@synopackageland/cli 0.7.3 → 0.9.0

package/dist/templates/_executor/dsm_test.go

@@ -1,290 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-type accountsStub struct {
-	s   Subject
-	err error
-}
-
-func (a accountsStub) Lookup(string) (Subject, error) { return a.s, a.err }
-
-type cmdStub struct {
-	reply string
-	args  []string
-	path  string
-	err   error
-}
-
-func TestDSMCommandDeadlineStaysDistinctFromDenial(t *testing.T) {
-	for _, cause := range []error{context.DeadlineExceeded, errors.New("explicit DSM refusal")} {
-		d := &liveDSM{Command: &cmdStub{err: cause}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
-		_, err := d.ScopeRoot(context.Background(), Subject{Username: "alice"}, "shared:reports")
-		if errors.Is(err, context.DeadlineExceeded) != errors.Is(cause, context.DeadlineExceeded) {
-			t.Fatal("lost deadline identity", err)
-		}
-		e := &Executor{DSM: d, Policy: Policy{App: "app"}}
-		_, code := e.eligible(context.Background(), "alice", 1200, true)
-		want := "INELIGIBLE"
-		if errors.Is(cause, context.DeadlineExceeded) {
-			want = "EXECUTOR_PAUSED"
-		}
-		if code != want {
-			t.Fatal(code, want)
-		}
-	}
-}
-
-func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
-	c.path = p
-	c.args = args
-	return []byte(c.reply), c.err
-}
-func TestDSMAccountFailClosed(t *testing.T) {
-	for _, tc := range []struct {
-		name, reply string
-		pass        bool
-	}{
-		{"valid", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"normal"}]}}`, true},
-		{"success empty", `{"success":true,"data":{}}`, false},
-		{"success no user", `{"success":true,"data":{"users":[]}}`, false},
-		{"missing expiry", `{"success":true,"data":{"users":[{"name":"alice","uid":1200}]}}`, false},
-		{"disabled", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"now"}]}}`, false},
-		{"uid mismatch", `{"success":true,"data":{"users":[{"name":"alice","uid":1201,"expired":"normal"}]}}`, false},
-		{"name mismatch", `{"success":true,"data":{"users":[{"name":"bob","uid":1200,"expired":"normal"}]}}`, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			c := &cmdStub{reply: tc.reply}
-			d := &liveDSM{Command: c, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200}}}
-			_, err := d.Account(context.Background(), "alice")
-			if (err == nil) != tc.pass {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-func TestDSMAppPrivilege(t *testing.T) {
-	for _, tc := range []struct {
-		name, reply string
-		pass        bool
-	}{
-		{"allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`, true},
-		{"deny", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`, false},
-		{"custom", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"custom"}]}}`, false},
-		{"default allow", `{"success":true,"data":{"applications":[]}}`, true},
-		{"missing applications", `{"success":true,"data":{}}`, false},
-		{"null applications", `{"success":true,"data":{"applications":null}}`, false},
-		{"deny overrides allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"deny"}]}}`, false},
-		{"duplicate", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"allow"}]}}`, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			c := &cmdStub{reply: tc.reply}
-			d := &liveDSM{Command: c}
-			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app", "")
-			if (err == nil) != tc.pass {
-				t.Fatal(err)
-			}
-			if !reflect.DeepEqual(c.args, []string{"--exec", "api=SYNO.Core.AppPriv.App", "method=preview", "version=2", `username="alice"`}) {
-				t.Fatal(c.args)
-			}
-		})
-	}
-}
-
-// Preview lists only effective allows, so an absent App means "not allowed"
-// unless DSM never manages the App (no entry mode). Mirrors the CGI EntryGate.
-func TestDSMAppPrivilegeByEntryMode(t *testing.T) {
-	const (
-		absent    = `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow"}]}}`
-		allowed   = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`
-		denied    = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`
-		allowAll  = `{"success":true,"data":{"applications":[{"app_id":"SYNO.ALLOW.ALL.APPLICATIONS","privilelge":"allow"}]}}`
-		malformed = `{"success":true,"data":{}}`
-	)
-	user, admin := Subject{Username: "alice"}, Subject{Username: "root-admin", Admin: true}
-	for _, tc := range []struct {
-		name, entry, reply string
-		s                  Subject
-		pass               bool
-	}{
-		{"legacy absent", "", absent, user, true},
-		{"app-privilege absent", "app-privilege", absent, user, false},
-		{"app-privilege allowed", "app-privilege", allowed, user, true},
-		{"app-privilege denied", "app-privilege", denied, user, false},
-		{"app-privilege admin", "app-privilege", allowAll, admin, true},
-		{"app-privilege admin malformed", "app-privilege", malformed, admin, false},
-		{"admin-only user allowed rule", "admin-only", allowed, user, false},
-		{"admin-only admin", "admin-only", allowAll, admin, true},
-		{"unknown mode", "everyone", allowed, user, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			d := &liveDSM{Command: &cmdStub{reply: tc.reply}}
-			if err := d.Allow(context.Background(), tc.s, "app", tc.entry); (err == nil) != tc.pass {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-func TestDSMVerify(t *testing.T) {
-	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			c, err := r.Cookie("id")
-			if err != nil || c.Value != "cookie" || r.Header.Get("X-SYNO-TOKEN") != "token" {
-				t.Error("cookie")
-			}
-			w.Write([]byte(reply))
-		}))
-		d := &liveDSM{HTTP: srv.Client(), Endpoint: srv.URL}
-		name, err := d.Verify(context.Background(), "cookie", "token")
-		srv.Close()
-		if strings.Contains(reply, `"alice"`) {
-			if err != nil || name != "alice" {
-				t.Fatal(name, err)
-			}
-		} else if err == nil {
-			t.Fatal("invalid identity accepted")
-		}
-	}
-}
-func TestDSMArgvAndEmbeddedError(t *testing.T) {
-	c := &cmdStub{reply: `{"success":true,"data":{"files":[{"error":{"code":407}}]}}`}
-	d := &liveDSM{Command: c}
-	_, err := d.API(context.Background(), "alice", "files.createFolder", map[string]any{"path": "/home", "name": "$(touch nope);`x`"})
-	if err == nil || c.path != "/usr/syno/bin/synowebapi" || !contains(c.args, "runner=alice") {
-		t.Fatal(err, c)
-	}
-	if !contains(c.args, `name="$(touch nope);`+"`x`"+`"`) {
-		t.Fatal(c.args)
-	}
-	c.err = errors.New("unavailable")
-	if _, err = d.API(context.Background(), "alice", "files.list", map[string]any{"path": "/home"}); err == nil {
-		t.Fatal("command error")
-	}
-}
-
-type rootStub struct {
-	calls int
-	err   error
-}
-
-func (r *rootStub) Run(context.Context, string, string) (string, error) {
-	r.calls++
-	return "root", r.err
-}
-func TestRootRequiresVerifiedAdmin(t *testing.T) {
-	e, f, _ := setup(t)
-	r := &rootStub{}
-	e.Runner = r
-	e.Policy.Root = map[string]string{"whoami": strings.Repeat("a", 64)}
-	out := request(e, "root.run", map[string]any{"name": "whoami"})
-	if out.Code != "ADMIN_REQUIRED" || r.calls != 0 {
-		t.Fatal(out)
-	}
-	f.user.Admin = true
-	if out = request(e, "root.run", map[string]any{"name": "whoami"}); !out.OK || r.calls != 1 {
-		t.Fatal(out)
-	}
-	if out = request(e, "root.run", map[string]any{"name": "other"}); out.Code != "POLICY_DENIED" {
-		t.Fatal(out)
-	}
-}
-func TestSubdirectoryBinding(t *testing.T) {
-	e, f, _ := setup(t)
-	f.root = t.TempDir()
-	f.root = realTestPath(t, f.root)
-	if err := makeTestDir(f.root + "/downloads"); err != nil {
-		t.Fatal(err)
-	}
-	out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home/downloads", "ttl_seconds": 60})
-	if !out.OK {
-		t.Fatal(out)
-	}
-}
-
-func TestDSMEmptyOperationDataDenied(t *testing.T) {
-	for _, op := range []string{"files.list", "files.info", "files.createFolder", "files.checkPermission"} {
-		c := &cmdStub{reply: `{"success":true,"data":{}}`}
-		d := &liveDSM{Command: c}
-		if _, err := d.API(context.Background(), "alice", op, map[string]any{"path": "/home", "name": "new"}); err == nil {
-			t.Fatal(op, "empty success accepted")
-		}
-	}
-}
-
-type eligibilityCommand struct{ expired, deniedApp string }
-
-func (c eligibilityCommand) Exec(_ context.Context, _ string, args []string) ([]byte, error) {
-	if contains(args, "api=SYNO.Core.User") {
-		return []byte(`{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"` + c.expired + `"}]}}`), nil
-	}
-	if c.deniedApp != "" {
-		return []byte(`{"success":true,"data":{"applications":[{"app_id":"` + c.deniedApp + `","privilelge":"deny"}]}}`), nil
-	}
-	return []byte(`{"success":true,"data":{"applications":[]}}`), nil
-}
-func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *testing.T) {
-	for _, tc := range []struct{ name, expiry, deny, want string }{
-		{"ordinary defaults", "normal", "", ""},
-		{"explicit App deny", "normal", "app", "APP_DENIED"},
-		{"explicit File Station deny", "normal", "SYNO.SDS.App.FileStation3.Instance", "APP_DENIED"},
-		{"disabled with default Apps", "now", "", "INELIGIBLE"},
-		{"unknown account state", "", "", "INELIGIBLE"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			e, _, _ := setup(t)
-			e.DSM = &liveDSM{Command: eligibilityCommand{expired: tc.expiry, deniedApp: tc.deny}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
-			_, code := e.eligible(context.Background(), "alice", 1200, true)
-			if code != tc.want {
-				t.Fatal(code, tc.want)
-			}
-		})
-	}
-}
-
-func TestDSMSharedScopeUsesMeasuredGetVolumeContract(t *testing.T) {
-	volume := t.TempDir()
-	volume, err := filepath.EvalSymlinks(volume)
-	if err != nil {
-		t.Fatal(err)
-	}
-	share := filepath.Join(volume, "reports")
-	if err := os.Mkdir(share, 0700); err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct {
-		name, data string
-		pass       bool
-	}{
-		{"DSM single share", `{"name":"reports","vol_path":` + strconv.Quote(volume) + `,"desc":"test","uuid":"fixture"}`, true},
-		{"different share", `{"name":"other","vol_path":` + strconv.Quote(volume) + `}`, false},
-		{"missing volume", `{"name":"reports"}`, false},
-		{"relative volume", `{"name":"reports","vol_path":"relative"}`, false},
-		{"unclean volume", `{"name":"reports","vol_path":"/volume1/../etc"}`, false},
-		{"root volume", `{"name":"reports","vol_path":"/"}`, false},
-		{"null", `null`, false},
-		{"invented list contract", `{"shares":[{"name":"reports","path":` + strconv.Quote(share) + `}]}`, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cmd := &cmdStub{reply: `{"success":true,"data":` + tc.data + `}`}
-			d := &liveDSM{Command: cmd}
-			root, err := d.ScopeRoot(context.Background(), Subject{}, "shared:reports")
-			if (err == nil) != tc.pass || tc.pass && root != share {
-				t.Fatalf("root=%q err=%v", root, err)
-			}
-			if !reflect.DeepEqual(cmd.args, []string{"--exec", "api=SYNO.Core.Share", "method=get", "version=1", `name="reports"`}) {
-				t.Fatal(cmd.args)
-			}
-		})
-	}
-}