@synopackageland/cli 0.8.0 → 0.9.0

package/templates/_gateway/gateway_test.go

@@ -1,676 +0,0 @@
-package main
-
-import (
-	"bufio"
-	"errors"
-	"io"
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"strconv"
-	"strings"
-	"sync/atomic"
-	"testing"
-	"time"
-)
-
-const base = "/webman/3rdparty/App/cgi/gateway.cgi"
-
-type fakeAuth struct {
-	id    identity
-	err   error
-	calls int
-}
-
-func (f *fakeAuth) Authenticate(*http.Request) (identity, error) {
-	f.calls++
-	return f.id, f.err
-}
-
-// upstream records what reached the container.
-type upstream struct {
-	*httptest.Server
-	hits    atomic.Int32
-	request atomic.Pointer[http.Request]
-	body    atomic.Pointer[string]
-}
-
-func newUpstream(t *testing.T, handler http.HandlerFunc) *upstream {
-	t.Helper()
-	u := &upstream{}
-	u.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		u.hits.Add(1)
-		u.request.Store(r)
-		b, _ := io.ReadAll(r.Body)
-		s := string(b)
-		u.body.Store(&s)
-		handler(w, r)
-	}))
-	t.Cleanup(u.Close)
-	return u
-}
-
-func hello(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/plain")
-	io.WriteString(w, "container says hi: "+r.URL.RequestURI())
-}
-
-func newTestGateway(t *testing.T, cfg config, auth authenticator, up *upstream) http.Handler {
-	t.Helper()
-	cfg.Upstream = up.Listener.Addr().String()
-	g, err := newGateway(cfg, auth)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return g
-}
-
-func do(h http.Handler, method, target string, hdr map[string]string, body string) *httptest.ResponseRecorder {
-	r := httptest.NewRequest(method, target, strings.NewReader(body))
-	r.RemoteAddr = "192.0.2.7:51234"
-	for k, v := range hdr {
-		r.Header.Set(k, v)
-	}
-	w := httptest.NewRecorder()
-	h.ServeHTTP(w, r)
-	return w
-}
-
-var signedIn = map[string]string{"Cookie": "id=abc"}
-
-func TestSignedInUserReachesContainer(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{id: identity{User: "alice"}}
-	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/index.html?x=1", signedIn, "")
-	if w.Code != 200 || w.Body.String() != "container says hi: /index.html?x=1" {
-		t.Fatalf("%d %q", w.Code, w.Body.String())
-	}
-}
-
-func TestAnonymousRequestIsRejectedAndNeverReachesContainer(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{err: errNoSession}
-	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", nil, "")
-	if w.Code != 401 || up.hits.Load() != 0 {
-		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
-	}
-	if !strings.Contains(w.Body.String(), "session_required") {
-		t.Errorf("body %q", w.Body.String())
-	}
-}
-
-func TestExpiredSessionIsRejected(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{err: errNoSession}
-	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", signedIn, "")
-	if w.Code != 401 || up.hits.Load() != 0 {
-		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
-	}
-}
-
-func TestAuthenticatorFailureFailsClosed(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{err: errors.New("authenticate.cgi missing")}
-	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", signedIn, "")
-	if w.Code != 520 || up.hits.Load() != 0 {
-		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
-	}
-	if got := w.Header().Get("X-Synopkgland-Error"); got != "auth_unavailable" {
-		t.Errorf("X-Synopkgland-Error = %q", got)
-	}
-}
-
-func TestForgedIdentityHeadersDoNotAuthenticate(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{err: errNoSession}
-	forged := map[string]string{
-		"X-Syno-User":      "admin",
-		"X-Syno-Admin":     "true",
-		"X-Forwarded-User": "admin",
-		"X-Remote-User":    "admin",
-		"Remote-User":      "admin",
-		"X-Forwarded-For":  "127.0.0.1",
-		"X-Real-IP":        "127.0.0.1",
-		"Authorization":    "Basic YWRtaW46YWRtaW4=",
-		"X-Syno-Token":     "bogus",
-		"Cookie":           "id=forged; did=forged",
-	}
-	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", forged, "")
-	if w.Code != 401 || up.hits.Load() != 0 {
-		t.Fatalf("code=%d hits=%d", w.Code, up.hits.Load())
-	}
-}
-
-func TestContainerNeverSeesClientIdentityOrSessionHeaders(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{id: identity{User: "bob"}}
-	hdr := map[string]string{
-		"Cookie":              "id=abc; did=xyz",
-		"X-Syno-Token":        "tok",
-		"X-Syno-User":         "admin",
-		"X-Syno-Admin":        "true",
-		"X-Forwarded-User":    "admin",
-		"X-Remote-User":       "admin",
-		"Remote-User":         "admin",
-		"Remote-Groups":       "administrators",
-		"X-Forwarded-For":     "10.0.0.9",
-		"Forwarded":           "for=10.0.0.9",
-		"X-Real-IP":           "10.0.0.9",
-		"X-Auth-Request-User": "admin",
-		"Accept-Language":     "zh-TW",
-	}
-	w := do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/?SynoToken=secret&a=b", hdr, "")
-	if w.Code != 200 {
-		t.Fatalf("code=%d", w.Code)
-	}
-	got := up.request.Load()
-	for _, name := range []string{"Cookie", "X-Syno-Token", "X-Forwarded-User", "X-Remote-User", "Remote-User", "Remote-Groups", "X-Forwarded-For", "Forwarded", "X-Real-Ip", "X-Auth-Request-User"} {
-		if v := got.Header.Get(name); v != "" {
-			t.Errorf("%s reached the container: %q", name, v)
-		}
-	}
-	if got.Header.Get("X-Syno-User") != "bob" || got.Header.Get("X-Syno-Admin") != "false" {
-		t.Errorf("identity = %q / %q, want gateway-set bob/false", got.Header.Get("X-Syno-User"), got.Header.Get("X-Syno-Admin"))
-	}
-	if got.Header.Get("Accept-Language") != "zh-TW" {
-		t.Errorf("ordinary header dropped")
-	}
-	if strings.Contains(got.URL.RawQuery, "SynoToken") || got.URL.Query().Get("a") != "b" {
-		t.Errorf("query = %q", got.URL.RawQuery)
-	}
-}
-
-func TestAdminHeaderIsTrueForAdministrators(t *testing.T) {
-	up := newUpstream(t, hello)
-	auth := &fakeAuth{id: identity{User: "alice", Groups: []string{"administrators"}}}
-	do(newTestGateway(t, config{Access: "users"}, auth, up), "GET", base+"/", signedIn, "")
-	if got := up.request.Load().Header.Get("X-Syno-Admin"); got != "true" {
-		t.Errorf("X-Syno-Admin = %q", got)
-	}
-}
-
-func TestAdminsOnlyRejectsOrdinaryUsers(t *testing.T) {
-	up := newUpstream(t, hello)
-	cfg := config{Access: "admins"}
-	g := newTestGateway(t, cfg, &fakeAuth{id: identity{User: "bob", Groups: []string{"staff"}}}, up)
-	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 401 || up.hits.Load() != 0 {
-		t.Fatalf("ordinary: code=%d hits=%d", w.Code, up.hits.Load())
-	} else if w.Header().Get("X-Synopkgland-Error") != "forbidden" || w.Header().Get("X-Synopkgland-Status") != "403" {
-		t.Errorf("headers: %v", w.Header())
-	}
-	g = newTestGateway(t, cfg, &fakeAuth{id: identity{User: "alice", Groups: []string{"administrators"}}}, up)
-	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 200 {
-		t.Fatalf("admin: code=%d", w.Code)
-	}
-}
-
-func TestGroupsRejectUsersOutsideEveryListedGroup(t *testing.T) {
-	up := newUpstream(t, hello)
-	cfg := config{Access: "groups", Groups: []string{"staff", "ops"}}
-	g := newTestGateway(t, cfg, &fakeAuth{id: identity{User: "bob", Groups: []string{"users"}}}, up)
-	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 401 || up.hits.Load() != 0 || !strings.Contains(w.Body.String(), "forbidden") {
-		t.Fatalf("outsider: code=%d hits=%d body=%q", w.Code, up.hits.Load(), w.Body.String())
-	}
-	g = newTestGateway(t, cfg, &fakeAuth{id: identity{User: "carol", Groups: []string{"ops"}}}, up)
-	if w := do(g, "GET", base+"/", signedIn, ""); w.Code != 200 {
-		t.Fatalf("member: code=%d", w.Code)
-	}
-}
-
-func TestGroupsAccessWithoutGroupsIsRefusedAtStartup(t *testing.T) {
-	for _, cfg := range []config{
-		{Upstream: "127.0.0.1:1", Access: "groups"},
-		{Upstream: "127.0.0.1:1", Access: "everyone"},
-		{Upstream: "127.0.0.1:1", Access: ""},
-		{Upstream: "10.0.0.5:80", Access: "users"},
-		{Upstream: "localhost:80", Access: "users"},
-	} {
-		if _, err := newGateway(cfg, &fakeAuth{}); err == nil {
-			t.Errorf("config %+v accepted", cfg)
-		}
-	}
-	if _, err := newGateway(config{Upstream: "127.0.0.1:18333", Access: "users"}, nil); err == nil {
-		t.Error("nil authenticator accepted")
-	}
-}
-
-func TestStateChangingRequestNeedsSynoToken(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	for _, method := range []string{"POST", "PUT", "PATCH", "DELETE"} {
-		if w := do(g, method, base+"/", signedIn, "x"); w.Code != 401 || !strings.Contains(w.Body.String(), "token_required") || w.Header().Get("X-Synopkgland-Error") != "token_required" {
-			t.Errorf("%s without token: %d %q", method, w.Code, w.Body.String())
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-	hdr := browserPost("tok")
-	if w := do(g, "POST", base+"/save", hdr, "payload"); w.Code != 200 || *up.body.Load() != "payload" {
-		t.Fatalf("with token: %d body=%q", w.Code, *up.body.Load())
-	}
-}
-
-func TestQueryTokenDoesNotSatisfyStateChangingRequests(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	hdr := browserPost("")
-	delete(hdr, "X-SYNO-TOKEN")
-	for _, method := range []string{"POST", "PUT", "PATCH", "DELETE"} {
-		w := do(g, method, base+"/?SynoToken=secret", hdr, "x")
-		if w.Code != 401 || w.Header().Get("X-Synopkgland-Error") != "token_required" || strings.Contains(w.Body.String(), "secret") {
-			t.Errorf("%s with query token only: %d %q", method, w.Code, w.Body.String())
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-func TestSafeRequestsNeedNoSynoToken(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	for _, method := range []string{"GET", "HEAD"} {
-		if w := do(g, method, base+"/", signedIn, ""); w.Code != 200 {
-			t.Errorf("%s: %d", method, w.Code)
-		}
-	}
-}
-
-func TestOversizedBodyIsRefused(t *testing.T) {
-	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
-		if _, err := io.ReadAll(r.Body); err != nil {
-			w.WriteHeader(413)
-		}
-	})
-	g := newTestGateway(t, config{Access: "users", MaxBodyBytes: 4}, &fakeAuth{id: identity{User: "bob"}}, up)
-	hdr := browserPost("tok")
-	if w := do(g, "POST", base+"/", hdr, "0123456789"); w.Code != 413 {
-		t.Fatalf("code=%d", w.Code)
-	}
-}
-
-func TestContainerDownIsServiceUnavailable(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	addr := l.Addr().String()
-	l.Close()
-	g, err := newGateway(config{Upstream: addr, Access: "users"}, &fakeAuth{id: identity{User: "bob"}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	w := do(g, "GET", base+"/", signedIn, "")
-	if w.Code != 521 || w.Header().Get("Retry-After") == "" || !strings.Contains(w.Body.String(), "upstream_unavailable") {
-		t.Fatalf("code=%d retry=%q body=%q", w.Code, w.Header().Get("Retry-After"), w.Body.String())
-	}
-	if w.Header().Get("X-Synopkgland-Error") != "upstream_unavailable" || w.Header().Get("X-Synopkgland-Status") != "503" {
-		t.Errorf("headers: %v", w.Header())
-	}
-}
-
-func TestSlowContainerIsGatewayTimeout(t *testing.T) {
-	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) { time.Sleep(300 * time.Millisecond) })
-	g := newTestGateway(t, config{Access: "users", ResponseTimeoutMillis: 50}, &fakeAuth{id: identity{User: "bob"}}, up)
-	w := do(g, "GET", base+"/", signedIn, "")
-	if w.Code != 524 || !strings.Contains(w.Body.String(), "upstream_timeout") || w.Header().Get("X-Synopkgland-Status") != "504" {
-		t.Fatalf("code=%d body=%q", w.Code, w.Body.String())
-	}
-}
-
-func TestContainerCannotSetCookiesOnTheDSMOrigin(t *testing.T) {
-	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
-		http.SetCookie(w, &http.Cookie{Name: "id", Value: "evil"})
-		io.WriteString(w, "ok")
-	})
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	w := do(g, "GET", base+"/", signedIn, "")
-	if w.Code != 200 || w.Header().Get("Set-Cookie") != "" {
-		t.Fatalf("code=%d set-cookie=%q", w.Code, w.Header().Get("Set-Cookie"))
-	}
-}
-
-func TestRedirectsStayInsideTheGateway(t *testing.T) {
-	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/abs":
-			http.Redirect(w, r, "http://"+r.Host+"/next?q=1", http.StatusFound)
-		case "/root":
-			http.Redirect(w, r, "/next", http.StatusFound)
-		case "/dir/rel":
-			http.Redirect(w, r, "next", http.StatusFound)
-		case "/rel":
-			w.Header().Set("Location", "next")
-			w.WriteHeader(http.StatusFound)
-		default:
-			http.Redirect(w, r, "https://example.org/away", http.StatusFound)
-		}
-	})
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	for path, want := range map[string]string{
-		"/abs":     base + "/next?q=1",
-		"/root":    base + "/next",
-		"/rel":     "next",
-		"/dir/rel": base + "/dir/next",
-		"/ext":     "https://example.org/away",
-	} {
-		w := do(g, "GET", base+path, signedIn, "")
-		if got := w.Header().Get("Location"); w.Code != 302 || got != want {
-			t.Errorf("%s: %d Location=%q want %q", path, w.Code, got, want)
-		}
-	}
-}
-
-func TestPathsCannotEscapeTheUpstream(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	for _, target := range []string{
-		base + "/../../etc/passwd",
-		base + "/%2e%2e/%2e%2e/x",
-		base + "//evil.example/x",
-		base + "/a/../../x",
-		base + "/x%00y",
-	} {
-		if w := do(g, "GET", target, signedIn, ""); w.Code != 400 {
-			t.Errorf("%s: code=%d", target, w.Code)
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-func TestPathWithoutTrailingSlashRedirectsSoRelativeLinksWork(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	w := do(g, "GET", base+"?x=1", signedIn, "")
-	if w.Code != 308 || w.Header().Get("Location") != "gateway.cgi/?x=1" {
-		t.Fatalf("code=%d location=%q", w.Code, w.Header().Get("Location"))
-	}
-}
-
-func TestRequestOutsideTheGatewayIsNotFound(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	if w := do(g, "GET", "/somewhere/else", signedIn, ""); w.Code != 410 || w.Header().Get("X-Synopkgland-Status") != "404" {
-		t.Fatalf("code=%d headers=%v", w.Code, w.Header())
-	}
-}
-
-func TestResponsesAreNotSharedCacheable(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	w := do(g, "GET", base+"/", signedIn, "")
-	if cc := w.Header().Get("Cache-Control"); !strings.Contains(cc, "private") {
-		t.Errorf("Cache-Control = %q", cc)
-	}
-}
-
-// DSM's nginx has `scgi_intercept_errors on` and `error_page 403 404 500 502 503 504`: a CGI reply with one of
-// these statuses loses its body and headers to DSM's generic error page. Measured on DSM 7.4-90069.
-func TestNoGatewayStatusIsOneThatDSMReplaces(t *testing.T) {
-	replaced := []int{403, 404, 500, 502, 503, 504}
-	for _, intended := range replaced {
-		w := httptest.NewRecorder()
-		reply(w, intended, "some_code", "message")
-		if slices.Contains(replaced, w.Code) || w.Code < 400 {
-			t.Errorf("reply(%d) sent %d, which DSM replaces or is not an error", intended, w.Code)
-		}
-		if got := w.Header().Get("X-Synopkgland-Status"); got != strconv.Itoa(intended) {
-			t.Errorf("reply(%d): X-Synopkgland-Status = %q", intended, got)
-		}
-		if w.Header().Get("X-Synopkgland-Error") != "some_code" || !strings.HasPrefix(w.Body.String(), "some_code\n") {
-			t.Errorf("reply(%d): error code lost: %v %q", intended, w.Header(), w.Body.String())
-		}
-	}
-}
-
-func TestStatusesDSMKeepsAreSentAsTheyAre(t *testing.T) {
-	for _, status := range []int{400, 401, 413, 501, 308} {
-		w := httptest.NewRecorder()
-		reply(w, status, "some_code", "message")
-		if w.Code != status || w.Header().Get("X-Synopkgland-Status") != "" || w.Header().Get("X-Synopkgland-Error") != "some_code" {
-			t.Errorf("reply(%d): sent %d headers=%v", status, w.Code, w.Header())
-		}
-	}
-}
-
-func TestContainerErrorBodiesSurviveDSMWhenTheAppAsks(t *testing.T) {
-	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		w.Header().Set("Retry-After", "7")
-		w.Header().Set("X-App-Reason", "no-such-note")
-		w.WriteHeader(map[string]int{"/missing": 404, "/boom": 500, "/busy": 503, "/denied": 401}[r.URL.Path])
-		io.WriteString(w, `{"error":"x"}`)
-	})
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	keep := map[string]string{"Cookie": "id=abc", "X-Synopkgland-Keep-Error-Body": "1"}
-	for path, want := range map[string][2]int{"/missing": {404, 410}, "/boom": {500, 520}, "/busy": {503, 521}, "/denied": {401, 401}} {
-		plain := do(g, "GET", base+path, signedIn, "")
-		if plain.Code != want[0] || plain.Header().Get("X-Synopkgland-Status") != "" {
-			t.Errorf("%s without the header: %d %v, want the container's own %d", path, plain.Code, plain.Header(), want[0])
-		}
-		w := do(g, "GET", base+path, keep, "")
-		if w.Code != want[1] || w.Body.String() != `{"error":"x"}` || w.Header().Get("Retry-After") != "7" || w.Header().Get("X-App-Reason") != "no-such-note" {
-			t.Errorf("%s with the header: %d %q %v", path, w.Code, w.Body.String(), w.Header())
-		}
-		if want[0] != want[1] && w.Header().Get("X-Synopkgland-Status") != strconv.Itoa(want[0]) {
-			t.Errorf("%s: X-Synopkgland-Status = %q", path, w.Header().Get("X-Synopkgland-Status"))
-		}
-	}
-}
-
-func TestKeepErrorBodyLeavesSuccessAndRedirectsAlone(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	w := do(g, "GET", base+"/", map[string]string{"Cookie": "id=abc", "X-Synopkgland-Keep-Error-Body": "1"}, "")
-	if w.Code != 200 || w.Header().Get("X-Synopkgland-Status") != "" {
-		t.Fatalf("%d %v", w.Code, w.Header())
-	}
-}
-
-// Server-Sent Events work through DSM (nginx does not buffer SCGI replies there), provided the gateway hands
-// each event on as it arrives instead of holding it until the container finishes.
-func TestServerSentEventsAreForwardedAsTheyArrive(t *testing.T) {
-	release := make(chan struct{})
-	gone := make(chan struct{})
-	up := newUpstream(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "text/event-stream")
-		io.WriteString(w, "data: one\n\n")
-		w.(http.Flusher).Flush()
-		select {
-		case <-release:
-			io.WriteString(w, "data: two\n\n")
-		case <-r.Context().Done():
-			close(gone)
-		}
-	})
-	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
-	defer srv.Close()
-	req, _ := http.NewRequest("GET", srv.URL+base+"/events", nil)
-	req.Header.Set("Cookie", "id=abc")
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		t.Fatal(err)
-	}
-	line := make(chan string, 1)
-	go func() {
-		buf := make([]byte, 64)
-		n, _ := resp.Body.Read(buf)
-		line <- string(buf[:n])
-	}()
-	select {
-	case got := <-line:
-		if got != "data: one\n\n" {
-			t.Fatalf("first event = %q", got)
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("the first event was held back while the container kept the stream open")
-	}
-	resp.Body.Close()
-	select {
-	case <-gone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("the container was not told the client went away")
-	}
-}
-
-// wsEchoHandler is a container that accepts a WebSocket upgrade and then answers every chunk with "echo:"+chunk.
-func wsEchoHandler(w http.ResponseWriter, r *http.Request) {
-	conn, brw, err := w.(http.Hijacker).Hijack()
-	if err != nil {
-		return
-	}
-	defer conn.Close()
-	io.WriteString(brw, "HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n\r\n")
-	brw.Flush()
-	buf := make([]byte, 64)
-	for {
-		n, err := brw.Read(buf)
-		if n > 0 {
-			io.WriteString(conn, "echo:"+string(buf[:n]))
-		}
-		if err != nil {
-			return
-		}
-	}
-}
-
-func dialUpgrade(t *testing.T, srv *httptest.Server, headers string) (net.Conn, *bufio.Reader, string) {
-	t.Helper()
-	conn, err := net.Dial("tcp", srv.Listener.Addr().String())
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { conn.Close() })
-	conn.SetDeadline(time.Now().Add(5 * time.Second))
-	io.WriteString(conn, "GET "+base+"/ws HTTP/1.1\r\nHost: "+srv.Listener.Addr().String()+"\r\nCookie: id=abc\r\nConnection: Upgrade\r\nUpgrade: websocket\r\n"+headers+"\r\n")
-	r := bufio.NewReader(conn)
-	status, err := r.ReadString('\n')
-	if err != nil {
-		t.Fatal(err)
-	}
-	return conn, r, strings.TrimSpace(status)
-}
-
-func TestWebSocketUpgradeIsProxiedBothWays(t *testing.T) {
-	up := newUpstream(t, wsEchoHandler)
-	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
-	defer srv.Close()
-	conn, r, status := dialUpgrade(t, srv, "Origin: http://"+srv.Listener.Addr().String()+"\r\n")
-	if status != "HTTP/1.1 101 Switching Protocols" {
-		t.Fatalf("status = %q", status)
-	}
-	for line, err := r.ReadString('\n'); strings.TrimSpace(line) != ""; line, err = r.ReadString('\n') {
-		if err != nil {
-			t.Fatal(err)
-		}
-	}
-	io.WriteString(conn, "hello")
-	got := make([]byte, len("echo:hello"))
-	if _, err := io.ReadFull(r, got); err != nil || string(got) != "echo:hello" {
-		t.Fatalf("echo = %q, %v", got, err)
-	}
-	h := up.request.Load().Header
-	if h.Get("X-Syno-User") != "bob" || h.Get("Cookie") != "" || h.Get("Upgrade") != "websocket" {
-		t.Errorf("headers at the container: %v", h)
-	}
-	if up.request.Load().Host != srv.Listener.Addr().String() {
-		t.Errorf("Host at the container = %q, want the one the browser used so that same-origin checks pass", up.request.Load().Host)
-	}
-}
-
-// upgradeRefusal reads the rest of a refused handshake and returns its X-Synopkgland-Error and -Status values.
-func upgradeRefusal(t *testing.T, r *bufio.Reader) (code, intended string) {
-	t.Helper()
-	for line, err := r.ReadString('\n'); strings.TrimSpace(line) != ""; line, err = r.ReadString('\n') {
-		if err != nil {
-			t.Fatal(err)
-		}
-		name, value, _ := strings.Cut(strings.TrimSpace(line), ": ")
-		switch strings.ToLower(name) {
-		case "x-synopkgland-error":
-			code = value
-		case "x-synopkgland-status":
-			intended = value
-		}
-	}
-	return code, intended
-}
-
-func TestWebSocketFromAnotherOriginIsRefused(t *testing.T) {
-	up := newUpstream(t, wsEchoHandler)
-	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
-	defer srv.Close()
-	own := srv.Listener.Addr().String()
-	for name, headers := range map[string]string{
-		"foreign origin":       "Origin: https://evil.example\r\n",
-		"sub-domain of host":   "Origin: http://" + own + ".evil.example\r\n",
-		"origin null":          "Origin: null\r\n",
-		"fetch cross-site":     "Sec-Fetch-Site: cross-site\r\n",
-		"fetch same-site":      "Sec-Fetch-Site: same-site\r\n",
-		"cross-site, own host": "Sec-Fetch-Site: cross-site\r\nOrigin: http://" + own + "\r\n",
-	} {
-		_, r, status := dialUpgrade(t, srv, headers)
-		code, intended := upgradeRefusal(t, r)
-		if status != "HTTP/1.1 401 Unauthorized" || code != "cross_site_blocked" || intended != "403" {
-			t.Errorf("%s: %q %q %q", name, status, code, intended)
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-// Browsers always send Origin on a WebSocket handshake, so a handshake with neither Origin nor
-// Sec-Fetch-Site is not from a browser that can be trusted to scope it: the rule is the one state-changing requests use.
-func TestWebSocketWithoutAnyOriginEvidenceIsRefused(t *testing.T) {
-	up := newUpstream(t, wsEchoHandler)
-	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
-	defer srv.Close()
-	_, r, status := dialUpgrade(t, srv, "")
-	code, _ := upgradeRefusal(t, r)
-	if status != "HTTP/1.1 401 Unauthorized" || code != "cross_site_blocked" || up.hits.Load() != 0 {
-		t.Fatalf("%q %q hits=%d", status, code, up.hits.Load())
-	}
-}
-
-func TestWebSocketWithOneKindOfSameOriginEvidenceIsAllowed(t *testing.T) {
-	up := newUpstream(t, wsEchoHandler)
-	srv := httptest.NewServer(newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up))
-	defer srv.Close()
-	for name, headers := range map[string]string{
-		"origin only":         "Origin: http://" + srv.Listener.Addr().String() + "\r\n",
-		"fetch metadata only": "Sec-Fetch-Site: same-origin\r\n",
-	} {
-		if _, _, status := dialUpgrade(t, srv, headers); status != "HTTP/1.1 101 Switching Protocols" {
-			t.Errorf("%s: %q", name, status)
-		}
-	}
-}
-
-func TestWebSocketNeedsTheSameAccessAsAnyRequest(t *testing.T) {
-	up := newUpstream(t, wsEchoHandler)
-	for name, auth := range map[string]*fakeAuth{"anonymous": {err: errNoSession}, "outsider": {id: identity{User: "bob", Groups: []string{"users"}}}} {
-		srv := httptest.NewServer(newTestGateway(t, config{Access: "admins"}, auth, up))
-		_, _, status := dialUpgrade(t, srv, "")
-		srv.Close()
-		if status != "HTTP/1.1 401 Unauthorized" {
-			t.Errorf("%s: %q", name, status)
-		}
-	}
-	if up.hits.Load() != 0 {
-		t.Fatalf("hits=%d", up.hits.Load())
-	}
-}
-
-func TestOtherProtocolUpgradesAreNotSupported(t *testing.T) {
-	up := newUpstream(t, hello)
-	g := newTestGateway(t, config{Access: "users"}, &fakeAuth{id: identity{User: "bob"}}, up)
-	w := do(g, "GET", base+"/", map[string]string{"Cookie": "id=abc", "Connection": "Upgrade", "Upgrade": "h2c"}, "")
-	if w.Code != 501 || up.hits.Load() != 0 || w.Header().Get("X-Synopkgland-Error") != "upgrade_unsupported" {
-		t.Fatalf("code=%d hits=%d headers=%v", w.Code, up.hits.Load(), w.Header())
-	}
-}

package/templates/_gateway/go.mod

@@ -1,5 +0,0 @@
-module synopkgland-gateway
-
-go 1.24
-
-toolchain go1.26.9