@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/_executor/cancel_contract_test.go

@@ -0,0 +1,236 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// stubbornMoveWriter keeps copying after its context ends until released, like
+// a slow write syscall, so the canceling window can be observed.
+type stubbornMoveWriter struct {
+	copying, release, published chan struct{}
+	publishing, finishPublish   chan struct{}
+	once                        sync.Once
+}
+
+func (w *stubbornMoveWriter) let() { w.once.Do(func() { close(w.release) }) }
+
+func newStubbornWriter() *stubbornMoveWriter {
+	return &stubbornMoveWriter{copying: make(chan struct{}), release: make(chan struct{}), published: make(chan struct{})}
+}
+func (w *stubbornMoveWriter) Write(context.Context, Subject, string, string, string, string) error {
+	return nil
+}
+func (w *stubbornMoveWriter) Move(_ context.Context, _ Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
+	close(w.copying)
+	<-w.release
+	return guard(func() (MoveReceipt, error) {
+		if w.publishing != nil {
+			close(w.publishing)
+			<-w.finishPublish
+		}
+		close(w.published)
+		return MoveReceipt{Path: d.Path + "/" + op.Name}, nil
+	})
+}
+
+func operationOf(t *testing.T, r Response) map[string]any {
+	t.Helper()
+	if !r.OK {
+		t.Fatal(r)
+	}
+	b, _ := json.Marshal(r.Result)
+	out := map[string]any{}
+	json.Unmarshal(b, &out)
+	return out
+}
+func wantOperation(t *testing.T, r Response, state, code, reason string) {
+	t.Helper()
+	out := operationOf(t, r)
+	got, _ := out["code"].(string)
+	why, _ := out["reason"].(string)
+	if out["state"] != state || got != code || why != reason {
+		t.Fatalf("want %s/%s/%s, got %v", state, code, reason, out)
+	}
+}
+func startedCopy(t *testing.T, e *Executor, w *stubbornMoveWriter, id, job string) {
+	t.Helper()
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	// Cleanups run in reverse: release the writer, then stop.
+	t.Cleanup(e.stopOperations)
+	t.Cleanup(w.let)
+	if r := offline(e, "files.moveFromStaging", moveParams(id, job)); !r.OK {
+		t.Fatal(r)
+	}
+	select {
+	case <-w.copying:
+	case <-time.After(2 * time.Second):
+		t.Fatal("copy did not start")
+	}
+}
+
+func TestCancelCopyingAcknowledgesDurablyUntilCanceled(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, id, "job")
+	ref := map[string]any{"delegation_id": id, "job_id": "job"}
+	for i := 0; i < 2; i++ {
+		// A repeated cancel after a lost reply returns the same acknowledgement.
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
+	}
+	wantOperation(t, offline(e, "files.operationStatus", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
+	e.commitMu.Lock()
+	op, err := e.Store.GetOperation("job")
+	e.commitMu.Unlock()
+	if err != nil || op.CancelRequested != "operation-canceled-by-user" {
+		t.Fatal("cancel intent not durable", op, err)
+	}
+	w.let()
+	waitState(t, e, "job", "canceled")
+	select {
+	case <-w.published:
+		t.Fatal("published after cancel acknowledgement")
+	default:
+	}
+	wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	wantOperation(t, offline(e, "files.moveFromStaging", moveParams(id, "job")), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+}
+
+func TestCancelRequestedCopySettlesCanceledAcrossStopAndCrash(t *testing.T) {
+	t.Run("stop-while-canceling", func(t *testing.T) {
+		e, _, _ := setup(t)
+		id := longGrant(t, e)
+		w := newStubbornWriter()
+		e.Writer = w
+		startedCopy(t, e, w, id, "job")
+		ref := map[string]any{"delegation_id": id, "job_id": "job"}
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "copying", "CANCEL_REQUESTED", "operation-canceled-by-user")
+		stopped := make(chan struct{})
+		go func() { e.stopOperations(); close(stopped) }()
+		w.let()
+		<-stopped
+		if err := e.startOperations(context.Background()); err != nil {
+			t.Fatal(err)
+		}
+		defer e.stopOperations()
+		wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	})
+	for _, intent := range []bool{false, true} {
+		name := map[bool]string{false: "crash-before-publish", true: "crash-after-publish-intent"}[intent]
+		t.Run(name, func(t *testing.T) {
+			e, _, _ := setup(t)
+			id := longGrant(t, e)
+			op := Operation{Version: 1, Package: e.Policy.Package, ID: id, Job: "job", State: "copying", CancelRequested: "operation-canceled-by-user", PublishIntent: intent, Staging: "result", Name: "out.csv", Size: 123}
+			if e.Store.PutOperation(op) != nil {
+				t.Fatal("put")
+			}
+			w := newStubbornWriter()
+			e.Writer = w
+			if err := e.startOperations(context.Background()); err != nil {
+				t.Fatal(err)
+			}
+			defer e.stopOperations()
+			ref := map[string]any{"delegation_id": id, "job_id": "job"}
+			if intent {
+				// A publish that may have happened is never reported as canceled.
+				wantOperation(t, offline(e, "files.operationStatus", ref), "uncertain", "uncertain", "")
+				return
+			}
+			wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+		})
+	}
+}
+
+func TestCancelBeforeAdmissionLeavesTombstoneThatIsNeverAdmitted(t *testing.T) {
+	e, f, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	e.Writer = w
+	if err := e.startOperations(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	defer e.stopOperations()
+	ref := map[string]any{"delegation_id": id, "job_id": "job"}
+	if r := offline(e, "files.operationStatus", ref); r.Code != "operation-not-found" {
+		t.Fatal(r)
+	}
+	if r := offline(e, "files.cancelOperation", map[string]any{"delegation_id": strings.Repeat("f", 64), "job_id": "job"}); r.Code != "operation-not-found" {
+		t.Fatal("canceled under an unknown grant", r)
+	}
+	f.user.Username = "bob"
+	if r := request(e, "files.cancelOperation", ref); r.Code != "operation-not-found" {
+		t.Fatal("another owner canceled", r)
+	}
+	f.user.Username = "alice"
+	for i := 0; i < 2; i++ {
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	}
+	// The original admission, arriving late or replayed, finds the tombstone.
+	for i := 0; i < 2; i++ {
+		wantOperation(t, offline(e, "files.moveFromStaging", moveParams(id, "job")), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	}
+	wantOperation(t, offline(e, "files.operationStatus", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	other := map[string]any{"delegation_id": longGrant(t, e), "job_id": "job"}
+	if r := offline(e, "files.cancelOperation", other); r.Code != "operation-not-found" {
+		t.Fatal("tombstone answered another grant", r)
+	}
+	select {
+	case <-w.copying:
+		t.Fatal("canceled reference was copied")
+	case <-time.After(50 * time.Millisecond):
+	}
+}
+
+func TestCancelQueuedNeverCopies(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	e.Writer = w
+	startedCopy(t, e, w, id, "active")
+	if r := offline(e, "files.moveFromStaging", moveParams(id, "queued")); !r.OK {
+		t.Fatal(r)
+	}
+	ref := map[string]any{"delegation_id": id, "job_id": "queued"}
+	for i := 0; i < 2; i++ {
+		wantOperation(t, offline(e, "files.cancelOperation", ref), "canceled", "OPERATION_CANCELED", "operation-canceled-by-user")
+	}
+	w.let()
+	waitState(t, e, "active", "committed")
+	if op := waitState(t, e, "queued", "canceled"); op.Part != nil || op.PublishIntent {
+		t.Fatal("canceled queued operation copied", op)
+	}
+}
+
+func TestCancelRacingPublishReturnsCommitted(t *testing.T) {
+	e, _, _ := setup(t)
+	id := longGrant(t, e)
+	w := newStubbornWriter()
+	w.publishing, w.finishPublish = make(chan struct{}), make(chan struct{})
+	e.Writer = w
+	startedCopy(t, e, w, id, "job")
+	w.let()
+	<-w.publishing
+	reply := make(chan Response, 1)
+	go func() {
+		reply <- offline(e, "files.cancelOperation", map[string]any{"delegation_id": id, "job_id": "job"})
+	}()
+	select {
+	case r := <-reply:
+		t.Fatal("cancel answered inside the publish fence", r)
+	case <-time.After(50 * time.Millisecond):
+	}
+	close(w.finishPublish)
+	out := operationOf(t, <-reply)
+	if out["state"] != "committed" || out["receipt"] == nil || out["code"] != nil {
+		t.Fatal("cancel after publish must report committed", out)
+	}
+	waitState(t, e, "job", "committed")
+}

package/dist/templates/_executor/copy.go

@@ -0,0 +1,64 @@
+package main
+
+import (
+	"bufio"
+	"errors"
+	"io"
+)
+
+// errParentGone means the move parent closed or broke the control pipe during
+// the copy: it exited or was killed, so no one can ever send publish.
+var errParentGone = errors.New("parent gone")
+
+type controlLine struct {
+	line string
+	err  error
+}
+
+// awaitControl reads the parent's next decision in the background. Pipe EOF
+// is the parent-death signal on every kernel, including 3.10, and unlike
+// PR_SET_PDEATHSIG it survives the child's identity drop and Go's threads.
+func awaitControl(r *bufio.Reader) <-chan controlLine {
+	next := make(chan controlLine, 1)
+	go func() {
+		line, err := r.ReadString('\n')
+		next <- controlLine{line, err}
+	}()
+	return next
+}
+
+// copyUnlessParentGone copies exactly size bytes, checking control between
+// chunks. The parent writes nothing during a copy, so any arrival ends it.
+func copyUnlessParentGone(out io.Writer, src io.Reader, size int64, control <-chan controlLine) error {
+	limited := io.LimitReader(src, size+1)
+	buf := make([]byte, 1<<20)
+	var n int64
+	for {
+		select {
+		case <-control:
+			return errParentGone
+		default:
+		}
+		m, err := limited.Read(buf)
+		if m > 0 {
+			if _, werr := out.Write(buf[:m]); werr != nil {
+				return werr
+			}
+			n += int64(m)
+		}
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return err
+		}
+	}
+	if n != size {
+		return errors.New("size mismatch")
+	}
+	return nil
+}
+
+func copyExact(out io.Writer, src io.Reader, size int64) error {
+	return copyUnlessParentGone(out, src, size, nil)
+}

package/dist/templates/_executor/copy_test.go

@@ -0,0 +1,88 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"os"
+	"testing"
+	"time"
+)
+
+type endlessZeros struct{ read int64 }
+
+func (z *endlessZeros) Read(p []byte) (int, error) {
+	clear(p)
+	z.read += int64(len(p))
+	return len(p), nil
+}
+
+// The move parent holds the child's control pipe open for the whole copy. If
+// the parent dies, the pipe closes and the child must stop copying at once
+// rather than fill a part file nobody can publish.
+func TestCopyStopsWhenParentClosesControl(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	control := awaitControl(bufio.NewReader(r))
+	src := &endlessZeros{}
+	done := make(chan error, 1)
+	go func() { done <- copyUnlessParentGone(io.Discard, src, 1<<50, control) }()
+	time.Sleep(50 * time.Millisecond)
+	w.Close()
+	select {
+	case err := <-done:
+		if !errors.Is(err, errParentGone) {
+			t.Fatal("want errParentGone, got", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("copy continued after the parent closed control")
+	}
+}
+
+// The parent never writes during the copy; anything arriving there is a
+// protocol violation and stops the copy too.
+func TestCopyStopsOnUnexpectedControlInput(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	defer w.Close()
+	control := awaitControl(bufio.NewReader(r))
+	done := make(chan error, 1)
+	go func() { done <- copyUnlessParentGone(io.Discard, &endlessZeros{}, 1<<50, control) }()
+	w.Write([]byte("P\n"))
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("copy accepted early control input")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("copy ignored control input")
+	}
+}
+
+func TestCopyKeepsExactSizeAndLeavesDecisionForCaller(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer r.Close()
+	control := awaitControl(bufio.NewReader(r))
+	var out bytes.Buffer
+	if err = copyUnlessParentGone(&out, bytes.NewReader(make([]byte, 3<<20)), 3<<20, control); err != nil || out.Len() != 3<<20 {
+		t.Fatal(out.Len(), err)
+	}
+	if copyUnlessParentGone(io.Discard, bytes.NewReader(make([]byte, 4)), 3, control) == nil {
+		t.Fatal("excess bytes accepted")
+	}
+	w.Write([]byte("P\n"))
+	if got := <-control; got.line != "P\n" || got.err != nil {
+		t.Fatal("decision lost", got)
+	}
+	w.Close()
+}

package/dist/templates/_executor/digest_review_test.go

@@ -32,7 +32,7 @@ func TestReviewLargePackageHashDoesNotBlockShutdown(t *testing.T) {
 		done <- manageService(ctx, make(chan string), func() (func(), error) { return func() {}, nil }, func(ctx context.Context) bool {
 			close(entered)
 			return samePackagePins(ctx, dir, strings.Repeat("a", 64), strings.Repeat("b", 64))
-		}, func() error { return nil }, func(string) {})
+		}, func() error { return nil })
 	}()
 	<-entered
 	time.Sleep(20 * time.Millisecond)
@@ -93,7 +93,7 @@ func TestLifecycleCancelsPendingPinCheck(t *testing.T) {
 			actions := make(chan string)
 			done := make(chan error, 1)
 			go func() {
-				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil }, func(string) {})
+				done <- manageService(ctx, actions, func() (func(), error) { t.Error("opened during canceled check"); return func() {}, nil }, func(ctx context.Context) bool { close(entered); <-ctx.Done(); close(canceled); return false }, func() error { return nil })
 			}()
 			<-entered
 			if action == "shutdown" {

package/dist/templates/_executor/dsm.go

@@ -78,11 +78,32 @@ type envelope struct {
 	Data    json.RawMessage `json:"data"`
 }
 
+// dsmError keeps the DSM error code of a refused call; the message stays generic.
+type dsmError struct{ Code int }
+
+func (*dsmError) Error() string { return "DSM refused" }
+
 func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	data, err := decodeSuccess(b)
+	if err == nil && (len(data) == 0 || string(data) == "null") {
+		return nil, &dsmError{}
+	}
+	return data, err
+}
+
+// decodeSuccess accepts a success without data: scheduler deletes answer
+// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
+func decodeSuccess(b []byte) (json.RawMessage, error) {
 	var r envelope
 	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
-		return nil, errors.New("DSM refused")
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
+		var refused struct {
+			Error struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		json.Unmarshal(b, &refused)
+		return nil, &dsmError{Code: refused.Error.Code}
 	}
 	return r.Data, nil
 }
@@ -117,6 +138,22 @@ func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, err
 	return out.Username, nil
 }
 func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	b, err := d.exec(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	return decodeEnvelope(b)
+}
+
+// mutate runs a call whose success carries no data, such as a scheduler delete.
+func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
+	b, err := d.exec(ctx, api, method, version, "", params)
+	if err == nil {
+		_, err = decodeSuccess(b)
+	}
+	return err
+}
+func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
 	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
 	if runner != "" {
 		args = append(args, "runner="+runner)
@@ -135,9 +172,12 @@ func (d *liveDSM) call(ctx context.Context, api, method, version, runner string,
 	}
 	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
 	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+			return nil, err
+		}
 		return nil, errors.New("DSM command")
 	}
-	return decodeEnvelope(b)
+	return b, nil
 }
 func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s, err := d.Accounts.Lookup(name)
@@ -161,13 +201,21 @@ func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s.Expired = out.Users[0].Expired
 	return s, nil
 }
-func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
+
+// Allow is the executor's offline App Privileges decision. It follows the CGI
+// EntryGate: administrators pass, admin-only refuses everyone else, and
+// app-privilege requires DSM's own allow. Preview lists only effective allows
+// (user, group and everyone rules), so an absent App is allowed only when the
+// package declares no entry mode and DSM therefore never manages its App.
+func (d *liveDSM) Allow(ctx context.Context, s Subject, app, entry string) error {
+	if !contains([]string{"", "admin-only", "app-privilege"}, entry) {
+		return errors.New("entry mode")
+	}
 	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
 	if err != nil {
 		return err
 	}
-	// DSM 7.x omits default-allowed Apps from preview (measured on vt-nas).
-	// An explicit deny/custom entry or malformed/ambiguous response still refuses.
+	// An explicit deny/custom entry or malformed/ambiguous response refuses.
 	var out struct {
 		Apps *[]json.RawMessage `json:"applications"`
 	}
@@ -193,7 +241,10 @@ func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
 	if count > 1 {
 		return errors.New("app ambiguous")
 	}
-	return nil
+	if entry == "" || s.Admin || entry == "app-privilege" && count == 1 {
+		return nil
+	}
+	return errors.New("app denied")
 }
 func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
 	if scope == "home" {
@@ -210,16 +261,15 @@ func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (strin
 	if err != nil {
 		return "", err
 	}
+	// DSM Share.get returns one share and its volume, not Share.list's array.
 	var out struct {
-		Shares []struct {
-			Name string `json:"name"`
-			Path string `json:"path"`
-		} `json:"shares"`
+		Name   string `json:"name"`
+		Volume string `json:"vol_path"`
 	}
-	if json.Unmarshal(data, &out) != nil || len(out.Shares) != 1 || out.Shares[0].Name != name || !cleanPath(out.Shares[0].Path) {
+	if json.Unmarshal(data, &out) != nil || out.Name != name || !validSelectedScope(scope) || !cleanPath(out.Volume) || out.Volume == "/" {
 		return "", errors.New("share")
 	}
-	return filepath.EvalSymlinks(out.Shares[0].Path)
+	return filepath.EvalSymlinks(filepath.Join(out.Volume, out.Name))
 }
 func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
 	if runner == "" {

package/dist/templates/_executor/dsm_test.go

@@ -5,7 +5,10 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -24,6 +27,25 @@ type cmdStub struct {
 	err   error
 }
 
+func TestDSMCommandDeadlineStaysDistinctFromDenial(t *testing.T) {
+	for _, cause := range []error{context.DeadlineExceeded, errors.New("explicit DSM refusal")} {
+		d := &liveDSM{Command: &cmdStub{err: cause}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
+		_, err := d.ScopeRoot(context.Background(), Subject{Username: "alice"}, "shared:reports")
+		if errors.Is(err, context.DeadlineExceeded) != errors.Is(cause, context.DeadlineExceeded) {
+			t.Fatal("lost deadline identity", err)
+		}
+		e := &Executor{DSM: d, Policy: Policy{App: "app"}}
+		_, code := e.eligible(context.Background(), "alice", 1200, true)
+		want := "INELIGIBLE"
+		if errors.Is(cause, context.DeadlineExceeded) {
+			want = "EXECUTOR_PAUSED"
+		}
+		if code != want {
+			t.Fatal(code, want)
+		}
+	}
+}
+
 func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
 	c.path = p
 	c.args = args
@@ -69,7 +91,7 @@ func TestDSMAppPrivilege(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			c := &cmdStub{reply: tc.reply}
 			d := &liveDSM{Command: c}
-			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app")
+			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app", "")
 			if (err == nil) != tc.pass {
 				t.Fatal(err)
 			}
@@ -79,6 +101,41 @@ func TestDSMAppPrivilege(t *testing.T) {
 		})
 	}
 }
+
+// Preview lists only effective allows, so an absent App means "not allowed"
+// unless DSM never manages the App (no entry mode). Mirrors the CGI EntryGate.
+func TestDSMAppPrivilegeByEntryMode(t *testing.T) {
+	const (
+		absent    = `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow"}]}}`
+		allowed   = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`
+		denied    = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`
+		allowAll  = `{"success":true,"data":{"applications":[{"app_id":"SYNO.ALLOW.ALL.APPLICATIONS","privilelge":"allow"}]}}`
+		malformed = `{"success":true,"data":{}}`
+	)
+	user, admin := Subject{Username: "alice"}, Subject{Username: "root-admin", Admin: true}
+	for _, tc := range []struct {
+		name, entry, reply string
+		s                  Subject
+		pass               bool
+	}{
+		{"legacy absent", "", absent, user, true},
+		{"app-privilege absent", "app-privilege", absent, user, false},
+		{"app-privilege allowed", "app-privilege", allowed, user, true},
+		{"app-privilege denied", "app-privilege", denied, user, false},
+		{"app-privilege admin", "app-privilege", allowAll, admin, true},
+		{"app-privilege admin malformed", "app-privilege", malformed, admin, false},
+		{"admin-only user allowed rule", "admin-only", allowed, user, false},
+		{"admin-only admin", "admin-only", allowAll, admin, true},
+		{"unknown mode", "everyone", allowed, user, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			d := &liveDSM{Command: &cmdStub{reply: tc.reply}}
+			if err := d.Allow(context.Background(), tc.s, "app", tc.entry); (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+		})
+	}
+}
 func TestDSMVerify(t *testing.T) {
 	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -194,3 +251,40 @@ func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *test
 		})
 	}
 }
+
+func TestDSMSharedScopeUsesMeasuredGetVolumeContract(t *testing.T) {
+	volume := t.TempDir()
+	volume, err := filepath.EvalSymlinks(volume)
+	if err != nil {
+		t.Fatal(err)
+	}
+	share := filepath.Join(volume, "reports")
+	if err := os.Mkdir(share, 0700); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name, data string
+		pass       bool
+	}{
+		{"DSM single share", `{"name":"reports","vol_path":` + strconv.Quote(volume) + `,"desc":"test","uuid":"fixture"}`, true},
+		{"different share", `{"name":"other","vol_path":` + strconv.Quote(volume) + `}`, false},
+		{"missing volume", `{"name":"reports"}`, false},
+		{"relative volume", `{"name":"reports","vol_path":"relative"}`, false},
+		{"unclean volume", `{"name":"reports","vol_path":"/volume1/../etc"}`, false},
+		{"root volume", `{"name":"reports","vol_path":"/"}`, false},
+		{"null", `null`, false},
+		{"invented list contract", `{"shares":[{"name":"reports","path":` + strconv.Quote(share) + `}]}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := &cmdStub{reply: `{"success":true,"data":` + tc.data + `}`}
+			d := &liveDSM{Command: cmd}
+			root, err := d.ScopeRoot(context.Background(), Subject{}, "shared:reports")
+			if (err == nil) != tc.pass || tc.pass && root != share {
+				t.Fatalf("root=%q err=%v", root, err)
+			}
+			if !reflect.DeepEqual(cmd.args, []string{"--exec", "api=SYNO.Core.Share", "method=get", "version=1", `name="reports"`}) {
+				t.Fatal(cmd.args)
+			}
+		})
+	}
+}