@synopackageland/cli 0.6.1 → 0.7.0

package/templates/native-go-delegate/backend/internal/delegate/destination_state.go

@@ -0,0 +1,117 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// ScopeSelection is executor evidence; an installation draft is never authority.
+type ScopeSelection struct {
+	Scope      string `json:"scope"`
+	Root       string `json:"root"`
+	Generation uint64 `json:"generation"`
+}
+
+// DestinationState contains only this caller's destination reference. Keep this
+// reference with an App job; do not persist the caller's DSM session.
+type DestinationState struct {
+	Key         string            `json:"key"`
+	Selection   *ScopeSelection   `json:"selection"`
+	Destination *DestinationGrant `json:"destination"`
+	Status      string            `json:"status"`
+}
+
+func virtualScope(scope string) string {
+	if scope == "home" {
+		return "/home"
+	}
+	if strings.HasPrefix(scope, "shared:") {
+		name := strings.TrimPrefix(scope, "shared:")
+		if validName(name) && !strings.ContainsAny(name, "\\:") && strings.TrimSpace(name) == name {
+			return "/" + name
+		}
+	}
+	return ""
+}
+func validSelection(value *ScopeSelection, dynamic bool) bool {
+	return value != nil && virtualScope(value.Scope) != "" && value.Root == virtualScope(value.Scope) && value.Generation <= 1<<53-1 && (!dynamic || value.Generation > 0)
+}
+
+// Never use this package-owned draft for authorization or executor parameters.
+func (s *Service) decorateScope(out *Capability) {
+	out.ScopeMode = s.Scope
+	if s.Scope != "install-selected" || s.InstallDraftPath == "" {
+		return
+	}
+	info, err := os.Lstat(s.InstallDraftPath)
+	if err != nil || !info.Mode().IsRegular() || info.Size() > 4096 {
+		return
+	}
+	b, err := os.ReadFile(s.InstallDraftPath)
+	var draft struct {
+		Schema int    `json:"schema"`
+		Scope  string `json:"scope"`
+	}
+	if err != nil || len(b) > 4096 || json.Unmarshal(b, &draft) != nil || draft.Schema != 1 || virtualScope(draft.Scope) == "" {
+		return
+	}
+	out.Preselection = draft.Scope
+	out.Mismatch = out.Selection != nil && out.Selection.Scope != draft.Scope
+}
+
+// Destination is the single caller-bound lookup for the chosen scope,
+// destination and grant status. Selection comes from matching executor pins.
+func (s *Service) Destination(ctx context.Context, caller api.Caller, r *http.Request, key string) (DestinationState, error) {
+	out := DestinationState{Key: key, Status: "missing"}
+	if s.Lifetime != "until-revoked" || !contains(s.Destinations, key) {
+		return out, fail("invalid-destination")
+	}
+	owner, err := s.owner(caller)
+	if err != nil {
+		return out, err
+	}
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return out, err
+	}
+	status := s.Status(ctx)
+	if status.State == "needs-scope-confirmation" {
+		out.Status = status.State
+		return out, nil
+	}
+	if status.State != "ready" && status.State != "disabled" {
+		return out, fail("EXECUTOR_UNAVAILABLE")
+	}
+	out.Selection = status.Selection
+	if !validSelection(out.Selection, s.Scope == "install-selected") {
+		return out, fail("EXECUTOR_PROTOCOL")
+	}
+	var list struct {
+		Delegations []Grant `json:"delegations"`
+	}
+	if err = s.Client.Call(ctx, "delegate.list", auth, nil, &list); err != nil {
+		return out, err
+	}
+	for _, grant := range list.Delegations {
+		if grant.Subject.Username != owner.User || grant.Subject.UIDString() != owner.UID || grant.Destination != key || grant.Lifetime != "until-revoked" {
+			continue
+		}
+		if out.Destination == nil {
+			out.Status = "reselection-required"
+		}
+		if grant.Revoked || grant.Scope != out.Selection.Scope || grant.ScopeGeneration != out.Selection.Generation || !validPath(grant.Path) || !(grant.Path == out.Selection.Root || strings.HasPrefix(grant.Path, out.Selection.Root+"/")) {
+			continue
+		}
+		out.Destination = &DestinationGrant{ID: grant.DelegationID, Key: key, Path: grant.Path, Username: grant.Subject.Username, Lifetime: grant.Lifetime}
+		out.Status = "active"
+	}
+	if status.State == "disabled" {
+		out.Status = "disabled"
+		out.Destination = nil
+	}
+	return out, nil
+}

package/templates/native-go-delegate/backend/internal/delegate/destination_state_test.go

@@ -0,0 +1,60 @@
+package delegate
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDestinationUsesProtectedSelectionAndThisOwnerOnly(t *testing.T) {
+	s := service(t, nil)
+	s.Scope = "install-selected"
+	s.Lifetime = "until-revoked"
+	s.Destinations = []string{"save"}
+	s.InstallDraftPath = filepath.Join(t.TempDir(), "delegate-install.json")
+	os.WriteFile(s.InstallDraftPath, []byte(`{"schema":1,"scope":"shared:untrusted"}`), 0600)
+	grants := `[{"delegation_id":"old","destination":"save","scope":"shared:reports","scope_generation":1,"path":"/reports/old","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"},{"delegation_id":"other","destination":"save","scope":"shared:reports","scope_generation":2,"path":"/reports/other","subject":{"username":"bob","uid":1206},"lifetime":"until-revoked"},{"delegation_id":"current","destination":"save","scope":"shared:reports","scope_generation":2,"path":"/reports/export","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"}]`
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, _ any, out any) error {
+		if op == "status" {
+			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false,"scope_state":"","selection":{"scope":"shared:reports","root":"/reports","generation":2}}`), out)
+		}
+		if op != "delegate.list" || auth["dsm_cookie"] != "fake-cookie" {
+			t.Fatal(op, auth)
+		}
+		return json.Unmarshal([]byte(`{"delegations":`+grants+`}`), out)
+	})
+	status := s.Status(context.Background())
+	if !status.Mismatch || status.Preselection != "shared:untrusted" || status.Selection.Scope != "shared:reports" {
+		t.Fatal(status)
+	}
+	got, err := s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save")
+	if err != nil || got.Status != "active" || got.Destination.ID != "current" || got.Selection.Scope != "shared:reports" {
+		t.Fatal(got, err)
+	}
+	grants = `[{"delegation_id":"old","destination":"save","scope":"home","scope_generation":1,"path":"/home","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"}]`
+	got, err = s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save")
+	if err != nil || got.Status != "reselection-required" || got.Destination != nil {
+		t.Fatal(got, err)
+	}
+	if _, err = s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "unknown"); err == nil {
+		t.Fatal("unknown key allowed")
+	}
+}
+func TestSelectedScopeMissingAndMalformedEvidenceNeverBecomeAuthority(t *testing.T) {
+	for _, wire := range []string{
+		`{"scope":"shared:reports","root":"/wrong","generation":1}`,
+		`{"scope":"shared:reports","root":"/reports","generation":0}`,
+		`{"scope":"shared:reports","root":"/reports","generation":9007199254740992}`,
+	} {
+		s := service(t, nil)
+		s.Scope = "install-selected"
+		s.Client = fakeExecutor(func(_ context.Context, _ string, _ map[string]string, _ any, out any) error {
+			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false,"selection":`+wire+`}`), out)
+		})
+		if got := s.Status(context.Background()); got.State != "blocked" || got.Selection != nil {
+			t.Fatal(got)
+		}
+	}
+}

package/templates/native-go-delegate/backend/internal/delegate/destination_test.go

@@ -0,0 +1,116 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+type fakeExecutor func(context.Context, string, map[string]string, any, any) error
+
+func (f fakeExecutor) Call(ctx context.Context, op string, auth map[string]string, in, out any) error {
+	return f(ctx, op, auth, in, out)
+}
+
+type fakeSession struct {
+	err        error
+	calls      int
+	user, path string
+}
+
+func (f *fakeSession) CheckPermission(_ context.Context, caller api.Caller, _ *http.Request, path string) error {
+	f.calls++
+	f.user, f.path = caller.User(), path
+	return f.err
+}
+func destinationCaller(t *testing.T, user string) api.Caller {
+	t.Helper()
+	var caller api.Caller
+	route := api.HandleRequest("test.caller", func(_ context.Context, c api.Caller, _ *http.Request, _ json.RawMessage) (any, error) {
+		caller = c
+		return struct{}{}, nil
+	})
+	srv, err := api.NewServerWithPermissions(identity{user}, []byte(`{"schema":1,"default":"administrators","methods":{"test.caller":"authenticated"}}`), route)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := httptest.NewRequest("POST", "/", strings.NewReader(`{"method":"test.caller","params":{}}`))
+	r.Header.Set("Content-Type", "application/json")
+	srv.ServeHTTP(httptest.NewRecorder(), r)
+	return caller
+}
+func destinationRequest() *http.Request {
+	r := httptest.NewRequest("POST", "/", nil)
+	r.AddCookie(&http.Cookie{Name: "id", Value: "fake-cookie"})
+	r.Header.Set("X-SYNO-TOKEN", "fake-token")
+	return r
+}
+func TestSelectDestinationChecksSessionBeforeSavingManifestBoundGrant(t *testing.T) {
+	session := &fakeSession{}
+	s := service(t, nil)
+	s.SessionFiles = session
+	s.Destinations = []string{"save"}
+	s.Operations = []string{"files.moveFromStaging"}
+	s.Lifetime = "until-revoked"
+	calls := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
+		calls++
+		if session.calls != 1 || session.user != "alice" || session.path != "/home" || op != "delegate.create" || auth["dsm_cookie"] != "fake-cookie" {
+			t.Fatal("grant saved before verifying caller write permission")
+		}
+		data, _ := json.Marshal(in)
+		if strings.Contains(string(data), "username") || strings.Contains(string(data), "uid") || strings.Contains(string(data), "job_id") || strings.Contains(string(data), "ttl_seconds") {
+			t.Fatal("caller authority or legacy job leaked into grant")
+		}
+		return json.Unmarshal([]byte(`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked","destination":"save","path":"/home"}`), out)
+	})
+	caller := destinationCaller(t, "alice")
+	grant, err := s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"})
+	if err != nil || grant.ID != "grant" || calls != 1 {
+		t.Fatal(grant, err, calls)
+	}
+	session.err = errors.New("denied")
+	if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil || calls != 1 {
+		t.Fatal("failed write check saved grant")
+	}
+	session.err = nil
+	for _, in := range []SelectDestinationParams{{Key: "other", Path: "/home"}, {Key: "save", Path: "/home/../etc"}, {Key: "save", Path: "/"}} {
+		if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), in); err == nil || calls != 1 {
+			t.Fatal("unbound destination saved grant")
+		}
+	}
+	s.Lifetime = ""
+	if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil || calls != 1 {
+		t.Fatal("legacy config silently made permanent")
+	}
+}
+func TestSelectDestinationRejectsExecutorSubjectMismatch(t *testing.T) {
+	for _, body := range []string{
+		`{"delegation_id":"grant","subject":{"username":"bob","uid":1205},"lifetime":"until-revoked","destination":"save","path":"/home"}`,
+		`{"delegation_id":"grant","subject":{"username":"alice","uid":1206},"lifetime":"until-revoked","destination":"save","path":"/home"}`,
+		`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked","destination":"other","path":"/home"}`,
+		`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"expires_at":"2030-01-01T00:00:00Z"}`,
+	} {
+		t.Run(body, func(t *testing.T) {
+			s := service(t, nil)
+			s.SessionFiles = &fakeSession{}
+			s.Destinations = []string{"save"}
+			s.Operations = []string{"files.moveFromStaging"}
+			s.Lifetime = "until-revoked"
+			s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, in, out any) error {
+				if op == "delegate.revoke" {
+					return nil
+				}
+				return json.Unmarshal([]byte(body), out)
+			})
+			if _, err := s.SelectDestination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil {
+				t.Fatal("unverified grant accepted")
+			}
+		})
+	}
+}

package/templates/native-go-delegate/backend/internal/delegate/example.go

@@ -0,0 +1,81 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"errors"
+	"golang.org/x/sys/unix"
+	"net/http"
+	"os"
+	"path"
+)
+
+// ExportExample is a small producer: capture the caller-bound destination,
+// produce in package-private staging, then use the existing completion hook.
+// A repeated job ID repeats the original request: MoveFromStaging returns the
+// original operation and admits only one the executor does not know.
+func (s *Service) ExportExample(ctx context.Context, caller api.Caller, request *http.Request, key, jobID string) (OperationRef, error) {
+	ref := OperationRef{JobID: jobID}
+	if !operationToken.MatchString(jobID) {
+		return ref, fail("invalid-request")
+	}
+	if s.Store == nil || background.RefuseRoot(os.Geteuid()) != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	selected, err := s.Destination(ctx, caller, request, key)
+	if err != nil {
+		return ref, err
+	}
+	if selected.Status != "active" || selected.Destination == nil {
+		return ref, fail("invalid-destination")
+	}
+	ref.DelegationID = selected.Destination.ID
+	binding, err := s.Store.MoveBinding(ctx, jobID)
+	if err == nil {
+		if binding.DelegationID != ref.DelegationID {
+			return ref, fail("operation-conflict")
+		}
+		auth, err := api.DSMSession(request)
+		if err != nil {
+			return ref, err
+		}
+		var original MoveParams
+		if json.Unmarshal(binding.Params, &original) != nil {
+			return ref, fail("operation-conflict")
+		}
+		_, err = s.admitStaging(ctx, auth, original)
+		return ref, err
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return ref, jobError(err)
+	}
+	if err = os.MkdirAll(s.StagingDir, 0700); err != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	name := "sdk-example-" + jobID + ".json"
+	parent, _, err := stagingParent(s.StagingDir, name)
+	if err != nil {
+		return ref, err
+	}
+	defer unix.Close(parent)
+	fd, err := unix.Openat(parent, path.Base(name), unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return ref, fail("operation-conflict")
+	}
+	file := os.NewFile(uintptr(fd), name)
+	contents, _ := json.Marshal(map[string]string{"example": "sdk-example", "job_id": jobID})
+	if _, err = file.Write(contents); err == nil {
+		err = file.Sync()
+	}
+	closeErr := file.Close()
+	if err != nil || closeErr != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	if err = unix.Fsync(parent); err != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	_, err = s.MoveFromStaging(ctx, MoveParams{DelegationID: ref.DelegationID, JobID: jobID, Staging: name, Name: name, Size: int64(len(contents))})
+	return ref, err
+}

package/templates/native-go-delegate/backend/internal/delegate/example_test.go

@@ -0,0 +1,91 @@
+package delegate
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestExportExampleProducesPrivateStagingAndCallsCompletionOnce(t *testing.T) {
+	s := service(t, nil)
+	s.Scope = "home"
+	s.Lifetime = "until-revoked"
+	s.Operations = []string{"files.moveFromStaging"}
+	s.Destinations = []string{"save"}
+	if err := os.MkdirAll(s.StagingDir, 0700); err != nil {
+		t.Fatal(err)
+	}
+	calls := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, params any, out any) error {
+		switch op {
+		case "status":
+			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false}`), out)
+		case "delegate.list":
+			return json.Unmarshal([]byte(`{"delegations":[{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"scope":"home","path":"/home/export","destination":"save","lifetime":"until-revoked"}]}`), out)
+		case "files.moveFromStaging":
+			calls++
+			in := params.(MoveParams)
+			b, err := os.ReadFile(filepath.Join(s.StagingDir, in.Staging))
+			if err != nil || !strings.Contains(string(b), "sdk-example") {
+				t.Fatal(string(b), err)
+			}
+			info, _ := os.Stat(filepath.Join(s.StagingDir, in.Staging))
+			if info.Mode().Perm() != 0600 {
+				t.Fatal(info.Mode())
+			}
+			return json.Unmarshal([]byte(`{"job_id":"example-1","state":"queued"}`), out)
+		case "files.operationStatus":
+			return json.Unmarshal([]byte(`{"job_id":"example-1","state":"queued"}`), out)
+		}
+		t.Fatal(op)
+		return nil
+	})
+	for i := 0; i < 2; i++ {
+		ref, err := s.ExportExample(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save", "example-1")
+		if err != nil || ref.JobID != "example-1" || ref.DelegationID != "grant" {
+			t.Fatal(ref, err)
+		}
+	}
+	if calls != 1 {
+		t.Fatal("replayed admission", calls)
+	}
+	if _, err := s.ExportExample(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save", "../escape"); err == nil {
+		t.Fatal("unsafe job id")
+	}
+}
+
+func TestExportExampleRecoversAnUnsentAdmission(t *testing.T) {
+	s := service(t, nil)
+	s.Scope, s.Lifetime, s.Operations, s.Destinations = "home", "until-revoked", []string{"files.moveFromStaging"}, []string{"save"}
+	if err := os.MkdirAll(s.StagingDir, 0700); err != nil {
+		t.Fatal(err)
+	}
+	e := newDedupExecutor()
+	offline := true
+	s.Client = fakeExecutor(func(ctx context.Context, op string, auth map[string]string, params, out any) error {
+		switch op {
+		case "status":
+			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false}`), out)
+		case "delegate.list":
+			return json.Unmarshal([]byte(`{"delegations":[{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"scope":"home","path":"/home/export","destination":"save","lifetime":"until-revoked"}]}`), out)
+		}
+		if offline {
+			return &dialFailure{fail("EXECUTOR_UNAVAILABLE")}
+		}
+		return e.Call(ctx, op, auth, params, out)
+	})
+	_, err := s.ExportExample(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save", "example-1")
+	code(t, err, "EXECUTOR_UNAVAILABLE")
+	offline = false
+	for i := 0; i < 2; i++ {
+		if _, err = s.ExportExample(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save", "example-1"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if moves, created := e.counts(); moves != 1 || created != 1 {
+		t.Fatal(moves, created)
+	}
+}