@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go-delegate/backend/internal/delegate/service_test.go

@@ -1,318 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"dsmapp/internal/background"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-type identity struct{ user string }
-
-func (i identity) Authenticate(*http.Request) (api.Identity, error) {
-	return api.Identity{User: i.user}, nil
-}
-func service(t *testing.T, c *Client) *Service {
-	dir := t.TempDir()
-	s := &Service{Client: c, Store: background.NewStore(filepath.Join(dir, "background")), Scope: "home", StagingDir: filepath.Join(dir, "executor-staging"), LookupUID: func(string) string { return "1205" }}
-	return s
-}
-func rpc(t *testing.T, s *Service, user, method, params string) map[string]any {
-	t.Helper()
-	routes := s.Routes()
-	server, e := api.NewServerWithPermissions(identity{user}, []byte(`{"schema":1,"default":"administrators","methods":{}}`), routes...)
-	if e != nil {
-		t.Fatal(e)
-	}
-	r := httptest.NewRequest("POST", "http://localhost/api", strings.NewReader(`{"method":"`+method+`","params":`+params+`}`))
-	r.Header.Set("Content-Type", "application/json")
-	r.AddCookie(&http.Cookie{Name: "id", Value: "cookie-only"})
-	r.Header.Set("X-SYNO-TOKEN", "request-token")
-	w := httptest.NewRecorder()
-	server.ServeHTTP(w, r)
-	var out map[string]any
-	if json.Unmarshal(w.Body.Bytes(), &out) != nil {
-		t.Fatal(w.Body.String())
-	}
-	return out
-}
-func TestCGIForwardsSessionPairNeverUsername(t *testing.T) {
-	c := executor(t, func(q Request) string {
-		wire, _ := json.Marshal(q)
-		if strings.Contains(string(wire), "username") || strings.Contains(string(wire), "alice") {
-			t.Errorf("username leaked: %s", wire)
-		}
-		if q.Auth["dsm_cookie"] != "cookie-only" || q.Auth["dsm_synotoken"] != "request-token" {
-			t.Errorf("auth %+v", q.Auth)
-		}
-		return `{"ok":true,"result":{"delegation_id":"d1","subject":{"username":"alice","uid":1205},"expires_at":"2030-01-01T00:00:00Z"}}` + "\n"
-	})
-	s := service(t, c)
-	for _, method := range []string{"delegate.create", "delegate.list", "delegate.revoke"} {
-		params := "{}"
-		if method == "delegate.create" {
-			params = `{"job_id":"j","ops":["files.write"],"path":"/home/Downloads","ttl_seconds":600}`
-		}
-		if method == "delegate.revoke" {
-			params = `{"delegation_id":"d1"}`
-		}
-		out := rpc(t, s, "alice", method, params)
-		if out["success"] != true {
-			t.Fatalf("%s: %+v", method, out)
-		}
-	}
-	out := rpc(t, s, "alice", "delegate.create", `{"job_id":"j","ops":["files.write"],"path":"/home","ttl_seconds":600,"username":"victim"}`)
-	if out["success"] != false {
-		t.Fatal("accepted username")
-	}
-}
-func TestDownloadJobsFinishCancelOwnerAndRecovery(t *testing.T) {
-	var mu sync.Mutex
-	revokes := 0
-	writes := 0
-	c := executor(t, func(q Request) string {
-		switch q.Op {
-		case "delegate.create":
-			return `{"ok":true,"result":{"delegation_id":"d1","subject":{"username":"alice","uid":1205},"expires_at":"2030-01-01T00:00:00Z"}}` + "\n"
-		case "delegate.revoke":
-			mu.Lock()
-			revokes++
-			mu.Unlock()
-			var p map[string]any
-			json.Unmarshal(q.Params, &p)
-			if q.Auth == nil && p["job_id"] == nil {
-				t.Error("missing job binding")
-			}
-		case "files.write":
-			mu.Lock()
-			writes++
-			mu.Unlock()
-		}
-		return `{"ok":true,"result":{}}` + "\n"
-	})
-	s := service(t, c)
-	web := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("download")) }))
-	defer web.Close()
-	submit := func(key string) string {
-		out := rpc(t, s, "alice", "delegate.jobs.submit", `{"key":"`+key+`","url":"`+web.URL+`/file","dest":"/home/Downloads","name":"file.txt"}`)
-		if out["success"] != true {
-			t.Fatal(out)
-		}
-		return out["data"].(map[string]any)["id"].(string)
-	}
-	id := submit("first")
-	if e := s.RunOnce(context.Background()); e != nil {
-		t.Fatal(e)
-	}
-	j, _ := s.Store.Get(context.Background(), id)
-	if j.DelegationID != "d1" {
-		t.Fatalf("delegation not stored on job: %+v", j)
-	}
-	if j.State != background.StateSucceeded {
-		t.Fatalf("job %+v", j)
-	}
-	id = submit("second")
-	out := rpc(t, s, "bob", "delegate.jobs.cancel", `{"id":"`+id+`"}`)
-	if out["success"] != false {
-		t.Fatal("other owner canceled")
-	}
-	out = rpc(t, s, "alice", "delegate.jobs.cancel", `{"id":"`+id+`"}`)
-	if out["success"] != true {
-		t.Fatal(out)
-	}
-	mu.Lock()
-	if revokes != 2 || writes != 1 {
-		t.Errorf("revokes %d writes %d", revokes, writes)
-	}
-	mu.Unlock()
-	id = submit("restart")
-	s.Store.Claim(context.Background())
-	if e := s.Recover(context.Background()); e != nil {
-		t.Fatal(e)
-	}
-	j, _ = s.Store.Get(context.Background(), id)
-	if j.State != background.StateInterrupted {
-		t.Fatal(j)
-	}
-	if pending, e := s.Store.DelegationCleanup(context.Background()); e != nil || len(pending) != 0 {
-		t.Fatalf("cleanup %v %v", pending, e)
-	}
-}
-func TestCapabilityUnavailableAndBlocked(t *testing.T) {
-	s := service(t, &Client{Socket: filepath.Join(t.TempDir(), "absent")})
-	out := rpc(t, s, "alice", "delegate.status", "{}")
-	if out["data"].(map[string]any)["state"] != "needs-admin-approval" {
-		t.Fatal(out)
-	}
-	s.Client = executor(t, func(Request) string { return `{"ok":false,"code":"POLICY_DENIED"}` + "\n" })
-	out = rpc(t, s, "alice", "delegate.status", "{}")
-	if out["data"].(map[string]any)["state"] != "blocked" {
-		t.Fatal(out)
-	}
-}
-func TestDownloadLimitTimeoutAndStagingCleanup(t *testing.T) {
-	c := executor(t, func(Request) string { return `{"ok":true,"result":{}}` + "\n" })
-	s := service(t, c)
-	web := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/slow" {
-			<-r.Context().Done()
-			return
-		}
-		w.Header().Set("Content-Length", "67108865")
-		w.WriteHeader(200)
-	}))
-	defer web.Close()
-	for _, p := range []string{"/big", "/slow"} {
-		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
-		e := s.download(ctx, DownloadInput{URL: web.URL + p, Dest: "/home", Name: "file"}, JobContext{Client: c, JobID: "j", DelegationID: "d", StagingDir: s.StagingDir})
-		cancel()
-		if e == nil {
-			t.Fatal("unbounded download")
-		}
-		files, _ := os.ReadDir(s.StagingDir)
-		if len(files) != 0 {
-			t.Fatal("staging leaked")
-		}
-	}
-}
-
-func TestRevocationFailureIsDurableAndRetried(t *testing.T) {
-	var mu sync.Mutex
-	reject := true
-	creates := 0
-	c := executor(t, func(q Request) string {
-		switch q.Op {
-		case "delegate.create":
-			mu.Lock()
-			creates++
-			mu.Unlock()
-			return `{"ok":true,"result":{"delegation_id":"d1","subject":{"username":"alice","uid":"1205"},"expires_at":"2030-01-01T00:00:00Z"}}` + "\n"
-		case "delegate.revoke":
-			mu.Lock()
-			bad := reject
-			mu.Unlock()
-			if bad {
-				return `{"ok":false,"code":"TEMPORARY_FAILURE"}` + "\n"
-			}
-		}
-		return `{"ok":true,"result":{}}` + "\n"
-	})
-	s := service(t, c)
-	params := `{"key":"same","url":"https://example.com/file","dest":"/home/Downloads","name":"file"}`
-	a := rpc(t, s, "alice", "delegate.jobs.submit", params)
-	b := rpc(t, s, "alice", "delegate.jobs.submit", params)
-	if a["success"] != true || b["success"] != true || a["data"].(map[string]any)["id"] != b["data"].(map[string]any)["id"] {
-		t.Fatal(a, b)
-	}
-	mu.Lock()
-	if creates != 1 {
-		t.Errorf("duplicate created %d grants", creates)
-	}
-	mu.Unlock()
-	id := a["data"].(map[string]any)["id"].(string)
-	out := rpc(t, s, "alice", "delegate.jobs.cancel", `{"id":"`+id+`"}`)
-	if out["data"].(map[string]any)["revocation_pending"] != true {
-		t.Fatal(out)
-	}
-	if list, e := s.Store.DelegationCleanup(context.Background()); e != nil || len(list) != 1 {
-		t.Fatal(list, e)
-	}
-	mu.Lock()
-	reject = false
-	mu.Unlock()
-	// A fresh process can retry using only durable job metadata.
-	s.Store = background.NewStore(filepath.Join(filepath.Dir(s.StagingDir), "background"))
-	if e := s.Sweep(context.Background()); e != nil {
-		t.Fatal(e)
-	}
-	if list, e := s.Store.DelegationCleanup(context.Background()); e != nil || len(list) != 0 {
-		t.Fatal(list, e)
-	}
-}
-func TestRunningJobCancellationStopsDownloadAndRevokes(t *testing.T) {
-	var mu sync.Mutex
-	revokes := 0
-	c := executor(t, func(q Request) string {
-		if q.Op == "delegate.create" {
-			return `{"ok":true,"result":{"delegation_id":"d1","subject":{"username":"alice","uid":1205},"expires_at":"2030-01-01T00:00:00Z"}}` + "\n"
-		}
-		if q.Op == "delegate.revoke" {
-			mu.Lock()
-			revokes++
-			mu.Unlock()
-		}
-		if q.Op == "files.write" {
-			t.Error("canceled download wrote destination")
-		}
-		return `{"ok":true,"result":{}}` + "\n"
-	})
-	started := make(chan struct{})
-	web := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { close(started); <-r.Context().Done() }))
-	defer web.Close()
-	s := service(t, c)
-	out := rpc(t, s, "alice", "delegate.jobs.submit", `{"key":"cancel-running","url":"`+web.URL+`","dest":"/home","name":"file"}`)
-	if out["success"] != true {
-		t.Fatal(out)
-	}
-	id := out["data"].(map[string]any)["id"].(string)
-	done := make(chan error, 1)
-	go func() { done <- s.RunOnce(context.Background()) }()
-	select {
-	case <-started:
-	case <-time.After(3 * time.Second):
-		t.Fatal("download did not start")
-	}
-	out = rpc(t, s, "alice", "delegate.jobs.cancel", `{"id":"`+id+`"}`)
-	if out["success"] != true {
-		t.Fatal(out)
-	}
-	select {
-	case e := <-done:
-		if e != nil {
-			t.Fatal(e)
-		}
-	case <-time.After(3 * time.Second):
-		t.Fatal("cancellation did not stop worker")
-	}
-	job, _ := s.Store.Get(context.Background(), id)
-	if job.State != background.StateCanceled {
-		t.Fatal(job)
-	}
-	mu.Lock()
-	if revokes < 1 {
-		t.Error("not revoked")
-	}
-	mu.Unlock()
-}
-func TestSessionCookieMustBeSingleAndRequestScoped(t *testing.T) {
-	for _, r := range []*http.Request{nil, httptest.NewRequest("POST", "http://localhost", nil)} {
-		if _, e := api.DSMSession(r); e == nil {
-			t.Fatal("missing cookie accepted")
-		}
-	}
-	r := httptest.NewRequest("POST", "http://localhost", nil)
-	r.AddCookie(&http.Cookie{Name: "id", Value: "a"})
-	r.AddCookie(&http.Cookie{Name: "id", Value: "b"})
-	if _, e := api.DSMSession(r); e == nil {
-		t.Fatal("ambiguous cookie accepted")
-	}
-}
-
-func TestStatusRejectsPreviousExecutorPolicy(t *testing.T) {
-	c := executor(t, func(Request) string {
-		return `{"ok":true,"result":{"ready":true,"version":"1","executor_digest":"old","policy_digest":"old"}}` + "\n"
-	})
-	s := service(t, c)
-	s.ExecutorDigest, s.PolicyDigest = "current", "current"
-	if got := s.Status(context.Background()); got.State != "blocked" {
-		t.Fatalf("stale executor ready: %+v", got)
-	}
-}

package/templates/native-go-delegate/backend/internal/delegate/staging.go

@@ -1,121 +0,0 @@
-package delegate
-
-import (
-	"dsmapp/internal/background"
-	"os"
-	"path"
-	"strings"
-
-	"golang.org/x/sys/unix"
-)
-
-func validStaging(p string) bool {
-	if p == "" || len(p) > 4096 || path.IsAbs(p) || path.Clean(p) != p {
-		return false
-	}
-	for _, part := range strings.Split(p, "/") {
-		if !validName(part) {
-			return false
-		}
-	}
-	return true
-}
-
-// stagingParent opens each relative directory without following symlinks.
-// The startup-owned staging root itself must be private and package-owned.
-func stagingParent(stagingDir, relative string) (int, background.StagingIdentity, error) {
-	var identity background.StagingIdentity
-	if !validStaging(relative) || background.RefuseRoot(os.Geteuid()) != nil {
-		return -1, identity, fail("STAGING_UNAVAILABLE")
-	}
-	fd, err := unix.Open(stagingDir, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return -1, identity, fail("STAGING_UNAVAILABLE")
-	}
-	var st unix.Stat_t
-	if unix.Fstat(fd, &st) != nil || st.Uid != uint32(os.Geteuid()) || st.Mode&0077 != 0 {
-		unix.Close(fd)
-		return -1, identity, fail("STAGING_UNAVAILABLE")
-	}
-	identity.RootDevice, identity.RootInode = uint64(st.Dev), uint64(st.Ino)
-	parts := strings.Split(relative, "/")
-	for _, part := range parts[:len(parts)-1] {
-		next, err := unix.Openat(fd, part, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
-		unix.Close(fd)
-		if err != nil {
-			return -1, identity, fail("STAGING_UNAVAILABLE")
-		}
-		fd = next
-		if unix.Fstat(fd, &st) != nil || st.Uid != uint32(os.Geteuid()) || st.Mode&0022 != 0 {
-			unix.Close(fd)
-			return -1, identity, fail("STAGING_UNAVAILABLE")
-		}
-	}
-	if unix.Fstat(fd, &st) != nil {
-		unix.Close(fd)
-		return -1, identity, fail("STAGING_UNAVAILABLE")
-	}
-	identity.ParentDevice, identity.ParentInode = uint64(st.Dev), uint64(st.Ino)
-	return fd, identity, nil
-}
-
-func sourceIdentity(parent int, relative string, identity background.StagingIdentity) (background.StagingIdentity, error) {
-	fd, err := unix.Openat(parent, path.Base(relative), unix.O_RDONLY|unix.O_NOFOLLOW|unix.O_NONBLOCK|unix.O_CLOEXEC, 0)
-	if err != nil {
-		return identity, err
-	}
-	file := os.NewFile(uintptr(fd), "staging")
-	defer file.Close()
-	var st unix.Stat_t
-	if unix.Fstat(fd, &st) != nil || st.Mode&unix.S_IFMT != unix.S_IFREG || st.Uid != uint32(os.Geteuid()) || st.Nlink != 1 {
-		return identity, fail("STAGING_UNAVAILABLE")
-	}
-	info, err := file.Stat()
-	if err != nil {
-		return identity, err
-	}
-	identity.Device, identity.Inode, identity.UID, identity.Size, identity.ModifiedNS = uint64(st.Dev), uint64(st.Ino), st.Uid, st.Size, info.ModTime().UnixNano()
-	return identity, nil
-}
-
-func pinSource(stagingDir, relative string, size int64) (background.StagingIdentity, error) {
-	parent, identity, err := stagingParent(stagingDir, relative)
-	if err != nil {
-		return identity, err
-	}
-	defer unix.Close(parent)
-	identity, err = sourceIdentity(parent, relative, identity)
-	if err != nil || identity.Size != size {
-		return identity, fail("STAGING_UNAVAILABLE")
-	}
-	return identity, nil
-}
-
-// cleanupSource runs under the package UID, never the destination subject or
-// root. A replaced source/parent is retained; only the pinned name is removed.
-// As with the executor's FD design, a concurrent rename after the last check
-// is not an ancestry sandbox or an atomic compare-and-unlink primitive.
-func cleanupSource(stagingDir, relative string, pinned background.StagingIdentity) error {
-	parent, identity, err := stagingParent(stagingDir, relative)
-	if err != nil {
-		return err
-	}
-	defer unix.Close(parent)
-	if identity.RootDevice != pinned.RootDevice || identity.RootInode != pinned.RootInode || identity.ParentDevice != pinned.ParentDevice || identity.ParentInode != pinned.ParentInode {
-		return fail("STAGING_CHANGED")
-	}
-	identity, err = sourceIdentity(parent, relative, identity)
-	if err == unix.ENOENT {
-		return nil
-	}
-	if err != nil || identity != pinned {
-		return fail("STAGING_CHANGED")
-	}
-	if err = unix.Unlinkat(parent, path.Base(relative), 0); err != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	if err = unix.Fsync(parent); err != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	return nil
-}

package/templates/native-go-delegate/backend/internal/delegate/status_disabled_test.go

@@ -1,51 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-)
-
-func TestStatusExposesOnlyVerifiedDisabledState(t *testing.T) {
-	for _, tc := range []struct {
-		wire, state string
-		disabled    *bool
-	}{
-		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false}`, "ready", boolRef(false)},
-		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":true}`, "disabled", boolRef(true)},
-		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":false,"disabled":false}`, "blocked", nil},
-		{`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true}`, "blocked", nil},
-	} {
-		s := service(t, nil)
-		s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
-			if op != "status" || auth != nil {
-				t.Fatal(op, auth)
-			}
-			return json.Unmarshal([]byte(tc.wire), out)
-		})
-		got := s.Status(context.Background())
-		wire, _ := json.Marshal(got)
-		var out struct {
-			Disabled *bool `json:"disabled"`
-		}
-		json.Unmarshal(wire, &out)
-		if got.State != tc.state || (out.Disabled == nil) != (tc.disabled == nil) || (out.Disabled != nil && *out.Disabled != *tc.disabled) {
-			t.Fatal(string(wire), tc.state)
-		}
-	}
-}
-func boolRef(value bool) *bool { return &value }
-
-func TestStatusDeclaresTrustedLongRunningPickerConfiguration(t *testing.T) {
-	s := service(t, nil)
-	s.Lifetime = "until-revoked"
-	s.Destinations = []string{"save", "reports"}
-	s.Client = fakeExecutor(func(_ context.Context, _ string, _ map[string]string, _ any, out any) error {
-		return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false}`), out)
-	})
-	out := rpc(t, s, "alice", "delegate.status", "{}")
-	data := out["data"].(map[string]any)
-	if data["lifetime"] != "until-revoked" || len(data["destinations"].([]any)) != 2 {
-		t.Fatal(out)
-	}
-}

package/templates/native-go-delegate/backend/internal/delegate/testdata/executor_contract.txt

@@ -1,112 +0,0 @@
-package main
-
-// Compiled beside the unmodified executor sources by W2's adapter tests.
-// Only DSM, peer credentials, and the bulk writer are substituted. The v1
-// decoder, grant/store, async journal, and publication fence are production.
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-type w2DSM struct{ root string }
-
-func (d w2DSM) Verify(_ context.Context, cookie, token string) (string, error) {
-	if token != "contract-token" || (cookie != "alice" && cookie != "bob" && cookie != "admin") {
-		return "", errors.New("invalid session")
-	}
-	return cookie, nil
-}
-func (d w2DSM) Account(_ context.Context, name string) (Subject, error) {
-	uid := 1205
-	if name == "bob" {
-		uid = 1206
-	}
-	if name == "admin" {
-		uid = 1207
-	}
-	return Subject{Username: name, UID: uid, GID: 100, Groups: []int{100}, Home: d.root, Expired: "normal", Admin: name == "admin"}, nil
-}
-func (d w2DSM) Allow(context.Context, Subject, string, string) error       { return nil }
-func (d w2DSM) ScopeRoot(context.Context, Subject, string) (string, error) { return d.root, nil }
-func (d w2DSM) API(context.Context, string, string, map[string]any) (json.RawMessage, error) {
-	return json.RawMessage(`{"allowed":true}`), nil
-}
-
-type w2Writer struct{ control string }
-
-func (w w2Writer) Write(context.Context, Subject, string, string, string, string) error {
-	return errors.New("not a legacy writer test")
-}
-func (w w2Writer) Move(ctx context.Context, _ Subject, op Operation, d Delegation, guard func(func() (MoveReceipt, error)) (MoveReceipt, error)) (MoveReceipt, error) {
-	f, err := os.OpenFile(filepath.Join(w.control, "attempt-"+op.Job), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600)
-	if err != nil {
-		return MoveReceipt{}, err
-	}
-	_, err = f.WriteString("attempt\n")
-	f.Close()
-	if err != nil {
-		return MoveReceipt{}, err
-	}
-	if strings.HasPrefix(op.Job, "stuck-") {
-		// Models a write that does not observe cancellation until released.
-		for {
-			if _, err = os.Stat(filepath.Join(w.control, "release-"+op.Job)); err == nil {
-				break
-			}
-			time.Sleep(5 * time.Millisecond)
-		}
-	}
-	if strings.HasPrefix(op.Job, "hold-") {
-		ticker := time.NewTicker(5 * time.Millisecond)
-		defer ticker.Stop()
-		for {
-			if _, err = os.Stat(filepath.Join(w.control, "release-"+op.Job)); err == nil {
-				break
-			}
-			select {
-			case <-ctx.Done():
-				return MoveReceipt{}, ctx.Err()
-			case <-ticker.C:
-			}
-		}
-	}
-	return guard(func() (MoveReceipt, error) {
-		if strings.HasPrefix(op.Job, "uncertain-") {
-			return MoveReceipt{}, errors.New("publication reply lost")
-		}
-		return MoveReceipt{Path: d.Path + "/" + op.Name}, nil
-	})
-}
-
-func TestW2ContractServer(t *testing.T) {
-	dir := os.Getenv("W2_CONTRACT_DIR")
-	if dir == "" {
-		t.Skip("adapter subprocess only")
-	}
-	e := &Executor{Policy: Policy{Version: 1, Package: "contract", App: "app", Scope: "home", Operations: []string{"delegate.create", "delegate.list", "delegate.revoke", "files.write", "files.moveFromStaging", "files.operationStatus", "files.cancelOperation", "delegate.disable", "delegate.enable", "delegate.audit"}, Destinations: []string{"save"}, Lifetime: "until-revoked"}, DSM: w2DSM{filepath.Join(dir, "home")}, Writer: w2Writer{dir}, Store: &Store{Dir: filepath.Join(dir, "protected")}, Now: time.Now}
-	if err := e.startOperations(context.Background()); err != nil {
-		t.Fatal(err)
-	}
-	defer e.stopOperations()
-	socket := filepath.Join(dir, "executor.sock")
-	os.Remove(socket)
-	listener, err := net.Listen("unix", socket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer listener.Close()
-	for {
-		c, err := listener.Accept()
-		if err != nil {
-			t.Fatal(err)
-		}
-		go e.Connection(context.Background(), c, os.Getuid(), func(net.Conn) (int, error) { return os.Getuid(), nil })
-	}
-}