@synopackageland/cli 0.6.1 → 0.7.1

package/templates/native-go/backend/internal/dsm/entry.go

@@ -0,0 +1,177 @@
+package dsm
+
+// The entry gate decides who may use the app at all, before any route policy.
+// It wraps the session authenticator, so every API method, transfer and the
+// window's own calls share one decision; apps never implement it themselves.
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+const (
+	// EntryAdminOnly admits only DSM administrators.
+	EntryAdminOnly = "admin-only"
+	// EntryAppPrivilege admits administrators and any account that DSM's
+	// Control Panel > Application Privileges allows for this app.
+	EntryAppPrivilege = "app-privilege"
+
+	// EntryCacheTTL bounds how long a privilege change can take to apply.
+	EntryCacheTTL = 30 * time.Second
+	// EntryCacheMaxEntries bounds the cache file whatever the traffic.
+	EntryCacheMaxEntries = 256
+
+	entryCacheFile = "entry-cache.json"
+)
+
+var packageName = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]{1,63}$`)
+
+// EntryGate is an api.Authenticator that admits a verified caller only when
+// the app's entry mode allows it.
+type EntryGate struct {
+	next    api.Authenticator
+	mode    string
+	app     string
+	dir     string
+	now     func() time.Time
+	allowed func(ctx context.Context, principal, app, addr string) (bool, error)
+}
+
+// NewEntryGate wraps next for the build-time entry mode. An empty mode keeps
+// next unchanged: the route policy alone decides, as before entry modes.
+// dataDir holds the short-lived decision cache shared by CGI processes.
+func NewEntryGate(next api.Authenticator, mode, packageID, dataDir string) (api.Authenticator, error) {
+	if next == nil {
+		return nil, errors.New("entry gate needs an authenticator")
+	}
+	switch mode {
+	case "":
+		return next, nil
+	case EntryAdminOnly, EntryAppPrivilege:
+	default:
+		return nil, fmt.Errorf("unknown entry mode %q", mode)
+	}
+	if !packageName.MatchString(packageID) {
+		return nil, fmt.Errorf("invalid package ID %q", packageID)
+	}
+	return &EntryGate{next: next, mode: mode, app: "SYNO.SDS." + packageID + ".Instance", dir: filepath.Join(dataDir, "entry"), now: time.Now, allowed: AppPrivilege}, nil
+}
+
+func (g *EntryGate) Authenticate(r *http.Request) (api.Identity, error) {
+	id, err := g.next.Authenticate(r)
+	if err != nil || id.Admin {
+		return id, err
+	}
+	if g.mode == EntryAdminOnly {
+		return api.Identity{}, api.ErrAdminRequired
+	}
+	addr, err := clientAddress(r)
+	if err != nil {
+		return api.Identity{}, err
+	}
+	allowed, err := g.decide(r.Context(), id.User, addr)
+	if err != nil {
+		return api.Identity{}, err
+	}
+	if !allowed {
+		return api.Identity{}, api.ErrAppPrivilegeDenied
+	}
+	return id, nil
+}
+
+// clientAddress is the browser's address as DSM's web server reported it
+// (REMOTE_ADDR); DSM's IP rules are evaluated against it.
+func clientAddress(r *http.Request) (string, error) {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return "", errors.New("client address unavailable")
+	}
+	return ip.String(), nil
+}
+
+type cachedDecision struct {
+	Allowed bool  `json:"allowed"`
+	At      int64 `json:"at"`
+}
+
+func (g *EntryGate) decide(ctx context.Context, principal, addr string) (bool, error) {
+	sum := sha256.Sum256([]byte(principal + "\x00" + g.app + "\x00" + addr))
+	key := hex.EncodeToString(sum[:])
+	now := g.now().Unix()
+	entries, _ := g.readCache()
+	if d, ok := entries[key]; ok && d.At <= now && now-d.At < int64(EntryCacheTTL/time.Second) {
+		return d.Allowed, nil
+	}
+	allowed, err := g.allowed(ctx, principal, g.app, addr)
+	if err != nil {
+		return false, err
+	}
+	if entries == nil {
+		entries = map[string]cachedDecision{}
+	}
+	entries[key] = cachedDecision{Allowed: allowed, At: now}
+	g.writeCache(entries, now)
+	return allowed, nil
+}
+
+func (g *EntryGate) readCache() (map[string]cachedDecision, error) {
+	data, err := os.ReadFile(filepath.Join(g.dir, entryCacheFile))
+	if err != nil {
+		return nil, err
+	}
+	var entries map[string]cachedDecision
+	if err := json.Unmarshal(data, &entries); err != nil {
+		return nil, err
+	}
+	return entries, nil
+}
+
+// writeCache keeps only fresh entries, newest first, up to the bound. A failed
+// write only costs the next request a fresh lookup.
+func (g *EntryGate) writeCache(entries map[string]cachedDecision, now int64) {
+	keys := make([]string, 0, len(entries))
+	for k, d := range entries {
+		if d.At <= now && now-d.At < int64(EntryCacheTTL/time.Second) {
+			keys = append(keys, k)
+		}
+	}
+	sort.Slice(keys, func(i, j int) bool { return entries[keys[i]].At > entries[keys[j]].At })
+	if len(keys) > EntryCacheMaxEntries {
+		keys = keys[:EntryCacheMaxEntries]
+	}
+	kept := make(map[string]cachedDecision, len(keys))
+	for _, k := range keys {
+		kept[k] = entries[k]
+	}
+	data, err := json.Marshal(kept)
+	if err != nil || os.MkdirAll(g.dir, 0o700) != nil {
+		return
+	}
+	tmp, err := os.CreateTemp(g.dir, entryCacheFile+".*")
+	if err != nil {
+		return
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := tmp.Write(data); err != nil || tmp.Close() != nil {
+		tmp.Close()
+		return
+	}
+	os.Rename(tmp.Name(), filepath.Join(g.dir, entryCacheFile))
+}

package/templates/native-go/backend/internal/dsm/entry_test.go

@@ -0,0 +1,315 @@
+package dsm
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"dsmapp/internal/api"
+)
+
+type fixedAuth struct {
+	id  api.Identity
+	err error
+}
+
+func (f fixedAuth) Authenticate(*http.Request) (api.Identity, error) { return f.id, f.err }
+
+type lookup struct {
+	calls         int
+	user, app, ip string
+	allowed       bool
+	err           error
+}
+
+func (l *lookup) check(_ context.Context, user, app, ip string) (bool, error) {
+	l.calls++
+	l.user, l.app, l.ip = user, app, ip
+	return l.allowed && l.err == nil, l.err
+}
+
+func newTestGate(t *testing.T, mode string, next api.Authenticator, l *lookup) (*EntryGate, *time.Time) {
+	t.Helper()
+	auth, err := NewEntryGate(next, mode, "DemoApp", t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	gate := auth.(*EntryGate)
+	now := time.Unix(1_700_000_000, 0)
+	gate.now = func() time.Time { return now }
+	gate.allowed = l.check
+	return gate, &now
+}
+
+func ordinary(user string) fixedAuth { return fixedAuth{id: api.Identity{User: user}} }
+
+func TestUndeclaredEntryKeepsTheAuthenticatorUnchanged(t *testing.T) {
+	next := ordinary("bob")
+	got, err := NewEntryGate(next, "", "DemoApp", t.TempDir())
+	if err != nil || got != api.Authenticator(next) {
+		t.Fatalf("legacy entry wrapped the authenticator: %T %v", got, err)
+	}
+}
+
+func TestUnknownEntryModeFailsAtStartup(t *testing.T) {
+	for _, mode := range []string{"all-users", "users", "App-Privilege", "admin"} {
+		if _, err := NewEntryGate(ordinary("bob"), mode, "DemoApp", t.TempDir()); err == nil {
+			t.Fatalf("accepted entry mode %q", mode)
+		}
+	}
+	if _, err := NewEntryGate(nil, EntryAppPrivilege, "DemoApp", t.TempDir()); err == nil {
+		t.Fatal("accepted a missing authenticator")
+	}
+	if _, err := NewEntryGate(ordinary("bob"), EntryAppPrivilege, "Demo.App", t.TempDir()); err == nil {
+		t.Fatal("accepted an invalid package ID")
+	}
+}
+
+func TestAdministratorsEnterWithoutAppPrivilegeLookup(t *testing.T) {
+	for _, mode := range []string{EntryAdminOnly, EntryAppPrivilege} {
+		l := &lookup{}
+		gate, _ := newTestGate(t, mode, fixedAuth{id: api.Identity{User: "alice", Admin: true}}, l)
+		id, err := gate.Authenticate(sessionRequest())
+		if err != nil || !id.Admin || id.User != "alice" || l.calls != 0 {
+			t.Fatalf("%s: %+v %v calls=%d", mode, id, err, l.calls)
+		}
+	}
+}
+
+func TestAdminOnlyEntryRefusesOrdinaryUsers(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAdminOnly, ordinary("bob"), l)
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAdminRequired) || l.calls != 0 {
+		t.Fatalf("err=%v calls=%d", err, l.calls)
+	}
+}
+
+func TestAppPrivilegeEntryAsksDSMForTheRegisteredAppAndClientAddress(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary(`CORP\bob`), l)
+	id, err := gate.Authenticate(sessionRequest())
+	if err != nil || id.User != `CORP\bob` || id.Admin {
+		t.Fatalf("%+v %v", id, err)
+	}
+	if l.user != `CORP\bob` || l.app != "SYNO.SDS.DemoApp.Instance" || l.ip != "192.0.2.7" {
+		t.Fatalf("lookup got user=%q app=%q ip=%q", l.user, l.app, l.ip)
+	}
+}
+
+func TestAppPrivilegeDenialAndLookupFailureBothRefuse(t *testing.T) {
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), &lookup{allowed: false})
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAppPrivilegeDenied) {
+		t.Fatalf("denied: %v", err)
+	}
+	gate, _ = newTestGate(t, EntryAppPrivilege, ordinary("bob"), &lookup{err: errors.New("bridge exited 2")})
+	_, err := gate.Authenticate(sessionRequest())
+	if err == nil || errors.Is(err, api.ErrAppPrivilegeDenied) || errors.Is(err, api.ErrNoSession) {
+		t.Fatalf("lookup failure must surface as unavailable: %v", err)
+	}
+}
+
+func TestUnparseableClientAddressRefusesWithoutLookup(t *testing.T) {
+	for _, addr := range []string{"", "not-an-ip", "192.0.2.300:1", "[::1"} {
+		l := &lookup{allowed: true}
+		gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+		r := sessionRequest()
+		r.RemoteAddr = addr
+		if _, err := gate.Authenticate(r); err == nil || l.calls != 0 {
+			t.Fatalf("%q: err=%v calls=%d", addr, err, l.calls)
+		}
+	}
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	r := sessionRequest()
+	r.RemoteAddr = "[2001:db8::7]:443"
+	if _, err := gate.Authenticate(r); err != nil || l.ip != "2001:db8::7" {
+		t.Fatalf("IPv6: %v %q", err, l.ip)
+	}
+}
+
+func TestSessionAndAuthenticationFailuresPassThroughUnchanged(t *testing.T) {
+	for _, want := range []error{api.ErrNoSession, errors.New("authenticate.cgi unavailable")} {
+		l := &lookup{allowed: true}
+		gate, _ := newTestGate(t, EntryAppPrivilege, fixedAuth{err: want}, l)
+		if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, want) || l.calls != 0 {
+			t.Fatalf("err=%v calls=%d", err, l.calls)
+		}
+	}
+}
+
+func TestDecisionsAreCachedBrieflyPerUserAppAndAddress(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, now := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	for range 3 {
+		if _, err := gate.Authenticate(sessionRequest()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if l.calls != 1 {
+		t.Fatalf("cached decision looked up %d times", l.calls)
+	}
+	l.allowed = false
+	*now = now.Add(EntryCacheTTL - time.Second)
+	if _, err := gate.Authenticate(sessionRequest()); err != nil || l.calls != 1 {
+		t.Fatalf("within TTL: %v calls=%d", err, l.calls)
+	}
+	*now = now.Add(2 * time.Second)
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAppPrivilegeDenied) || l.calls != 2 {
+		t.Fatalf("after TTL: %v calls=%d", err, l.calls)
+	}
+	r := sessionRequest()
+	r.RemoteAddr = "198.51.100.4:1"
+	gate.Authenticate(r)
+	if l.calls != 3 {
+		t.Fatalf("another address reused a cached decision: calls=%d", l.calls)
+	}
+}
+
+func TestCacheSurvivesAcrossCGIProcessesAndIgnoresFutureEntries(t *testing.T) {
+	dir := t.TempDir()
+	l := &lookup{allowed: true}
+	first, err := NewEntryGate(ordinary("bob"), EntryAppPrivilege, "DemoApp", dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Unix(1_700_000_000, 0)
+	g1 := first.(*EntryGate)
+	g1.now = func() time.Time { return now }
+	g1.allowed = l.check
+	g1.Authenticate(sessionRequest())
+	second, _ := NewEntryGate(ordinary("bob"), EntryAppPrivilege, "DemoApp", dir)
+	g2 := second.(*EntryGate)
+	g2.now = func() time.Time { return now.Add(time.Second) }
+	g2.allowed = g1.allowed
+	g2.Authenticate(sessionRequest())
+	if l.calls != 1 {
+		t.Fatalf("a new process ignored the shared cache: calls=%d", l.calls)
+	}
+	g2.now = func() time.Time { return now.Add(-time.Minute) }
+	g2.Authenticate(sessionRequest())
+	if l.calls != 2 {
+		t.Fatalf("an entry from the future was trusted: calls=%d", l.calls)
+	}
+	info, err := os.Stat(filepath.Join(dir, "entry", entryCacheFile))
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("cache file: %v %v", info, err)
+	}
+}
+
+func TestFailuresAreNeverCached(t *testing.T) {
+	l := &lookup{err: errors.New("bridge exited 2")}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	gate.Authenticate(sessionRequest())
+	l.err, l.allowed = nil, true
+	if _, err := gate.Authenticate(sessionRequest()); err != nil || l.calls != 2 {
+		t.Fatalf("err=%v calls=%d", err, l.calls)
+	}
+}
+
+func TestCacheIsBoundedAndToleratesCorruption(t *testing.T) {
+	l := &lookup{allowed: true}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	for i := range EntryCacheMaxEntries + 20 {
+		r := sessionRequest()
+		r.RemoteAddr = "10.0." + strconv.Itoa(i/250) + "." + strconv.Itoa(i%250) + ":1"
+		if _, err := gate.Authenticate(r); err != nil {
+			t.Fatal(err)
+		}
+	}
+	entries, err := gate.readCache()
+	if err != nil || len(entries) > EntryCacheMaxEntries {
+		t.Fatalf("cache holds %d entries: %v", len(entries), err)
+	}
+	if err := os.WriteFile(filepath.Join(gate.dir, entryCacheFile), []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	before := l.calls
+	if _, err := gate.Authenticate(sessionRequest()); err != nil || l.calls != before+1 {
+		t.Fatalf("corrupt cache: %v calls=%d", err, l.calls-before)
+	}
+}
+
+func TestUnwritableCacheStillDecides(t *testing.T) {
+	l := &lookup{allowed: false}
+	gate, _ := newTestGate(t, EntryAppPrivilege, ordinary("bob"), l)
+	gate.dir = filepath.Join(t.TempDir(), "missing", "nested")
+	if _, err := gate.Authenticate(sessionRequest()); !errors.Is(err, api.ErrAppPrivilegeDenied) {
+		t.Fatal(err)
+	}
+}
+
+func TestAppPrivilegeRefusesMalformedInputsBeforeTheBridge(t *testing.T) {
+	for _, app := range []string{"", "SYNO", "SYNO.SDS.Demo App.Instance", "SYNO..Instance", "SYNO.SDS.Demo.Instance\n"} {
+		if appID.MatchString(app) {
+			t.Fatalf("accepted app ID %q", app)
+		}
+	}
+	if !appID.MatchString("SYNO.SDS.DemoApp.Instance") {
+		t.Fatal("refused the generated app ID")
+	}
+	for _, args := range [][3]string{{"", "SYNO.SDS.Demo.Instance", "10.0.0.5"}, {"bob", "SYNO.SDS.Demo.Instance", "10.0.0.05"}, {"bob", "SYNO.SDS.Demo.Instance", "fe80::1%eth0"}, {"bob", "bad", "10.0.0.5"}} {
+		if ok, err := AppPrivilege(context.Background(), args[0], args[1], args[2]); ok || err == nil {
+			t.Fatalf("%q: %v %v", args, ok, err)
+		}
+	}
+}
+
+// admin-only is the floor of every route: SDK routes the policy marks
+// authenticated (nas.files.list, bg.jobs.submit, delegate.status) refuse an
+// ordinary user exactly like app routes, while administrators reach them.
+func TestAdminOnlyEntryFloorsSDKRoutesAtAdministrators(t *testing.T) {
+	sdkRoutes := []string{"nas.files.list", "bg.jobs.submit", "delegate.status", "portal.status", "executor.status"}
+	for _, tc := range []struct {
+		id   api.Identity
+		code string
+	}{
+		{api.Identity{User: "bob"}, "admin_required"},
+		{api.Identity{User: "alice", Admin: true}, ""},
+	} {
+		executed := 0
+		var routes []api.Route
+		for _, method := range sdkRoutes {
+			routes = append(routes, api.Handle(method, func(context.Context, api.Caller, json.RawMessage) (any, error) {
+				executed++
+				return map[string]bool{"ok": true}, nil
+			}))
+		}
+		gate, _ := newTestGate(t, EntryAdminOnly, fixedAuth{id: tc.id}, &lookup{allowed: true})
+		srv, err := api.NewServerWithPermissions(gate, []byte(`{"schema":1,"default":"administrators","methods":{}}`), routes...)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, method := range sdkRoutes {
+			req := httptest.NewRequest(http.MethodPost, "http://nas.local/webman/3rdparty/DemoApp/cgi/api.cgi", strings.NewReader(`{"method":"`+method+`"}`))
+			req.Header.Set("Content-Type", "application/json")
+			rec := httptest.NewRecorder()
+			srv.ServeHTTP(rec, req)
+			var env struct {
+				Error *struct {
+					Code string `json:"code"`
+				} `json:"error"`
+			}
+			if err := json.Unmarshal(rec.Body.Bytes(), &env); err != nil {
+				t.Fatalf("%s: %q", method, rec.Body.String())
+			}
+			got := ""
+			if env.Error != nil {
+				got = env.Error.Code
+			}
+			if got != tc.code {
+				t.Fatalf("%s as %+v: code %q, want %q", method, tc.id, got, tc.code)
+			}
+		}
+		if want := map[bool]int{true: len(sdkRoutes), false: 0}[tc.id.Admin]; executed != want {
+			t.Fatalf("%+v executed %d handlers, want %d", tc.id, executed, want)
+		}
+	}
+}

package/templates/native-go/backend/internal/dsm/native/apppriv_check.c

@@ -0,0 +1,33 @@
+// Minimal DSM SDK bridge for Application Privileges. DSM evaluates its own
+// user, group and everyone rules, allow/deny precedence and IP ranges; this
+// bridge only passes the verified principal, the registered app ID and the
+// client address, and prints DSM's exact decision.
+#include <dlfcn.h>
+#include <stdio.h>
+#include <string.h>
+
+#ifndef DSM_SDK_LIBRARY
+#define DSM_SDK_LIBRARY "/usr/lib/libsynosdk.so"
+#endif
+
+// ABI measured on DSM 7.4 (vt-nas, kernel 4.4): int (const char *user,
+// const char *app, const char *ip) returning 1 (allowed) or 0 (refused).
+// A NULL address refuses every account, so the address is mandatory.
+typedef int (*apppriv_check_fn)(const char *, const char *, const char *);
+_Static_assert(sizeof(int) == 4, "DSM BOOL ABI requires a 32-bit int");
+
+static int bounded(const char *value, size_t max) {
+    return value[0] != '\0' && strlen(value) <= max;
+}
+
+int main(int argc, char **argv) {
+    if (argc != 4 || !bounded(argv[1], 1024) || !bounded(argv[2], 128) || !bounded(argv[3], 64)) return 2;
+    void *library = dlopen(DSM_SDK_LIBRARY, RTLD_NOW | RTLD_LOCAL);
+    if (!library) return 2;
+    apppriv_check_fn check = (apppriv_check_fn)dlsym(library, "SLIBAppPrivUserHas");
+    if (!check) { dlclose(library); return 2; }
+    int result = check(argv[1], argv[2], argv[3]);
+    dlclose(library);
+    if (result != 0 && result != 1) return 2;
+    return printf("%d\n", result) == 2 ? 0 : 2;
+}

package/templates/native-go/backend/internal/dsm/native/build.sh

@@ -1,9 +1,18 @@
 #!/bin/sh
 set -eu
 # Zig 0.16.0 cross-compiles this small libc/dlopen bridge. No proprietary SDK
-# headers or libraries are distributed. GNU ABI 2.17 covers both DSM targets.
+# headers or libraries are distributed. GNU ABI 2.17 covers every DSM target.
 cd "$(dirname "$0")"
 [ "$(zig version)" = "0.16.0" ] || { echo 'requires Zig 0.16.0' >&2; exit 2; }
-for arch in x86_64 aarch64; do
-  zig cc admin_check.c -target "$arch-linux-gnu.2.17" -std=c11 -O2 -Wall -Wextra -Werror -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro,-z,now -Wl,--build-id=none -s -ldl -o "admin-$arch.elf"
-done
+build() { # <arch> <zig target> [compiler flags]
+  arch=$1 target=$2
+  shift 2
+  for bridge in admin apppriv; do
+    zig cc "${bridge}_check.c" -target "$target" "$@" -std=c11 -O2 -Wall -Wextra -Werror -fPIE -pie -fstack-protector-strong -D_FORTIFY_SOURCE=2 -Wl,-z,relro,-z,now -Wl,--build-id=none -s -ldl -o "$bridge-$arch.elf"
+  done
+}
+build x86_64 x86_64-linux-gnu.2.17
+build aarch64 aarch64-linux-gnu.2.17
+# ARMv7-A, VFPv3 and NEON, no integer divide: the Cortex-A9 (armada38x,
+# monaco) and Cortex-A15 (alpine, alpine4k) models both run it.
+build armv7 arm-linux-gnueabihf.2.17 -mcpu=baseline

package/templates/native-go/backend/internal/dsm/native/provenance.json

@@ -3,10 +3,16 @@
   "abi": "GNU libc 2.17",
   "files": {
     "admin_check.c": "87dbc9be7742f52bdde6ed3bf73ea79facc6f0708b317696eff03624b4c3276b",
-    "build.sh": "deae3f75b53882efbf6c0d31197892a8571f1b20ae42c92f99ee6782e3286d1e",
+    "apppriv_check.c": "08249e0a7d3e03fbb02da43f8c7323af11b914448d4a5928f99d39bb430a553c",
+    "build.sh": "89f05d98b60b4d28113f8faa97897ac18a7a5387afef3e85cfa47fa98b13629a",
     "admin-x86_64.elf": "cb14c60b74a59847f14d27e9361f874f82d99f6416407df861655b742c3a976c",
-    "admin-aarch64.elf": "2a8f33a8c31837bfc498a486baf78ac9b0549f743a9adf89de6d094db61e8baa"
+    "admin-aarch64.elf": "2a8f33a8c31837bfc498a486baf78ac9b0549f743a9adf89de6d094db61e8baa",
+    "apppriv-x86_64.elf": "62b62a00d2b7bb725d4e10a3aecfd59005f943f98355a129cb418213a4595363",
+    "apppriv-aarch64.elf": "8ef803709f0bb775cac607833f1d45f3025371da268297ec6c0253f7431a9167",
+    "admin-armv7.elf": "da4a0f986adcb66ab7d09d1e8478ee8b22ae9d6ccb1461ea4552789a7663f1f8",
+    "apppriv-armv7.elf": "19d86118414f0d04f0806b5f3e199f26092b5521f24e70847093532a2b84b2a7"
   },
   "sdkSymbol": "SLIBGroupIsAdminGroupMem",
-  "sdkRealtime": true
+  "sdkRealtime": true,
+  "appPrivSymbol": "SLIBAppPrivUserHas"
 }

package/templates/native-go/backend/internal/filestation/check_permission.go

@@ -0,0 +1,71 @@
+package filestation
+
+import (
+	"context"
+	"dsmapp/internal/api"
+	"encoding/json"
+	"net/http"
+	"time"
+)
+
+// CheckPermission is an online write check with the current user's session.
+// It creates no probe file and does not grant any offline authority.
+func (c *Client) CheckPermission(ctx context.Context, r *http.Request, path string) error {
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return err
+	}
+	r = r.Clone(ctx)
+	r.Header.Set("X-SYNO-TOKEN", auth["dsm_synotoken"])
+	if !validPath(path) {
+		return fail("invalid-request")
+	}
+	v := fields("SYNO.FileStation.CheckPermission", "write", "3")
+	v.Set("path", path)
+	v.Set("filename", ".synopkgland-permission-probe")
+	v.Set("overwrite", "false")
+	v.Set("size", "0")
+	var data map[string]json.RawMessage
+	if err := c.call(ctx, r, v, &data); err != nil {
+		return err
+	}
+	var skip *bool
+	if json.Unmarshal(data["blSkip"], &skip) != nil || skip == nil || *skip {
+		return fail("denied")
+	}
+	// File Station can return per-file refusal inside a success envelope.
+	for _, key := range []string{"error", "errors"} {
+		if raw := data[key]; len(raw) != 0 && string(raw) != "null" && string(raw) != "[]" {
+			return fail("denied")
+		}
+	}
+	return nil
+}
+
+// Keep the original DSMClient contract usable by existing read-only adapters.
+// An adapter lacking the new method refuses the write check.
+type permissionClient interface {
+	CheckPermission(context.Context, *http.Request, string) error
+}
+
+func (s *Service) CheckPermission(ctx context.Context, caller api.Caller, r *http.Request, path string) error {
+	if !validPath(path) {
+		return fail("invalid-request")
+	}
+	auth, err := api.DSMSession(r)
+	if err != nil {
+		return err
+	}
+	r = r.Clone(ctx)
+	r.Header.Set("X-SYNO-TOKEN", auth["dsm_synotoken"])
+	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+	if err := s.verify(ctx, caller, r); err != nil {
+		return err
+	}
+	client, ok := s.client.(permissionClient)
+	if !ok {
+		return fail("unsupported")
+	}
+	return client.CheckPermission(ctx, r, path)
+}