@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/native-go/backend/internal/api/sdk-permissions.json

@@ -1,59 +0,0 @@
-{
-  "files": {
-    "nas.session.status": "authenticated",
-    "nas.files.shares": "authenticated",
-    "nas.files.list": "authenticated",
-    "nas.files.info": "authenticated",
-    "nas.files.create_folder": "authenticated",
-    "nas.files.download": "authenticated",
-    "nas.files.upload": "authenticated"
-  },
-  "jobs": {
-    "bg.status": "authenticated",
-    "bg.browse": "authenticated",
-    "bg.jobs.submit": "authenticated",
-    "bg.jobs.list": "authenticated",
-    "bg.jobs.get": "authenticated",
-    "bg.jobs.cancel": "authenticated",
-    "bg.jobs.result": "authenticated",
-    "bg.schedules.list": "authenticated",
-    "bg.schedules.create": "authenticated",
-    "bg.schedules.disable": "authenticated",
-    "bg.schedules.delete": "authenticated",
-    "bg.jobs.purge": "administrators",
-    "bg.schedules.enable": "administrators"
-  },
-  "portal": {
-    "portal.status": "authenticated"
-  },
-  "identity": {
-    "identity.status": "public",
-    "identity.login": "public",
-    "identity.session": "public",
-    "identity.logout": "public"
-  },
-  "rootOps": {
-    "executor.status": "authenticated",
-    "executor.control": "administrators",
-    "root.run": "administrators"
-  },
-  "delegate": {
-    "delegate.destination": "authenticated",
-    "delegate.status": "authenticated",
-    "delegate.create": "authenticated",
-    "delegate.list": "authenticated",
-    "delegate.revoke": "authenticated",
-    "delegate.jobs.submit": "authenticated",
-    "delegate.jobs.list": "authenticated",
-    "delegate.jobs.cancel": "authenticated",
-    "delegate.select_destination": "authenticated",
-    "delegate.move_from_staging": "authenticated",
-    "delegate.operations.get": "authenticated",
-    "delegate.operations.list": "authenticated",
-    "delegate.operations.cancel": "authenticated",
-    "delegate.disable": "administrators",
-    "delegate.enable": "administrators",
-    "delegate.audit": "authenticated",
-    "delegate.example.export": "authenticated"
-  }
-}

package/dist/templates/native-go/backend/internal/api/sdk_policy_test.go

@@ -1,31 +0,0 @@
-package api
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-)
-
-func TestSDKPolicyCannotBeOverridden(t *testing.T) {
-	h := func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil }
-	for _, method := range []string{"nas.files.list", "bg.jobs.purge", "identity.login"} {
-		for _, permission := range []string{"public", "authenticated", "administrators"} {
-			raw := []byte(`{"schema":1,"default":"administrators","methods":{"` + method + `":"` + permission + `"}}`)
-			if _, err := NewServerWithPermissions(&fakeAuth{}, raw, Handle(method, h)); err == nil {
-				t.Fatalf("accepted override %s %s", method, permission)
-			}
-		}
-	}
-}
-func TestSDKPolicyKeepsBothUserAndAdminBoundaries(t *testing.T) {
-	h := func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil }
-	s, err := NewServer(&fakeAuth{}, Handle("nas.files.list", h), Handle("bg.jobs.purge", h), Handle("identity.login", h), Handle("app.private", h))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for name, want := range map[string]policy{"nas.files.list": policyUser, "bg.jobs.purge": policyAdmin, "identity.login": policyPublic, "app.private": policyAdmin} {
-		if s.routes[name].policy != want {
-			t.Fatal(name)
-		}
-	}
-}

package/dist/templates/native-go/backend/internal/api/server.go

@@ -1,305 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"log"
-	"mime"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"time"
-
-	"dsmapp/internal/jsonlimits"
-)
-
-// MaxRequestBytes bounds the request body the CGI reads (CONTENT_LENGTH is
-// caller-controlled).
-const MaxRequestBytes = 1 << 20
-
-// RequestTimeout bounds cooperative CGI work even after a browser disconnect:
-// net/http/cgi does not add a deadline. Leave headroom before a 25-second client
-// timeout (observed in the live diagnosis) for framing and delivering the reply.
-const RequestTimeout = 20 * time.Second
-
-// WithRequestDeadline wraps the complete CGI handler, including middleware
-// that runs before Server. Server also bounds direct uses of its HTTP handler;
-// context.WithTimeout preserves the earlier outer deadline in that case.
-func WithRequestDeadline(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ctx, cancel := context.WithTimeout(r.Context(), RequestTimeout)
-		defer cancel()
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
-}
-
-// ErrNoSession means the request carries no valid DSM session.
-var ErrNoSession = errors.New("no valid DSM session")
-
-// ErrAdminRequired is an entry refusal: the app admits only administrators.
-var ErrAdminRequired = errors.New("app entry requires an administrator")
-
-// ErrAppPrivilegeDenied is an entry refusal: DSM Application Privileges do not
-// allow this account to use the app from this address.
-var ErrAppPrivilegeDenied = errors.New("DSM Application Privileges deny this app")
-
-// Authenticator verifies the DSM session behind a request.
-type Authenticator interface {
-	Authenticate(r *http.Request) (Identity, error)
-}
-
-// Server is the http.Handler behind the package CGI.
-type Server struct {
-	auth   Authenticator
-	routes map[string]Route
-}
-
-// NewServer refuses an empty authenticator and any route that is not usable,
-// so a mistake fails at startup instead of opening a route.
-func NewServer(auth Authenticator, routes ...Route) (*Server, error) {
-	p, err := bundledPolicy()
-	if err != nil {
-		return nil, err
-	}
-	return newServer(auth, p, routes...)
-}
-
-// NewServerWithPermissions accepts a trusted startup policy, never request
-// parameters. Production scaffolds use NewServer and the embedded JSON file.
-func NewServerWithPermissions(auth Authenticator, raw []byte, routes ...Route) (*Server, error) {
-	p, err := parsePermissions(raw)
-	if err != nil {
-		return nil, err
-	}
-	return newServer(auth, p, routes...)
-}
-
-func newServer(auth Authenticator, p permissions, routes ...Route) (*Server, error) {
-	if auth == nil {
-		return nil, errors.New("api.NewServer needs an Authenticator")
-	}
-	registry, err := buildRegistry(routes)
-	if err != nil {
-		return nil, err
-	}
-	for method := range p.methods {
-		if _, owned := sdkPolicy(method); owned {
-			return nil, errors.New("App policy cannot override SDK route: " + method)
-		}
-		if _, known := registry[method]; !known {
-			return nil, errors.New("permission configured for unregistered API method: " + method)
-		}
-	}
-	for method, route := range registry {
-		route.policy = p.forMethod(method)
-		if rule, owned := sdkPolicy(method); owned {
-			route.policy = rule
-		}
-		registry[method] = route
-	}
-	return &Server{auth: auth, routes: registry}, nil
-}
-
-type request struct {
-	Method string          `json:"method"`
-	Params json.RawMessage `json:"params"`
-}
-
-func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), RequestTimeout)
-	defer cancel()
-	r = r.WithContext(ctx)
-	// DSM's CGI gateway cuts the reply short if the CGI exits with request
-	// bytes unread, so drain whatever the handling below did not consume.
-	defer io.Copy(io.Discard, r.Body)
-	defer func() {
-		if p := recover(); p != nil {
-			log.Printf("handler panic: %v", p)
-			writeError(w, internalError)
-		}
-	}()
-	if method := r.URL.Query().Get("method"); method != "" {
-		if !sameOrigin(r) {
-			writeError(w, &Error{"cross_origin", "cross-origin request refused"})
-			return
-		}
-		if e := PrepareTransferRequest(w, r); e != nil {
-			writeError(w, e)
-			return
-		}
-		caller, route, e := s.authorize(r, method)
-		if e != nil {
-			writeError(w, e)
-			return
-		}
-		if route.streamHandler == nil {
-			writeError(w, BadRequest("not an HTTP transfer method"))
-			return
-		}
-		if err := route.streamHandler(r.Context(), caller, w, r); err != nil {
-			writeError(w, asRequestError(ctx, err))
-		}
-		return
-	}
-	req, apiErr := readRequest(w, r)
-	if apiErr != nil {
-		writeError(w, apiErr)
-		return
-	}
-	caller, route, apiErr := s.authorize(r, req.Method)
-	if apiErr != nil {
-		writeError(w, apiErr)
-		return
-	}
-	if route.streamHandler != nil {
-		writeError(w, BadRequest("use HTTP transfer endpoint"))
-		return
-	}
-	if route.responseHandler != nil {
-		if err := route.responseHandler(r.Context(), caller, w, r, req.Params); err != nil {
-			writeError(w, asRequestError(ctx, err))
-		}
-		return
-	}
-	var data any
-	var err error
-	if route.requestHandler != nil {
-		data, err = route.requestHandler(r.Context(), caller, r, req.Params)
-	} else {
-		data, err = route.handler(r.Context(), caller, req.Params)
-	}
-	if err != nil {
-		writeError(w, asRequestError(ctx, err))
-		return
-	}
-	writeJSON(w, http.StatusOK, map[string]any{"success": true, "data": data})
-}
-
-// PrepareTransferRequest forwards a native download form's token to the same
-// authenticator as JSON requests. Raw upload bodies remain untouched.
-func PrepareTransferRequest(w http.ResponseWriter, r *http.Request) *Error {
-	media, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type"))
-	if r.Method != http.MethodPost || media != "application/x-www-form-urlencoded" {
-		return nil
-	}
-	r.Body = http.MaxBytesReader(w, r.Body, 8192)
-	if err := r.ParseForm(); err != nil {
-		return BadRequest("invalid transfer form")
-	}
-	tokens := r.PostForm["SynoToken"]
-	if len(tokens) > 1 {
-		return BadRequest("invalid transfer token")
-	}
-	if len(tokens) == 1 {
-		token := tokens[0]
-		if len(token) > 4096 || strings.ContainsAny(token, "\r\n\x00") {
-			return BadRequest("invalid transfer token")
-		}
-		r.Header.Set("X-SYNO-TOKEN", token)
-	}
-	return nil
-}
-
-// authorize is the single access decision. Public routes skip authentication;
-// everything else, including unknown methods, authenticates exactly once
-// first, so anonymous callers cannot probe which methods exist.
-func (s *Server) authorize(r *http.Request, method string) (Caller, Route, *Error) {
-	route, known := s.routes[method]
-	if known && route.policy == policyPublic {
-		return Caller{}, route, nil
-	}
-	identity, err := s.auth.Authenticate(r)
-	if r.Context().Err() != nil {
-		return Caller{}, Route{}, asError(r.Context().Err())
-	}
-	if errors.Is(err, ErrNoSession) {
-		return Caller{}, Route{}, &Error{"session_required", "sign in to DSM again"}
-	}
-	if errors.Is(err, ErrAdminRequired) {
-		return Caller{}, Route{}, adminRequired
-	}
-	if errors.Is(err, ErrAppPrivilegeDenied) {
-		return Caller{}, Route{}, &Error{"app_privilege_denied", "DSM Application Privileges do not allow this account to use this app"}
-	}
-	if err != nil {
-		log.Printf("authentication unavailable: %v", err)
-		return Caller{}, Route{}, &Error{"auth_unavailable", "DSM authentication is unavailable"}
-	}
-	// Signed-in callers learn that a method is unregistered; method names
-	// already ship in the app's UI. Route constructors never grant permission.
-	if !known {
-		return Caller{}, Route{}, &Error{"unknown_method", "unknown method"}
-	}
-	if route.policy == policyAdmin && !identity.Admin {
-		return Caller{}, Route{}, adminRequired
-	}
-	caller := Caller{identity: identity, authenticated: true}
-	return caller, route, nil
-}
-
-func readRequest(w http.ResponseWriter, r *http.Request) (request, *Error) {
-	var req request
-	if r.Method != http.MethodPost {
-		return req, &Error{"method_not_allowed", "use POST"}
-	}
-	if mediaType, _, err := mime.ParseMediaType(r.Header.Get("Content-Type")); err != nil || mediaType != "application/json" {
-		return req, &Error{"json_required", "send Content-Type: application/json"}
-	}
-	if !sameOrigin(r) {
-		return req, &Error{"cross_origin", "cross-origin request refused"}
-	}
-	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, MaxRequestBytes))
-	if err != nil || !jsonlimits.WithinLimits(body) {
-		return req, &Error{"request_too_large", "request body too large"}
-	}
-	dec := json.NewDecoder(bytes.NewReader(body))
-	dec.DisallowUnknownFields()
-	if err := dec.Decode(&req); err != nil || dec.More() || req.Method == "" {
-		return req, BadRequest(`body must be {"method": "...", "params": {...}}`)
-	}
-	return req, nil
-}
-
-// sameOrigin refuses browser requests another site initiated. The JSON
-// content type already forces a CORS preflight, which DSM never answers; these
-// checks add an explicit refusal when the browser reports the origin.
-func sameOrigin(r *http.Request) bool {
-	if site := r.Header.Get("Sec-Fetch-Site"); site != "" && site != "same-origin" {
-		return false
-	}
-	if origin := r.Header.Get("Origin"); origin != "" {
-		u, err := url.Parse(origin)
-		return err == nil && u.Host == r.Host
-	}
-	return true
-}
-
-func writeJSON(w http.ResponseWriter, status int, body any) {
-	var payload bytes.Buffer
-	if err := json.NewEncoder(&payload).Encode(body); err != nil {
-		// DSM replaces CGI 5xx bodies with HTML; preserve the API envelope.
-		status = http.StatusOK
-		payload.Reset()
-		payload.WriteString(`{"success":false,"error":{"code":"internal","message":"Response unavailable"}}`)
-	}
-	h := w.Header()
-	h.Set("Content-Type", "application/json")
-	h.Set("Cache-Control", "no-store")
-	h.Set("X-Content-Type-Options", "nosniff")
-	// DSM's CGI bridge can terminate chunked responses without a final chunk.
-	// Exact byte lengths frame successful and refused responses consistently.
-	h.Set("Content-Length", strconv.Itoa(payload.Len()))
-	w.WriteHeader(status)
-	_, _ = w.Write(payload.Bytes())
-}
-
-func writeError(w http.ResponseWriter, e *Error) {
-	writeJSON(w, http.StatusOK, map[string]any{
-		"success": false,
-		"error":   map[string]string{"code": e.Code, "message": e.Message},
-	})
-}

package/dist/templates/native-go/backend/internal/api/testdata/permissions-cases.json

@@ -1,172 +0,0 @@
-[
-  {
-    "name": "default",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {}}",
-    "valid": true
-  },
-  {
-    "name": "explicit exceptions",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"greeting.get\": \"authenticated\", \"health.ping\": \"public\", \"root.output\": \"administrators\"}}",
-    "valid": true
-  },
-  {
-    "name": "schema numeric equivalent",
-    "json": "{\"schema\":1.0,\"default\":\"administrators\",\"methods\":{}}",
-    "valid": true
-  },
-  {
-    "name": "empty",
-    "json": "",
-    "valid": false
-  },
-  {
-    "name": "non JSON",
-    "json": "schema: 1",
-    "valid": false
-  },
-  {
-    "name": "missing default",
-    "json": "{\"schema\": 1, \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "missing methods",
-    "json": "{\"schema\": 1, \"default\": \"administrators\"}",
-    "valid": false
-  },
-  {
-    "name": "weak default",
-    "json": "{\"schema\": 1, \"default\": \"authenticated\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "public default",
-    "json": "{\"schema\": 1, \"default\": \"public\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "username is not group",
-    "json": "{\"schema\": 1, \"default\": \"admin\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "singular group",
-    "json": "{\"schema\": 1, \"default\": \"administrator\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "default null",
-    "json": "{\"schema\": 1, \"default\": null, \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "schema null",
-    "json": "{\"schema\": null, \"default\": \"administrators\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "schema bool",
-    "json": "{\"schema\": true, \"default\": \"administrators\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "schema string",
-    "json": "{\"schema\": \"1\", \"default\": \"administrators\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "unknown field",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {}, \"scope\": \"admin\"}",
-    "valid": false
-  },
-  {
-    "name": "case alias",
-    "json": "{\"Schema\": 1, \"default\": \"administrators\", \"methods\": {}}",
-    "valid": false
-  },
-  {
-    "name": "null methods",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": null}",
-    "valid": false
-  },
-  {
-    "name": "array methods",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": []}",
-    "valid": false
-  },
-  {
-    "name": "role null",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\": null}}",
-    "valid": false
-  },
-  {
-    "name": "role alias",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\": \"admin\"}}",
-    "valid": false
-  },
-  {
-    "name": "role array",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\": [\"administrators\"]}}",
-    "valid": false
-  },
-  {
-    "name": "method uppercase",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"App.status\": \"public\"}}",
-    "valid": false
-  },
-  {
-    "name": "method trailing newline",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.status\\n\": \"public\"}}",
-    "valid": false
-  },
-  {
-    "name": "method no namespace",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"status\": \"public\"}}",
-    "valid": false
-  },
-  {
-    "name": "method too long",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {\"app.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\": \"public\"}}",
-    "valid": false
-  },
-  {
-    "name": "duplicates",
-    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{\"app.status\":\"authenticated\",\"app.status\":\"public\"}}",
-    "valid": false
-  },
-  {
-    "name": "escaped duplicate",
-    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{\"app.status\":\"authenticated\",\"app.\\u0073tatus\":\"public\"}}",
-    "valid": false
-  },
-  {
-    "name": "duplicate default",
-    "json": "{\"schema\":1,\"default\":\"administrators\",\"default\":\"administrators\",\"methods\":{}}",
-    "valid": false
-  },
-  {
-    "name": "trailing",
-    "json": "{\"schema\": 1, \"default\": \"administrators\", \"methods\": {}}{}",
-    "valid": false
-  },
-  {
-    "name": "trailing comma",
-    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{},}",
-    "valid": false
-  },
-  {
-    "name": "comment",
-    "json": "{\"schema\":1,\"default\":\"administrators\",\"methods\":{}/*x*/}",
-    "valid": false
-  },
-  {
-    "name": "truncated",
-    "json": "{\"schema\":1",
-    "valid": false
-  },
-  {
-    "name": "UTF-8 BOM refuses consistently",
-    "json": "\ufeff{\"schema\":1,\"default\":\"administrators\",\"methods\":{}}",
-    "valid": false
-  }
-]