@synopackageland/cli 0.8.0 → 0.9.0

package/dist/templates/_executor/executor.go

@@ -1,735 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"io"
-	"net"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"sync"
-	"time"
-	"unicode"
-	"unicode/utf8"
-)
-
-const version = "1"
-const maxRequest = 64 << 10
-
-var allOps = []string{"status", "delegate.create", "delegate.list", "delegate.revoke", "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.moveFromStaging", "files.operationStatus", "files.cancelOperation", "delegate.disable", "delegate.enable", "delegate.audit", "root.run"}
-var tokenRE = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
-var destinationRE = regexp.MustCompile(`^[a-z][a-z0-9_-]{0,63}$`)
-var idRE = regexp.MustCompile(`^[a-f0-9]{64}$`)
-
-type Policy struct {
-	Version      int               `json:"v"`
-	Package      string            `json:"package"`
-	App          string            `json:"app"`
-	Entry        string            `json:"entry,omitempty"`
-	Scope        string            `json:"scope,omitempty"`
-	Operations   []string          `json:"operations"`
-	Destinations []string          `json:"destinations,omitempty"`
-	Lifetime     string            `json:"lifetime,omitempty"`
-	Root         map[string]string `json:"root,omitempty"`
-}
-type Subject struct {
-	Username string `json:"username"`
-	UID      int    `json:"uid"`
-	GID      int    `json:"gid"`
-	Groups   []int  `json:"groups"`
-	Home     string `json:"home"`
-	Expired  string `json:"expired"`
-	Admin    bool   `json:"admin"`
-}
-type Delegation struct {
-	ScopeGeneration uint64            `json:"scope_generation,omitempty"`
-	Lifetime        string            `json:"lifetime,omitempty"`
-	DestinationKey  string            `json:"destination,omitempty"`
-	Directory       directoryIdentity `json:"directory,omitempty"`
-	ID              string            `json:"delegation_id"`
-	Package         string            `json:"package"`
-	Subject         Subject           `json:"subject"`
-	Job             string            `json:"job_id"`
-	Ops             []string          `json:"ops"`
-	Scope           string            `json:"scope"`
-	Path            string            `json:"path"`
-	Root            string            `json:"root"`
-	Expires         time.Time         `json:"expires_at"`
-	Revoked         bool              `json:"revoked"`
-}
-type Auth struct {
-	Cookie    string `json:"dsm_cookie,omitempty"`
-	SynoToken string `json:"dsm_synotoken,omitempty"`
-	hasKeys   bool
-}
-
-// Preserve wire key presence: an explicit empty credential is caller auth.
-func (a *Auth) UnmarshalJSON(b []byte) error {
-	type plainAuth Auth
-	var decoded plainAuth
-	if err := strictJSON(b, &decoded); err != nil {
-		return err
-	}
-	var keys map[string]json.RawMessage
-	if err := json.Unmarshal(b, &keys); err != nil {
-		return err
-	}
-	for key := range keys {
-		if key != "dsm_cookie" && key != "dsm_synotoken" {
-			return errors.New("auth key")
-		}
-	}
-	*a = Auth(decoded)
-	a.hasKeys = len(keys) > 0 || bytes.Equal(bytes.TrimSpace(b), []byte("null"))
-	return nil
-}
-
-type Request struct {
-	Version int             `json:"v"`
-	Op      string          `json:"op"`
-	Auth    Auth            `json:"auth"`
-	Params  json.RawMessage `json:"params"`
-}
-type Response struct {
-	OK      bool   `json:"ok"`
-	Result  any    `json:"result,omitempty"`
-	Code    string `json:"code,omitempty"`
-	Message string `json:"message,omitempty"`
-}
-type Params struct {
-	Lifetime       string   `json:"lifetime,omitempty"`
-	DestinationKey string   `json:"destination,omitempty"`
-	Size           int64    `json:"size,omitempty"`
-	Job            string   `json:"job_id,omitempty"`
-	Ops            []string `json:"ops,omitempty"`
-	Scope          string   `json:"scope,omitempty"`
-	Path           string   `json:"path,omitempty"`
-	TTL            int64    `json:"ttl_seconds,omitempty"`
-	ID             string   `json:"delegation_id,omitempty"`
-	Staging        string   `json:"staging,omitempty"`
-	Dest           string   `json:"dest_dir,omitempty"`
-	Name           string   `json:"name,omitempty"`
-}
-type DSM interface {
-	Verify(context.Context, string, string) (string, error)
-	Account(context.Context, string) (Subject, error)
-	Allow(context.Context, Subject, string, string) error
-	ScopeRoot(context.Context, Subject, string) (string, error)
-	API(context.Context, string, string, map[string]any) (json.RawMessage, error)
-}
-type writeJobKey struct{}
-
-type Writer interface {
-	Write(context.Context, Subject, string, string, string, string) error
-}
-type RootRunner interface {
-	Run(context.Context, string, string) (string, error)
-}
-type Executor struct {
-	Policy                       Policy
-	DSM                          DSM
-	Writer                       Writer
-	Runner                       RootRunner
-	Store                        *Store
-	Now                          func() time.Time
-	ExecutorDigest, PolicyDigest string
-	legacyCalls                  map[string][]chan struct{}
-	copySlot                     chan struct{}
-	commitMu                     sync.Mutex // Durable admission/revoke/disable and bounded publish only.
-	async                        *operationRuntime
-}
-
-func deny(code string) Response {
-	return Response{Code: code, Message: strings.ToLower(strings.ReplaceAll(code, "_", " "))}
-}
-func success(v any) Response { return Response{OK: true, Result: v} }
-func contains(v []string, s string) bool {
-	for _, x := range v {
-		if x == s {
-			return true
-		}
-	}
-	return false
-}
-func validName(s string) bool {
-	return s != "" && !strings.Contains(s, "/") && !strings.Contains(s, "..") && !strings.ContainsFunc(s, unicode.IsControl) && utf8.ValidString(s)
-}
-func cleanPath(p string) bool {
-	return strings.HasPrefix(p, "/") && filepath.Clean(p) == p && !strings.ContainsFunc(p, unicode.IsControl) && utf8.ValidString(p)
-}
-func within(root, p string) bool {
-	return p == root || strings.HasPrefix(p, strings.TrimSuffix(root, "/")+"/")
-}
-func strictJSON(b []byte, v any) error {
-	if !utf8.Valid(b) {
-		return errors.New("utf8")
-	}
-	// encoding/json otherwise silently accepts duplicate keys, including auth.
-	d := json.NewDecoder(bytes.NewReader(b))
-	_, params := v.(*Params)
-	_, auth := v.(*Auth)
-	if err := uniqueValue(d, params || auth); err != nil {
-		return err
-	}
-	if _, err := d.Token(); err != io.EOF {
-		return errors.New("trailing JSON")
-	}
-	d = json.NewDecoder(bytes.NewReader(b))
-	d.DisallowUnknownFields()
-	return d.Decode(v)
-}
-
-// Match encoding/json's Unicode case folding when detecting duplicate keys.
-func foldJSONKey(s string) string {
-	return strings.Map(func(r rune) rune {
-		folded := r
-		for next := unicode.SimpleFold(r); next != r; next = unicode.SimpleFold(next) {
-			if next < folded {
-				folded = next
-			}
-		}
-		return folded
-	}, s)
-}
-func uniqueValue(d *json.Decoder, canonical bool) error {
-	tok, err := d.Token()
-	if err != nil {
-		return err
-	}
-	del, ok := tok.(json.Delim)
-	if !ok {
-		return nil
-	}
-	switch del {
-	case '{':
-		seen := map[string]bool{}
-		for d.More() {
-			k, err := d.Token()
-			if err != nil {
-				return err
-			}
-			s, ok := k.(string)
-			folded := foldJSONKey(s)
-			if !ok || seen[folded] {
-				return errors.New("duplicate key")
-			}
-			seen[folded] = true
-			credentialObject := strings.EqualFold(s, "auth") || strings.EqualFold(s, "params")
-			if credentialObject && s != "auth" && s != "params" {
-				return errors.New("noncanonical key")
-			}
-			if canonical && strings.ContainsFunc(s, func(r rune) bool { return !((r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '_') }) {
-				return errors.New("noncanonical key")
-			}
-			if err = uniqueValue(d, canonical || credentialObject); err != nil {
-				return err
-			}
-		}
-	case '[':
-		for d.More() {
-			if err = uniqueValue(d, canonical); err != nil {
-				return err
-			}
-		}
-	default:
-		return errors.New("invalid JSON")
-	}
-	_, err = d.Token()
-	return err
-}
-func (e *Executor) Connection(parent context.Context, c net.Conn, uid int, peer func(net.Conn) (int, error)) {
-	got, err := peer(c)
-	if err != nil || (got != uid && got != 0) {
-		return
-	}
-	c.SetDeadline(time.Now().Add(15 * time.Second))
-	r := bufio.NewReaderSize(c, maxRequest+1)
-	line, err := r.ReadSlice('\n')
-	var out Response
-	if len(line) > maxRequest || err == bufio.ErrBufferFull {
-		out = deny("REQUEST_TOO_LARGE")
-	} else if err != nil {
-		out = deny("INVALID_REQUEST")
-	} else {
-		var req Request
-		if strictJSON(line, &req) != nil {
-			out = deny("INVALID_REQUEST")
-		} else {
-			ctx, cancel := context.WithTimeout(parent, 30*time.Second)
-			defer cancel()
-			out = e.handlePeer(ctx, req, got, uid)
-		}
-	}
-	c.SetWriteDeadline(time.Now().Add(5 * time.Second))
-	json.NewEncoder(c).Encode(out)
-}
-func (e *Executor) eligible(ctx context.Context, name string, uid int, files bool) (Subject, string) {
-	moveValidationStage(ctx, "account")
-	s, err := e.DSM.Account(ctx, name)
-	if moveValidationDeadline(ctx, err) {
-		return s, "EXECUTOR_PAUSED"
-	}
-	if err != nil || s.Username != name || s.Expired != "normal" || s.UID < 1024 || s.GID < 0 || len(s.Groups) == 0 || (uid >= 0 && s.UID != uid) {
-		return Subject{}, "INELIGIBLE"
-	}
-	moveValidationStage(ctx, "app-privilege")
-	if err := e.DSM.Allow(ctx, s, e.Policy.App, e.Policy.Entry); err != nil {
-		if moveValidationDeadline(ctx, err) {
-			return s, "EXECUTOR_PAUSED"
-		}
-		return Subject{}, "APP_DENIED"
-	}
-	moveValidationStage(ctx, "file-station-privilege")
-	if files {
-		if err := e.DSM.Allow(ctx, s, "SYNO.SDS.App.FileStation3.Instance", ""); err != nil {
-			if moveValidationDeadline(ctx, err) {
-				return s, "EXECUTOR_PAUSED"
-			}
-			return Subject{}, "APP_DENIED"
-		}
-	}
-	return s, ""
-}
-func (e *Executor) verified(ctx context.Context, auth Auth) (Subject, string) {
-	if auth.Cookie == "" || len(auth.Cookie) > 4096 || (strings.Contains(auth.Cookie, ";") || strings.ContainsFunc(auth.Cookie, func(r rune) bool { return r < 0x20 || r == 0x7f })) || auth.SynoToken == "" || len(auth.SynoToken) > 4096 || strings.ContainsFunc(auth.SynoToken, unicode.IsControl) {
-		return Subject{}, "AUTH_DENIED"
-	}
-	name, err := e.DSM.Verify(ctx, auth.Cookie, auth.SynoToken)
-	if err != nil || name == "" {
-		return Subject{}, "AUTH_DENIED"
-	}
-	s, err := e.DSM.Account(ctx, name)
-	if err != nil || s.Username != name || s.Expired != "normal" {
-		return Subject{}, "AUTH_DENIED"
-	}
-	return s, ""
-}
-func (e *Executor) Handle(ctx context.Context, r Request) Response {
-	if isExtension(r.Op) {
-		return e.handleExtension(ctx, r)
-	}
-	if ctx.Err() != nil {
-		return deny("EXECUTOR_PAUSED")
-	}
-	if r.Version != 1 {
-		return deny("INVALID_REQUEST")
-	}
-	if !contains(allOps, r.Op) {
-		return deny("UNKNOWN_OP")
-	}
-	if !contains(e.Policy.Operations, r.Op) {
-		return deny("POLICY_DENIED")
-	}
-	var p Params
-	if len(r.Params) == 0 {
-		r.Params = json.RawMessage(`{}`)
-	}
-	if strictJSON(r.Params, &p) != nil {
-		return deny("INVALID_REQUEST")
-	}
-	// Reject parameters belonging to another operation, rather than silently ignoring them.
-	var keys map[string]json.RawMessage
-	if json.Unmarshal(r.Params, &keys) != nil {
-		return deny("INVALID_REQUEST")
-	}
-	allowed := map[string]string{"status": "", "delegate.create": "job_id ops scope path ttl_seconds destination lifetime", "delegate.list": "", "delegate.revoke": "delegation_id job_id", "files.list": "delegation_id job_id path", "files.info": "delegation_id job_id path", "files.createFolder": "delegation_id job_id path name", "files.checkPermission": "delegation_id job_id path", "files.write": "delegation_id job_id staging dest_dir name", "root.run": "name"}
-	for k := range keys {
-		if !contains(strings.Fields(allowed[r.Op]), k) {
-			return deny("INVALID_REQUEST")
-		}
-	}
-	if r.Op == "delegate.create" || strings.HasPrefix(r.Op, "files.") {
-		e.commitMu.Lock()
-		disabled, err := e.Store.Disabled()
-		e.commitMu.Unlock()
-		if err != nil {
-			return deny("STORAGE_ERROR")
-		}
-		if disabled {
-			return deny("disabled")
-		}
-	}
-	switch r.Op {
-	case "status":
-		e.commitMu.Lock()
-		defer e.commitMu.Unlock()
-		disabled, err := e.Store.Disabled()
-		out := map[string]any{"executor_digest": e.ExecutorDigest, "policy_digest": e.PolicyDigest, "version": version, "ready": err == nil, "disabled": disabled}
-		if e.Policy.Scope == installSelectedScope {
-			state, code := e.selectionLocked()
-			out["scope_state"] = code
-			out["selection"] = nil
-			if code == "" {
-				out["selection"] = map[string]any{"scope": state.Scope, "root": scopeVirtual(state.Scope), "generation": state.Generation}
-			}
-			if code == "STORAGE_ERROR" {
-				out["ready"] = false
-			}
-		}
-		return success(out)
-	case "delegate.create":
-		long := p.Lifetime == "until-revoked"
-		if long {
-			if _, ok := keys["job_id"]; ok {
-				return deny("INVALID_REQUEST")
-			}
-			if _, ok := keys["ttl_seconds"]; ok {
-				return deny("INVALID_REQUEST")
-			}
-			if !contains(e.Policy.Destinations, p.DestinationKey) {
-				return deny("invalid-destination")
-			}
-		}
-		if (long && (e.Policy.Lifetime != p.Lifetime || !contains(e.Policy.Destinations, p.DestinationKey) || p.Job != "" || p.TTL != 0 || len(p.Ops) != 1 || p.Ops[0] != "files.moveFromStaging")) || (!long && (p.Lifetime != "" || p.DestinationKey != "" || !tokenRE.MatchString(p.Job) || p.TTL <= 0 || p.TTL > 86400*30 || contains(p.Ops, "files.moveFromStaging"))) || len(p.Ops) == 0 || p.Scope != e.Policy.Scope || !cleanPath(p.Path) {
-			return deny("INVALID_REQUEST")
-		}
-		for _, op := range p.Ops {
-			if !strings.HasPrefix(op, "files.") || !contains(allOps, op) || !contains(e.Policy.Operations, op) {
-				return deny("POLICY_DENIED")
-			}
-		}
-		s, code := e.verified(ctx, r.Auth)
-		if code != "" {
-			return deny(code)
-		}
-		s, code = e.eligible(ctx, s.Username, s.UID, true)
-		if code != "" {
-			return deny(code)
-		}
-		selection, selectionCode := e.selection()
-		if selectionCode != "" {
-			return deny(selectionCode)
-		}
-		root, err := e.DSM.ScopeRoot(ctx, s, selection.Scope)
-		if err != nil {
-			return deny("SCOPE_DENIED")
-		}
-		d := Delegation{Package: e.Policy.Package, Subject: s, Job: p.Job, Ops: p.Ops, Scope: selection.Scope, ScopeGeneration: selection.Generation, Path: scopeVirtual(selection.Scope), Root: root, Expires: e.Now().UTC().Add(time.Duration(p.TTL) * time.Second)}
-		var real string
-		if long {
-			real, err = mappedDirectory(d, p.Path)
-		} else {
-			real, err = scopedPath(d, p.Path)
-		}
-		if err != nil {
-			return deny("SCOPE_DENIED")
-		}
-		d.Root = real
-		d.Path = p.Path
-		if long {
-			d.Lifetime = p.Lifetime
-			d.DestinationKey = p.DestinationKey
-			d.Expires = time.Time{}
-			d.Directory, err = bindDirectory(real)
-			if err != nil {
-				return deny("SCOPE_DENIED")
-			}
-		}
-		// Permission creation is checked as the subject, never SYSTEM_ADMIN.
-		if _, err = e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Path}); err != nil {
-			return deny("PERMISSION_DENIED")
-		}
-		id := make([]byte, 32)
-		if _, err = rand.Read(id); err != nil {
-			return deny("INTERNAL")
-		}
-		d.ID = hex.EncodeToString(id)
-		e.commitMu.Lock()
-		disabled, disableErr := e.Store.Disabled()
-		if !e.scopeMatchesLocked(d) {
-			e.commitMu.Unlock()
-			return deny("SCOPE_DENIED")
-		}
-		if disableErr != nil || disabled {
-			e.commitMu.Unlock()
-			return deny("disabled")
-		}
-		putErr := e.auditLocked(s, "delegate.create", "", d.Path, "admitting")
-		// A destination key denotes one current choice for this person. Changing
-		// it cancels its previous grant under the same publish fence.
-		if putErr == nil && long {
-			var previous []Delegation
-			previous, putErr = e.Store.List()
-			for _, prior := range previous {
-				if putErr != nil {
-					break
-				}
-				if prior.Package != d.Package || prior.Subject.UID != s.UID || prior.Subject.Username != s.Username || prior.Lifetime != "until-revoked" || prior.DestinationKey != d.DestinationKey || prior.Revoked {
-					continue
-				}
-				putErr = e.auditLocked(s, "delegate.revoke", prior.ID, prior.Path, "destination-replaced")
-				if putErr == nil {
-					prior.Revoked = true
-					putErr = e.Store.Put(prior)
-				}
-				if putErr == nil {
-					e.cancelGrantLocked(prior.ID, "destination-replaced")
-				}
-			}
-		}
-		if putErr == nil {
-			putErr = e.Store.Put(d)
-		}
-		e.commitMu.Unlock()
-		if putErr != nil {
-			return deny("STORAGE_ERROR")
-		}
-		if long {
-			return success(publicDelegation(d))
-		}
-		return success(map[string]any{"delegation_id": d.ID, "subject": publicSubject(s), "expires_at": d.Expires})
-	case "delegate.list":
-		s, code := e.verified(ctx, r.Auth)
-		if code != "" {
-			return deny(code)
-		}
-		ds, err := e.Store.List()
-		if err != nil {
-			return deny("STORAGE_ERROR")
-		}
-		out := []any{}
-		for _, d := range ds {
-			if d.Package == e.Policy.Package && d.Subject.UID == s.UID && d.Subject.Username == s.Username {
-				if !e.scopeMatches(d) {
-					d.Revoked = true
-				}
-				out = append(out, publicDelegation(d))
-			}
-		}
-		return success(map[string]any{"delegations": out})
-	case "delegate.revoke":
-		d, err := e.Store.Get(p.ID)
-		if err != nil || d.Package != e.Policy.Package {
-			return deny("DELEGATION_DENIED")
-		}
-		if r.Auth.hasKeys || r.Auth.Cookie != "" || r.Auth.SynoToken != "" {
-			s, code := e.verified(ctx, r.Auth)
-			if code != "" {
-				return deny(code)
-			}
-			if (d.Lifetime != "" || !s.Admin) && (s.UID != d.Subject.UID || s.Username != d.Subject.Username) {
-				return deny("DELEGATION_DENIED")
-			}
-		} else if d.Lifetime != "" || p.Job == "" || p.Job != d.Job {
-			return deny("DELEGATION_DENIED")
-		}
-		e.commitMu.Lock()
-		locked := true
-		defer func() {
-			if locked {
-				e.commitMu.Unlock()
-			}
-		}()
-		d, err = e.Store.Get(p.ID)
-		if err != nil {
-			return deny("STORAGE_ERROR")
-		}
-		d.Revoked = true
-		if e.Store.Put(d) != nil {
-			return deny("STORAGE_ERROR")
-		}
-		e.cancelGrantLocked(d.ID, "grant-revoked")
-		if e.auditLocked(d.Subject, "delegate.revoke", "", d.Path, "revoked") != nil {
-			return deny("STORAGE_ERROR")
-		}
-		pending := e.legacyPendingLocked(d.ID)
-		e.commitMu.Unlock()
-		locked = false
-		if waitLegacy(ctx, pending) != nil {
-			return deny("EXECUTOR_PAUSED")
-		}
-		return success(map[string]any{"revoked": true})
-	case "root.run":
-		if !tokenRE.MatchString(p.Name) {
-			return deny("INVALID_REQUEST")
-		}
-		digest, ok := e.Policy.Root[p.Name]
-		if !ok {
-			return deny("POLICY_DENIED")
-		}
-		s, code := e.verified(ctx, r.Auth)
-		if code != "" {
-			return deny(code)
-		}
-		if !s.Admin {
-			return deny("ADMIN_REQUIRED")
-		}
-		if e.DSM.Allow(ctx, s, e.Policy.App, e.Policy.Entry) != nil {
-			return deny("APP_DENIED")
-		}
-		if e.Runner == nil {
-			return deny("ROOT_FAILED")
-		}
-		out, err := e.Runner.Run(ctx, p.Name, digest)
-		if err != nil {
-			return deny("ROOT_FAILED")
-		}
-		return success(map[string]any{"output": out})
-	}
-	d, err := e.Store.Get(p.ID)
-	if err != nil || d.Package != e.Policy.Package || d.Revoked || (d.Lifetime != "" || !e.Now().Before(d.Expires)) || d.Job != p.Job || !contains(d.Ops, r.Op) || !e.scopeMatches(d) {
-		return deny("DELEGATION_DENIED")
-	}
-	s, code := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
-	if code != "" {
-		return deny(code)
-	}
-	root, err := e.DSM.ScopeRoot(ctx, s, d.Scope)
-	if err != nil {
-		return deny("SCOPE_DENIED")
-	}
-	// Revalidate the root so a moved home/share never inherits an old delegation.
-	check := d
-	check.Root = root
-	check.Path = scopeVirtual(d.Scope)
-	real, err := scopedPath(check, d.Path)
-	if err != nil || real != d.Root {
-		return deny("SCOPE_DENIED")
-	}
-	path := p.Path
-	if r.Op == "files.write" {
-		path = p.Dest
-	}
-	if !cleanPath(path) {
-		return deny("INVALID_REQUEST")
-	}
-	if !within(d.Path, path) {
-		return deny("SCOPE_DENIED")
-	}
-	real, err = scopedPath(d, path)
-	if err != nil {
-		return deny("SCOPE_DENIED")
-	}
-	if r.Op == "files.write" {
-		if !validName(p.Name) || !validRelative(p.Staging) {
-			return deny("INVALID_REQUEST")
-		}
-		release, err := e.acquireCopy(ctx)
-		if err != nil {
-			return deny("EXECUTOR_PAUSED")
-		}
-		defer release()
-		e.commitMu.Lock()
-		disabled, x := e.Store.Disabled()
-		fresh, x2 := e.Store.Get(d.ID)
-		e.commitMu.Unlock()
-		if x != nil || x2 != nil {
-			return deny("STORAGE_ERROR")
-		}
-		if disabled {
-			return deny("disabled")
-		}
-		if fresh.Revoked || ctx.Err() != nil {
-			return deny("DELEGATION_DENIED")
-		}
-		writerCtx := context.WithValue(ctx, writeJobKey{}, p.Job)
-		writerCtx = context.WithValue(writerCtx, legacyPublishKey{}, func(publish func() (MoveReceipt, error)) (MoveReceipt, error) {
-			current, c := e.eligible(ctx, d.Subject.Username, d.Subject.UID, true)
-			if c != "" || !sameIdentity(s, current) {
-				return MoveReceipt{}, errors.New("identity changed")
-			}
-			if _, x := e.DSM.API(ctx, s.Username, "files.checkPermission", map[string]any{"path": p.Dest}); x != nil {
-				return MoveReceipt{}, x
-			}
-			e.commitMu.Lock()
-			defer e.commitMu.Unlock()
-			disabled, x := e.Store.Disabled()
-			fresh, x2 := e.Store.Get(d.ID)
-			if x != nil || x2 != nil || disabled || fresh.Revoked || !e.Now().Before(fresh.Expires) || ctx.Err() != nil {
-				return MoveReceipt{}, errors.New("write fenced")
-			}
-			return publish()
-		})
-		if err = e.Writer.Write(writerCtx, s, p.Staging, real, p.Name, d.Root); err != nil {
-			return deny("WRITE_FAILED")
-		}
-		return success(map[string]any{"path": strings.TrimSuffix(p.Dest, "/") + "/" + p.Name})
-	}
-	args := map[string]any{"path": path}
-	if r.Op == "files.createFolder" {
-		if !validName(p.Name) {
-			return deny("INVALID_REQUEST")
-		}
-		args["name"] = p.Name
-	}
-	done, code := e.beginLegacy(d)
-	if code != "" {
-		return deny(code)
-	}
-	defer done()
-	out, err := e.DSM.API(ctx, s.Username, r.Op, args)
-	if err != nil {
-		return deny("DSM_FAILED")
-	}
-	return success(out)
-}
-func publicSubject(s Subject) any { return map[string]any{"username": s.Username, "uid": s.UID} }
-func publicDelegation(d Delegation) any {
-	out := map[string]any{"delegation_id": d.ID, "subject": publicSubject(d.Subject), "job_id": d.Job, "ops": d.Ops, "scope": d.Scope, "path": d.Path, "expires_at": d.Expires, "revoked": d.Revoked, "destination": d.DestinationKey, "lifetime": d.Lifetime}
-	if d.ScopeGeneration != 0 {
-		out["scope_generation"] = d.ScopeGeneration
-	}
-	return out
-}
-func scopeVirtual(scope string) string {
-	if scope == "home" {
-		return "/home"
-	}
-	if strings.HasPrefix(scope, "shared:") && validName(strings.TrimPrefix(scope, "shared:")) {
-		return "/" + strings.TrimPrefix(scope, "shared:")
-	}
-	return ""
-}
-func scopedPath(d Delegation, p string) (string, error) {
-	virtual := scopeVirtual(d.Scope)
-	if virtual == "" || !cleanPath(p) || !within(virtual, p) {
-		return "", errors.New("scope")
-	}
-	// Root is the bound delegation directory; Path is its File Station spelling.
-	base := d.Path
-	if base == "" {
-		base = virtual
-	}
-	if !within(base, p) {
-		return "", errors.New("scope")
-	}
-	real, err := filepath.EvalSymlinks(filepath.Join(d.Root, strings.TrimPrefix(strings.TrimPrefix(p, base), "/")))
-	if err != nil || !within(d.Root, real) {
-		return "", errors.New("scope")
-	}
-	return real, nil
-}
-func validRelative(p string) bool {
-	if p == "" || filepath.IsAbs(p) || filepath.Clean(p) != p {
-		return false
-	}
-	for _, part := range strings.Split(p, "/") {
-		if !validName(part) || part == "." {
-			return false
-		}
-	}
-	return true
-}
-
-// Permanent destinations reject every symlink component; legacy File Station
-// lookup retains its historical canonical-path semantics.
-func mappedDirectory(d Delegation, p string) (string, error) {
-	base := d.Path
-	if base == "" {
-		base = scopeVirtual(d.Scope)
-	}
-	if base == "" || !cleanPath(d.Root) || !cleanPath(p) || !within(base, p) {
-		return "", errors.New("scope")
-	}
-	real := filepath.Join(d.Root, strings.TrimPrefix(strings.TrimPrefix(p, base), "/"))
-	if _, err := bindDirectory(real); err != nil {
-		return "", err
-	}
-	return real, nil
-}