@synopackageland/cli 0.6.1 → 0.7.1

package/templates/_executor/dsm.go

@@ -78,11 +78,32 @@ type envelope struct {
 	Data    json.RawMessage `json:"data"`
 }
 
+// dsmError keeps the DSM error code of a refused call; the message stays generic.
+type dsmError struct{ Code int }
+
+func (*dsmError) Error() string { return "DSM refused" }
+
 func decodeEnvelope(b []byte) (json.RawMessage, error) {
+	data, err := decodeSuccess(b)
+	if err == nil && (len(data) == 0 || string(data) == "null") {
+		return nil, &dsmError{}
+	}
+	return data, err
+}
+
+// decodeSuccess accepts a success without data: scheduler deletes answer
+// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
+func decodeSuccess(b []byte) (json.RawMessage, error) {
 	var r envelope
 	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success || len(r.Data) == 0 || string(r.Data) == "null" {
-		return nil, errors.New("DSM refused")
+	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
+		var refused struct {
+			Error struct {
+				Code int `json:"code"`
+			} `json:"error"`
+		}
+		json.Unmarshal(b, &refused)
+		return nil, &dsmError{Code: refused.Error.Code}
 	}
 	return r.Data, nil
 }
@@ -117,6 +138,22 @@ func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, err
 	return out.Username, nil
 }
 func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
+	b, err := d.exec(ctx, api, method, version, runner, params)
+	if err != nil {
+		return nil, err
+	}
+	return decodeEnvelope(b)
+}
+
+// mutate runs a call whose success carries no data, such as a scheduler delete.
+func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
+	b, err := d.exec(ctx, api, method, version, "", params)
+	if err == nil {
+		_, err = decodeSuccess(b)
+	}
+	return err
+}
+func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
 	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
 	if runner != "" {
 		args = append(args, "runner="+runner)
@@ -135,9 +172,12 @@ func (d *liveDSM) call(ctx context.Context, api, method, version, runner string,
 	}
 	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
 	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+			return nil, err
+		}
 		return nil, errors.New("DSM command")
 	}
-	return decodeEnvelope(b)
+	return b, nil
 }
 func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s, err := d.Accounts.Lookup(name)
@@ -161,13 +201,21 @@ func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
 	s.Expired = out.Users[0].Expired
 	return s, nil
 }
-func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
+
+// Allow is the executor's offline App Privileges decision. It follows the CGI
+// EntryGate: administrators pass, admin-only refuses everyone else, and
+// app-privilege requires DSM's own allow. Preview lists only effective allows
+// (user, group and everyone rules), so an absent App is allowed only when the
+// package declares no entry mode and DSM therefore never manages its App.
+func (d *liveDSM) Allow(ctx context.Context, s Subject, app, entry string) error {
+	if !contains([]string{"", "admin-only", "app-privilege"}, entry) {
+		return errors.New("entry mode")
+	}
 	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
 	if err != nil {
 		return err
 	}
-	// DSM 7.x omits default-allowed Apps from preview (measured on vt-nas).
-	// An explicit deny/custom entry or malformed/ambiguous response still refuses.
+	// An explicit deny/custom entry or malformed/ambiguous response refuses.
 	var out struct {
 		Apps *[]json.RawMessage `json:"applications"`
 	}
@@ -193,7 +241,10 @@ func (d *liveDSM) Allow(ctx context.Context, s Subject, app string) error {
 	if count > 1 {
 		return errors.New("app ambiguous")
 	}
-	return nil
+	if entry == "" || s.Admin || entry == "app-privilege" && count == 1 {
+		return nil
+	}
+	return errors.New("app denied")
 }
 func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
 	if scope == "home" {
@@ -210,16 +261,15 @@ func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (strin
 	if err != nil {
 		return "", err
 	}
+	// DSM Share.get returns one share and its volume, not Share.list's array.
 	var out struct {
-		Shares []struct {
-			Name string `json:"name"`
-			Path string `json:"path"`
-		} `json:"shares"`
+		Name   string `json:"name"`
+		Volume string `json:"vol_path"`
 	}
-	if json.Unmarshal(data, &out) != nil || len(out.Shares) != 1 || out.Shares[0].Name != name || !cleanPath(out.Shares[0].Path) {
+	if json.Unmarshal(data, &out) != nil || out.Name != name || !validSelectedScope(scope) || !cleanPath(out.Volume) || out.Volume == "/" {
 		return "", errors.New("share")
 	}
-	return filepath.EvalSymlinks(out.Shares[0].Path)
+	return filepath.EvalSymlinks(filepath.Join(out.Volume, out.Name))
 }
 func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
 	if runner == "" {

package/templates/_executor/dsm_test.go

@@ -5,7 +5,10 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 )
@@ -24,6 +27,25 @@ type cmdStub struct {
 	err   error
 }
 
+func TestDSMCommandDeadlineStaysDistinctFromDenial(t *testing.T) {
+	for _, cause := range []error{context.DeadlineExceeded, errors.New("explicit DSM refusal")} {
+		d := &liveDSM{Command: &cmdStub{err: cause}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
+		_, err := d.ScopeRoot(context.Background(), Subject{Username: "alice"}, "shared:reports")
+		if errors.Is(err, context.DeadlineExceeded) != errors.Is(cause, context.DeadlineExceeded) {
+			t.Fatal("lost deadline identity", err)
+		}
+		e := &Executor{DSM: d, Policy: Policy{App: "app"}}
+		_, code := e.eligible(context.Background(), "alice", 1200, true)
+		want := "INELIGIBLE"
+		if errors.Is(cause, context.DeadlineExceeded) {
+			want = "EXECUTOR_PAUSED"
+		}
+		if code != want {
+			t.Fatal(code, want)
+		}
+	}
+}
+
 func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
 	c.path = p
 	c.args = args
@@ -69,7 +91,7 @@ func TestDSMAppPrivilege(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			c := &cmdStub{reply: tc.reply}
 			d := &liveDSM{Command: c}
-			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app")
+			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app", "")
 			if (err == nil) != tc.pass {
 				t.Fatal(err)
 			}
@@ -79,6 +101,41 @@ func TestDSMAppPrivilege(t *testing.T) {
 		})
 	}
 }
+
+// Preview lists only effective allows, so an absent App means "not allowed"
+// unless DSM never manages the App (no entry mode). Mirrors the CGI EntryGate.
+func TestDSMAppPrivilegeByEntryMode(t *testing.T) {
+	const (
+		absent    = `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow"}]}}`
+		allowed   = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`
+		denied    = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`
+		allowAll  = `{"success":true,"data":{"applications":[{"app_id":"SYNO.ALLOW.ALL.APPLICATIONS","privilelge":"allow"}]}}`
+		malformed = `{"success":true,"data":{}}`
+	)
+	user, admin := Subject{Username: "alice"}, Subject{Username: "root-admin", Admin: true}
+	for _, tc := range []struct {
+		name, entry, reply string
+		s                  Subject
+		pass               bool
+	}{
+		{"legacy absent", "", absent, user, true},
+		{"app-privilege absent", "app-privilege", absent, user, false},
+		{"app-privilege allowed", "app-privilege", allowed, user, true},
+		{"app-privilege denied", "app-privilege", denied, user, false},
+		{"app-privilege admin", "app-privilege", allowAll, admin, true},
+		{"app-privilege admin malformed", "app-privilege", malformed, admin, false},
+		{"admin-only user allowed rule", "admin-only", allowed, user, false},
+		{"admin-only admin", "admin-only", allowAll, admin, true},
+		{"unknown mode", "everyone", allowed, user, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			d := &liveDSM{Command: &cmdStub{reply: tc.reply}}
+			if err := d.Allow(context.Background(), tc.s, "app", tc.entry); (err == nil) != tc.pass {
+				t.Fatal(err)
+			}
+		})
+	}
+}
 func TestDSMVerify(t *testing.T) {
 	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -194,3 +251,40 @@ func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *test
 		})
 	}
 }
+
+func TestDSMSharedScopeUsesMeasuredGetVolumeContract(t *testing.T) {
+	volume := t.TempDir()
+	volume, err := filepath.EvalSymlinks(volume)
+	if err != nil {
+		t.Fatal(err)
+	}
+	share := filepath.Join(volume, "reports")
+	if err := os.Mkdir(share, 0700); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name, data string
+		pass       bool
+	}{
+		{"DSM single share", `{"name":"reports","vol_path":` + strconv.Quote(volume) + `,"desc":"test","uuid":"fixture"}`, true},
+		{"different share", `{"name":"other","vol_path":` + strconv.Quote(volume) + `}`, false},
+		{"missing volume", `{"name":"reports"}`, false},
+		{"relative volume", `{"name":"reports","vol_path":"relative"}`, false},
+		{"unclean volume", `{"name":"reports","vol_path":"/volume1/../etc"}`, false},
+		{"root volume", `{"name":"reports","vol_path":"/"}`, false},
+		{"null", `null`, false},
+		{"invented list contract", `{"shares":[{"name":"reports","path":` + strconv.Quote(share) + `}]}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := &cmdStub{reply: `{"success":true,"data":` + tc.data + `}`}
+			d := &liveDSM{Command: cmd}
+			root, err := d.ScopeRoot(context.Background(), Subject{}, "shared:reports")
+			if (err == nil) != tc.pass || tc.pass && root != share {
+				t.Fatalf("root=%q err=%v", root, err)
+			}
+			if !reflect.DeepEqual(cmd.args, []string{"--exec", "api=SYNO.Core.Share", "method=get", "version=1", `name="reports"`}) {
+				t.Fatal(cmd.args)
+			}
+		})
+	}
+}