@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go/backend/internal/identity/identity_test.go

@@ -1,530 +0,0 @@
-package identity
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"dsmapp/internal/api"
-)
-
-type fixture struct {
-	t       *testing.T
-	service *Service
-	server  *httptest.Server
-	now     time.Time
-	valid   bool
-	code    int
-	otp     bool
-	logout  int
-	calls   []string
-	dir     string
-	// synoToken makes the fake DSM session a SynoToken session: NormalUser.get
-	// then needs the cookie and this X-SYNO-TOKEN header, as DSM web logins do.
-	synoToken string
-	// token is the X-SYNO-TOKEN the browser sends with each App request.
-	token string
-}
-
-func setup(t *testing.T) *fixture {
-	f := &fixture{t: t, now: time.Date(2026, 10, 8, 0, 0, 0, 0, time.UTC), valid: true, dir: t.TempDir()}
-	f.server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if err := r.ParseForm(); err != nil {
-			t.Fatal(err)
-		}
-		name := r.Form.Get("api") + "." + r.Form.Get("method")
-		f.calls = append(f.calls, name)
-		switch name {
-		case "SYNO.Core.NormalUser.get":
-			c, err := r.Cookie("id")
-			if r.Form.Has("SynoToken") {
-				t.Error("SynoToken must travel only in the header")
-			}
-			if f.valid && err == nil && c.Value == "valid-dsm-cookie" && (f.synoToken == "" || r.Header.Get("X-SYNO-TOKEN") == f.synoToken) {
-				fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
-			} else {
-				fmt.Fprint(w, `{"success":false,"error":{"code":119}}`)
-			}
-		case "SYNO.Core.Desktop.Initdata.get":
-			fmt.Fprint(w, `{"success":true,"data":{"isLogined":false,"user":"alice"}}`)
-		case "SYNO.API.Auth.login":
-			if r.Form.Get("session") != "" || r.Form.Get("version") != "7" {
-				t.Errorf("wrong auth parameters: %v", r.Form)
-			}
-			if f.code != 0 {
-				fmt.Fprintf(w, `{"success":false,"error":{"code":%d}}`, f.code)
-			} else if f.otp && r.Form.Get("otp_code") != "123456" {
-				fmt.Fprint(w, `{"success":false,"error":{"code":403,"types":[{"type":"otp"}]}}`)
-			} else {
-				fmt.Fprint(w, `{"success":true,"data":{"sid":"secret-dsm-sid"}}`)
-			}
-		case "SYNO.API.Auth.logout":
-			f.logout++
-			if r.Form.Get("_sid") != "secret-dsm-sid" {
-				t.Error("missing logout SID")
-			}
-			fmt.Fprint(w, `{"success":true}`)
-		default:
-			t.Errorf("unexpected DSM call %s", name)
-		}
-	}))
-	t.Cleanup(f.server.Close)
-	var err error
-	f.service, err = New(Config{DataDir: f.dir, CookiePath: "/webman/3rdparty/test/", Endpoint: f.server.URL, Now: func() time.Time { return f.now }, Lookup: func(name string) (Subject, error) {
-		if name != "alice" {
-			return Subject{}, fmt.Errorf("missing")
-		}
-		return Subject{User: name, UID: "1205"}, nil
-	}, Administrator: func(context.Context, string) (bool, error) { return false, nil }})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return f
-}
-func (f *fixture) call(method, params string, appCookie *http.Cookie, dsmCookie bool) (*httptest.ResponseRecorder, map[string]any) {
-	f.t.Helper()
-	req := httptest.NewRequest("POST", "https://nas:5001/webman/3rdparty/test/cgi/api.cgi", strings.NewReader(`{"method":"`+method+`","params":`+params+`}`))
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Origin", "https://nas:5001")
-	req.RemoteAddr = "192.0.2.1:9000"
-	if appCookie != nil {
-		req.AddCookie(appCookie)
-	}
-	if dsmCookie {
-		req.AddCookie(&http.Cookie{Name: "id", Value: "valid-dsm-cookie"})
-	}
-	if f.token != "" {
-		req.Header.Set("X-SYNO-TOKEN", f.token)
-	}
-	out := httptest.NewRecorder()
-	f.service.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		id, err := f.service.Authenticate(r)
-		if err != nil {
-			reply(w, nil, "session_required")
-			return
-		}
-		reply(w, map[string]any{"user": id.User}, "")
-	})).ServeHTTP(out, req)
-	var body map[string]any
-	if err := json.Unmarshal(out.Body.Bytes(), &body); err != nil {
-		f.t.Fatalf("bad response: %s", out.Body.String())
-	}
-	return out, body
-}
-func errorCode(out map[string]any) string {
-	if e, ok := out["error"].(map[string]any); ok {
-		return e["code"].(string)
-	}
-	return ""
-}
-func sessionCookie(t *testing.T, rec *httptest.ResponseRecorder) *http.Cookie {
-	t.Helper()
-	for _, c := range rec.Result().Cookies() {
-		if c.MaxAge > 0 {
-			return c
-		}
-	}
-	t.Fatalf("no session cookie: %s", rec.Body.String())
-	return nil
-}
-func TestCookieExchangeAndNoInitdataShortcut(t *testing.T) {
-	f := setup(t)
-	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, false); errorCode(out) != "session_required" {
-		t.Fatalf("anonymous: %v", out)
-	}
-	f.valid = false
-	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "session_required" {
-		t.Fatalf("invalid: %v", out)
-	}
-	f.valid = true
-	rec, out := f.call("identity.session", `{"bootstrap":true}`, nil, true)
-	if errorCode(out) != "" || out["data"].(map[string]any)["user"] != "alice" {
-		t.Fatal(out)
-	}
-	c := sessionCookie(t, rec)
-	if !c.Secure || !c.HttpOnly || c.SameSite != http.SameSiteLaxMode || c.Path != "/webman/3rdparty/test/" || len(c.Value) < 32 {
-		t.Fatalf("cookie: %+v", c)
-	}
-	for _, call := range f.calls {
-		if strings.Contains(call, "Initdata") {
-			t.Fatal("Initdata must never authenticate")
-		}
-	}
-}
-func TestSynoTokenSessionBootstrapsAndRevalidates(t *testing.T) {
-	f := setup(t)
-	f.synoToken = "secret-syno-token"
-	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "session_required" {
-		t.Fatalf("cookie alone must not pass a SynoToken session: %v", out)
-	}
-	f.token = "secret-syno-token"
-	rec, out := f.call("identity.session", `{"bootstrap":true}`, nil, true)
-	if errorCode(out) != "" {
-		t.Fatalf("bootstrap with SynoToken: %v", out)
-	}
-	c := sessionCookie(t, rec)
-	if _, out = f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "" {
-		t.Fatalf("live revalidation with SynoToken: %v", out)
-	}
-	filepath.WalkDir(f.dir, func(path string, d os.DirEntry, err error) error {
-		if err != nil {
-			t.Fatal(err)
-		}
-		if raw, _ := os.ReadFile(path); !d.IsDir() && strings.Contains(string(raw), "secret-syno-token") {
-			t.Fatalf("SynoToken written to %s", path)
-		}
-		return nil
-	})
-	f.token = ""
-	if _, out = f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "session_required" {
-		t.Fatalf("revalidation without SynoToken: %v", out)
-	}
-}
-func TestTokenlessSessionStillVerifiesWhenBrowserSendsToken(t *testing.T) {
-	f := setup(t)
-	f.token = "unused-token"
-	if _, out := f.call("identity.session", `{"bootstrap":true}`, nil, true); errorCode(out) != "" {
-		t.Fatal(out)
-	}
-}
-func TestLoginOTPLogoutAndNoCredentialsOnDisk(t *testing.T) {
-	f := setup(t)
-	f.otp = true
-	if _, out := f.call("identity.login", `{"account":"alice","password":"secret-password"}`, nil, false); errorCode(out) != "otp_required" {
-		t.Fatal(out)
-	}
-	rec, out := f.call("identity.login", `{"account":"alice","password":"secret-password","otp":"123456"}`, nil, false)
-	if errorCode(out) != "" || f.logout != 1 {
-		t.Fatalf("%v logout=%d", out, f.logout)
-	}
-	c := sessionCookie(t, rec)
-	if _, out = f.call("identity.session", `{}`, c, false); errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	filepath.WalkDir(f.dir, func(path string, d os.DirEntry, err error) error {
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !d.IsDir() {
-			raw, _ := os.ReadFile(path)
-			for _, secret := range []string{"secret-password", "secret-dsm-sid", "valid-dsm-cookie", c.Value} {
-				if strings.Contains(string(raw), secret) {
-					t.Fatalf("secret written to %s", path)
-				}
-			}
-		}
-		return nil
-	})
-	if _, out = f.call("identity.logout", `{}`, c, false); errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	if _, out = f.call("identity.session", `{}`, c, false); errorCode(out) != "session_required" {
-		t.Fatal(out)
-	}
-}
-func TestStableLoginErrors(t *testing.T) {
-	for _, tc := range []struct {
-		code int
-		want string
-	}{{400, "invalid_credentials"}, {401, "account_disabled"}, {402, "login_not_permitted"}, {403, "login_not_permitted"}} {
-		t.Run(fmt.Sprint(tc.code), func(t *testing.T) {
-			f := setup(t)
-			f.code = tc.code
-			_, out := f.call("identity.login", `{"account":"alice","password":"wrong"}`, nil, false)
-			if errorCode(out) != tc.want {
-				t.Fatal(out)
-			}
-			if out["error"].(map[string]any)["message"] != "Sign-in could not be completed." {
-				t.Fatal("account detail leaked")
-			}
-		})
-	}
-}
-func TestExpiryDisableAndSensitiveRevalidation(t *testing.T) {
-	f := setup(t)
-	rec, _ := f.call("identity.session", `{"bootstrap":true}`, nil, true)
-	c := sessionCookie(t, rec)
-	f.valid = false
-	if _, out := f.call("greeting.set", `{"text":"x"}`, c, true); errorCode(out) != "session_required" {
-		t.Fatalf("disabled account accepted: %v", out)
-	}
-	if _, out := f.call("identity.session", `{}`, c, false); errorCode(out) != "session_required" {
-		t.Fatal("revoked session survived")
-	}
-	rec, _ = f.call("identity.login", `{"account":"alice","password":"p"}`, nil, false)
-	c = sessionCookie(t, rec)
-	f.now = f.now.Add(15 * time.Minute)
-	if _, out := f.call("identity.session", `{}`, c, false); errorCode(out) != "session_required" {
-		t.Fatalf("expired: %v", out)
-	}
-}
-func TestSlidingRequiresLiveAccountAndPersistsAcrossCGI(t *testing.T) {
-	f := setup(t)
-	rec, _ := f.call("identity.session", `{"bootstrap":true}`, nil, true)
-	c := sessionCookie(t, rec)
-	f.now = f.now.Add(14 * time.Minute)
-	rec, out := f.call("identity.session", `{}`, c, true)
-	if errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	c = sessionCookie(t, rec)
-	// Each CGI creates a new service; the same disk record must remain usable.
-	cfg := f.service.cfg
-	var err error
-	f.service, err = New(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	f.now = f.now.Add(2 * time.Minute)
-	if _, out = f.call("identity.session", `{}`, c, false); errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	f.now = f.now.Add(13 * time.Minute)
-	if _, out = f.call("identity.session", `{}`, c, false); errorCode(out) != "session_required" {
-		t.Fatal("password-only reads slid expiry")
-	}
-}
-func TestRateLimitsPersistByIPAndAccount(t *testing.T) {
-	f := setup(t)
-	f.code = 400
-	for i := 0; i < 5; i++ {
-		_, out := f.call("identity.login", `{"account":"alice","password":"wrong"}`, nil, false)
-		if errorCode(out) != "invalid_credentials" {
-			t.Fatal(out)
-		}
-	}
-	cfg := f.service.cfg
-	f.service, _ = New(cfg)
-	_, out := f.call("identity.login", `{"account":"alice","password":"wrong"}`, nil, false)
-	if errorCode(out) != "rate_limited" {
-		t.Fatal(out)
-	}
-	f.now = f.now.Add(time.Minute)
-	_, out = f.call("identity.login", `{"account":"alice","password":"wrong"}`, nil, false)
-	if errorCode(out) != "invalid_credentials" {
-		t.Fatal(out)
-	}
-}
-func TestTransportGuards(t *testing.T) {
-	f := setup(t)
-	for _, tc := range []struct {
-		name, url, origin, site, forwarded string
-		want                               string
-	}{{"HTTP", "http://nas:5001/", "http://nas:5001", "", "https", "https_required"}, {"missing origin", "https://nas:5001/", "", "", "", "csrf_rejected"}, {"cross origin", "https://nas:5001/", "https://evil.test", "", "", "csrf_rejected"}, {"wrong scheme", "https://nas:5001/", "http://nas:5001", "", "", "csrf_rejected"}, {"cross site", "https://nas:5001/", "https://nas:5001", "cross-site", "", "csrf_rejected"}} {
-		t.Run(tc.name, func(t *testing.T) {
-			r := httptest.NewRequest("POST", tc.url, strings.NewReader(`{"method":"identity.login","params":{"account":"alice","password":"secret"}}`))
-			r.Header.Set("Content-Type", "application/json")
-			r.Header.Set("Origin", tc.origin)
-			r.Header.Set("Sec-Fetch-Site", tc.site)
-			r.Header.Set("X-Forwarded-Proto", tc.forwarded)
-			w := httptest.NewRecorder()
-			f.service.Wrap(http.NotFoundHandler()).ServeHTTP(w, r)
-			var out map[string]any
-			json.Unmarshal(w.Body.Bytes(), &out)
-			if errorCode(out) != tc.want {
-				t.Fatal(out)
-			}
-		})
-	}
-	if len(f.calls) != 0 {
-		t.Fatal("transport refusal reached DSM")
-	}
-}
-func TestUIDChangeAndMissingCookieFailClosed(t *testing.T) {
-	f := setup(t)
-	rec, _ := f.call("identity.login", `{"account":"alice","password":"p"}`, nil, false)
-	c := sessionCookie(t, rec)
-	if _, out := f.call("greeting.set", `{}`, c, false); errorCode(out) != "session_revalidation_required" {
-		t.Fatal(out)
-	}
-	f.service.cfg.Lookup = func(name string) (Subject, error) { return Subject{User: name, UID: "9999"}, nil }
-	if _, out := f.call("identity.session", `{}`, c, false); errorCode(out) != "session_required" {
-		t.Fatal("UID replacement inherited session")
-	}
-}
-func TestStatusAndPermissionsRemainSeparate(t *testing.T) {
-	f := setup(t)
-	_, out := f.call("identity.status", `{}`, nil, false)
-	if out["data"].(map[string]any)["enabled"] != true {
-		t.Fatal(out)
-	}
-	srv, err := api.NewServerWithPermissions(f.service, []byte(`{"schema":1,"default":"administrators","methods":{"greeting.get":"authenticated"}}`), api.Handle("greeting.get", func(context.Context, api.Caller, json.RawMessage) (any, error) { return "ok", nil }))
-	if err != nil {
-		t.Fatal(err)
-	}
-	_ = srv
-}
-
-func TestRateLimitsAccountAcrossIPsAndIPAcrossAccounts(t *testing.T) {
-	for _, mode := range []string{"account", "ip"} {
-		t.Run(mode, func(t *testing.T) {
-			f := setup(t)
-			f.code = 400
-			limit := 5
-			if mode == "ip" {
-				limit = 20
-			}
-			for i := 0; i <= limit; i++ {
-				account := "alice"
-				ip := fmt.Sprintf("192.0.2.%d:9000", i+1)
-				if mode == "ip" {
-					account = fmt.Sprintf("user%d", i)
-					ip = "192.0.2.1:9000"
-				}
-				req := httptest.NewRequest("POST", "https://nas:5001/cgi/api.cgi", strings.NewReader(fmt.Sprintf(`{"method":"identity.login","params":{"account":%q,"password":"wrong"}}`, account)))
-				req.Header.Set("Content-Type", "application/json")
-				req.Header.Set("Origin", "https://nas:5001")
-				req.RemoteAddr = ip
-				w := httptest.NewRecorder()
-				f.service.Wrap(http.NotFoundHandler()).ServeHTTP(w, req)
-				var out map[string]any
-				json.Unmarshal(w.Body.Bytes(), &out)
-				want := "invalid_credentials"
-				if i == limit {
-					want = "rate_limited"
-				}
-				if errorCode(out) != want {
-					t.Fatalf("attempt %d: %v", i, out)
-				}
-			}
-		})
-	}
-}
-func TestBusinessPolicyAndPasswordOnlyReads(t *testing.T) {
-	f := setup(t)
-	rec, _ := f.call("identity.login", `{"account":"alice","password":"p"}`, nil, false)
-	c := sessionCookie(t, rec)
-	for _, m := range []string{"app.status", "greeting.get"} {
-		if _, out := f.call(m, `{}`, c, false); errorCode(out) != "" {
-			t.Fatal(out)
-		}
-	}
-	handler := func(context.Context, api.Caller, json.RawMessage) (any, error) { return "ok", nil }
-	srv, err := api.NewServerWithPermissions(f.service, []byte(`{"schema":1,"default":"administrators","methods":{"greeting.get":"authenticated"}}`), api.Handle("greeting.get", handler), api.Handle("greeting.set", handler))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct{ method, want string }{{"greeting.get", ""}, {"greeting.set", "admin_required"}} {
-		r := httptest.NewRequest("POST", "https://nas:5001/cgi/api.cgi", strings.NewReader(`{"method":"`+tc.method+`","params":{}}`))
-		r.Header.Set("Content-Type", "application/json")
-		r.Header.Set("Origin", "https://nas:5001")
-		r.AddCookie(c)
-		r.AddCookie(&http.Cookie{Name: "id", Value: "valid-dsm-cookie"})
-		w := httptest.NewRecorder()
-		f.service.Wrap(srv).ServeHTTP(w, r)
-		var out map[string]any
-		json.Unmarshal(w.Body.Bytes(), &out)
-		if errorCode(out) != tc.want {
-			t.Fatal(out)
-		}
-	}
-}
-func TestIdentityRejectsMalformedRequestsAndRotates(t *testing.T) {
-	f := setup(t)
-	rec, _ := f.call("identity.login", `{"account":"alice","password":"p"}`, nil, false)
-	old := sessionCookie(t, rec)
-	rec, _ = f.call("identity.login", `{"account":"alice","password":"p"}`, old, false)
-	fresh := sessionCookie(t, rec)
-	if fresh.Value == old.Value {
-		t.Fatal("session was not rotated")
-	}
-	if _, out := f.call("identity.session", `{}`, old, false); errorCode(out) != "session_required" {
-		t.Fatal(out)
-	}
-	if _, out := f.call("identity.session", `{"username":"mallory"}`, fresh, false); errorCode(out) != "bad_request" {
-		t.Fatal(out)
-	}
-	if _, out := f.call("identity.logout", `{}`, fresh, false); errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	rec, out := f.call("identity.session", `{"bootstrap":true}`, fresh, true)
-	if errorCode(out) != "session_required" {
-		t.Fatalf("revoked session silently reissued: %v", out)
-	}
-	if len(rec.Result().Cookies()) != 1 || rec.Result().Cookies()[0].MaxAge != -1 {
-		t.Fatal("missing cookie deletion")
-	}
-}
-
-func TestAppOnlyFilesRefuseWithDSMCodeAndStreamsReachCentralServer(t *testing.T) {
-	f := setup(t)
-	login, out := f.call("identity.login", `{"account":"alice","password":"p"}`, nil, false)
-	if errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	cookie := sessionCookie(t, login)
-	for _, method := range []string{"nas.files.list", "nas.session.status"} {
-		_, out = f.call(method, `{}`, cookie, false)
-		if errorCode(out) != "dsm_session_required" {
-			t.Fatalf("%s: %v", method, out)
-		}
-	}
-	called := false
-	srv, err := api.NewServerWithPermissions(f.service, []byte(`{"schema":1,"default":"administrators","methods":{}}`), api.HandleStream("nas.files.download", func(_ context.Context, c api.Caller, w http.ResponseWriter, r *http.Request) error {
-		called = true
-		_, e := w.Write([]byte(c.User()))
-		return e
-	}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := httptest.NewRequest("GET", "https://nas:5001/webman/3rdparty/test/cgi/api.cgi?method=nas.files.download&path=/home/a", nil)
-	r.Header.Set("Origin", "https://nas:5001")
-	r.AddCookie(cookie)
-	r.AddCookie(&http.Cookie{Name: "id", Value: "valid-dsm-cookie"})
-	w := httptest.NewRecorder()
-	f.service.Wrap(srv).ServeHTTP(w, r)
-	if !called || w.Body.String() != "alice" {
-		t.Fatal(w.Body.String())
-	}
-}
-
-func TestIdentityUploadDoesNotBufferJSONOrReplaceCallerSession(t *testing.T) {
-	f := setup(t)
-	login, out := f.call("identity.login", `{"account":"alice","password":"p"}`, nil, false)
-	if errorCode(out) != "" {
-		t.Fatal(out)
-	}
-	cookie := sessionCookie(t, login)
-	srv, err := api.NewServerWithPermissions(f.service, []byte(`{"schema":1,"default":"administrators","methods":{}}`), api.HandleStream("nas.files.upload", func(_ context.Context, c api.Caller, w http.ResponseWriter, r *http.Request) error {
-		if c.User() != "alice" {
-			t.Fatal("wrong caller")
-		}
-		dc, err := r.Cookie("id")
-		if err != nil || dc.Value != "valid-dsm-cookie" {
-			t.Fatal("DSM session replaced")
-		}
-		n, err := io.Copy(io.Discard, r.Body)
-		if n != 2<<20 {
-			t.Fatalf("upload body consumed before handler: %d", n)
-		}
-		_, err = w.Write([]byte("uploaded"))
-		return err
-	}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := httptest.NewRequest("POST", "https://nas:5001/cgi/api.cgi?method=nas.files.upload&parent=/home&name=a", io.LimitReader(zeroReader{}, 2<<20))
-	r.ContentLength = 2 << 20
-	r.Header.Set("Content-Type", "application/octet-stream")
-	r.Header.Set("Origin", "https://nas:5001")
-	r.AddCookie(cookie)
-	r.AddCookie(&http.Cookie{Name: "id", Value: "valid-dsm-cookie"})
-	w := httptest.NewRecorder()
-	f.service.Wrap(srv).ServeHTTP(w, r)
-	if w.Body.String() != "uploaded" {
-		t.Fatal(w.Body.String())
-	}
-}
-
-type zeroReader struct{}
-
-func (zeroReader) Read(p []byte) (int, error) { clear(p); return len(p), nil }

package/templates/native-go/backend/internal/identity/service.go

@@ -1,159 +0,0 @@
-// Package identity implements standalone identity only. It never supplies DSM
-// credentials or file authority to business handlers.
-package identity
-
-import (
-	"context"
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"net/http"
-	"os/user"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"dsmapp/internal/api"
-	"dsmapp/internal/dsm"
-)
-
-type Subject struct {
-	User string `json:"user"`
-	UID  string `json:"uid"`
-}
-type Config struct {
-	DataDir       string
-	CookiePath    string
-	Endpoint      string
-	Client        *http.Client
-	TTL           time.Duration
-	Now           func() time.Time
-	Lookup        func(string) (Subject, error)
-	Administrator func(context.Context, string) (bool, error)
-}
-type Service struct {
-	cfg        Config
-	dir        string
-	cookieName string
-}
-
-func New(cfg Config) (*Service, error) {
-	if cfg.DataDir == "" || !strings.HasPrefix(cfg.CookiePath, "/") || strings.ContainsAny(cfg.CookiePath, ";\r\n\\") {
-		return nil, errors.New("invalid identity configuration")
-	}
-	if cfg.Endpoint == "" {
-		cfg.Endpoint = "http://127.0.0.1:5000/webapi/entry.cgi"
-	}
-	if cfg.Client == nil {
-		cfg.Client = &http.Client{Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
-	}
-	if cfg.Now == nil {
-		cfg.Now = time.Now
-	}
-	if cfg.TTL == 0 {
-		cfg.TTL = 15 * time.Minute
-	}
-	if cfg.TTL < time.Second || cfg.TTL > 15*time.Minute {
-		return nil, errors.New("identity TTL must be at most 15 minutes")
-	}
-	if cfg.Lookup == nil {
-		cfg.Lookup = func(name string) (Subject, error) {
-			u, err := user.Lookup(name)
-			if err != nil {
-				return Subject{}, err
-			}
-			return Subject{User: u.Username, UID: u.Uid}, nil
-		}
-	}
-	if cfg.Administrator == nil {
-		cfg.Administrator = dsm.IsAdministrator
-	}
-	// Names differ across application paths; cookies still remain host-only.
-	return &Service{cfg: cfg, dir: filepath.Join(cfg.DataDir, "identity"), cookieName: "spl_session_" + digest(cfg.DataDir + "\x00" + cfg.CookiePath)[:16]}, nil
-}
-func digest(value string) string {
-	sum := sha256.Sum256([]byte(value))
-	return hex.EncodeToString(sum[:])
-}
-func randomID() (string, error) {
-	b := make([]byte, 32)
-	if _, err := rand.Read(b); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(b), nil
-}
-func (s *Service) cookie(w http.ResponseWriter, token string, expires time.Time) {
-	age := int(expires.Sub(s.cfg.Now()).Seconds())
-	if age < 1 {
-		age = 1
-	}
-	if token == "" {
-		age = -1
-		expires = time.Unix(1, 0)
-	}
-	http.SetCookie(w, &http.Cookie{Name: s.cookieName, Value: token, Path: s.cfg.CookiePath, HttpOnly: true, Secure: true, SameSite: http.SameSiteLaxMode, Expires: expires, MaxAge: age})
-}
-func validSubject(sub Subject) bool {
-	return sub.User != "" && sub.UID != "" && len(sub.User) <= 1024 && !strings.ContainsAny(sub.User, "\r\n\x00")
-}
-func (s *Service) resolve(name string) (Subject, error) {
-	sub, err := s.cfg.Lookup(name)
-	if err != nil || !validSubject(sub) || sub.User != name {
-		return Subject{}, api.ErrNoSession
-	}
-	return sub, nil
-}
-func (s *Service) Authenticate(r *http.Request) (api.Identity, error) {
-	var sub Subject
-	err := s.transaction(func(st *state) error {
-		_, rec, err := s.current(st, r, false)
-		if err != nil {
-			return err
-		}
-		sub = rec.Subject
-		return nil
-	})
-	if err != nil {
-		return api.Identity{}, api.ErrNoSession
-	}
-	admin, err := s.cfg.Administrator(r.Context(), sub.User)
-	if err != nil {
-		return api.Identity{}, errors.New("identity role lookup unavailable")
-	}
-	return api.Identity{User: sub.User, Admin: admin}, nil
-}
-func (s *Service) current(st *state, r *http.Request, revalidate bool) (string, record, error) {
-	c, err := r.Cookie(s.cookieName)
-	if err != nil || len(c.Value) != 64 {
-		return "", record{}, api.ErrNoSession
-	}
-	key := digest(c.Value)
-	rec, ok := st.Sessions[key]
-	if !ok || !s.cfg.Now().Before(rec.Expires) {
-		delete(st.Sessions, key)
-		return "", record{}, api.ErrNoSession
-	}
-	sub, err := s.resolve(rec.Subject.User)
-	if err != nil || sub != rec.Subject {
-		delete(st.Sessions, key)
-		return "", record{}, api.ErrNoSession
-	}
-	if revalidate {
-		dc, err := r.Cookie("id")
-		if err != nil || dc.Value == "" {
-			return "", record{}, errRevalidation
-		}
-		live, err := s.verify(r, dc.Value)
-		if err != nil || live != sub {
-			delete(st.Sessions, key)
-			return "", record{}, api.ErrNoSession
-		}
-		rec.Expires = s.cfg.Now().Add(s.cfg.TTL)
-		st.Sessions[key] = rec
-	}
-	return c.Value, rec, nil
-}
-
-var errRevalidation = fmt.Errorf("session_revalidation_required")