@synopackageland/cli 0.6.1 → 0.7.0

package/dist/templates/native-go/backend/internal/filestation/check_permission_test.go

@@ -0,0 +1,77 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestCheckPermissionRequiresVerifiedSessionAndExplicitWriteResult(t *testing.T) {
+	for _, body := range []string{`{"blSkip":false}`, `{}`, `{"blSkip":true}`, `{"blSkip":null}`, `{"blSkip":false,"errors":[{"code":407}]}`} {
+		t.Run(body, func(t *testing.T) {
+			checks := 0
+			client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+				r.ParseForm()
+				switch r.Form.Get("api") {
+				case "SYNO.Core.NormalUser":
+					fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+				case "SYNO.FileStation.CheckPermission":
+					checks++
+					if r.Form.Get("version") != "3" || r.Form.Get("method") != "write" || r.Form.Get("path") != "/home" || r.Form.Get("filename") != ".synopkgland-permission-probe" || r.Form.Get("overwrite") != "false" || r.Form.Get("size") != "0" || r.Header.Get("Cookie") != "id=test-session" || r.Header.Get("X-SYNO-TOKEN") != "test-token" {
+						t.Error("incorrect permission check transport")
+					}
+					fmt.Fprintf(w, `{"success":true,"data":%s}`, body)
+				default:
+					t.Error("unexpected API")
+				}
+			})
+			service := NewService(client)
+			err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home")
+			if (err == nil) != (body == `{"blSkip":false}`) || checks != 1 {
+				t.Fatalf("checks=%d err=%v", checks, err)
+			}
+			checks = 0
+			if err := service.CheckPermission(context.Background(), callerFor(t, "bob"), sessionRequest(), "/home"); err == nil || checks != 0 {
+				t.Fatal("mismatched subject checked write permission")
+			}
+			if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home/../etc"); err == nil || checks != 0 {
+				t.Fatal("invalid path checked")
+			}
+		})
+	}
+}
+
+func TestCheckPermissionValidatesCredentialPairBeforeDSM(t *testing.T) {
+	calls := 0
+	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		r.ParseForm()
+		if r.Form.Get("api") == "SYNO.Core.NormalUser" {
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+		} else {
+			fmt.Fprint(w, `{"success":true,"data":{"blSkip":false}}`)
+		}
+	})
+	service := NewService(client)
+	for index, r := range []*http.Request{nil, httptest.NewRequest("POST", "/", nil), sessionRequest(), sessionRequest()} {
+		if r != nil && r.Header.Get("X-SYNO-TOKEN") != "" {
+			if index == 2 {
+				r.Header.Del("X-SYNO-TOKEN")
+			} else {
+				r.Header.Set("SynoToken", "different")
+			}
+		}
+		before := calls
+		if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err == nil || calls != before {
+			t.Fatal("invalid session reached DSM", err, calls)
+		}
+	}
+	r := sessionRequest()
+	r.Header.Del("X-SYNO-TOKEN")
+	r.Header.Set("SynoToken", "test-token")
+	if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err != nil {
+		t.Fatal("canonical alias refused", err)
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/sdk_policy_test.go

@@ -0,0 +1,39 @@
+package filestation
+
+import (
+	"encoding/json"
+	"os"
+	"sort"
+	"testing"
+)
+
+// Every files entry in the SDK policy must name a route this package serves.
+func TestSDKPolicyListsExactlyTheFileRoutes(t *testing.T) {
+	raw, err := os.ReadFile("../api/sdk-permissions.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var policy struct {
+		Files map[string]string `json:"files"`
+	}
+	if err := json.Unmarshal(raw, &policy); err != nil {
+		t.Fatal(err)
+	}
+	var declared, routed []string
+	for method := range policy.Files {
+		declared = append(declared, method)
+	}
+	for _, route := range (&Service{}).Routes() {
+		routed = append(routed, route.Method())
+	}
+	sort.Strings(declared)
+	sort.Strings(routed)
+	if len(declared) != len(routed) {
+		t.Fatalf("policy %v, routes %v", declared, routed)
+	}
+	for i := range declared {
+		if declared[i] != routed[i] {
+			t.Fatalf("policy %v, routes %v", declared, routed)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/service.go

@@ -204,7 +204,7 @@ func (s *Service) discover(ctx context.Context, r *http.Request, folder string,
 // Browse lists share roots (empty folder) or one folder through the caller's
 // own DSM session, so File Station's current permissions decide what is
 // visible. It is read-only metadata and stores no grant; background jobs use it
-// to let an administrator pick the file that ReadFile will then import.
+// to let an authenticated caller pick the file that ReadFile will then import.
 func (s *Service) Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (Page, error) {
 	if !c.Authenticated() {
 		return Page{}, fail("session_required")

package/dist/templates/native-go/backend/internal/portal/portal.go

@@ -0,0 +1,138 @@
+// Package portal reads the DSM Application Portal alias an administrator set
+// for this package. DSM owns the setting: the package never writes it, and
+// anything this reader does not fully understand reads as Unavailable.
+package portal
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"regexp"
+	"syscall"
+	"unicode/utf8"
+
+	"dsmapp/internal/jsonlimits"
+)
+
+// MaxConfigBytes bounds DSM's saved setting; its real size is a few hundred bytes.
+const MaxConfigBytes = 64 << 10
+
+const (
+	// Active means users can open the app at /<alias>/ after DSM sign-in.
+	Active = "active"
+	// Inactive means no administrator has set an alias yet.
+	Inactive = "inactive"
+	// Unavailable means the setting could not be read safely.
+	Unavailable = "unavailable"
+)
+
+// Status is what portal.status returns; Alias is set only when Active.
+type Status struct {
+	State string `json:"state"`
+	Alias string `json:"alias,omitempty"`
+}
+
+// A single URL path segment; DSM's own validation is looser than this.
+var aliasPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`)
+
+// ConfigPath is where DSM saves the package's portal setting
+// (/var/packages/<package>/etc is the package's @appconf directory).
+func ConfigPath(packageID string) string {
+	return "/var/packages/" + packageID + "/etc/AppPortal.json"
+}
+
+// Read returns the saved alias when the setting belongs to appID.
+func Read(path, appID string) Status {
+	raw, err := readBounded(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return Status{State: Inactive}
+	}
+	if err != nil {
+		return Status{State: Unavailable}
+	}
+	id, alias, ok := parse(raw)
+	if !ok || id != appID {
+		return Status{State: Unavailable}
+	}
+	if alias == "" {
+		return Status{State: Inactive}
+	}
+	if !aliasPattern.MatchString(alias) {
+		return Status{State: Unavailable}
+	}
+	return Status{State: Active, Alias: alias}
+}
+
+func readBounded(path string) ([]byte, error) {
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() {
+		return nil, errors.New("not a regular file")
+	}
+	raw, err := io.ReadAll(io.LimitReader(f, MaxConfigBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	if len(raw) > MaxConfigBytes {
+		return nil, errors.New("too large")
+	}
+	return raw, nil
+}
+
+// parse accepts exactly one JSON object with unique top-level keys, a string
+// id and a string or null alias; other DSM fields are skipped unread.
+func parse(raw []byte) (id, alias string, ok bool) {
+	if !utf8.Valid(raw) || !jsonlimits.WithinLimits(raw) {
+		return "", "", false
+	}
+	d := json.NewDecoder(bytes.NewReader(raw))
+	if token, err := d.Token(); err != nil || token != json.Delim('{') {
+		return "", "", false
+	}
+	seen := map[string]bool{}
+	hasID := false
+	for d.More() {
+		token, err := d.Token()
+		key, isKey := token.(string)
+		if err != nil || !isKey || seen[key] {
+			return "", "", false
+		}
+		seen[key] = true
+		var value json.RawMessage
+		if err := d.Decode(&value); err != nil {
+			return "", "", false
+		}
+		switch key {
+		case "id":
+			if json.Unmarshal(value, &id) != nil || id == "" {
+				return "", "", false
+			}
+			hasID = true
+		case "alias":
+			var text *string
+			if json.Unmarshal(value, &text) != nil {
+				return "", "", false
+			}
+			if text != nil {
+				alias = *text
+			}
+		}
+	}
+	if token, err := d.Token(); err != nil || token != json.Delim('}') {
+		return "", "", false
+	}
+	if _, err := d.Token(); err != io.EOF {
+		return "", "", false
+	}
+	return id, alias, hasID
+}

package/dist/templates/native-go/backend/internal/portal/portal_test.go

@@ -0,0 +1,89 @@
+package portal
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const appID = "SYNO.SDS.HelloGo.Instance"
+
+// saved mirrors DSM 7.4's AppPortal.json after an administrator sets an alias.
+func saved(alias string) string {
+	return "{\n\t\"acl\" : \"\",\n\t\"alias\" : " + alias + ",\n\t\"alternatePort\" : null,\n\t\"application\" : \"Hello Go\",\n\t\"fqdn\" : null,\n\t\"https\" : \n\t{\n\t\t\"hsts\" : false\n\t},\n\t\"id\" : \"" + appID + "\",\n\t\"version\" : 3\n}\n"
+}
+
+func write(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "AppPortal.json")
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestActiveAlias(t *testing.T) {
+	got := Read(write(t, saved(`"hello-go"`)), appID)
+	if got != (Status{State: Active, Alias: "hello-go"}) {
+		t.Fatalf("got %+v", got)
+	}
+}
+
+func TestNoSavedSettingIsInactive(t *testing.T) {
+	if got := Read(filepath.Join(t.TempDir(), "AppPortal.json"), appID); got != (Status{State: Inactive}) {
+		t.Fatalf("missing file: %+v", got)
+	}
+	for _, alias := range []string{`null`, `""`} {
+		if got := Read(write(t, saved(alias)), appID); got != (Status{State: Inactive}) {
+			t.Fatalf("alias %s: %+v", alias, got)
+		}
+	}
+}
+
+func TestAnythingElseFailsClosed(t *testing.T) {
+	other := strings.Replace(saved(`"hello-go"`), appID, "SYNO.SDS.Other.Instance", 1)
+	cases := map[string]string{
+		"another app":     other,
+		"no id":           `{"alias":"hello-go"}`,
+		"duplicate alias": `{"alias":"hello-go","alias":"evil","id":"` + appID + `"}`,
+		"duplicate id":    `{"id":"SYNO.SDS.Other.Instance","alias":"hello-go","id":"` + appID + `"}`,
+		"alias number":    saved(`1`),
+		"alias path":      saved(`"a/b"`),
+		"alias dots":      saved(`".."`),
+		"alias query":     saved(`"a?b"`),
+		"alias too long":  saved(`"` + strings.Repeat("a", 65) + `"`),
+		"array":           `[]`,
+		"trailing value":  saved(`"hello-go"`) + `{}`,
+		"not json":        `alias=hello-go`,
+		"not utf8":        "{\"alias\":\"\xff\",\"id\":\"" + appID + "\"}",
+		"too large":       saved(`"hello-go"`) + strings.Repeat(" ", MaxConfigBytes),
+		"too deep":        strings.Replace(saved(`"hello-go"`), `"acl" : ""`, `"acl" : `+strings.Repeat("[", 64)+strings.Repeat("]", 64), 1),
+	}
+	for name, content := range cases {
+		if got := Read(write(t, content), appID); got != (Status{State: Unavailable}) {
+			t.Errorf("%s: %+v", name, got)
+		}
+	}
+}
+
+func TestOnlyARegularFileIsRead(t *testing.T) {
+	dir := t.TempDir()
+	target := write(t, saved(`"hello-go"`))
+	link := filepath.Join(dir, "AppPortal.json")
+	if err := os.Symlink(target, link); err != nil {
+		t.Fatal(err)
+	}
+	if got := Read(link, appID); got != (Status{State: Unavailable}) {
+		t.Fatalf("symlink: %+v", got)
+	}
+	if got := Read(dir, appID); got != (Status{State: Unavailable}) {
+		t.Fatalf("directory: %+v", got)
+	}
+}
+
+func TestConfigPathIsThePackagesOwnSetting(t *testing.T) {
+	if got := ConfigPath("HelloGo"); got != "/var/packages/HelloGo/etc/AppPortal.json" {
+		t.Fatal(got)
+	}
+}

package/dist/templates/native-go/dsm-package.yaml

@@ -11,9 +11,28 @@ build: 1
 displayname: __DISPLAY_NAME__
 description: A native DSM package with a Go backend and a DSM window UI.
 maintainer: Your Name
+# Optional INFO/website metadata. Omit fields you do not need.
+# metadata:
+#   contact_email: you@example.com
+#   support_email: support@example.com
+#   homepage: https://example.com
+#   source_url: https://github.com/you/your-app
+#   issues_url: https://github.com/you/your-app/issues
+#   license: MIT
+#   long_description:
+#     en: |-
+#       Explain what the app does and how to use it.
+#     zh-TW: Translated description.
+#   changelog:          # text, or per-language like long_description
+#     en: |-
+#       - Most important change first. Omit to use Release notes.
+#     zh-TW: |-
+#       - Translated changes.
+#   screenshots: [https://example.com/screenshot.png]
 os_min_ver: "7.1-42661"
 
-# One SPK per architecture. Supported: x86_64, aarch64.
+# One SPK per architecture. Supported: x86_64, aarch64, armv7 (add it here to
+# build it; armv7 jobs/delegate/root-ops/daemon are built but not NAS-verified).
 arches: [x86_64, aarch64]
 
 backend:

package/dist/templates/native-go/i18n/glossary.json

@@ -580,7 +580,8 @@
         "it": "Siamo spiacenti, a questo account utente non sono stati assegnati privilegi appropriati per eseguire questa azione."
       },
       "keys": [
-        "error.admin_required"
+        "error.admin_required",
+        "error.app_privilege_denied"
       ]
     },
     {

package/dist/templates/native-go/i18n/messages/de.json

@@ -3,6 +3,7 @@
   "app.refresh": "Aktualisieren",
   "app.title": "Es funktioniert",
   "error.admin_required": "Dieses Benutzerkonto verfügt nicht über die erforderlichen Berechtigungen, um diese Aktion durchzuführen.",
+  "error.app_privilege_denied": "Dieses Benutzerkonto verfügt nicht über die erforderlichen Berechtigungen, um diese Aktion durchzuführen.",
   "error.auth_unavailable": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",
   "error.bad_request": "Überprüfen Sie den eingegebenen Wert und versuchen Sie es erneut.",
   "error.bad_response": "Dieser Vorgang kann nicht ausgeführt werden. Bitte versuchen Sie es später erneut.",

package/dist/templates/native-go/i18n/messages/en.json

@@ -3,6 +3,7 @@
   "app.refresh": "Refresh",
   "app.title": "It works",
   "error.admin_required": "Sorry, this user account has not been assigned proper privileges to perform this action.",
+  "error.app_privilege_denied": "Sorry, this user account has not been assigned proper privileges to perform this action.",
   "error.auth_unavailable": "Unable to perform this operation. Please try again later.",
   "error.bad_request": "Check the entered value and try again.",
   "error.bad_response": "Unable to perform this operation. Please try again later.",

package/dist/templates/native-go/i18n/messages/es.json

@@ -3,6 +3,7 @@
   "app.refresh": "Actualizar",
   "app.title": "Funciona",
   "error.admin_required": "A esta cuenta de usuario no se le han asignado los privilegios adecuados para realizar esta acción.",
+  "error.app_privilege_denied": "A esta cuenta de usuario no se le han asignado los privilegios adecuados para realizar esta acción.",
   "error.auth_unavailable": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",
   "error.bad_request": "Compruebe el valor introducido y vuelva a intentarlo.",
   "error.bad_response": "No se puede realizar esta operación. Vuelva a intentarlo más tarde.",

package/dist/templates/native-go/i18n/messages/fr.json

@@ -3,6 +3,7 @@
   "app.refresh": "Actualiser",
   "app.title": "Ça fonctionne",
   "error.admin_required": "Désolé, ce compte utilisateur ne dispose pas des droits nécessaires pour accomplir cette action.",
+  "error.app_privilege_denied": "Désolé, ce compte utilisateur ne dispose pas des droits nécessaires pour accomplir cette action.",
   "error.auth_unavailable": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",
   "error.bad_request": "Vérifiez la valeur saisie et réessayez.",
   "error.bad_response": "Impossible d'effectuer cette opération. Veuillez réessayer ultérieurement.",

package/dist/templates/native-go/i18n/messages/it.json

@@ -3,6 +3,7 @@
   "app.refresh": "Aggiorna",
   "app.title": "Funziona",
   "error.admin_required": "Siamo spiacenti, a questo account utente non sono stati assegnati privilegi appropriati per eseguire questa azione.",
+  "error.app_privilege_denied": "Siamo spiacenti, a questo account utente non sono stati assegnati privilegi appropriati per eseguire questa azione.",
   "error.auth_unavailable": "Impossibile eseguire questa operazione. Riprovare più tardi.",
   "error.bad_request": "Controllare il valore inserito e riprovare.",
   "error.bad_response": "Impossibile eseguire questa operazione. Riprovare più tardi.",

package/dist/templates/native-go/i18n/messages/ja.json

@@ -3,6 +3,7 @@
   "app.refresh": "最新の情報に更新",
   "app.title": "動作しています",
   "error.admin_required": "申し訳ありませんが、このユーザー アカウントにはこの操作を行うための権限が与えられていません。",
+  "error.app_privilege_denied": "申し訳ありませんが、このユーザー アカウントにはこの操作を行うための権限が与えられていません。",
   "error.auth_unavailable": "この操作は実行できません。後でもう一度お試しください。",
   "error.bad_request": "入力した値を確認して、もう一度お試しください。",
   "error.bad_response": "この操作は実行できません。後でもう一度お試しください。",

package/dist/templates/native-go/i18n/messages/ko.json

@@ -3,6 +3,7 @@
   "app.refresh": "새로 고침",
   "app.title": "정상적으로 작동합니다",
   "error.admin_required": "죄송합니다. 이 사용자 계정에는 이 작업을 수행하기에 적절한 권한이 할당되지 않았습니다.",
+  "error.app_privilege_denied": "죄송합니다. 이 사용자 계정에는 이 작업을 수행하기에 적절한 권한이 할당되지 않았습니다.",
   "error.auth_unavailable": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",
   "error.bad_request": "입력한 값을 확인한 후 다시 시도하십시오.",
   "error.bad_response": "이 작업을 수행할 수 없습니다. 나중에 다시 시도하십시오.",

package/dist/templates/native-go/i18n/messages/zh-CN.json

@@ -3,6 +3,7 @@
   "app.refresh": "刷新",
   "app.title": "运行成功",
   "error.admin_required": "抱歉，此用户帐户权限不足，无法执行此操作。",
+  "error.app_privilege_denied": "抱歉，此用户帐户权限不足，无法执行此操作。",
   "error.auth_unavailable": "无法执行此操作。请稍后再试。",
   "error.bad_request": "请检查输入的值后重试。",
   "error.bad_response": "无法执行此操作。请稍后再试。",

package/dist/templates/native-go/i18n/messages/zh-TW.json

@@ -3,6 +3,7 @@
   "app.refresh": "重新整理",
   "app.title": "成功運作了",
   "error.admin_required": "抱歉，此使用者帳號權限不足，無法執行此動作。",
+  "error.app_privilege_denied": "抱歉，此使用者帳號權限不足，無法執行此動作。",
   "error.auth_unavailable": "無法執行此操作。請稍後再試。",
   "error.bad_request": "請檢查輸入的值後再試一次。",
   "error.bad_response": "無法執行此操作。請稍後再試。",

package/dist/templates/native-go/ui/app.css

@@ -33,3 +33,13 @@
 .dsmapp-facts { display: grid; grid-template-columns: max-content 1fr; gap: 4px 16px; margin: 0; }
 .dsmapp-facts dt { color: #5d6b7a; }
 .dsmapp-facts dd { margin: 0; }
+/* SDK portal panel (ctx.portal.mountPanel). */
+.dsmapp-portal-form { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; max-width: 560px; }
+.dsmapp-portal input { height: 28px; padding: 0 8px; border: 1px solid #c8d0da; border-radius: 3px; font: inherit; }
+.dsmapp-portal button {
+  height: 30px; padding: 0 12px; border: 1px solid #c8d0da; border-radius: 3px;
+  background: #fff; color: inherit; font: inherit; cursor: pointer; margin-top: 8px;
+}
+.dsmapp-portal-form button { margin-top: 0; }
+.dsmapp-portal-form button[type="submit"] { border-color: #0086e5; background: #0086e5; color: #fff; }
+.dsmapp-portal-error { color: #c0392b; }

package/dist/templates/native-go/ui/app.js

@@ -15,6 +15,9 @@
 //                                   host-theme/language-change unsupported
 //   ctx.host.openFileManager(path) / revealFile(path) -> File Station virtual path
 //       request only; preview/details/settings return unsupported, never a grant
+//   ctx.portal               -> only with `portal:` in dsm-package.yaml;
+//                               mountPanel(element) shows the DSM Application
+//                               Portal link, or the alias form to administrators
 // Replace everything below with your own UI (plain JS, or a bundle you build
 // with Vite/Vue into this folder -- see README.md).
 (function () {
@@ -40,6 +43,7 @@
     var message = el("p", { class: "dsmapp-message", role: "status" });
     var form = el("form", { class: "dsmapp-form", hidden: "" }, [input, save]);
     var adminOnly = el("p", { class: "dsmapp-note", hidden: "", text: t("greeting.adminOnly") });
+    var portal = ctx.portal ? el("section", { class: "dsmapp-portal" }) : null;
 
     root.classList.add("dsmapp");
     root.replaceChildren(
@@ -51,6 +55,7 @@
       el("h2", { text: t("status.heading") }),
       status
     );
+    var portalPanel = portal && (root.appendChild(portal), ctx.portal.mountPanel(portal));
 
     // Errors arrive as { code }; the backend's English message is only a fallback.
     function showError(error) {
@@ -93,7 +98,12 @@
 
     ctx.reopen(refresh);
     refresh();
-    return { unmount: function () { root.replaceChildren(); } };
+    return {
+      unmount: function () {
+        if (portalPanel) portalPanel.dispose();
+        root.replaceChildren();
+      }
+    };
   }
 
   window.DsmPackageApps = window.DsmPackageApps || {};