@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/native-go/backend/internal/filestation/check_permission_test.go

@@ -0,0 +1,77 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestCheckPermissionRequiresVerifiedSessionAndExplicitWriteResult(t *testing.T) {
+	for _, body := range []string{`{"blSkip":false}`, `{}`, `{"blSkip":true}`, `{"blSkip":null}`, `{"blSkip":false,"errors":[{"code":407}]}`} {
+		t.Run(body, func(t *testing.T) {
+			checks := 0
+			client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+				r.ParseForm()
+				switch r.Form.Get("api") {
+				case "SYNO.Core.NormalUser":
+					fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+				case "SYNO.FileStation.CheckPermission":
+					checks++
+					if r.Form.Get("version") != "3" || r.Form.Get("method") != "write" || r.Form.Get("path") != "/home" || r.Form.Get("filename") != ".synopkgland-permission-probe" || r.Form.Get("overwrite") != "false" || r.Form.Get("size") != "0" || r.Header.Get("Cookie") != "id=test-session" || r.Header.Get("X-SYNO-TOKEN") != "test-token" {
+						t.Error("incorrect permission check transport")
+					}
+					fmt.Fprintf(w, `{"success":true,"data":%s}`, body)
+				default:
+					t.Error("unexpected API")
+				}
+			})
+			service := NewService(client)
+			err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home")
+			if (err == nil) != (body == `{"blSkip":false}`) || checks != 1 {
+				t.Fatalf("checks=%d err=%v", checks, err)
+			}
+			checks = 0
+			if err := service.CheckPermission(context.Background(), callerFor(t, "bob"), sessionRequest(), "/home"); err == nil || checks != 0 {
+				t.Fatal("mismatched subject checked write permission")
+			}
+			if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home/../etc"); err == nil || checks != 0 {
+				t.Fatal("invalid path checked")
+			}
+		})
+	}
+}
+
+func TestCheckPermissionValidatesCredentialPairBeforeDSM(t *testing.T) {
+	calls := 0
+	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		r.ParseForm()
+		if r.Form.Get("api") == "SYNO.Core.NormalUser" {
+			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
+		} else {
+			fmt.Fprint(w, `{"success":true,"data":{"blSkip":false}}`)
+		}
+	})
+	service := NewService(client)
+	for index, r := range []*http.Request{nil, httptest.NewRequest("POST", "/", nil), sessionRequest(), sessionRequest()} {
+		if r != nil && r.Header.Get("X-SYNO-TOKEN") != "" {
+			if index == 2 {
+				r.Header.Del("X-SYNO-TOKEN")
+			} else {
+				r.Header.Set("SynoToken", "different")
+			}
+		}
+		before := calls
+		if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err == nil || calls != before {
+			t.Fatal("invalid session reached DSM", err, calls)
+		}
+	}
+	r := sessionRequest()
+	r.Header.Del("X-SYNO-TOKEN")
+	r.Header.Set("SynoToken", "test-token")
+	if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err != nil {
+		t.Fatal("canonical alias refused", err)
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/client.go

@@ -21,6 +21,9 @@ const MaxBytes = 512 * 1024
 const maxMetadata = 1024 * 1024
 const PageSize = 100
 
+// downloadPeek bounds how much of a DSM 7.1 download is inspected for an error envelope.
+const downloadPeek = 4096
+
 // Client has no cookie jar or credentials. The destination is startup-owned,
 // literal loopback only; proxies, redirects and automatic retries are disabled.
 type Client struct {
@@ -269,15 +272,48 @@ func (c *Client) DownloadStream(ctx context.Context, r *http.Request, p string)
 	if e != nil {
 		return Download{}, e
 	}
-	disposition, _, _ := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
-	if disposition != "attachment" {
+	body := resp.Body
+	raw := resp.Header.Values("Content-Disposition")
+	if len(raw) == 0 {
+		// DSM 7.1 sends no Content-Disposition at all. Only a short body that is
+		// a complete DSM envelope is an error; everything else is the file.
+		if body, e = unlessEnvelope(resp); e != nil {
+			return Download{}, e
+		}
+	} else if disposition, _, _ := mime.ParseMediaType(raw[0]); len(raw) != 1 || disposition != "attachment" {
 		e = decode(resp, nil)
 		if e == nil {
 			e = fail("unavailable")
 		}
 		return Download{}, e
 	}
-	return Download{Body: resp.Body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
+	return Download{Body: body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
+}
+
+// unlessEnvelope returns the whole body as a stream unless it fits in the peek
+// and decodes as a DSM envelope, which is refused and never becomes content.
+func unlessEnvelope(resp *http.Response) (io.ReadCloser, error) {
+	head, e := io.ReadAll(io.LimitReader(resp.Body, downloadPeek+1))
+	if e != nil {
+		resp.Body.Close()
+		return nil, fail("read_failed")
+	}
+	if len(head) <= downloadPeek {
+		var envelope struct {
+			Success *bool `json:"success"`
+		}
+		if json.Unmarshal(head, &envelope) == nil && envelope.Success != nil {
+			resp.Body = io.NopCloser(bytes.NewReader(head))
+			if e = decode(resp, nil); e == nil {
+				e = fail("unavailable")
+			}
+			return nil, e
+		}
+	}
+	return struct {
+		io.Reader
+		io.Closer
+	}{io.MultiReader(bytes.NewReader(head), resp.Body), resp.Body}, nil
 }
 
 // Read is the bounded package-private job import, using the same stream.

package/dist/templates/native-go/backend/internal/filestation/download_dsm71_test.go

@@ -0,0 +1,82 @@
+package filestation
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// DSM 7.1.1-42962 (vt-62, t-0231) answers Download v2 mode=download with the
+// file bytes and no Content-Disposition header. Its Content-Type was not
+// recorded, so every plausible type is covered.
+func dsm71Download(contentType, body string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if contentType != "" {
+			w.Header().Set("Content-Type", contentType)
+		}
+		fmt.Fprint(w, body)
+	}
+}
+
+func TestDSM71DownloadWithoutDispositionReturnsFileBytes(t *testing.T) {
+	for _, tt := range []struct{ contentType, body string }{
+		{"text/plain", "t0231 fixture a.txt"},
+		{"application/octet-stream", "\x00\x01binary"},
+		{"", "no type"},
+		{"application/json", `{"name":"a user file"}`},
+		{"application/json", `[{"success":false}]`},
+		{"text/plain", strings.Repeat("y", downloadPeek+7)},
+	} {
+		t.Run(tt.contentType, func(t *testing.T) {
+			c := fakeClient(t, dsm71Download(tt.contentType, tt.body))
+			b, err := c.Read(context.Background(), sessionRequest(), "/home/a")
+			if err != nil || string(b) != tt.body {
+				t.Fatalf("%v %q", err, b)
+			}
+		})
+	}
+}
+
+func TestDSM71DownloadStreamsBeyondThePeek(t *testing.T) {
+	body := strings.Repeat("z", MaxBytes*3)
+	c := fakeClient(t, dsm71Download("application/octet-stream", body))
+	d, err := c.DownloadStream(context.Background(), sessionRequest(), "/home/a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Body.Close()
+	b, err := io.ReadAll(d.Body)
+	if err != nil || string(b) != body || d.ContentType != "application/octet-stream" {
+		t.Fatal(err, len(b))
+	}
+}
+
+func TestDSM71DownloadEnvelopeWithoutDispositionIsNeverContent(t *testing.T) {
+	for _, tt := range []struct{ contentType, body, want string }{
+		{"application/json; charset=utf-8", `{"success":false,"error":{"code":408}}`, "denied"},
+		{"text/plain", `{"success":false,"error":{"code":119}}`, "session_required"},
+		{"", ` {"error":{"code":407},"success":false}` + "\n", "denied"},
+		{"application/json", `{"success":true,"data":{}}`, "unavailable"},
+	} {
+		t.Run(tt.want, func(t *testing.T) {
+			c := fakeClient(t, dsm71Download(tt.contentType, tt.body))
+			b, err := c.Read(context.Background(), sessionRequest(), "/home/a")
+			if err == nil || len(b) != 0 || !strings.Contains(err.Error(), tt.want) {
+				t.Fatalf("%v %q", err, b)
+			}
+		})
+	}
+}
+
+func TestNonAttachmentDispositionStaysRefused(t *testing.T) {
+	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Disposition", `inline; filename="a"`)
+		fmt.Fprint(w, "abc")
+	})
+	if b, err := c.Read(context.Background(), sessionRequest(), "/home/a"); err == nil || len(b) != 0 {
+		t.Fatal("inline disposition admitted")
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/sdk_policy_test.go

@@ -0,0 +1,39 @@
+package filestation
+
+import (
+	"encoding/json"
+	"os"
+	"sort"
+	"testing"
+)
+
+// Every files entry in the SDK policy must name a route this package serves.
+func TestSDKPolicyListsExactlyTheFileRoutes(t *testing.T) {
+	raw, err := os.ReadFile("../api/sdk-permissions.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var policy struct {
+		Files map[string]string `json:"files"`
+	}
+	if err := json.Unmarshal(raw, &policy); err != nil {
+		t.Fatal(err)
+	}
+	var declared, routed []string
+	for method := range policy.Files {
+		declared = append(declared, method)
+	}
+	for _, route := range (&Service{}).Routes() {
+		routed = append(routed, route.Method())
+	}
+	sort.Strings(declared)
+	sort.Strings(routed)
+	if len(declared) != len(routed) {
+		t.Fatalf("policy %v, routes %v", declared, routed)
+	}
+	for i := range declared {
+		if declared[i] != routed[i] {
+			t.Fatalf("policy %v, routes %v", declared, routed)
+		}
+	}
+}

package/dist/templates/native-go/backend/internal/filestation/service.go

@@ -204,7 +204,7 @@ func (s *Service) discover(ctx context.Context, r *http.Request, folder string,
 // Browse lists share roots (empty folder) or one folder through the caller's
 // own DSM session, so File Station's current permissions decide what is
 // visible. It is read-only metadata and stores no grant; background jobs use it
-// to let an administrator pick the file that ReadFile will then import.
+// to let an authenticated caller pick the file that ReadFile will then import.
 func (s *Service) Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (Page, error) {
 	if !c.Authenticated() {
 		return Page{}, fail("session_required")

package/dist/templates/native-go/backend/internal/identity/README.md

@@ -16,7 +16,11 @@ The transport accepts same-origin JSON POST requests:
 - `identity.logout {}` removes the app session and clears the cookie.
 
 NormalUser.get is the only DSM cookie identity check; anonymous Initdata success
-cannot establish identity. Local `user.Lookup` binds the username to its UID.
+cannot establish identity. DSM web logins enable SynoToken, and DSM refuses
+their cookie alone (119), so the check also forwards the request's single
+`X-SYNO-TOKEN` header, which the DSM window's `ctx.call` sends. Sessions without
+SynoToken still verify with the cookie alone. The token is never put in a URL,
+logged or stored. Local `user.Lookup` binds the username to its UID.
 Auth login creates a temporary SID, then immediately logs it out before issuing
 an app session. A logout failure refuses the app login. No password, OTP, DSM SID
 or DSM cookie is logged or persisted. Only hashes of app bearer IDs are stored.

package/dist/templates/native-go/backend/internal/identity/dsm.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"strings"
 	"time"
+	"unicode"
 )
 
 type dsmReply struct {
@@ -25,7 +26,9 @@ type dsmReply struct {
 	} `json:"error"`
 }
 
-func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (dsmReply, error) {
+// dsmCall sends token only as X-SYNO-TOKEN: DSM web logins enable SynoToken,
+// and their cookie alone is refused with 119.
+func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie, token string) (dsmReply, error) {
 	var out dsmReply
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
@@ -37,6 +40,9 @@ func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (
 	if cookie != "" {
 		req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
 	}
+	if token != "" {
+		req.Header.Set("X-SYNO-TOKEN", token)
+	}
 	res, err := s.cfg.Client.Do(req)
 	if err != nil {
 		return out, errors.New("DSM unavailable")
@@ -48,19 +54,32 @@ func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie string) (
 	}
 	return out, nil
 }
-func (s *Service) verify(ctx context.Context, cookie string) (Subject, error) {
-	out, err := s.dsmCall(ctx, url.Values{"api": {"SYNO.Core.NormalUser"}, "method": {"get"}, "version": {"1"}}, cookie)
+
+// verify checks the caller's DSM session with the request's cookie and, when the
+// browser sent one, its SynoToken. Neither is stored or logged.
+func (s *Service) verify(r *http.Request, cookie string) (Subject, error) {
+	token := synoToken(r)
+	out, err := s.dsmCall(r.Context(), url.Values{"api": {"SYNO.Core.NormalUser"}, "method": {"get"}, "version": {"1"}}, cookie, token)
 	if err != nil || !out.Success {
 		return Subject{}, errors.New("DSM session refused")
 	}
 	return s.resolve(out.Data.Username)
 }
+
+// synoToken returns the single, well-formed X-SYNO-TOKEN header or "".
+func synoToken(r *http.Request) string {
+	values := r.Header.Values("X-SYNO-TOKEN")
+	if len(values) != 1 || len(values[0]) > 4096 || strings.ContainsFunc(values[0], unicode.IsControl) {
+		return ""
+	}
+	return values[0]
+}
 func (s *Service) login(ctx context.Context, account, password, otp string) (Subject, string) {
 	form := url.Values{"api": {"SYNO.API.Auth"}, "method": {"login"}, "version": {"7"}, "account": {account}, "passwd": {password}, "format": {"sid"}}
 	if otp != "" {
 		form.Set("otp_code", otp)
 	}
-	out, err := s.dsmCall(ctx, form, "")
+	out, err := s.dsmCall(ctx, form, "", "")
 	if err != nil {
 		return Subject{}, "auth_unavailable"
 	}
@@ -84,7 +103,7 @@ func (s *Service) login(ctx context.Context, account, password, otp string) (Sub
 	}
 	// The temporary DSM session exists only to prove identity. Dispose of it
 	// before issuing an application session, including when local lookup fails.
-	loggedOut, err := s.dsmCall(context.WithoutCancel(ctx), url.Values{"api": {"SYNO.API.Auth"}, "method": {"logout"}, "version": {"7"}, "_sid": {out.Data.SID}}, "")
+	loggedOut, err := s.dsmCall(context.WithoutCancel(ctx), url.Values{"api": {"SYNO.API.Auth"}, "method": {"logout"}, "version": {"7"}, "_sid": {out.Data.SID}}, "", "")
 	if err != nil || !loggedOut.Success {
 		return Subject{}, "auth_unavailable"
 	}

package/dist/templates/native-go/backend/internal/identity/http.go

@@ -237,7 +237,7 @@ func (s *Service) handle(w http.ResponseWriter, r *http.Request, req request) {
 					code = "session_required"
 					return nil
 				}
-				sub, err := s.verify(r.Context(), dc.Value)
+				sub, err := s.verify(r, dc.Value)
 				if err != nil {
 					code = "session_required"
 					return nil

package/dist/templates/native-go/backend/internal/identity/identity_test.go

@@ -27,6 +27,11 @@ type fixture struct {
 	logout  int
 	calls   []string
 	dir     string
+	// synoToken makes the fake DSM session a SynoToken session: NormalUser.get
+	// then needs the cookie and this X-SYNO-TOKEN header, as DSM web logins do.
+	synoToken string
+	// token is the X-SYNO-TOKEN the browser sends with each App request.
+	token string
 }
 
 func setup(t *testing.T) *fixture {
@@ -40,7 +45,10 @@ func setup(t *testing.T) *fixture {
 		switch name {
 		case "SYNO.Core.NormalUser.get":
 			c, err := r.Cookie("id")
-			if f.valid && err == nil && c.Value == "valid-dsm-cookie" {
+			if r.Form.Has("SynoToken") {
+				t.Error("SynoToken must travel only in the header")
+			}
+			if f.valid && err == nil && c.Value == "valid-dsm-cookie" && (f.synoToken == "" || r.Header.Get("X-SYNO-TOKEN") == f.synoToken) {
 				fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
 			} else {
 				fmt.Fprint(w, `{"success":false,"error":{"code":119}}`)
@@ -93,6 +101,9 @@ func (f *fixture) call(method, params string, appCookie *http.Cookie, dsmCookie
 	if dsmCookie {
 		req.AddCookie(&http.Cookie{Name: "id", Value: "valid-dsm-cookie"})
 	}
+	if f.token != "" {
+		req.Header.Set("X-SYNO-TOKEN", f.token)
+	}
 	out := httptest.NewRecorder()
 	f.service.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		id, err := f.service.Authenticate(r)
@@ -148,6 +159,42 @@ func TestCookieExchangeAndNoInitdataShortcut(t *testing.T) {
 		}
 	}
 }
+func TestSynoTokenSessionBootstrapsAndRevalidates(t *testing.T) {
+	f := setup(t)
+	f.synoToken = "secret-syno-token"
+	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "session_required" {
+		t.Fatalf("cookie alone must not pass a SynoToken session: %v", out)
+	}
+	f.token = "secret-syno-token"
+	rec, out := f.call("identity.session", `{"bootstrap":true}`, nil, true)
+	if errorCode(out) != "" {
+		t.Fatalf("bootstrap with SynoToken: %v", out)
+	}
+	c := sessionCookie(t, rec)
+	if _, out = f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "" {
+		t.Fatalf("live revalidation with SynoToken: %v", out)
+	}
+	filepath.WalkDir(f.dir, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			t.Fatal(err)
+		}
+		if raw, _ := os.ReadFile(path); !d.IsDir() && strings.Contains(string(raw), "secret-syno-token") {
+			t.Fatalf("SynoToken written to %s", path)
+		}
+		return nil
+	})
+	f.token = ""
+	if _, out = f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "session_required" {
+		t.Fatalf("revalidation without SynoToken: %v", out)
+	}
+}
+func TestTokenlessSessionStillVerifiesWhenBrowserSendsToken(t *testing.T) {
+	f := setup(t)
+	f.token = "unused-token"
+	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "" {
+		t.Fatal(out)
+	}
+}
 func TestLoginOTPLogoutAndNoCredentialsOnDisk(t *testing.T) {
 	f := setup(t)
 	f.otp = true

package/dist/templates/native-go/backend/internal/identity/service.go

@@ -145,7 +145,7 @@ func (s *Service) current(st *state, r *http.Request, revalidate bool) (string,
 		if err != nil || dc.Value == "" {
 			return "", record{}, errRevalidation
 		}
-		live, err := s.verify(r.Context(), dc.Value)
+		live, err := s.verify(r, dc.Value)
 		if err != nil || live != sub {
 			delete(st.Sessions, key)
 			return "", record{}, api.ErrNoSession

package/dist/templates/native-go/backend/internal/portal/portal.go

@@ -0,0 +1,138 @@
+// Package portal reads the DSM Application Portal alias an administrator set
+// for this package. DSM owns the setting: the package never writes it, and
+// anything this reader does not fully understand reads as Unavailable.
+package portal
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	"regexp"
+	"syscall"
+	"unicode/utf8"
+
+	"dsmapp/internal/jsonlimits"
+)
+
+// MaxConfigBytes bounds DSM's saved setting; its real size is a few hundred bytes.
+const MaxConfigBytes = 64 << 10
+
+const (
+	// Active means users can open the app at /<alias>/ after DSM sign-in.
+	Active = "active"
+	// Inactive means no administrator has set an alias yet.
+	Inactive = "inactive"
+	// Unavailable means the setting could not be read safely.
+	Unavailable = "unavailable"
+)
+
+// Status is what portal.status returns; Alias is set only when Active.
+type Status struct {
+	State string `json:"state"`
+	Alias string `json:"alias,omitempty"`
+}
+
+// A single URL path segment; DSM's own validation is looser than this.
+var aliasPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`)
+
+// ConfigPath is where DSM saves the package's portal setting
+// (/var/packages/<package>/etc is the package's @appconf directory).
+func ConfigPath(packageID string) string {
+	return "/var/packages/" + packageID + "/etc/AppPortal.json"
+}
+
+// Read returns the saved alias when the setting belongs to appID.
+func Read(path, appID string) Status {
+	raw, err := readBounded(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return Status{State: Inactive}
+	}
+	if err != nil {
+		return Status{State: Unavailable}
+	}
+	id, alias, ok := parse(raw)
+	if !ok || id != appID {
+		return Status{State: Unavailable}
+	}
+	if alias == "" {
+		return Status{State: Inactive}
+	}
+	if !aliasPattern.MatchString(alias) {
+		return Status{State: Unavailable}
+	}
+	return Status{State: Active, Alias: alias}
+}
+
+func readBounded(path string) ([]byte, error) {
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() {
+		return nil, errors.New("not a regular file")
+	}
+	raw, err := io.ReadAll(io.LimitReader(f, MaxConfigBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	if len(raw) > MaxConfigBytes {
+		return nil, errors.New("too large")
+	}
+	return raw, nil
+}
+
+// parse accepts exactly one JSON object with unique top-level keys, a string
+// id and a string or null alias; other DSM fields are skipped unread.
+func parse(raw []byte) (id, alias string, ok bool) {
+	if !utf8.Valid(raw) || !jsonlimits.WithinLimits(raw) {
+		return "", "", false
+	}
+	d := json.NewDecoder(bytes.NewReader(raw))
+	if token, err := d.Token(); err != nil || token != json.Delim('{') {
+		return "", "", false
+	}
+	seen := map[string]bool{}
+	hasID := false
+	for d.More() {
+		token, err := d.Token()
+		key, isKey := token.(string)
+		if err != nil || !isKey || seen[key] {
+			return "", "", false
+		}
+		seen[key] = true
+		var value json.RawMessage
+		if err := d.Decode(&value); err != nil {
+			return "", "", false
+		}
+		switch key {
+		case "id":
+			if json.Unmarshal(value, &id) != nil || id == "" {
+				return "", "", false
+			}
+			hasID = true
+		case "alias":
+			var text *string
+			if json.Unmarshal(value, &text) != nil {
+				return "", "", false
+			}
+			if text != nil {
+				alias = *text
+			}
+		}
+	}
+	if token, err := d.Token(); err != nil || token != json.Delim('}') {
+		return "", "", false
+	}
+	if _, err := d.Token(); err != io.EOF {
+		return "", "", false
+	}
+	return id, alias, hasID
+}