@synopackageland/cli 0.8.0 → 0.9.0

package/templates/_executor/watch_test.go

@@ -1,291 +0,0 @@
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-)
-
-func TestLifecycleWatch(t *testing.T) {
-	for _, action := range []string{"stop", "purge"} {
-		t.Run(action, func(t *testing.T) {
-			root := t.TempDir()
-			pkg := filepath.Join(root, "package")
-			control := filepath.Join(pkg, "var", "executor", "control")
-			os.MkdirAll(filepath.Dir(control), 0700)
-			os.WriteFile(filepath.Join(pkg, "INFO"), []byte("package=\"TestApp\"\nversion=\"1\"\n"), 0600)
-			monitor := newLifecycleMonitor("TestApp", pkg, control, func(string) {})
-			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-			defer cancel()
-			result := make(chan string, 1)
-			go func() { result <- monitor.watch(ctx, time.Millisecond) }()
-			select {
-			case got := <-result:
-				t.Fatalf("stopped healthy package: %s", got)
-			case <-time.After(10 * time.Millisecond):
-			}
-			switch action {
-			default:
-				os.WriteFile(control, []byte(action+"\n"), 0600)
-			}
-			got := <-result
-			want := "purge"
-			if action == "stop" {
-				want = "stop"
-			}
-			if got != want || ctx.Err() != nil {
-				t.Fatalf("got %q, want %q (%v)", got, want, ctx.Err())
-			}
-			state := filepath.Join(root, "state")
-			socket := filepath.Join(root, "socket")
-			os.MkdirAll(filepath.Join(state, "runtime"), 0700)
-			os.MkdirAll(filepath.Join(state, "delegations"), 0700)
-			os.MkdirAll(socket, 0700)
-			if err := finishControl(state, filepath.Join(state, "runtime"), socket, got == "purge"); err != nil {
-				t.Fatal(err)
-			}
-			if _, err := os.Stat(socket); !os.IsNotExist(err) {
-				t.Fatal("socket survived")
-			}
-			_, err := os.Stat(state)
-			if (got == "purge") != os.IsNotExist(err) {
-				t.Fatal("wrong protected state retention", err)
-			}
-		})
-	}
-}
-
-// Observe exactly one filesystem poll at an injected time. Cancellation ends a
-// poll that has no action, without sleeping or waiting ten real minutes.
-func observeLifecycle(t *testing.T, m *lifecycleMonitor, now time.Time) string {
-	t.Helper()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	m.now = func() time.Time { cancel(); return now }
-	return m.watch(ctx, time.Hour)
-}
-
-func TestMissingPackagePurgeRequiresTenContinuousMinutes(t *testing.T) {
-	for _, missing := range []string{"directory", "INFO", "identity", "mismatch", "duplicate"} {
-		t.Run(missing, func(t *testing.T) {
-			pkg := filepath.Join(t.TempDir(), "package")
-			if err := os.Mkdir(pkg, 0700); err != nil {
-				t.Fatal(err)
-			}
-			info := filepath.Join(pkg, "INFO")
-			content := "package=\"TestApp\"\n"
-			switch missing {
-			case "directory":
-				if err := os.Remove(pkg); err != nil {
-					t.Fatal(err)
-				}
-			case "identity":
-				content = "version=\"2\"\n"
-			case "mismatch":
-				content = "package=\"OtherApp\"\n"
-			case "duplicate":
-				content += content
-			}
-			if missing != "directory" && missing != "INFO" {
-				if err := os.WriteFile(info, []byte(content), 0600); err != nil {
-					t.Fatal(err)
-				}
-			}
-			m := newLifecycleMonitor("TestApp", pkg, filepath.Join(pkg, "control"), func(string) {})
-			start := time.Unix(1000, 0)
-			for _, elapsed := range []time.Duration{0, time.Minute, 10*time.Minute - time.Nanosecond} {
-				if got := observeLifecycle(t, m, start.Add(elapsed)); got != "stop" {
-					t.Fatalf("at %s: %q", elapsed, got)
-				}
-			}
-			if got := observeLifecycle(t, m, start.Add(10*time.Minute)); got != "purge" {
-				t.Fatalf("at cutoff: %q", got)
-			}
-		})
-	}
-}
-
-func TestMissingPackageTimerResetsWhenIdentityReturns(t *testing.T) {
-	pkg := t.TempDir()
-	info := filepath.Join(pkg, "INFO")
-	m := newLifecycleMonitor("TestApp", pkg, filepath.Join(pkg, "control"), func(string) {})
-	start := time.Unix(1000, 0)
-	if got := observeLifecycle(t, m, start); got != "stop" {
-		t.Fatal(got)
-	}
-	if err := os.WriteFile(info, []byte("package=\"TestApp\"\n"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	if got := observeLifecycle(t, m, start.Add(9*time.Minute)); got != "stop" {
-		t.Fatal(got)
-	}
-	if err := os.Remove(info); err != nil {
-		t.Fatal(err)
-	}
-	if got := observeLifecycle(t, m, start.Add(10*time.Minute)); got != "stop" {
-		t.Fatal("timer not reset", got)
-	}
-	if got := observeLifecycle(t, m, start.Add(19*time.Minute)); got != "stop" {
-		t.Fatal("purged too soon", got)
-	}
-	if got := observeLifecycle(t, m, start.Add(20*time.Minute)); got != "purge" {
-		t.Fatal("missing fallback purge", got)
-	}
-}
-
-func TestPurgeMailboxOverridesMissingPackageGracePeriod(t *testing.T) {
-	pkg := filepath.Join(t.TempDir(), "missing")
-	control := filepath.Join(t.TempDir(), "control")
-	if err := os.WriteFile(control, []byte("purge\n"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	m := newLifecycleMonitor("TestApp", pkg, control, func(string) {})
-	if got := observeLifecycle(t, m, time.Unix(1000, 0)); got != "purge" {
-		t.Fatal("purge mailbox delayed", got)
-	}
-}
-
-func TestMissingPackageRejectsStartAndUnreadableInfoResetsAbsence(t *testing.T) {
-	pkg := t.TempDir()
-	info := filepath.Join(pkg, "INFO")
-	control := filepath.Join(pkg, "control")
-	if err := os.WriteFile(control, []byte("start\n"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	m := newLifecycleMonitor("TestApp", pkg, control, func(string) {})
-	start := time.Unix(1000, 0)
-	if got := observeLifecycle(t, m, start); got != "stop" {
-		t.Fatal("start accepted without package identity", got)
-	}
-	// A symlink cannot be trusted as INFO, but does not prove it is absent.
-	if err := os.Symlink(control, info); err != nil {
-		t.Fatal(err)
-	}
-	if got := observeLifecycle(t, m, start.Add(9*time.Minute)); got != "stop" {
-		t.Fatal("unreadable identity resumed or purged", got)
-	}
-	if err := os.Remove(info); err != nil {
-		t.Fatal(err)
-	}
-	if got := observeLifecycle(t, m, start.Add(10*time.Minute)); got != "stop" {
-		t.Fatal("unverified absence counted toward purge", got)
-	}
-	if got := observeLifecycle(t, m, start.Add(20*time.Minute)); got != "purge" {
-		t.Fatal("confirmed absence did not purge", got)
-	}
-}
-
-func TestReappearedPackageHonorsStopCapturedBeforeApprovedBoot(t *testing.T) {
-	pkg := t.TempDir()
-	info := filepath.Join(pkg, "INFO")
-	control := filepath.Join(pkg, "control")
-	if err := os.WriteFile(control, []byte("stop\n"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	m := newLifecycleMonitor("TestApp", pkg, control, func(string) {})
-	start := time.Unix(1000, 0)
-	if got := observeLifecycle(t, m, start); got != "stop" {
-		t.Fatal(got)
-	}
-	if err := os.WriteFile(info, []byte("package=\"TestApp\"\n"), 0600); err != nil {
-		t.Fatal(err)
-	}
-	m.now = func() time.Time { return start.Add(time.Minute) }
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	if got := m.watch(ctx, time.Millisecond); got != "stop" || ctx.Err() != nil {
-		t.Fatal("old stop ignored after absence", got, ctx.Err())
-	}
-}
-func TestLifecycleWatchIgnoresInvalidControlAndResumesAfterOldStop(t *testing.T) {
-	root := t.TempDir()
-	pkg := filepath.Join(root, "package")
-	control := filepath.Join(pkg, "var", "executor", "control")
-	os.MkdirAll(filepath.Dir(control), 0700)
-	os.WriteFile(filepath.Join(pkg, "INFO"), []byte("package=\"TestApp\"\n"), 0600)
-	os.WriteFile(control, []byte("stop\n"), 0600)
-	var mu sync.Mutex
-	logs := 0
-	observed := make(chan struct{}, 32)
-	monitor := newLifecycleMonitor("TestApp", pkg, control, func(string) { mu.Lock(); logs++; mu.Unlock(); observed <- struct{}{} })
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	result := make(chan string, 1)
-	go func() { result <- monitor.watch(ctx, time.Millisecond) }()
-	checkRunning := func() {
-		t.Helper()
-		select {
-		case got := <-result:
-			t.Fatalf("unexpected action %q", got)
-		case <-time.After(12 * time.Millisecond):
-		}
-	}
-	checkRunning()
-	for _, value := range []string{"STOP", " purge", "purge\n\n", "purge;id", "wrong"} {
-		os.WriteFile(control, []byte(value), 0600)
-		select {
-		case <-observed:
-		case got := <-result:
-			t.Fatalf("unexpected action %q", got)
-		case <-ctx.Done():
-			t.Fatal("invalid request not observed")
-		}
-	}
-	mu.Lock()
-	count := logs
-	mu.Unlock()
-	if count < 5 {
-		t.Fatalf("missing invalid-control logs: %d", count)
-	}
-	// Atomic replacement is a fresh request, even when its contents match old stop.
-	next := control + ".new"
-	os.WriteFile(next, []byte("stop\n"), 0600)
-	os.Rename(next, control)
-	if got := <-result; got != "stop" || ctx.Err() != nil {
-		t.Fatal(got, ctx.Err())
-	}
-}
-func TestLifecycleWatchHonorsPendingPurgeAtStartup(t *testing.T) {
-	root := t.TempDir()
-	os.WriteFile(filepath.Join(root, "INFO"), []byte("package=\"TestApp\"\n"), 0600)
-	control := filepath.Join(root, "control")
-	os.WriteFile(control, []byte("purge\n"), 0600)
-	monitor := newLifecycleMonitor("TestApp", root, control, func(string) {})
-	if got := monitor.watch(context.Background(), time.Millisecond); got != "purge" {
-		t.Fatal(got)
-	}
-}
-
-func TestLifecycleMonitorReadsStartAfterStopAndKeepsCheckingPurge(t *testing.T) {
-	dir := realTestPath(t, t.TempDir())
-	os.WriteFile(filepath.Join(dir, "INFO"), []byte("package=\"TestApp\"\n"), 0600)
-	control := filepath.Join(dir, "control")
-	monitor := newLifecycleMonitor("TestApp", dir, control, func(string) {})
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	for _, action := range []string{"stop", "start", "stop", "purge"} {
-		tmp := control + ".new"
-		os.WriteFile(tmp, []byte(action+"\n"), 0600)
-		os.Rename(tmp, control)
-		if got := monitor.watch(ctx, time.Millisecond); got != action || ctx.Err() != nil {
-			t.Fatal(got, action, ctx.Err())
-		}
-	}
-}
-
-// A supervisor restart is not a new administrator approval: the stop already in
-// the mailbox keeps the revived monitor paused.
-func TestRevivedMonitorHonorsStopAlreadyInMailbox(t *testing.T) {
-	pkg := t.TempDir()
-	os.WriteFile(filepath.Join(pkg, "INFO"), []byte("package=\"TestApp\"\n"), 0600)
-	control := filepath.Join(pkg, "control")
-	os.WriteFile(control, []byte("stop\n"), 0600)
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-	defer cancel()
-	if got := newRevivedLifecycleMonitor("TestApp", pkg, control, func(string) {}).watch(ctx, time.Millisecond); got != "stop" || ctx.Err() != nil {
-		t.Fatal("revived monitor ignored stop", got, ctx.Err())
-	}
-}

package/templates/_executor/write_review_linux_test.go

@@ -1,87 +0,0 @@
-//go:build linux
-
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-)
-
-func TestReviewCanceledWriteDoesNotLeavePartialDestination(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("requires disposable local Linux root runner")
-	}
-	base, err := os.MkdirTemp("/tmp", "p2review-write-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(base)
-	os.Chmod(base, 0711)
-	stage, dest := filepath.Join(base, "stage"), filepath.Join(base, "dest")
-	os.Mkdir(stage, 0700)
-	os.Mkdir(dest, 0700)
-	s := Subject{UID: 1200, GID: 100, Groups: []int{100}}
-	os.Chown(dest, s.UID, s.GID)
-	src, err := os.Create(filepath.Join(stage, "source"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err = src.Truncate(8 << 30); err != nil {
-		src.Close()
-		t.Skip(err)
-	}
-	src.Close()
-	binary, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	launcher := filepath.Join(base, "child")
-	body := "#!/bin/sh\nexport W3_MOVE_CHILD=\"$1\"\nexec " + strconv.Quote(binary) + " -test.run=^TestMoveChild$ 2>" + strconv.Quote(filepath.Join(base, "error")) + "\n"
-	os.WriteFile(launcher, []byte(body), 0700)
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	done := make(chan error, 1)
-	w := subprocessWriter{Staging: stage, Executable: launcher, PackageUID: 0}
-	go func() {
-		done <- w.Write(context.WithValue(ctx, writeJobKey{}, "job1"), s, "source", dest, "file", dest)
-	}()
-	target := filepath.Join(dest, "file")
-	deadline := time.After(3 * time.Second)
-	for {
-		entries, _ := os.ReadDir(dest)
-		writing := false
-		for _, entry := range entries {
-			info, _ := entry.Info()
-			if info != nil && info.Size() > 0 {
-				writing = true
-			}
-		}
-		if writing {
-			break
-		}
-		select {
-		case err := <-done:
-			b, _ := os.ReadFile(filepath.Join(base, "error"))
-			t.Fatalf("child ended before write: %v %s", err, b)
-		case <-deadline:
-			t.Fatal("write did not start")
-		default:
-			time.Sleep(time.Millisecond)
-		}
-	}
-	cancel()
-	if err := <-done; err == nil {
-		t.Fatal("expected cancellation")
-	}
-	entries, _ := os.ReadDir(dest)
-	if len(entries) != 0 {
-		t.Fatal("temporary file survived cancellation", entries)
-	}
-	if _, err = os.Stat(target); !os.IsNotExist(err) {
-		t.Fatal("WRITE_FAILED left a partial destination")
-	}
-}

package/templates/_gateway/auth.go

@@ -1,101 +0,0 @@
-package main
-
-// DSM runs a package's CGI as the package account and forwards the browser's
-// cookies. The authenticator hands only the session carriers (cookie,
-// SynoToken, client address) to DSM's own authenticate.cgi, which prints the
-// signed-in user name, then resolves local groups or directory groups through DSM NSS.
-// It never parses the session cookie or trusts a user name from the request.
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/http"
-	"net/url"
-	"os/exec"
-	"regexp"
-	"strings"
-	"time"
-)
-
-// authenticateCGI is DSM's session check for third-party CGIs.
-const authenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
-
-var errNoSession = errors.New("no valid DSM session")
-
-type identity struct {
-	User   string
-	Groups []string
-}
-
-type authenticator interface {
-	Authenticate(r *http.Request) (identity, error)
-}
-
-type dsmAuthenticator struct {
-	groupFile       string
-	passwdFile      string
-	directoryGroups func(context.Context, string) ([]string, error)
-	timeout         time.Duration
-	run             func(ctx context.Context, path string, env []string) ([]byte, error)
-}
-
-func newDSMAuthenticator() *dsmAuthenticator {
-	return &dsmAuthenticator{groupFile: "/etc/group", passwdFile: "/etc/passwd", timeout: 10 * time.Second, run: runCGI, directoryGroups: (directoryLookup{timeout: 2 * time.Second, run: runDirectoryCommand}).groups}
-}
-
-var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,193}$`)
-
-func (a *dsmAuthenticator) Authenticate(r *http.Request) (identity, error) {
-	cookie := r.Header.Get("Cookie")
-	if cookie == "" {
-		return identity{}, errNoSession
-	}
-	ctx, cancel := context.WithTimeout(r.Context(), a.timeout)
-	defer cancel()
-	out, err := a.run(ctx, authenticateCGI, sessionEnv(r, cookie))
-	var exit interface{ ExitCode() int }
-	if errors.As(err, &exit) {
-		return identity{}, errNoSession
-	}
-	if err != nil {
-		return identity{}, fmt.Errorf("run %s: %w", authenticateCGI, err)
-	}
-	user := strings.TrimSpace(string(out))
-	if !userName.MatchString(user) {
-		return identity{}, errNoSession
-	}
-	groups, err := a.groupsOf(ctx, user)
-	if err != nil {
-		return identity{}, err
-	}
-	return identity{User: user, Groups: groups}, nil
-}
-
-// sessionEnv is the complete environment authenticate.cgi sees: nothing from
-// this process and no request header besides the session carriers.
-func sessionEnv(r *http.Request, cookie string) []string {
-	token := r.Header.Get("X-SYNO-TOKEN")
-	if token == "" {
-		// A navigation or iframe cannot send the header; DSM's front end appends ?SynoToken= instead.
-		token = r.URL.Query().Get("SynoToken")
-	}
-	host, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		host = r.RemoteAddr
-	}
-	return []string{
-		"REQUEST_METHOD=GET",
-		"HTTP_COOKIE=" + cookie,
-		"HTTP_X_SYNO_TOKEN=" + token,
-		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
-		"REMOTE_ADDR=" + host,
-	}
-}
-
-func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, path)
-	cmd.Env = env
-	return cmd.Output()
-}

package/templates/_gateway/auth_test.go

@@ -1,216 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-	"testing"
-)
-
-const groupFile = `root:x:0:
-users:x:100:
-administrators:x:101:admin,alice
-staff:x:1030:alice,carol
-http:x:1023:
-`
-
-// DSM keeps no member list for users: the group is every local account's primary group.
-const passwdFile = `root:x:0:0::/root:/bin/sh
-alice:x:1001:100::/var/services/homes/alice:/sbin/nologin
-bob:x:1002:100::/var/services/homes/bob:/sbin/nologin
-carol:x:1003:100::/var/services/homes/carol:/sbin/nologin
-dave:x:1004:1030::/var/services/homes/dave:/sbin/nologin
-`
-
-type fakeRunner struct {
-	out  string
-	err  error
-	env  []string
-	path string
-}
-
-func (f *fakeRunner) run(_ context.Context, path string, env []string) ([]byte, error) {
-	f.path, f.env = path, env
-	return []byte(f.out), f.err
-}
-
-type exitError struct{}
-
-func (*exitError) Error() string { return "exit status 1" }
-func (*exitError) ExitCode() int { return 1 }
-
-func newTestAuth(t *testing.T, runner *fakeRunner) *dsmAuthenticator {
-	t.Helper()
-	dir := t.TempDir()
-	groups, passwd := filepath.Join(dir, "group"), filepath.Join(dir, "passwd")
-	for path, content := range map[string]string{groups: groupFile, passwd: passwdFile} {
-		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-	a := newDSMAuthenticator()
-	a.groupFile, a.passwdFile = groups, passwd
-	a.run = runner.run
-	return a
-}
-
-func sessionRequest() *http.Request {
-	r := httptest.NewRequest(http.MethodGet, "/webman/3rdparty/App/cgi/gateway.cgi/", nil)
-	r.RemoteAddr = "192.0.2.7:51234"
-	r.Header.Set("Cookie", "id=abc; did=xyz")
-	r.Header.Set("X-SYNO-TOKEN", "tok+en/=")
-	r.Header.Set("User-Agent", "should-not-pass")
-	return r
-}
-
-func TestUserAndGroupsComeFromAuthenticateCGIAndGroupFile(t *testing.T) {
-	runner := &fakeRunner{out: "alice\n"}
-	id, err := newTestAuth(t, runner).Authenticate(sessionRequest())
-	if err != nil || id.User != "alice" {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-	if want := []string{"users", "administrators", "staff"}; !slices.Equal(id.Groups, want) {
-		t.Errorf("groups = %v, want %v", id.Groups, want)
-	}
-	if runner.path != authenticateCGI {
-		t.Errorf("ran %q", runner.path)
-	}
-}
-
-func TestOrdinaryUserHasNoAdministratorsGroup(t *testing.T) {
-	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
-	if err != nil || id.User != "bob" || slices.Contains(id.Groups, "administrators") {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-}
-
-func TestPrimaryGroupCountsAsMembershipEvenWithoutAMemberListEntry(t *testing.T) {
-	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
-	if err != nil || !slices.Equal(id.Groups, []string{"users"}) {
-		t.Fatalf("got %+v, %v", id, err)
-	}
-}
-
-func TestPrimaryGroupIsNotDuplicatedWhenAlsoListedAsMember(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: "dave"})
-	if err := os.WriteFile(a.groupFile, []byte("staff:x:1030:dave\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	id, _ := a.Authenticate(sessionRequest())
-	if !slices.Equal(id.Groups, []string{"staff"}) {
-		t.Fatalf("groups = %v", id.Groups)
-	}
-}
-
-func TestMissingPasswdFileFailsClosedWithoutBeingNoSession(t *testing.T) {
-	a := newTestAuth(t, &fakeRunner{out: "bob"})
-	a.passwdFile = filepath.Join(t.TempDir(), "absent")
-	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, errNoSession) {
-		t.Fatalf("err = %v", err)
-	}
-}
-
-func TestOnlySessionCarriersReachAuthenticateCGI(t *testing.T) {
-	runner := &fakeRunner{out: "alice"}
-	if _, err := newTestAuth(t, runner).Authenticate(sessionRequest()); err != nil {
-		t.Fatal(err)
-	}
-	want := []string{
-		"HTTP_COOKIE=id=abc; did=xyz",
-		"HTTP_X_SYNO_TOKEN=tok+en/=",
-		"QUERY_STRING=SynoToken=tok%2Ben%2F%3D",
-		"REMOTE_ADDR=192.0.2.7",
-		"REQUEST_METHOD=GET",
-	}
-	got := slices.Clone(runner.env)
-	slices.Sort(got)
-	if !slices.Equal(got, want) {
-		t.Fatalf("env = %q\nwant  %q", got, want)
-	}
-}
-
-func TestMissingCookieNeverRunsAuthenticateCGI(t *testing.T) {
-	runner := &fakeRunner{out: "alice"}
-	r := sessionRequest()
-	r.Header.Del("Cookie")
-	_, err := newTestAuth(t, runner).Authenticate(r)
-	if !errors.Is(err, errNoSession) || runner.path != "" {
-		t.Fatalf("err=%v ran=%q", err, runner.path)
-	}
-}
-
-func TestExpiredOrMalformedSessionsAreNoSession(t *testing.T) {
-	for name, runner := range map[string]*fakeRunner{
-		"expired session (exit status)": {err: &exitError{}},
-		"empty output":                  {out: "\n"},
-		"two lines":                     {out: "alice\nadmin\n"},
-		"html output":                   {out: "<html>login</html>"},
-		"overlong name":                 {out: strings.Repeat("a", 200)},
-		"space in name":                 {out: "alice admin"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			_, err := newTestAuth(t, runner).Authenticate(sessionRequest())
-			if !errors.Is(err, errNoSession) {
-				t.Fatalf("err = %v", err)
-			}
-		})
-	}
-}
-
-func TestAuthenticateCGIThatCannotRunFailsClosedWithoutBeingNoSession(t *testing.T) {
-	_, err := newTestAuth(t, &fakeRunner{err: errors.New("fork/exec: no such file")}).Authenticate(sessionRequest())
-	if err == nil || errors.Is(err, errNoSession) {
-		t.Fatalf("err = %v", err)
-	}
-}
-
-func TestGroupMembershipIsReadFreshOnEveryRequest(t *testing.T) {
-	runner := &fakeRunner{out: "carol"}
-	a := newTestAuth(t, runner)
-	id, _ := a.Authenticate(sessionRequest())
-	if !slices.Equal(id.Groups, []string{"users", "staff"}) {
-		t.Fatalf("groups = %v", id.Groups)
-	}
-	if err := os.WriteFile(a.groupFile, []byte("users:x:100:\nstaff:x:1030:alice\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	id, _ = a.Authenticate(sessionRequest())
-	if !slices.Equal(id.Groups, []string{"users"}) {
-		t.Fatalf("groups after removal = %v", id.Groups)
-	}
-}
-
-func tokenEnv(t *testing.T, r *http.Request) []string {
-	t.Helper()
-	runner := &fakeRunner{out: "alice"}
-	if _, err := newTestAuth(t, runner).Authenticate(r); err != nil {
-		t.Fatal(err)
-	}
-	return runner.env
-}
-
-func TestQueryTokenIsUsedWhenHeaderIsEmpty(t *testing.T) {
-	r := sessionRequest()
-	r.Header.Del("X-SYNO-TOKEN")
-	r.URL.RawQuery = "a=b&SynoToken=q%2Btok"
-	env := tokenEnv(t, r)
-	for _, want := range []string{"HTTP_X_SYNO_TOKEN=q+tok", "QUERY_STRING=SynoToken=q%2Btok"} {
-		if !slices.Contains(env, want) {
-			t.Fatalf("env = %q, missing %q", env, want)
-		}
-	}
-}
-
-func TestHeaderTokenWinsOverQueryToken(t *testing.T) {
-	r := sessionRequest()
-	r.URL.RawQuery = "SynoToken=from-query"
-	env := tokenEnv(t, r)
-	if !slices.Contains(env, "HTTP_X_SYNO_TOKEN=tok+en/=") || slices.Contains(env, "QUERY_STRING=SynoToken=from-query") {
-		t.Fatalf("env = %q", env)
-	}
-}