@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/native-go/backend/internal/filestation/service.go

@@ -1,254 +0,0 @@
-package filestation
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strings"
-	"time"
-)
-
-// DSMClient has only request-scoped session operations. It cannot open a NAS
-// path, log in as a package account, or acquire an offline credential.
-type DSMClient interface {
-	Verify(context.Context, *http.Request, string) error
-	Discover(context.Context, *http.Request, int) (Page, error)
-	List(context.Context, *http.Request, string, ListOptions) (Page, error)
-	Stat(context.Context, *http.Request, string) (Entry, error)
-	Create(context.Context, *http.Request, string, string) error
-	UploadStream(context.Context, *http.Request, string, string, io.Reader, int64) error
-	DownloadStream(context.Context, *http.Request, string) (Download, error)
-	Read(context.Context, *http.Request, string) ([]byte, error)
-}
-type Service struct{ client DSMClient }
-
-func NewService(client DSMClient) *Service { return &Service{client: client} }
-
-// Local uses the startup-owned loopback address; dataDir is never used to
-// store sessions or infer NAS permissions.
-func Local(_ string) *Service {
-	c, e := NewClient("http://127.0.0.1:5000")
-	if e != nil {
-		return nil
-	}
-	return NewService(c)
-}
-func (s *Service) verify(ctx context.Context, c api.Caller, r *http.Request) error {
-	if !c.Authenticated() {
-		return fail("session_required")
-	}
-	if s == nil || s.client == nil {
-		return fail("unavailable")
-	}
-	check, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	return s.client.Verify(check, r, c.User())
-}
-func (s *Service) ListShares(ctx context.Context, c api.Caller, r *http.Request, offset int) (Page, error) {
-	if e := s.verify(ctx, c, r); e != nil {
-		return Page{}, e
-	}
-	return s.client.Discover(ctx, r, offset)
-}
-func (s *Service) List(ctx context.Context, c api.Caller, r *http.Request, path string, opts ListOptions) (Page, error) {
-	if e := s.verify(ctx, c, r); e != nil {
-		return Page{}, e
-	}
-	return s.client.List(ctx, r, path, opts)
-}
-func (s *Service) Info(ctx context.Context, c api.Caller, r *http.Request, path string) (Entry, error) {
-	if e := s.verify(ctx, c, r); e != nil {
-		return Entry{}, e
-	}
-	return s.client.Stat(ctx, r, path)
-}
-func (s *Service) CreateFolder(ctx context.Context, c api.Caller, r *http.Request, parent, name string) error {
-	if e := s.verify(ctx, c, r); e != nil {
-		return e
-	}
-	return s.client.Create(ctx, r, parent, name)
-}
-func (s *Service) Upload(ctx context.Context, c api.Caller, r *http.Request, parent, name string, source io.Reader, size int64) error {
-	if e := s.verify(ctx, c, r); e != nil {
-		return e
-	}
-	return s.client.UploadStream(ctx, r, parent, name, source, size)
-}
-func (s *Service) Download(ctx context.Context, c api.Caller, r *http.Request, path string) (Download, error) {
-	if e := s.verify(ctx, c, r); e != nil {
-		return Download{}, e
-	}
-	return s.client.DownloadStream(ctx, r, path)
-}
-
-// Routes exposes JSON metadata and HTTP streaming operations. Every entry
-// passes through the central authenticator and immutable SDK policy.
-func (s *Service) Routes() []api.Route {
-	if s == nil {
-		return nil
-	}
-	routes := []api.Route{}
-	for _, method := range []string{"nas.session.status", "nas.files.shares", "nas.files.list", "nas.files.info", "nas.files.create_folder"} {
-		name := method
-		routes = append(routes, api.HandleRequest(name, func(ctx context.Context, c api.Caller, r *http.Request, p json.RawMessage) (any, error) {
-			return s.handle(ctx, c, r, name, p)
-		}))
-	}
-	return append(routes, api.HandleStream("nas.files.download", s.downloadHTTP), api.HandleStream("nas.files.upload", s.uploadHTTP))
-}
-func strict(p json.RawMessage, dst any) error {
-	d := json.NewDecoder(bytes.NewReader(p))
-	d.DisallowUnknownFields()
-	if d.Decode(dst) != nil || d.Decode(new(any)) != io.EOF {
-		return fail("invalid-request")
-	}
-	return nil
-}
-func (s *Service) handle(ctx context.Context, c api.Caller, r *http.Request, method string, p json.RawMessage) (any, error) {
-	switch method {
-	case "nas.session.status":
-		if e := strict(p, &struct{}{}); e != nil {
-			return nil, e
-		}
-		if e := s.verify(ctx, c, r); e != nil {
-			return nil, e
-		}
-		return map[string]string{"mode": "filestation-session"}, nil
-	case "nas.files.shares":
-		var in struct {
-			Offset int `json:"offset"`
-		}
-		if e := strict(p, &in); e != nil {
-			return nil, e
-		}
-		return s.ListShares(ctx, c, r, in.Offset)
-	case "nas.files.list":
-		var in struct {
-			Path string `json:"path"`
-			ListOptions
-		}
-		if e := strict(p, &in); e != nil {
-			return nil, e
-		}
-		return s.List(ctx, c, r, in.Path, in.ListOptions)
-	case "nas.files.info":
-		var in struct {
-			Path string `json:"path"`
-		}
-		if e := strict(p, &in); e != nil {
-			return nil, e
-		}
-		return s.Info(ctx, c, r, in.Path)
-	case "nas.files.create_folder":
-		var in struct {
-			Parent string `json:"parent"`
-			Name   string `json:"name"`
-		}
-		if e := strict(p, &in); e != nil {
-			return nil, e
-		}
-		e := s.CreateFolder(ctx, c, r, in.Parent, in.Name)
-		return map[string]bool{"created": e == nil}, e
-	}
-	return nil, fail("unsupported")
-}
-
-// relative constructs the existing job-import path; it is syntax validation,
-// never a permission decision. DSM checks the resulting path with this session.
-func relative(root, rel string) (string, error) {
-	if !validPath(root) {
-		return "", fail("invalid-request")
-	}
-	if rel == "" {
-		return root, nil
-	}
-	for _, part := range strings.Split(rel, "/") {
-		if !validName(part) {
-			return "", fail("invalid-request")
-		}
-	}
-	target := root + "/" + rel
-	if !validPath(target) {
-		return "", fail("invalid-request")
-	}
-	return target, nil
-}
-
-// readRegularFile avoids downloading a folder as an archive. DSM still enforces
-// its current permissions on the subsequent download, not this metadata observation.
-func (s *Service) readRegularFile(ctx context.Context, r *http.Request, target string) ([]byte, error) {
-	item, e := s.client.Stat(ctx, r, target)
-	if e != nil {
-		return nil, e
-	}
-	if item.IsDir {
-		return nil, fail("invalid-request")
-	}
-	if item.Additional.Size > MaxBytes {
-		return nil, fail("limit-exceeded")
-	}
-	return s.client.Read(ctx, r, target)
-}
-
-// discover lists the share roots for an empty folder, else one folder's page.
-func (s *Service) discover(ctx context.Context, r *http.Request, folder string, offset int) (Page, error) {
-	if folder == "" {
-		return s.client.Discover(ctx, r, offset)
-	}
-	return s.client.List(ctx, r, folder, ListOptions{Offset: offset})
-}
-
-// Browse lists share roots (empty folder) or one folder through the caller's
-// own DSM session, so File Station's current permissions decide what is
-// visible. It is read-only metadata and stores no grant; background jobs use it
-// to let an authenticated caller pick the file that ReadFile will then import.
-func (s *Service) Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (Page, error) {
-	if !c.Authenticated() {
-		return Page{}, fail("session_required")
-	}
-	if s == nil || s.client == nil {
-		return Page{}, fail("unavailable")
-	}
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	if e := s.verify(ctx, c, r); e != nil {
-		return Page{}, e
-	}
-	return s.discover(ctx, r, folder, offset)
-}
-
-// ReadFile reads one regular file below a folder the caller names, through the
-// caller's own DSM session, up to MaxBytes. It is the single-file import used by
-// package-private background jobs; the bytes never pass through the browser.
-// The request itself is the consent, so no grant is stored.
-func (s *Service) ReadFile(ctx context.Context, c api.Caller, r *http.Request, folder, rel string) ([]byte, error) {
-	if !c.Authenticated() {
-		return nil, fail("session_required")
-	}
-	if s == nil || s.client == nil {
-		return nil, fail("unavailable")
-	}
-	if rel == "" {
-		return nil, fail("invalid-request")
-	}
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	if e := s.verify(ctx, c, r); e != nil {
-		return nil, e
-	}
-	item, e := s.client.Stat(ctx, r, folder)
-	if e != nil {
-		return nil, e
-	}
-	if !item.IsDir {
-		return nil, fail("invalid-request")
-	}
-	target, e := relative(folder, rel)
-	if e != nil {
-		return nil, e
-	}
-	return s.readRegularFile(ctx, r, target)
-}

package/dist/templates/native-go/backend/internal/filestation/service_test.go

@@ -1,74 +0,0 @@
-package filestation
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-type testAuth struct{ user string }
-
-func (a testAuth) Authenticate(*http.Request) (api.Identity, error) {
-	if a.user == "" {
-		return api.Identity{}, api.ErrNoSession
-	}
-	return api.Identity{User: a.user}, nil
-}
-func invoke(t *testing.T, s *Service, user, method, params string) map[string]any {
-	t.Helper()
-	server, e := sessionTestServer(testAuth{user}, s.Routes()...)
-	if e != nil {
-		t.Fatal(e)
-	}
-	r := sessionRequest()
-	r.Body = http.NoBody
-	b := []byte(fmt.Sprintf(`{"method":%q,"params":%s}`, method, params))
-	r.Body = ioNop(b)
-	r.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	server.ServeHTTP(w, r)
-	var out map[string]any
-	if json.Unmarshal(w.Body.Bytes(), &out) != nil {
-		t.Fatal(w.Body.String())
-	}
-	return out
-}
-
-// SDK file routes use immutable authenticated policies. App test routes
-// explicitly opt in here.
-func sessionTestServer(auth api.Authenticator, routes ...api.Route) (*api.Server, error) {
-	methods := map[string]string{}
-	for _, route := range routes {
-		if !strings.HasPrefix(route.Method(), "nas.") {
-			methods[route.Method()] = "authenticated"
-		}
-	}
-	policy, err := json.Marshal(map[string]any{"schema": 1, "default": "administrators", "methods": methods})
-	if err != nil {
-		return nil, err
-	}
-	return api.NewServerWithPermissions(auth, policy, routes...)
-}
-func ioNop(b []byte) io.ReadCloser { return io.NopCloser(bytes.NewReader(b)) }
-func callerFor(t *testing.T, user string) api.Caller {
-	var got api.Caller
-	server, err := sessionTestServer(testAuth{user}, api.HandleRequest("test.caller", func(_ context.Context, c api.Caller, _ *http.Request, _ json.RawMessage) (any, error) {
-		got = c
-		return nil, nil
-	}))
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := sessionRequest()
-	r.Body = ioNop([]byte(`{"method":"test.caller","params":{}}`))
-	r.Header.Set("Content-Type", "application/json")
-	server.ServeHTTP(httptest.NewRecorder(), r)
-	return got
-}

package/dist/templates/native-go/backend/internal/filestation/upload_stream.go

@@ -1,76 +0,0 @@
-package filestation
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"mime/multipart"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// MaxUploadBytes bounds an interactive upload from a trusted application's
-// reader. This is not a background grant; DSM checks the current session.
-const MaxUploadBytes int64 = 16 << 30
-
-// UploadStream uploads a server-selected reader without buffering file bytes.
-// Never accept an unverified browser filesystem path as the reader's source.
-// No overwrite, retries, parent creation or retained session. A lost response
-// is commit-uncertain, including a timeout after a partially written upload.
-func (c *Client) UploadStream(ctx context.Context, r *http.Request, parent, name string, source io.Reader, size int64) error {
-	if c == nil || r == nil || source == nil || !validPath(parent) || !validName(name) || size < 0 || size > MaxUploadBytes {
-		return fail("invalid-request")
-	}
-	cookies := r.CookiesNamed("id")
-	token := r.Header.Get("X-SYNO-TOKEN")
-	if len(cookies) != 1 || cookies[0].Value == "" || token == "" || len(cookies[0].Value) > 4096 || len(token) > 4096 || strings.ContainsAny(token, "\r\n\x00") {
-		return fail("session_required")
-	}
-	var b bytes.Buffer
-	m := multipart.NewWriter(&b)
-	for _, f := range [][2]string{{"api", "SYNO.FileStation.Upload"}, {"method", "upload"}, {"version", "2"}, {"path", parent}, {"create_parents", "false"}, {"size", strconv.FormatInt(size, 10)}, {"SynoToken", token}} {
-		if e := m.WriteField(f[0], f[1]); e != nil {
-			return fail("invalid-request")
-		}
-	}
-	if _, e := m.CreateFormFile("file", name); e != nil {
-		return fail("invalid-request")
-	}
-	prefixLen := b.Len()
-	if e := m.Close(); e != nil {
-		return fail("invalid-request")
-	}
-	framing := b.Bytes()
-	body := io.MultiReader(bytes.NewReader(framing[:prefixLen]), io.LimitReader(source, size), bytes.NewReader(framing[prefixLen:]))
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Minute)
-	defer cancel()
-	req, e := http.NewRequestWithContext(ctx, http.MethodPost, c.endpoint, body)
-	if e != nil {
-		return fail("invalid-request")
-	}
-	req.ContentLength = int64(len(framing)) + size
-	req.Header.Set("Content-Type", m.FormDataContentType())
-	req.AddCookie(cookies[0])
-	req.Header.Set("X-SYNO-TOKEN", token)
-	client := *c.http
-	client.Timeout = 20 * time.Minute
-	// Upload response headers arrive after DSM receives and commits the file.
-	// Keep the metadata deadline unchanged for other requests on this client.
-	if transport, ok := client.Transport.(*http.Transport); ok {
-		transport = transport.Clone()
-		transport.ResponseHeaderTimeout = 20 * time.Minute
-		client.Transport = transport
-		defer transport.CloseIdleConnections()
-	}
-	resp, e := client.Do(req)
-	if e != nil {
-		return fail("commit-uncertain")
-	}
-	if resp.StatusCode != http.StatusOK {
-		resp.Body.Close()
-		return fail("commit-uncertain")
-	}
-	return mutationOutcome(decode(resp, nil))
-}

package/dist/templates/native-go/backend/internal/filestation/upload_stream_test.go

@@ -1,77 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-	"time"
-)
-
-func TestStreamingUploadWaitsForCommitResponseHeaders(t *testing.T) {
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		io.Copy(io.Discard, r.Body)
-		time.Sleep(30 * time.Millisecond)
-		fmt.Fprint(w, `{"success":true}`)
-	})
-	transport := c.http.Transport.(*http.Transport).Clone()
-	transport.ResponseHeaderTimeout = time.Millisecond
-	c.http.Transport = transport
-	if e := c.UploadStream(context.Background(), sessionRequest(), "/home", "fixture.bin", strings.NewReader("abc"), 3); e != nil {
-		t.Fatal("metadata header deadline incorrectly limited upload", e)
-	}
-	if transport.ResponseHeaderTimeout != time.Millisecond {
-		t.Fatal("upload mutated the shared metadata transport")
-	}
-}
-
-func TestStreamingUploadHasExactContentLengthAndSession(t *testing.T) {
-	payload := strings.Repeat("bounded-stream", 100000)
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.ContentLength <= int64(len(payload)) || r.Header.Get("Cookie") != "id=test-session" {
-			t.Error("length/session")
-		}
-		mr, e := r.MultipartReader()
-		if e != nil {
-			t.Fatal(e)
-		}
-		fields := map[string]string{}
-		last := ""
-		for {
-			p, e := mr.NextPart()
-			if e == io.EOF {
-				break
-			}
-			if e != nil {
-				t.Fatal(e)
-			}
-			b, _ := io.ReadAll(p)
-			last = p.FormName()
-			fields[last] = string(b)
-		}
-		if last != "file" || fields["file"] != payload || fields["path"] != "/home" || fields["SynoToken"] != "test-token" || fields["create_parents"] != "false" || fields["overwrite"] != "" {
-			t.Error("unsafe upload")
-		}
-		fmt.Fprint(w, `{"success":true}`)
-	})
-	if e := c.UploadStream(context.Background(), sessionRequest(), "/home", "file.bin", strings.NewReader(payload), int64(len(payload))); e != nil {
-		t.Fatal(e)
-	}
-	for _, size := range []int64{-1, MaxUploadBytes + 1} {
-		if c.UploadStream(context.Background(), sessionRequest(), "/home", "file.bin", strings.NewReader("x"), size) == nil {
-			t.Fatal("unbounded")
-		}
-	}
-	if c.UploadStream(context.Background(), sessionRequest(), "/home", "../bad", strings.NewReader("x"), 1) == nil {
-		t.Fatal("traversal")
-	}
-}
-
-func TestStreamingUploadMalformedReplyRemainsUncertain(t *testing.T) {
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { io.Copy(io.Discard, r.Body); fmt.Fprint(w, "broken") })
-	if e := c.UploadStream(context.Background(), sessionRequest(), "/home", "file.bin", strings.NewReader("abc"), 3); e == nil || !strings.Contains(e.Error(), "commit-uncertain") {
-		t.Fatal(e)
-	}
-}

package/dist/templates/native-go/backend/internal/filestation/write.go

@@ -1,32 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"errors"
-	"net/http"
-	"strings"
-)
-
-func validName(n string) bool {
-	return n != "" && n != "." && n != ".." && len(n) <= 255 && !strings.ContainsAny(n, "/\\\x00\r\n,\"")
-}
-func (c *Client) Create(ctx context.Context, r *http.Request, parent, name string) error {
-	if !validPath(parent) || !validName(name) {
-		return fail("invalid-request")
-	}
-	v := fields("SYNO.FileStation.CreateFolder", "create", "2")
-	v.Set("folder_path", array(parent))
-	v.Set("name", array(name))
-	v.Set("force_parent", "false")
-	return mutationOutcome(c.call(ctx, r, v, nil))
-}
-
-// An unreadable response cannot establish whether DSM committed the write.
-func mutationOutcome(err error) error {
-	var e *api.Error
-	if errors.As(err, &e) && (e.Code == "unavailable" || e.Code == "canceled") {
-		return fail("commit-uncertain")
-	}
-	return err
-}

package/dist/templates/native-go/backend/internal/filestation/write_test.go

@@ -1,124 +0,0 @@
-package filestation
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-)
-
-func TestCreateAndUploadAreBoundedAndUseSession(t *testing.T) {
-	calls := 0
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		calls++
-		if r.Header.Get("Cookie") != "id=test-session" {
-			t.Error("session missing")
-		}
-		if calls == 1 {
-			r.ParseForm()
-			if r.Form.Get("api") != "SYNO.FileStation.CreateFolder" || r.Form.Get("folder_path") != `["/home"]` || r.Form.Get("name") != `["new"]` || r.Form.Get("force_parent") != "false" {
-				t.Error("create fields")
-			}
-		} else {
-			m, e := r.MultipartReader()
-			if e != nil {
-				t.Fatal(e)
-			}
-			fields := map[string]string{}
-			last := ""
-			for {
-				p, e := m.NextPart()
-				if e == io.EOF {
-					break
-				}
-				if e != nil {
-					t.Fatal(e)
-				}
-				b, _ := io.ReadAll(p)
-				last = p.FormName()
-				fields[last] = string(b)
-				if last == "file" && p.FileName() != "a.txt" {
-					t.Error("filename")
-				}
-			}
-			if fields["file"] != "abc" || fields["path"] != "/home" || fields["api"] != "SYNO.FileStation.Upload" || fields["SynoToken"] != "test-token" || fields["create_parents"] != "false" || fields["overwrite"] != "" || last != "file" {
-				t.Error("multipart fields")
-			}
-		}
-		fmt.Fprint(w, `{"success":true,"data":{}}`)
-	})
-	r := sessionRequest()
-	ctx := context.Background()
-	if e := c.Create(ctx, r, "/home", "new"); e != nil {
-		t.Fatal(e)
-	}
-	if e := c.UploadStream(ctx, r, "/home", "a.txt", strings.NewReader("abc"), 3); e != nil {
-		t.Fatal(e)
-	}
-	for _, n := range []string{"../evil", "/evil", "a/b", "a\\b", "a\r\nx", ".", "..", "a,b"} {
-		if c.UploadStream(ctx, r, "/home", n, strings.NewReader("abc"), 3) == nil {
-			t.Fatal(n)
-		}
-	}
-	if c.UploadStream(ctx, r, "/home", "a", strings.NewReader("abc"), MaxUploadBytes+1) == nil {
-		t.Fatal("oversized write")
-	}
-	if calls != 2 {
-		t.Fatal("invalid input reached server")
-	}
-}
-
-func TestMutationMalformedReplyIsCommitUncertain(t *testing.T) {
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, "broken response") })
-	for _, e := range []error{c.Create(context.Background(), sessionRequest(), "/home", "x"), c.UploadStream(context.Background(), sessionRequest(), "/home", "x", strings.NewReader("abc"), 3)} {
-		if e == nil || !strings.Contains(e.Error(), "commit-uncertain") {
-			t.Fatal(e)
-		}
-	}
-}
-
-func TestBinaryUploadDownloadChecksum(t *testing.T) {
-	payload := []byte{0, 1, 2, 255, 128, '\n', '"', '<', '>'}
-	var stored []byte
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == http.MethodPost {
-			mr, e := r.MultipartReader()
-			if e != nil {
-				t.Fatal(e)
-			}
-			for {
-				p, e := mr.NextPart()
-				if e == io.EOF {
-					break
-				}
-				if e != nil {
-					t.Fatal(e)
-				}
-				if p.FormName() == "file" {
-					stored, e = io.ReadAll(p)
-					if e != nil {
-						t.Fatal(e)
-					}
-				}
-			}
-			fmt.Fprint(w, `{"success":true}`)
-		} else {
-			w.Header().Set("Content-Disposition", `attachment; filename="bytes"`)
-			w.Write(stored)
-		}
-	})
-	if e := c.UploadStream(context.Background(), sessionRequest(), "/home", "bytes", bytes.NewReader(payload), int64(len(payload))); e != nil {
-		t.Fatal(e)
-	}
-	out, e := c.Read(context.Background(), sessionRequest(), "/home/bytes")
-	if e != nil {
-		t.Fatal(e)
-	}
-	if sha256.Sum256(out) != sha256.Sum256(payload) {
-		t.Fatal("binary checksum mismatch")
-	}
-}