string(raw) != "[]" {
+			return fail("denied")
+		}
+	}
+	return nil
+}
+
+// Keep the original DSMClient contract usable by existing read-only adapters.
+// An adapter lacking the new method refuses the write check.
+type permissionClient interface {
+	CheckPermission(context.Context, *http.Request, string) error
+}
+
+func (s *Service) CheckPermission(ctx context.Context, caller api.Caller, r *http.Request, path string) error {
+	if !validPath(path) {
+		return fail("invalid-request")
+	}
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return err
+	}
+	r = r.Clone(ctx)
+	r.Header.Set("X-SYNO-TOKEN", auth["dsm_synotoken"])
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	if err := s.verify(ctx, caller, r); err != nil {
+		return err
+	}
+	client, ok := s.client.(permissionClient)
+	if !ok {
+		return fail("unsupported")
+	}
+	return client.CheckPermission(ctx, r, path)
+}

package/templates/native-go/backend/internal/filestation/check_permission_test.go

@@ -0,0 +1,77 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestCheckPermissionRequiresVerifiedSessionAndExplicitWriteResult(t *testing.T) {
+	for _, body := range []string{`{"blSkip":false}`, `{}`, `{"blSkip":true}`, `{"blSkip":null}`, `{"blSkip":false,"errors":[{"code":407}]}`} {
+		t.Run(body, func(t *testing.T) {
+			checks := 0
+			client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+				r.ParseForm()
+				switch r.Form.Get("api") {
+				case "SYNO.Core.NormalUser":
+					fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+				case "SYNO.FileStation.CheckPermission":
+					checks++
+					if r.Form.Get("version") != "3" || r.Form.Get("method") != "write" || r.Form.Get("path") != "/home" || r.Form.Get("filename") != ".synopkgland-permission-probe" || r.Form.Get("overwrite") != "false" || r.Form.Get("size") != "0" || r.Header.Get("Cookie") != "id=test-session" || r.Header.Get("X-SYNO-TOKEN") != "test-token" {
+						t.Error("incorrect permission check transport")
+					}
+					fmt.Fprintf(w, `{"success":true,"data":%s}`, body)
+				default:
+					t.Error("unexpected API")
+				}
+			})
+			service := NewService(client)
+			err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home")
+			if (err == nil) != (body == `{"blSkip":false}`) || checks != 1 {
+				t.Fatalf("checks=%d err=%v", checks, err)
+			}
+			checks = 0
+			if err := service.CheckPermission(context.Background(), callerFor(t, "bob"), sessionRequest(), "/home"); err == nil || checks != 0 {
+				t.Fatal("mismatched subject checked write permission")
+			}
+			if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home/../etc"); err == nil || checks != 0 {
+				t.Fatal("invalid path checked")
+			}
+		})
+	}
+}
+
+func TestCheckPermissionValidatesCredentialPairBeforeDSM(t *testing.T) {
+	calls := 0
+	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		r.ParseForm()
+		if r.Form.Get("api") == "SYNO.Core.NormalUser" {
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+		} else {
+			fmt.Fprint(w, `{"success":true,"data":{"blSkip":false}}`)
+		}
+	})
+	service := NewService(client)
+	for index, r := range []*http.Request{nil, httptest.NewRequest("POST", "/", nil), sessionRequest(), sessionRequest()} {
+		if r != nil && r.Header.Get("X-SYNO-TOKEN") != "" {
+			if index == 2 {
+				r.Header.Del("X-SYNO-TOKEN")
+			} else {
+				r.Header.Set("SynoToken", "different")
+			}
+		}
+		before := calls
+		if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err == nil || calls != before {
+			t.Fatal("invalid session reached DSM", err, calls)
+		}
+	}
+	r := sessionRequest()
+	r.Header.Del("X-SYNO-TOKEN")
+	r.Header.Set("SynoToken", "test-token")
+	if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err != nil {
+		t.Fatal("canonical alias refused", err)
+	}
+}

package/templates/native-go/backend/internal/filestation/sdk_policy_test.go

@@ -0,0 +1,39 @@
+package filestation
+
+import (
+	"encoding/json"
+	"os"
+	"sort"
+	"testing"
+)
+
+// Every files entry in the SDK policy must name a route this package serves.
+func TestSDKPolicyListsExactlyTheFileRoutes(t *testing.T) {
+	raw, err := os.ReadFile("../api/sdk-permissions.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var policy struct {
+		Files map[string]string `json:"files"`
+	}
+	if err := json.Unmarshal(raw, &policy); err != nil {
+		t.Fatal(err)
+	}
+	var declared, routed []string
+	for method := range policy.Files {
+		declared = append(declared, method)
+	}
+	for _, route := range (&Service{}).Routes() {
+		routed = append(routed, route.Method())
+	}
+	sort.Strings(declared)
+	sort.Strings(routed)
+	if len(declared) != len(routed) {
+		t.Fatalf("policy %v, routes %v", declared, routed)
+	}
+	for i := range declared {
+		if declared[i] != routed[i] {
+			t.Fatalf("policy %v, routes %v", declared, routed)
+		}
+	}
+}

package/templates/native-go/backend/internal/filestation/service.go

@@ -204,7 +204,7 @@ func (s *Service) discover(ctx context.Context, r *http.Request, folder string,
 // Browse lists share roots (empty folder) or one folder through the caller's
 // own DSM session, so File Station's current permissions decide what is
 // visible. It is read-only metadata and stores no grant; background jobs use it
-// to let an administrator pick the file that ReadFile will then import.
+// to let an authenticated caller pick the file that ReadFile will then import.
 func (s *Service) Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (Page, error) {
 	if !c.Authenticated() {
 		return Page{}, fail("session_required")