@synopackageland/cli 0.6.1 → 0.7.1

package/dist/templates/native-go-delegate/backend/internal/delegate/cancel_contract_test.go

@@ -0,0 +1,95 @@
+package delegate
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func wantCanceled(t *testing.T, out OperationResult, err error) {
+	t.Helper()
+	if err != nil || out.State != "canceled" || out.Code != "OPERATION_CANCELED" || out.Reason != "operation-canceled-by-user" {
+		t.Fatal("want canceled", out, err)
+	}
+}
+
+// A cancel of a reference that was reserved but never admitted must stop the
+// SDK's own admission recovery from sending it later.
+func TestCancelOfUnadmittedReferenceIsNeverSentByRecovery(t *testing.T) {
+	s, in, e, clock := recoveringService(t)
+	reserveWithoutSending(t, s, in)
+	ref := OperationRef{in.DelegationID, in.JobID}
+	out, err := s.CancelOperation(context.Background(), nil, ref)
+	wantCanceled(t, out, err)
+	clock.at = clock.at.Add(time.Hour)
+	for i := 0; i < 2; i++ {
+		out, err := s.MoveFromStaging(context.Background(), in)
+		if err != nil || out.State != "canceled" {
+			t.Fatal("same-ref call after cancel", out, err)
+		}
+		if err = restarted(s, e, clock).SweepMoves(context.Background()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if moves, created := e.counts(); moves != 0 || created != 0 {
+		t.Fatal("canceled reference was admitted", moves, created)
+	}
+	if _, err = os.Stat(filepath.Join(s.StagingDir, in.Staging)); err != nil {
+		t.Fatal("canceled source removed", err)
+	}
+}
+
+// The intent survives an executor that cannot be reached at cancel time: the
+// package's next same-ref call or sweep forwards the cancel, never admission.
+func TestCancelIntentSurvivesUnavailableExecutorAndRestart(t *testing.T) {
+	s, in, e, clock := recoveringService(t)
+	reserveWithoutSending(t, s, in)
+	dir, err := os.MkdirTemp("/tmp", "t0205-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(dir)
+	s.Client = &Client{Socket: filepath.Join(dir, "absent.sock"), Timeout: time.Second}
+	_, err = s.CancelOperation(context.Background(), nil, OperationRef{in.DelegationID, in.JobID})
+	code(t, err, "EXECUTOR_UNAVAILABLE")
+	next := restarted(s, e, clock)
+	if err = next.SweepMoves(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if moves, created := e.counts(); moves != 0 || created != 0 || e.cancels != 1 {
+		t.Fatal("sweep admitted a canceled reference", moves, created, e.cancels)
+	}
+	if out, err := next.MoveFromStaging(context.Background(), in); err != nil || out.State != "canceled" {
+		t.Fatal(out, err)
+	}
+	if pending, err := next.Store.PendingMoves(context.Background()); err != nil || len(pending) != 0 {
+		t.Fatal("canceled mirror still swept", pending, err)
+	}
+}
+
+// A cancel whose reply was lost is repeated with the same reference.
+func TestRepeatedCancelAfterLostReplyIsIdempotent(t *testing.T) {
+	s, in, e, _ := recoveringService(t)
+	if _, err := s.MoveFromStaging(context.Background(), in); err != nil {
+		t.Fatal(err)
+	}
+	ref := OperationRef{in.DelegationID, in.JobID}
+	s.Client = fakeExecutor(func(ctx context.Context, op string, auth map[string]string, p, out any) error {
+		if err := e.Call(ctx, op, auth, p, out); err != nil || op != "files.cancelOperation" {
+			return err
+		}
+		return fail("EXECUTOR_TIMEOUT")
+	})
+	_, err := s.CancelOperation(context.Background(), nil, ref)
+	code(t, err, "EXECUTOR_TIMEOUT")
+	s.Client = e
+	for i := 0; i < 2; i++ {
+		out, err := s.CancelOperation(context.Background(), nil, ref)
+		wantCanceled(t, out, err)
+	}
+	if moves, created := e.counts(); moves != 1 || created != 1 {
+		t.Fatal(moves, created)
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/client.go

@@ -31,6 +31,14 @@ type Client struct {
 	Timeout time.Duration
 }
 
+// ExecutorClient keeps the session/staging bridge independent of transport.
+// The production client still uses the existing bounded v1 Unix socket.
+type ExecutorClient interface {
+	Call(context.Context, string, map[string]string, any, any) error
+}
+
+var _ ExecutorClient = (*Client)(nil)
+
 func Local(packageID string) *Client {
 	return &Client{Socket: "/run/synopkgland/" + packageID + "/executor.sock", Timeout: 20 * time.Second}
 }

package/dist/templates/native-go-delegate/backend/internal/delegate/destination.go

@@ -0,0 +1,110 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"net/http"
+	"time"
+)
+
+// DestinationSession verifies the authenticated caller and the write permission
+// with the same request's DSM session. No session material is persisted.
+type DestinationSession interface {
+	CheckPermission(context.Context, api.Caller, *http.Request, string) error
+}
+
+type SelectDestinationParams struct {
+	Key  string `json:"key"`
+	Path string `json:"path"`
+}
+
+func contains(values []string, value string) bool {
+	for _, candidate := range values {
+		if candidate == value {
+			return true
+		}
+	}
+	return false
+}
+
+// SelectDestination makes only explicitly configured permanent destinations.
+// Executor independently verifies the session, scope, policy and subject.
+func (s *Service) selectDestination(ctx context.Context, caller api.Caller, r *http.Request, in SelectDestinationParams) (Grant, error) {
+	var out Grant
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return out, err
+	}
+	owner, err := s.owner(caller)
+	if err != nil {
+		return out, err
+	}
+	if s.Lifetime != "until-revoked" || !contains(s.Operations, "files.moveFromStaging") {
+		return out, fail("unsupported")
+	}
+	if !contains(s.Destinations, in.Key) || !validPath(in.Path) || in.Path == "/" {
+		return out, fail("invalid-destination")
+	}
+	if s.SessionFiles == nil {
+		return out, fail("session_required")
+	}
+	if err = s.SessionFiles.CheckPermission(ctx, caller, r, in.Path); err != nil {
+		return out, err
+	}
+	err = s.Client.Call(ctx, "delegate.create", auth, map[string]any{
+		"ops": []string{"files.moveFromStaging"}, "scope": s.Scope, "path": in.Path,
+		"destination": in.Key, "lifetime": "until-revoked",
+	}, &out)
+	if err != nil {
+		return Grant{}, err
+	}
+	if out.DelegationID == "" || out.Subject.Username != owner.User || out.Subject.UIDString() != owner.UID || out.Lifetime != "until-revoked" || !out.ExpiresAt.IsZero() || out.Destination != in.Key || out.Path != in.Path {
+		if out.DelegationID != "" {
+			cleanup, done := context.WithTimeout(context.Background(), 10*time.Second)
+			defer done()
+			_ = s.Client.Call(cleanup, "delegate.revoke", auth, map[string]string{"delegation_id": out.DelegationID}, nil)
+		}
+		return Grant{}, fail("EXECUTOR_PROTOCOL")
+	}
+	return out, nil
+}
+
+// DestinationGrant is the picker-facing reference from the frozen W1a DTO.
+// It intentionally excludes numeric identities and legacy job/expiry metadata.
+type DestinationGrant struct {
+	ID       string `json:"id"`
+	Key      string `json:"key"`
+	Path     string `json:"path"`
+	Username string `json:"username"`
+	Lifetime string `json:"lifetime"`
+}
+
+func (s *Service) SelectDestination(ctx context.Context, caller api.Caller, r *http.Request, in SelectDestinationParams) (DestinationGrant, error) {
+	grant, err := s.selectDestination(ctx, caller, r, in)
+	if err != nil {
+		return DestinationGrant{}, err
+	}
+	return DestinationGrant{ID: grant.DelegationID, Key: in.Key, Path: grant.Path, Username: grant.Subject.Username, Lifetime: grant.Lifetime}, nil
+}
+
+// verifyOperationOwner avoids writing even an App-owned operation mirror for
+// another user's grant. The executor's session-filtered list supplies subjects;
+// it still rechecks live grant/ACL/fence on every subsequent operation.
+func (s *Service) verifyOperationOwner(ctx context.Context, caller api.Caller, auth map[string]string, id string) error {
+	owner, err := s.owner(caller)
+	if err != nil {
+		return err
+	}
+	var out struct {
+		Delegations []Grant `json:"delegations"`
+	}
+	if err = s.Client.Call(ctx, "delegate.list", auth, nil, &out); err != nil {
+		return err
+	}
+	for _, grant := range out.Delegations {
+		if grant.DelegationID == id && grant.Subject.Username == owner.User && grant.Subject.UIDString() == owner.UID {
+			return nil
+		}
+	}
+	return fail("DELEGATION_DENIED")
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/destination_state.go

@@ -0,0 +1,117 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// ScopeSelection is executor evidence; an installation draft is never authority.
+type ScopeSelection struct {
+	Scope      string `json:"scope"`
+	Root       string `json:"root"`
+	Generation uint64 `json:"generation"`
+}
+
+// DestinationState contains only this caller's destination reference. Keep this
+// reference with an App job; do not persist the caller's DSM session.
+type DestinationState struct {
+	Key         string            `json:"key"`
+	Selection   *ScopeSelection   `json:"selection"`
+	Destination *DestinationGrant `json:"destination"`
+	Status      string            `json:"status"`
+}
+
+func virtualScope(scope string) string {
+	if scope == "home" {
+		return "/home"
+	}
+	if strings.HasPrefix(scope, "shared:") {
+		name := strings.TrimPrefix(scope, "shared:")
+		if validName(name) && !strings.ContainsAny(name, "\\:") && strings.TrimSpace(name) == name {
+			return "/" + name
+		}
+	}
+	return ""
+}
+func validSelection(value *ScopeSelection, dynamic bool) bool {
+	return value != nil && virtualScope(value.Scope) != "" && value.Root == virtualScope(value.Scope) && value.Generation <= 1<<53-1 && (!dynamic || value.Generation > 0)
+}
+
+// Never use this package-owned draft for authorization or executor parameters.
+func (s *Service) decorateScope(out *Capability) {
+	out.ScopeMode = s.Scope
+	if s.Scope != "install-selected" || s.InstallDraftPath == "" {
+		return
+	}
+	info, err := os.Lstat(s.InstallDraftPath)
+	if err != nil || !info.Mode().IsRegular() || info.Size() > 4096 {
+		return
+	}
+	b, err := os.ReadFile(s.InstallDraftPath)
+	var draft struct {
+		Schema int    `json:"schema"`
+		Scope  string `json:"scope"`
+	}
+	if err != nil || len(b) > 4096 || json.Unmarshal(b, &draft) != nil || draft.Schema != 1 || virtualScope(draft.Scope) == "" {
+		return
+	}
+	out.Preselection = draft.Scope
+	out.Mismatch = out.Selection != nil && out.Selection.Scope != draft.Scope
+}
+
+// Destination is the single caller-bound lookup for the chosen scope,
+// destination and grant status. Selection comes from matching executor pins.
+func (s *Service) Destination(ctx context.Context, caller api.Caller, r *http.Request, key string) (DestinationState, error) {
+	out := DestinationState{Key: key, Status: "missing"}
+	if s.Lifetime != "until-revoked" || !contains(s.Destinations, key) {
+		return out, fail("invalid-destination")
+	}
+	owner, err := s.owner(caller)
+	if err != nil {
+		return out, err
+	}
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return out, err
+	}
+	status := s.Status(ctx)
+	if status.State == "needs-scope-confirmation" {
+		out.Status = status.State
+		return out, nil
+	}
+	if status.State != "ready" && status.State != "disabled" {
+		return out, fail("EXECUTOR_UNAVAILABLE")
+	}
+	out.Selection = status.Selection
+	if !validSelection(out.Selection, s.Scope == "install-selected") {
+		return out, fail("EXECUTOR_PROTOCOL")
+	}
+	var list struct {
+		Delegations []Grant `json:"delegations"`
+	}
+	if err = s.Client.Call(ctx, "delegate.list", auth, nil, &list); err != nil {
+		return out, err
+	}
+	for _, grant := range list.Delegations {
+		if grant.Subject.Username != owner.User || grant.Subject.UIDString() != owner.UID || grant.Destination != key || grant.Lifetime != "until-revoked" {
+			continue
+		}
+		if out.Destination == nil {
+			out.Status = "reselection-required"
+		}
+		if grant.Revoked || grant.Scope != out.Selection.Scope || grant.ScopeGeneration != out.Selection.Generation || !validPath(grant.Path) || !(grant.Path == out.Selection.Root || strings.HasPrefix(grant.Path, out.Selection.Root+"/")) {
+			continue
+		}
+		out.Destination = &DestinationGrant{ID: grant.DelegationID, Key: key, Path: grant.Path, Username: grant.Subject.Username, Lifetime: grant.Lifetime}
+		out.Status = "active"
+	}
+	if status.State == "disabled" {
+		out.Status = "disabled"
+		out.Destination = nil
+	}
+	return out, nil
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/destination_state_test.go

@@ -0,0 +1,60 @@
+package delegate
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDestinationUsesProtectedSelectionAndThisOwnerOnly(t *testing.T) {
+	s := service(t, nil)
+	s.Scope = "install-selected"
+	s.Lifetime = "until-revoked"
+	s.Destinations = []string{"save"}
+	s.InstallDraftPath = filepath.Join(t.TempDir(), "delegate-install.json")
+	os.WriteFile(s.InstallDraftPath, []byte(`{"schema":1,"scope":"shared:untrusted"}`), 0600)
+	grants := `[{"delegation_id":"old","destination":"save","scope":"shared:reports","scope_generation":1,"path":"/reports/old","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"},{"delegation_id":"other","destination":"save","scope":"shared:reports","scope_generation":2,"path":"/reports/other","subject":{"username":"bob","uid":1206},"lifetime":"until-revoked"},{"delegation_id":"current","destination":"save","scope":"shared:reports","scope_generation":2,"path":"/reports/export","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"}]`
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, _ any, out any) error {
+		if op == "status" {
+			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false,"scope_state":"","selection":{"scope":"shared:reports","root":"/reports","generation":2}}`), out)
+		}
+		if op != "delegate.list" || auth["dsm_cookie"] != "fake-cookie" {
+			t.Fatal(op, auth)
+		}
+		return json.Unmarshal([]byte(`{"delegations":`+grants+`}`), out)
+	})
+	status := s.Status(context.Background())
+	if !status.Mismatch || status.Preselection != "shared:untrusted" || status.Selection.Scope != "shared:reports" {
+		t.Fatal(status)
+	}
+	got, err := s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save")
+	if err != nil || got.Status != "active" || got.Destination.ID != "current" || got.Selection.Scope != "shared:reports" {
+		t.Fatal(got, err)
+	}
+	grants = `[{"delegation_id":"old","destination":"save","scope":"home","scope_generation":1,"path":"/home","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"}]`
+	got, err = s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save")
+	if err != nil || got.Status != "reselection-required" || got.Destination != nil {
+		t.Fatal(got, err)
+	}
+	if _, err = s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "unknown"); err == nil {
+		t.Fatal("unknown key allowed")
+	}
+}
+func TestSelectedScopeMissingAndMalformedEvidenceNeverBecomeAuthority(t *testing.T) {
+	for _, wire := range []string{
+		`{"scope":"shared:reports","root":"/wrong","generation":1}`,
+		`{"scope":"shared:reports","root":"/reports","generation":0}`,
+		`{"scope":"shared:reports","root":"/reports","generation":9007199254740992}`,
+	} {
+		s := service(t, nil)
+		s.Scope = "install-selected"
+		s.Client = fakeExecutor(func(_ context.Context, _ string, _ map[string]string, _ any, out any) error {
+			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false,"selection":`+wire+`}`), out)
+		})
+		if got := s.Status(context.Background()); got.State != "blocked" || got.Selection != nil {
+			t.Fatal(got)
+		}
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/destination_test.go

@@ -0,0 +1,116 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+type fakeExecutor func(context.Context, string, map[string]string, any, any) error
+
+func (f fakeExecutor) Call(ctx context.Context, op string, auth map[string]string, in, out any) error {
+	return f(ctx, op, auth, in, out)
+}
+
+type fakeSession struct {
+	err        error
+	calls      int
+	user, path string
+}
+
+func (f *fakeSession) CheckPermission(_ context.Context, caller api.Caller, _ *http.Request, path string) error {
+	f.calls++
+	f.user, f.path = caller.User(), path
+	return f.err
+}
+func destinationCaller(t *testing.T, user string) api.Caller {
+	t.Helper()
+	var caller api.Caller
+	route := api.HandleRequest("test.caller", func(_ context.Context, c api.Caller, _ *http.Request, _ json.RawMessage) (any, error) {
+		caller = c
+		return struct{}{}, nil
+	})
+	srv, err := api.NewServerWithPermissions(identity{user}, []byte(`{"schema":1,"default":"administrators","methods":{"test.caller":"authenticated"}}`), route)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := httptest.NewRequest("POST", "/", strings.NewReader(`{"method":"test.caller","params":{}}`))
+	r.Header.Set("Content-Type", "application/json")
+	srv.ServeHTTP(httptest.NewRecorder(), r)
+	return caller
+}
+func destinationRequest() *http.Request {
+	r := httptest.NewRequest("POST", "/", nil)
+	r.AddCookie(&http.Cookie{Name: "id", Value: "fake-cookie"})
+	r.Header.Set("X-SYNO-TOKEN", "fake-token")
+	return r
+}
+func TestSelectDestinationChecksSessionBeforeSavingManifestBoundGrant(t *testing.T) {
+	session := &fakeSession{}
+	s := service(t, nil)
+	s.SessionFiles = session
+	s.Destinations = []string{"save"}
+	s.Operations = []string{"files.moveFromStaging"}
+	s.Lifetime = "until-revoked"
+	calls := 0
+	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
+		calls++
+		if session.calls != 1 || session.user != "alice" || session.path != "/home" || op != "delegate.create" || auth["dsm_cookie"] != "fake-cookie" {
+			t.Fatal("grant saved before verifying caller write permission")
+		}
+		data, _ := json.Marshal(in)
+		if strings.Contains(string(data), "username") || strings.Contains(string(data), "uid") || strings.Contains(string(data), "job_id") || strings.Contains(string(data), "ttl_seconds") {
+			t.Fatal("caller authority or legacy job leaked into grant")
+		}
+		return json.Unmarshal([]byte(`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked","destination":"save","path":"/home"}`), out)
+	})
+	caller := destinationCaller(t, "alice")
+	grant, err := s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"})
+	if err != nil || grant.ID != "grant" || calls != 1 {
+		t.Fatal(grant, err, calls)
+	}
+	session.err = errors.New("denied")
+	if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil || calls != 1 {
+		t.Fatal("failed write check saved grant")
+	}
+	session.err = nil
+	for _, in := range []SelectDestinationParams{{Key: "other", Path: "/home"}, {Key: "save", Path: "/home/../etc"}, {Key: "save", Path: "/"}} {
+		if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), in); err == nil || calls != 1 {
+			t.Fatal("unbound destination saved grant")
+		}
+	}
+	s.Lifetime = ""
+	if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil || calls != 1 {
+		t.Fatal("legacy config silently made permanent")
+	}
+}
+func TestSelectDestinationRejectsExecutorSubjectMismatch(t *testing.T) {
+	for _, body := range []string{
+		`{"delegation_id":"grant","subject":{"username":"bob","uid":1205},"lifetime":"until-revoked","destination":"save","path":"/home"}`,
+		`{"delegation_id":"grant","subject":{"username":"alice","uid":1206},"lifetime":"until-revoked","destination":"save","path":"/home"}`,
+		`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked","destination":"other","path":"/home"}`,
+		`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"expires_at":"2030-01-01T00:00:00Z"}`,
+	} {
+		t.Run(body, func(t *testing.T) {
+			s := service(t, nil)
+			s.SessionFiles = &fakeSession{}
+			s.Destinations = []string{"save"}
+			s.Operations = []string{"files.moveFromStaging"}
+			s.Lifetime = "until-revoked"
+			s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, in, out any) error {
+				if op == "delegate.revoke" {
+					return nil
+				}
+				return json.Unmarshal([]byte(body), out)
+			})
+			if _, err := s.SelectDestination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil {
+				t.Fatal("unverified grant accepted")
+			}
+		})
+	}
+}

package/dist/templates/native-go-delegate/backend/internal/delegate/example.go

@@ -0,0 +1,81 @@
+package delegate
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"dsmapp/internal/background"
+	"encoding/json"
+	"errors"
+	"golang.org/x/sys/unix"
+	"net/http"
+	"os"
+	"path"
+)
+
+// ExportExample is a small producer: capture the caller-bound destination,
+// produce in package-private staging, then use the existing completion hook.
+// A repeated job ID repeats the original request: MoveFromStaging returns the
+// original operation and admits only one the executor does not know.
+func (s *Service) ExportExample(ctx context.Context, caller api.Caller, request *http.Request, key, jobID string) (OperationRef, error) {
+	ref := OperationRef{JobID: jobID}
+	if !operationToken.MatchString(jobID) {
+		return ref, fail("invalid-request")
+	}
+	if s.Store == nil || background.RefuseRoot(os.Geteuid()) != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	selected, err := s.Destination(ctx, caller, request, key)
+	if err != nil {
+		return ref, err
+	}
+	if selected.Status != "active" || selected.Destination == nil {
+		return ref, fail("invalid-destination")
+	}
+	ref.DelegationID = selected.Destination.ID
+	binding, err := s.Store.MoveBinding(ctx, jobID)
+	if err == nil {
+		if binding.DelegationID != ref.DelegationID {
+			return ref, fail("operation-conflict")
+		}
+		auth, err := api.DSMSession(request)
+		if err != nil {
+			return ref, err
+		}
+		var original MoveParams
+		if json.Unmarshal(binding.Params, &original) != nil {
+			return ref, fail("operation-conflict")
+		}
+		_, err = s.admitStaging(ctx, auth, original)
+		return ref, err
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return ref, jobError(err)
+	}
+	if err = os.MkdirAll(s.StagingDir, 0700); err != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	name := "sdk-example-" + jobID + ".json"
+	parent, _, err := stagingParent(s.StagingDir, name)
+	if err != nil {
+		return ref, err
+	}
+	defer unix.Close(parent)
+	fd, err := unix.Openat(parent, path.Base(name), unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0600)
+	if err != nil {
+		return ref, fail("operation-conflict")
+	}
+	file := os.NewFile(uintptr(fd), name)
+	contents, _ := json.Marshal(map[string]string{"example": "sdk-example", "job_id": jobID})
+	if _, err = file.Write(contents); err == nil {
+		err = file.Sync()
+	}
+	closeErr := file.Close()
+	if err != nil || closeErr != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	if err = unix.Fsync(parent); err != nil {
+		return ref, fail("STAGING_UNAVAILABLE")
+	}
+	_, err = s.MoveFromStaging(ctx, MoveParams{DelegationID: ref.DelegationID, JobID: jobID, Staging: name, Name: name, Size: int64(len(contents))})
+	return ref, err
+}