@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go/backend/internal/datamigrate/migrate_test.go

@@ -1,177 +0,0 @@
-package datamigrate
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-	"reflect"
-	"testing"
-)
-
-func readState(t *testing.T, dir string) State {
-	t.Helper()
-	got, err := Load(dir)
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	return got
-}
-
-func TestMissingStateIsZero(t *testing.T) {
-	got, err := Load(t.TempDir())
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if got != (State{}) {
-		t.Fatalf("missing state = %+v, want zero", got)
-	}
-}
-
-func TestRunAppliesEveryMigrationInVersionOrderAndRecordsSchema(t *testing.T) {
-	dir := t.TempDir()
-	var order []int
-	migrations := []Migration{
-		{Version: 2, Name: "second", Apply: func(Context) error { order = append(order, 2); return nil }},
-		{Version: 1, Name: "first", Apply: func(Context) error { order = append(order, 1); return nil }},
-	}
-	got, err := Run(dir, Info{NewPkgVer: "1.1.0-0002"}, migrations)
-	if err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-	if want := []int{1, 2}; !reflect.DeepEqual(order, want) {
-		t.Fatalf("migration order = %v, want %v", order, want)
-	}
-	if got.Schema != 2 {
-		t.Fatalf("returned schema = %d, want 2", got.Schema)
-	}
-	if reread := readState(t, dir); reread.Schema != 2 || reread.PackageVersion != "1.1.0-0002" {
-		t.Fatalf("recorded state = %+v", reread)
-	}
-}
-
-func TestRunSkipsMigrationsAlreadyRecorded(t *testing.T) {
-	dir := t.TempDir()
-	runs := 0
-	migration := Migration{Version: 1, Name: "once", Apply: func(Context) error { runs++; return nil }}
-	for range 2 {
-		if _, err := Run(dir, Info{}, []Migration{migration}); err != nil {
-			t.Fatalf("Run: %v", err)
-		}
-	}
-	if runs != 1 {
-		t.Fatalf("migration applied %d times, want 1", runs)
-	}
-}
-
-func TestRunStopsAtFailureAndKeepsEarlierVersion(t *testing.T) {
-	dir := t.TempDir()
-	sentinel := errors.New("boom")
-	applied := 0
-	migrations := []Migration{
-		{Version: 1, Name: "ok", Apply: func(Context) error { applied++; return nil }},
-		{Version: 2, Name: "bad", Apply: func(Context) error { applied++; return sentinel }},
-		{Version: 3, Name: "later", Apply: func(Context) error { applied++; return nil }},
-	}
-	_, err := Run(dir, Info{}, migrations)
-	if !errors.Is(err, sentinel) {
-		t.Fatalf("Run error = %v, want the migration error", err)
-	}
-	if applied != 2 {
-		t.Fatalf("applied %d migrations, want 2", applied)
-	}
-	if got := readState(t, dir); got.Schema != 1 {
-		t.Fatalf("recorded schema = %d, want 1 (last success)", got.Schema)
-	}
-}
-
-func TestRunLeavesOldDataWhenAMigrationFails(t *testing.T) {
-	dir := t.TempDir()
-	keep := filepath.Join(dir, "old.db")
-	if err := os.WriteFile(keep, []byte("old"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := Run(dir, Info{}, []Migration{{Version: 1, Name: "bad", Apply: func(Context) error { return errors.New("nope") }}}); err == nil {
-		t.Fatal("want error")
-	}
-	if data, err := os.ReadFile(keep); err != nil || string(data) != "old" {
-		t.Fatalf("old data = %q, %v", data, err)
-	}
-	if _, err := os.Stat(filepath.Join(dir, StateFile)); !os.IsNotExist(err) {
-		t.Fatalf("a failed first migration must not record a version: %v", err)
-	}
-}
-
-func TestRunGivesMigrationsTheOldAndNewPackageVersion(t *testing.T) {
-	dir := t.TempDir()
-	var first Context
-	if _, err := Run(dir, Info{OldPkgVer: "1.0.0-0001", NewPkgVer: "1.1.0-0002"}, []Migration{
-		{Version: 1, Name: "m1", Apply: func(ctx Context) error { first = ctx; return nil }},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	if first.OldPkgVer != "1.0.0-0001" || first.NewPkgVer != "1.1.0-0002" || first.DataDir != dir {
-		t.Fatalf("context = %+v", first)
-	}
-	var second Context
-	if _, err := Run(dir, Info{NewPkgVer: "1.2.0-0003"}, []Migration{
-		{Version: 2, Name: "m2", Apply: func(ctx Context) error { second = ctx; return nil }},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	if second.OldPkgVer != "1.1.0-0002" {
-		t.Fatalf("old package version without SYNOPKG_OLD_PKGVER = %q, want the recorded one", second.OldPkgVer)
-	}
-}
-
-func TestRunRecordsThePackageVersionWithoutMigrations(t *testing.T) {
-	dir := t.TempDir()
-	if _, err := Run(dir, Info{NewPkgVer: "1.0.0-0001"}, nil); err != nil {
-		t.Fatal(err)
-	}
-	if got := readState(t, dir); got.Schema != 0 || got.PackageVersion != "1.0.0-0001" {
-		t.Fatalf("state = %+v", got)
-	}
-	if _, err := Run(dir, Info{NewPkgVer: "1.1.0-0002"}, nil); err != nil {
-		t.Fatal(err)
-	}
-	if got := readState(t, dir); got.PackageVersion != "1.1.0-0002" {
-		t.Fatalf("state = %+v", got)
-	}
-}
-
-func TestRunRejectsInvalidMigrationLists(t *testing.T) {
-	dir := t.TempDir()
-	ok := func(Context) error { return nil }
-	for name, migrations := range map[string][]Migration{
-		"zero version": {{Version: 0, Name: "z", Apply: ok}},
-		"negative":     {{Version: -1, Name: "n", Apply: ok}},
-		"duplicate":    {{Version: 1, Name: "a", Apply: ok}, {Version: 1, Name: "b", Apply: ok}},
-		"nil apply":    {{Version: 1, Name: "a"}},
-	} {
-		if _, err := Run(dir, Info{}, migrations); err == nil {
-			t.Errorf("%s: want an error before anything runs", name)
-		}
-	}
-}
-
-func TestRunRejectsAnEmptyDataDirectory(t *testing.T) {
-	if _, err := Run("", Info{}, nil); err == nil {
-		t.Fatal("want an error")
-	}
-}
-
-func TestLoadRejectsCorruptState(t *testing.T) {
-	for name, body := range map[string]string{
-		"not json":     "{",
-		"negative":     `{"schema":-1}`,
-		"not a number": `{"schema":"one"}`,
-	} {
-		dir := t.TempDir()
-		if err := os.WriteFile(filepath.Join(dir, StateFile), []byte(body), 0o600); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := Load(dir); err == nil {
-			t.Errorf("%s: want an error", name)
-		}
-	}
-}

package/templates/native-go/backend/internal/dsm/admin.go

@@ -1,76 +0,0 @@
-package dsm
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"os/exec"
-	"time"
-)
-
-// IsAdministrator is the single DSM role provider. The native SDK owns group
-// names, domain/LDAP membership and real-time checks. Unknown results refuse.
-func IsAdministrator(ctx context.Context, principal string) (bool, error) {
-	if !validPrincipal(principal) {
-		return false, errors.New("invalid DSM principal")
-	}
-	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
-	defer cancel()
-	return nativeAdministrator(ctx, principal)
-}
-
-var errNativeRole = errors.New("DSM administrator verification unavailable")
-var errOutputLimit = errors.New("DSM authentication output limit exceeded")
-
-type boundedOutput struct {
-	buffer bytes.Buffer
-	limit  int
-}
-
-func (b *boundedOutput) Write(p []byte) (int, error) {
-	if len(p) > b.limit-b.Len() {
-		return 0, errOutputLimit
-	}
-	return b.buffer.Write(p)
-}
-
-func (b *boundedOutput) Len() int      { return b.buffer.Len() }
-func (b *boundedOutput) Bytes() []byte { return b.buffer.Bytes() }
-
-func commandOutput(cmd *exec.Cmd, limit int) ([]byte, error) {
-	var out = boundedOutput{limit: limit}
-	var stderr = boundedOutput{limit: 1024}
-	cmd.Stdout, cmd.Stderr = &out, &stderr
-	cmd.WaitDelay = 250 * time.Millisecond
-	configureCommand(cmd)
-	if err := cmd.Run(); err != nil {
-		return nil, err
-	}
-	return out.Bytes(), nil
-}
-
-func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, path)
-	cmd.Env = env
-	return commandOutput(cmd, 1026)
-}
-
-func parseNativeRole(out []byte, err error) (bool, error) {
-	return parseNativeBit(out, err, errNativeRole)
-}
-
-// parseNativeBit accepts only a bridge's exact "1\n" or "0\n"; anything else,
-// including a failed run, is the caller's unavailable error.
-func parseNativeBit(out []byte, err, unavailable error) (bool, error) {
-	if err != nil {
-		return false, unavailable
-	}
-	switch string(out) {
-	case "1\n":
-		return true, nil
-	case "0\n":
-		return false, nil
-	default:
-		return false, unavailable
-	}
-}

package/templates/native-go/backend/internal/dsm/admin_linux.go

@@ -1,110 +0,0 @@
-//go:build linux
-
-package dsm
-
-import (
-	"context"
-	_ "embed"
-	"errors"
-	"os"
-	"os/exec"
-	"runtime"
-	"syscall"
-
-	"golang.org/x/sys/unix"
-)
-
-// The bridge is compiled reproducibly from native/admin_check.c. Embedding
-// binds it to the CGI's build; no writable helper path or runtime library path.
-//
-//go:embed native/admin-x86_64.elf
-var adminAMD64 []byte
-
-//go:embed native/admin-aarch64.elf
-var adminARM64 []byte
-
-//go:embed native/apppriv-x86_64.elf
-var appPrivAMD64 []byte
-
-//go:embed native/apppriv-aarch64.elf
-var appPrivARM64 []byte
-
-//go:embed native/admin-armv7.elf
-var adminARMv7 []byte
-
-//go:embed native/apppriv-armv7.elf
-var appPrivARMv7 []byte
-
-// Bridges per runtime.GOARCH; an architecture without one is refused.
-var (
-	adminBridges   = map[string][]byte{"amd64": adminAMD64, "arm64": adminARM64, "arm": adminARMv7}
-	appPrivBridges = map[string][]byte{"amd64": appPrivAMD64, "arm64": appPrivARM64, "arm": appPrivARMv7}
-)
-
-func nativeAdministrator(ctx context.Context, principal string) (bool, error) {
-	out, err := runBridge(ctx, adminBridges, principal)
-	return parseNativeRole(out, err)
-}
-
-func nativeAppPrivilege(ctx context.Context, principal, app, addr string) (bool, error) {
-	out, err := runBridge(ctx, appPrivBridges, principal, app, addr)
-	return parseNativeBit(out, err, errNativeAppPriv)
-}
-
-// runBridge executes the sealed bridge for this architecture with fixed
-// arguments and a minimal environment, returning at most 16 bytes of output.
-func runBridge(ctx context.Context, bridges map[string][]byte, args ...string) ([]byte, error) {
-	payload, ok := bridges[runtime.GOARCH]
-	if !ok {
-		return nil, errors.New("unsupported architecture")
-	}
-	file, err := sealedBridge(payload)
-	if err != nil {
-		return nil, err
-	}
-	defer file.Close()
-	cmd := exec.CommandContext(ctx, "/proc/self/fd/3", args...)
-	cmd.ExtraFiles = []*os.File{file}
-	// In particular, never inherit LD_PRELOAD/LD_LIBRARY_PATH or credentials.
-	cmd.Env = []string{"LANG=C", "LC_ALL=C"}
-	return commandOutput(cmd, 16)
-}
-
-// memfdCreate is the sealing primitive; tests replace it to model old kernels.
-var memfdCreate = unix.MemfdCreate
-
-func sealedBridge(payload []byte) (*os.File, error) {
-	fd, err := memfdCreate("synopkgland-admin", unix.MFD_CLOEXEC|unix.MFD_ALLOW_SEALING)
-	if errors.Is(err, unix.ENOSYS) {
-		return unlinkedBridge(bridgeFallbackDir, payload)
-	}
-	if err != nil {
-		return nil, err
-	}
-	file := os.NewFile(uintptr(fd), "synopkgland-admin")
-	fail := func(err error) (*os.File, error) { file.Close(); return nil, err }
-	if _, err = file.Write(payload); err != nil {
-		return fail(err)
-	}
-	if err = unix.Fchmod(fd, 0500); err != nil {
-		return fail(err)
-	}
-	if _, err = unix.FcntlInt(file.Fd(), unix.F_ADD_SEALS, unix.F_SEAL_WRITE|unix.F_SEAL_GROW|unix.F_SEAL_SHRINK|unix.F_SEAL_SEAL); err != nil {
-		return fail(err)
-	}
-	if _, err = file.Seek(0, 0); err != nil {
-		return fail(err)
-	}
-	return file, nil
-}
-
-func configureCommand(cmd *exec.Cmd) {
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-	cmd.Cancel = func() error {
-		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
-		if errors.Is(err, syscall.ESRCH) {
-			return os.ErrProcessDone
-		}
-		return err
-	}
-}

package/templates/native-go/backend/internal/dsm/admin_linux_test.go

@@ -1,105 +0,0 @@
-//go:build linux
-
-package dsm
-
-import (
-	"bytes"
-	"context"
-	"debug/elf"
-	"errors"
-	"golang.org/x/sys/unix"
-	"io"
-	"os"
-	"strings"
-	"testing"
-)
-
-func TestNativeBridgeIsSealedBeforeExecution(t *testing.T) {
-	if fd, err := unix.MemfdCreate("probe", unix.MFD_CLOEXEC); errors.Is(err, unix.ENOSYS) {
-		t.Skip("kernel has no memfd_create; covered by the fallback tests")
-	} else if err == nil {
-		unix.Close(fd)
-	}
-	file, err := sealedBridge([]byte("immutable"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	if _, err = file.WriteAt([]byte("attack"), 0); err == nil {
-		t.Fatal("sealed executable remains writable")
-	}
-	if err = file.Truncate(0); err == nil {
-		t.Fatal("sealed executable can shrink")
-	}
-	seals, err := unix.FcntlInt(file.Fd(), unix.F_GET_SEALS, 0)
-	if err != nil || seals != unix.F_SEAL_WRITE|unix.F_SEAL_GROW|unix.F_SEAL_SHRINK|unix.F_SEAL_SEAL {
-		t.Fatal(seals, err)
-	}
-}
-
-func TestEveryShippedArchHasBothBridges(t *testing.T) {
-	for arch, machine := range map[string]elf.Machine{"amd64": elf.EM_X86_64, "arm64": elf.EM_AARCH64, "arm": elf.EM_ARM} {
-		for name, bridges := range map[string]map[string][]byte{"admin": adminBridges, "apppriv": appPrivBridges} {
-			file, err := elf.NewFile(bytes.NewReader(bridges[arch]))
-			if err != nil || file.Machine != machine {
-				t.Fatalf("%s bridge for %s: %v %v", name, arch, file, err)
-			}
-		}
-	}
-}
-
-func withMemfd(t *testing.T, create func(string, int) (int, error), fallback string) {
-	t.Helper()
-	saved, savedDir := memfdCreate, bridgeFallbackDir
-	t.Cleanup(func() { memfdCreate, bridgeFallbackDir = saved, savedDir })
-	memfdCreate = create
-	SetBridgeFallbackDir(fallback)
-}
-
-func TestBridgeFallsBackToPackageTempOnlyWithoutMemfd(t *testing.T) {
-	dir := t.TempDir()
-	withMemfd(t, func(string, int) (int, error) { return -1, unix.ENOSYS }, dir)
-	file, err := sealedBridge([]byte("bridge"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	got, err := io.ReadAll(file)
-	if err != nil || string(got) != "bridge" {
-		t.Fatalf("payload %q %v", got, err)
-	}
-	if entries, _ := os.ReadDir(dir); len(entries) != 0 {
-		t.Fatalf("fallback left %v", entries)
-	}
-}
-
-func TestBridgeRefusesOtherMemfdFailuresAndUnsetFallback(t *testing.T) {
-	withMemfd(t, func(string, int) (int, error) { return -1, unix.EPERM }, t.TempDir())
-	if _, err := sealedBridge([]byte("bridge")); !errors.Is(err, unix.EPERM) {
-		t.Fatalf("EPERM must not fall back: %v", err)
-	}
-	withMemfd(t, func(string, int) (int, error) { return -1, unix.ENOSYS }, "")
-	if _, err := sealedBridge([]byte("bridge")); err == nil {
-		t.Fatal("ENOSYS without a package temp directory must refuse")
-	}
-}
-
-// Read-only device fixture. The runner provides existing principals and executes
-// this test binary from a memfd. No files, users, groups or NAS settings change.
-func TestNativeAdministratorDeviceFixture(t *testing.T) {
-	fixture := os.Getenv("DSM_ADMIN_DEVICE_FIXTURE")
-	if fixture == "" {
-		t.Skip("device runner supplies existing principals")
-	}
-	for _, row := range strings.Split(fixture, ";") {
-		fields := strings.SplitN(row, "=", 2)
-		if len(fields) != 2 {
-			t.Fatal("bad fixture")
-		}
-		want := fields[0] == "1"
-		got, err := IsAdministrator(context.Background(), fields[1])
-		if err != nil || got != want {
-			t.Fatalf("native role %q: %v %v want=%v", fields[1], got, err, want)
-		}
-	}
-}

package/templates/native-go/backend/internal/dsm/admin_other.go

@@ -1,15 +0,0 @@
-//go:build !linux
-
-package dsm
-
-import (
-	"context"
-	"os/exec"
-)
-
-// Host tests inject a role provider; DSM native roles require Linux.
-func nativeAdministrator(context.Context, string) (bool, error) { return false, errNativeRole }
-func nativeAppPrivilege(context.Context, string, string, string) (bool, error) {
-	return false, errNativeAppPriv
-}
-func configureCommand(*exec.Cmd) {}

package/templates/native-go/backend/internal/dsm/admin_test.go

@@ -1,67 +0,0 @@
-package dsm
-
-import (
-	"context"
-	"errors"
-	"io"
-	"strings"
-	"testing"
-)
-
-func TestNativeRoleProtocolNeverGuessesPrivileges(t *testing.T) {
-	for _, tc := range []struct {
-		out          string
-		err          error
-		admin, valid bool
-	}{
-		{"1\n", nil, true, true}, {"0\n", nil, false, true},
-		{"1\n", errors.New("failed"), false, false}, {"true\n", nil, false, false},
-		{"2\n", nil, false, false}, {"-1\n", nil, false, false}, {"1\n0\n", nil, false, false},
-		{"1", nil, false, false}, {" 1\n", nil, false, false}, {"", nil, false, false},
-	} {
-		admin, err := parseNativeRole([]byte(tc.out), tc.err)
-		if admin != tc.admin || (err == nil) != tc.valid {
-			t.Fatalf("%q: admin=%v err=%v", tc.out, admin, err)
-		}
-	}
-}
-
-func TestDirectoryPrincipalsArePreservedForNativeSDK(t *testing.T) {
-	for _, name := range []string{`CORP\alice`, "alice@example.com", "CORP\\\u7ba1\u7406\u54e1", "user with space@example.com", strings.Repeat("a", 256)} {
-		a := newTestAuth(t, &fakeRunner{out: name + "\n"})
-		a.isAdministrator = func(_ context.Context, actual string) (bool, error) {
-			if actual != name {
-				t.Fatalf("principal rewritten %q => %q", name, actual)
-			}
-			return true, nil
-		}
-		id, err := a.Authenticate(sessionRequest())
-		if err != nil || !id.Admin || id.User != name {
-			t.Fatalf("%q: %+v %v", name, id, err)
-		}
-	}
-	for _, name := range []string{"", "alice\nadmin", "alice\x00admin", " alice", "alice ", string([]byte{0xff}), strings.Repeat("a", 1025)} {
-		if validPrincipal(name) {
-			t.Fatalf("accepted invalid principal %q", name)
-		}
-	}
-}
-
-func TestNativeOutputBufferIsBounded(t *testing.T) {
-	out := &boundedOutput{limit: 16}
-	if n, err := out.Write([]byte(strings.Repeat("x", 16))); n != 16 || err != nil {
-		t.Fatal(n, err)
-	}
-	if _, err := out.Write([]byte("1")); err == nil || out.Len() != 16 {
-		t.Fatal(err, out.Len())
-	}
-}
-
-func TestNativeOutputCopyCannotBypassLimit(t *testing.T) {
-	out := &boundedOutput{limit: 16}
-	source := struct{ io.Reader }{strings.NewReader(strings.Repeat("x", 4096))}
-	_, err := io.Copy(out, source)
-	if err == nil || out.Len() > 16 {
-		t.Fatalf("copy bypassed output limit: len=%d err=%v", out.Len(), err)
-	}
-}

package/templates/native-go/backend/internal/dsm/apppriv.go

@@ -1,30 +0,0 @@
-package dsm
-
-import (
-	"context"
-	"errors"
-	"net/netip"
-	"regexp"
-	"time"
-)
-
-var errNativeAppPriv = errors.New("DSM Application Privileges verification unavailable")
-
-// appID is a DSM application ID such as SYNO.SDS.<package>.Instance.
-var appID = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*){1,7}$`)
-
-// AppPrivilege asks DSM's native SDK whether principal may use app from addr.
-// DSM applies its own user, group and everyone rules, deny precedence and IP
-// ranges, and always allows administrators. Unknown results refuse.
-func AppPrivilege(ctx context.Context, principal, app, addr string) (bool, error) {
-	if !validPrincipal(principal) || len(app) > 128 || !appID.MatchString(app) {
-		return false, errNativeAppPriv
-	}
-	ip, err := netip.ParseAddr(addr)
-	if err != nil || ip.Zone() != "" || ip.String() != addr {
-		return false, errNativeAppPriv
-	}
-	ctx, cancel := context.WithTimeout(ctx, 3*time.Second)
-	defer cancel()
-	return nativeAppPrivilege(ctx, principal, app, addr)
-}

package/templates/native-go/backend/internal/dsm/auth.go

@@ -1,94 +0,0 @@
-// Package dsm verifies the DSM login behind a package CGI request.
-//
-// DSM runs a package's CGI as the package account and forwards the browser's
-// cookies. This package hands only the session carriers (cookie, SynoToken,
-// client address) to DSM's own authenticate.cgi, which prints the signed-in
-// user name. DSM's native SDK then resolves administrator membership for
-// local, AD and LDAP accounts; no group-name comparison lives in this package.
-package dsm
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-	"unicode"
-	"unicode/utf8"
-
-	"dsmapp/internal/api"
-)
-
-// AuthenticateCGI is DSM's session check for third-party CGIs.
-const AuthenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
-
-// Authenticator implements api.Authenticator against DSM.
-type Authenticator struct {
-	Timeout         time.Duration
-	run             func(ctx context.Context, path string, env []string) ([]byte, error)
-	isAdministrator func(context.Context, string) (bool, error)
-}
-
-func NewAuthenticator() *Authenticator {
-	return &Authenticator{Timeout: 10 * time.Second, run: runCGI, isAdministrator: IsAdministrator}
-}
-
-// The name comes only from authenticate.cgi. Preserve directory-qualified and
-// Unicode principals verbatim; controls, multiline and unbounded names refuse.
-func validPrincipal(name string) bool {
-	if name == "" || len(name) > 1024 || !utf8.ValidString(name) || strings.TrimSpace(name) != name || strings.ContainsAny(name, "<>/") {
-		return false
-	}
-	for _, ch := range name {
-		if unicode.IsControl(ch) {
-			return false
-		}
-	}
-	return true
-}
-
-func (a *Authenticator) Authenticate(r *http.Request) (api.Identity, error) {
-	cookie := r.Header.Get("Cookie")
-	if cookie == "" {
-		return api.Identity{}, api.ErrNoSession
-	}
-	ctx, cancel := context.WithTimeout(r.Context(), a.Timeout)
-	defer cancel()
-	out, err := a.run(ctx, AuthenticateCGI, sessionEnv(r, cookie))
-	var exit interface{ ExitCode() int }
-	if errors.As(err, &exit) {
-		return api.Identity{}, api.ErrNoSession
-	}
-	if err != nil {
-		return api.Identity{}, fmt.Errorf("run %s: %w", AuthenticateCGI, err)
-	}
-	user := strings.TrimSuffix(strings.TrimSuffix(string(out), "\n"), "\r")
-	if !validPrincipal(user) {
-		return api.Identity{}, api.ErrNoSession
-	}
-	admin, err := a.isAdministrator(ctx, user)
-	if err != nil {
-		return api.Identity{}, err
-	}
-	return api.Identity{User: user, Admin: admin}, nil
-}
-
-// sessionEnv is the complete environment authenticate.cgi sees: nothing from
-// this process and no request header besides the session carriers.
-func sessionEnv(r *http.Request, cookie string) []string {
-	token := r.Header.Get("X-SYNO-TOKEN")
-	host, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host = r.RemoteAddr
-	}
-	return []string{
-		"REQUEST_METHOD=GET",
-		"HTTP_COOKIE=" + cookie,
-		"HTTP_X_SYNO_TOKEN=" + token,
-		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
-		"REMOTE_ADDR=" + host,
-	}
-}