@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go/backend/internal/api/cgi_framing_test.go

@@ -1,32 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"testing"
-)
-
-func TestJSONHasExactCGIResponseLength(t *testing.T) {
-	for _, value := range []any{map[string]any{"success": true, "data": "\u8cc7\u6599\u593e"}, map[string]any{"success": false, "error": "denied"}, make(chan int)} {
-		w := httptest.NewRecorder()
-		writeJSON(w, http.StatusOK, value)
-		if w.Header().Get("Content-Length") != strconv.Itoa(w.Body.Len()) {
-			t.Fatalf("CGI response missing exact byte length: %v", w.Header())
-		}
-		if !json.Valid(w.Body.Bytes()) {
-			t.Fatal("invalid JSON response")
-		}
-		if _, unsupported := value.(chan int); unsupported {
-			var fallback struct {
-				Success bool
-				Error   struct{ Code string }
-			}
-			_ = json.Unmarshal(w.Body.Bytes(), &fallback)
-			if w.Code != http.StatusOK || fallback.Success || fallback.Error.Code != "internal" {
-				t.Fatal("serialization failure lost DSM JSON refusal envelope")
-			}
-		}
-	}
-}

package/templates/native-go/backend/internal/api/cookie_review_test.go

@@ -1,28 +0,0 @@
-package api
-
-import (
-	"net/http/httptest"
-	"testing"
-)
-
-func TestReviewInvalidDuplicateIDMustNotBeDiscarded(t *testing.T) {
-	r := httptest.NewRequest("POST", "/", nil)
-	r.Header.Set("Cookie", "id=session; id=invalid\tvalue")
-	r.Header.Set("X-SYNO-TOKEN", "token")
-	if _, err := DSMSession(r); err == nil {
-		t.Fatal("duplicate id silently dropped; accepted request")
-	}
-}
-func TestCookieRejectsEveryASCIIControl(t *testing.T) {
-	for c := 0; c <= 127; c++ {
-		if c >= 32 && c != 127 {
-			continue
-		}
-		r := httptest.NewRequest("POST", "/", nil)
-		r.Header.Set("Cookie", "id=sess"+string(rune(c))+"ion")
-		r.Header.Set("X-SYNO-TOKEN", "token")
-		if _, err := DSMSession(r); err == nil {
-			t.Errorf("accepted control %d", c)
-		}
-	}
-}

package/templates/native-go/backend/internal/api/deadline_test.go

@@ -1,114 +0,0 @@
-package api
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-)
-
-type deadlineAuth struct {
-	t   *testing.T
-	ctx context.Context
-}
-
-func (a *deadlineAuth) Authenticate(r *http.Request) (Identity, error) {
-	a.t.Helper()
-	d, ok := r.Context().Deadline()
-	if !ok || time.Until(d) > 20*time.Second || time.Until(d) <= 0 {
-		a.t.Fatalf("authentication deadline: %v %v", d, ok)
-	}
-	a.ctx = r.Context()
-	return Identity{User: "alice", Admin: true}, nil
-}
-func TestRequestDeadlineReachesAuthenticationAndAllHandlers(t *testing.T) {
-	for _, kind := range []string{"json", "request", "response", "stream"} {
-		t.Run(kind, func(t *testing.T) {
-			auth := &deadlineAuth{t: t}
-			called := false
-			check := func(ctx context.Context, r *http.Request) {
-				t.Helper()
-				called = true
-				if ctx != auth.ctx || (r != nil && r.Context() != ctx) {
-					t.Fatal("context not propagated")
-				}
-			}
-			var route Route
-			switch kind {
-			case "json":
-				route = Handle("demo.deadline", func(ctx context.Context, _ Caller, _ json.RawMessage) (any, error) { check(ctx, nil); return nil, nil })
-			case "request":
-				route = HandleRequest("demo.deadline", func(ctx context.Context, _ Caller, r *http.Request, _ json.RawMessage) (any, error) {
-					check(ctx, r)
-					return nil, nil
-				})
-			case "response":
-				route = HandleResponse("demo.deadline", func(ctx context.Context, _ Caller, _ http.ResponseWriter, r *http.Request, _ json.RawMessage) error {
-					check(ctx, r)
-					return nil
-				})
-			case "stream":
-				route = HandleStream("demo.deadline", func(ctx context.Context, _ Caller, _ http.ResponseWriter, r *http.Request) error {
-					check(ctx, r)
-					return nil
-				})
-			}
-			srv := newTestServer(t, auth, route)
-			target := "/api.cgi"
-			if kind == "stream" {
-				target += "?method=demo.deadline"
-			}
-			r := httptest.NewRequest("POST", target, strings.NewReader(`{"method":"demo.deadline"}`))
-			r.Header.Set("Content-Type", "application/json")
-			srv.ServeHTTP(httptest.NewRecorder(), r)
-			if !called || auth.ctx.Err() != context.Canceled {
-				t.Fatalf("called=%v context=%v", called, auth.ctx)
-			}
-		})
-	}
-}
-func TestEarlierRequestDeadlinePreserved(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-	defer cancel()
-	srv := newTestServer(t, &fakeAuth{admin: true}, Handle("demo.wait", func(c context.Context, _ Caller, _ json.RawMessage) (any, error) {
-		want, _ := ctx.Deadline()
-		got, ok := c.Deadline()
-		if !ok || !got.Equal(want) {
-			t.Fatal("earlier deadline lost")
-		}
-		<-c.Done()
-		return nil, c.Err()
-	}))
-	r := httptest.NewRequest("POST", "/api.cgi", strings.NewReader(`{"method":"demo.wait"}`)).WithContext(ctx)
-	r.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	srv.ServeHTTP(w, r)
-	if !strings.Contains(w.Body.String(), `"bad_response"`) {
-		t.Fatal(w.Body.String())
-	}
-}
-
-func TestCGIDeadlineIncludesOuterIdentityMiddleware(t *testing.T) {
-	var outerDeadline time.Time
-	srv := newTestServer(t, &fakeAuth{admin: true}, Handle("demo.deadline", func(ctx context.Context, _ Caller, _ json.RawMessage) (any, error) {
-		d, _ := ctx.Deadline()
-		if !d.Equal(outerDeadline) {
-			t.Fatal("API restarted the outer CGI budget")
-		}
-		return nil, nil
-	}))
-	outer := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var ok bool
-		outerDeadline, ok = r.Context().Deadline()
-		if !ok || time.Until(outerDeadline) > 20*time.Second {
-			t.Fatal("outer middleware has no CGI deadline")
-		}
-		srv.ServeHTTP(w, r)
-	})
-	r := httptest.NewRequest("POST", "/api.cgi", strings.NewReader(`{"method":"demo.deadline"}`))
-	r.Header.Set("Content-Type", "application/json")
-	WithRequestDeadline(outer).ServeHTTP(httptest.NewRecorder(), r)
-}

package/templates/native-go/backend/internal/api/dsm-session.go

@@ -1,54 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"strings"
-	"unicode"
-)
-
-// DSMSession forwards only the current request's DSM authentication material.
-// Identical X-SYNO-TOKEN and SynoToken aliases are allowed; conflicting values
-// or multiple values for either header are refused. Tokens are never accepted
-// from request params or environment variables.
-func DSMSession(r *http.Request) (map[string]string, error) {
-	if r == nil {
-		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-	}
-	// Inspect raw headers before net/http can silently discard malformed values.
-	ids := 0
-	for _, line := range r.Header.Values("Cookie") {
-		if strings.ContainsFunc(line, func(r rune) bool { return r < 0x20 || r == 0x7f }) {
-			return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-		}
-		for _, part := range strings.Split(line, ";") {
-			name, _, _ := strings.Cut(strings.TrimSpace(part), "=")
-			if strings.TrimSpace(name) == "id" {
-				ids++
-			}
-		}
-	}
-	if ids != 1 {
-		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-	}
-	cookies := r.CookiesNamed("id")
-	if len(cookies) != 1 || cookies[0].Value == "" || len(cookies[0].Value) > 4096 || (strings.Contains(cookies[0].Value, ";") || strings.ContainsFunc(cookies[0].Value, func(r rune) bool { return r < 0x20 || r == 0x7f })) {
-		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-	}
-	token := ""
-	for _, name := range []string{"X-SYNO-TOKEN", "SynoToken"} {
-		values := r.Header.Values(name)
-		if len(values) > 1 {
-			return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-		}
-		if len(values) == 1 && values[0] != "" {
-			if token != "" && token != values[0] {
-				return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-			}
-			token = values[0]
-		}
-	}
-	if token == "" || len(token) > 4096 || strings.ContainsFunc(token, unicode.IsControl) {
-		return nil, &Error{Code: "session_required", Message: "DSM session cookie and token are required"}
-	}
-	return map[string]string{"dsm_cookie": cookies[0].Value, "dsm_synotoken": token}, nil
-}

package/templates/native-go/backend/internal/api/dsm-session_test.go

@@ -1,51 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func TestDSMSessionRequiresRequestCookieAndToken(t *testing.T) {
-	t.Setenv("HTTP_X_SYNO_TOKEN", "environment-token")
-	for _, tc := range []struct {
-		name    string
-		headers map[string][]string
-		cookies []string
-		pass    bool
-	}{
-		{"x header", map[string][]string{"X-SYNO-TOKEN": {"request-token"}}, []string{"session"}, true},
-		{"SynoToken", map[string][]string{"SynoToken": {"request-token"}}, []string{"session"}, true},
-		{"same aliases", map[string][]string{"X-SYNO-TOKEN": {"request-token"}, "SynoToken": {"request-token"}}, []string{"session"}, true},
-		{"no token", nil, []string{"session"}, false},
-		{"no cookie", map[string][]string{"X-SYNO-TOKEN": {"request-token"}}, nil, false},
-		{"duplicate cookie", map[string][]string{"X-SYNO-TOKEN": {"request-token"}}, []string{"a", "b"}, false},
-		{"duplicate header", map[string][]string{"X-SYNO-TOKEN": {"a", "b"}}, []string{"session"}, false},
-		{"conflicting aliases", map[string][]string{"X-SYNO-TOKEN": {"a"}, "SynoToken": {"b"}}, []string{"session"}, false},
-		{"oversize", map[string][]string{"X-SYNO-TOKEN": {strings.Repeat("a", 4097)}}, []string{"session"}, false},
-		{"control characters", map[string][]string{"X-SYNO-TOKEN": {"secret\r\nInjected: value"}}, []string{"session"}, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			r := httptest.NewRequest("POST", "/api.cgi?SynoToken=query-token", nil)
-			for k, values := range tc.headers {
-				for _, v := range values {
-					r.Header.Add(k, v)
-				}
-			}
-			for _, v := range tc.cookies {
-				r.AddCookie(&http.Cookie{Name: "id", Value: v})
-			}
-			got, err := DSMSession(r)
-			if (err == nil) != tc.pass {
-				t.Fatal("unexpected acceptance", err)
-			}
-			if tc.pass && (got["dsm_cookie"] != "session" || got["dsm_synotoken"] != "request-token" || len(got) != 2) {
-				t.Fatal("wrong request credentials")
-			}
-			if err != nil && strings.Contains(err.Error(), "secret") {
-				t.Fatal("credential leak")
-			}
-		})
-	}
-}

package/templates/native-go/backend/internal/api/entry_test.go

@@ -1,47 +0,0 @@
-package api
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"testing"
-)
-
-func TestEntryRefusalsReachTheBrowserAsStableCodes(t *testing.T) {
-	raw := []byte(`{"schema":1,"default":"administrators","methods":{"demo.user":"authenticated"}}`)
-	for _, tc := range []struct {
-		err  error
-		code string
-	}{
-		{ErrAdminRequired, "admin_required"},
-		{ErrAppPrivilegeDenied, "app_privilege_denied"},
-		{errors.New("bridge exited 2"), "auth_unavailable"},
-	} {
-		executed := 0
-		srv, err := NewServerWithPermissions(&fakeAuth{err: tc.err}, raw, Handle("demo.user", func(context.Context, Caller, json.RawMessage) (any, error) {
-			executed++
-			return nil, nil
-		}))
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, method := range []string{"demo.user", "future.unknown"} {
-			_, env := post(t, srv, `{"method":"`+method+`"}`)
-			if env.Error == nil || env.Error.Code != tc.code || executed != 0 {
-				t.Fatalf("%v %s: %+v executed=%d", tc.err, method, env.Error, executed)
-			}
-		}
-	}
-}
-
-func TestRequireAdminLetsHandlersReserveGlobalSettings(t *testing.T) {
-	if err := RequireAdmin(Caller{identity: Identity{User: "alice", Admin: true}, authenticated: true}); err != nil {
-		t.Fatal(err)
-	}
-	for _, c := range []Caller{{identity: Identity{User: "bob"}, authenticated: true}, {identity: Identity{User: "alice", Admin: true}}, {}} {
-		var apiErr *Error
-		if err := RequireAdmin(c); !errors.As(err, &apiErr) || apiErr.Code != "admin_required" {
-			t.Fatalf("%+v: %v", c, err)
-		}
-	}
-}

package/templates/native-go/backend/internal/api/errors.go

@@ -1,47 +0,0 @@
-package api
-
-import (
-	"context"
-	"errors"
-	"log"
-)
-
-// Error is an API error the browser may see. Any other error a handler
-// returns is logged and reported only as "internal". Errors travel in the
-// JSON envelope with HTTP 200, as DSM's own WebAPI does: DSM's web server
-// replaces the body of a CGI's 403, 404 and 5xx replies with its own page.
-type Error struct {
-	Code    string
-	Message string
-}
-
-func (e *Error) Error() string { return e.Code + ": " + e.Message }
-
-// BadRequest reports invalid params.
-func BadRequest(message string) *Error {
-	return &Error{"bad_request", message}
-}
-
-var internalError = &Error{"internal", "internal error"}
-
-func asError(err error) *Error {
-	if errors.Is(err, context.DeadlineExceeded) {
-		return &Error{"bad_response", "request timed out; retry later"}
-	}
-	if errors.Is(err, context.Canceled) {
-		return &Error{"bad_response", "request canceled"}
-	}
-	var apiErr *Error
-	if errors.As(err, &apiErr) {
-		return apiErr
-	}
-	log.Printf("handler error: %v", err)
-	return internalError
-}
-
-func asRequestError(ctx context.Context, err error) *Error {
-	if ctx.Err() != nil {
-		return asError(ctx.Err())
-	}
-	return asError(err)
-}

package/templates/native-go/backend/internal/api/permissions.go

@@ -1,161 +0,0 @@
-package api
-
-import (
-	"bytes"
-	"crypto/sha256"
-	_ "embed"
-	"encoding/json"
-	"fmt"
-	"io"
-	"unicode/utf8"
-)
-
-// AdministratorPermission names a policy rule. DSM's native SDK decides the
-// role; this token is never compared with a group or account name.
-const AdministratorPermission = "administrators"
-const MaxPermissionsBytes = 65536
-const MaxPermissionMethods = 1024
-
-//go:embed permissions.json
-var bundledPermissions []byte
-
-// SDK rules are immutable; App JSON only configures App methods.
-//
-//go:embed sdk-permissions.json
-var sdkPermissionsJSON []byte
-
-func sdkPolicy(method string) (policy, bool) {
-	var capabilities map[string]map[string]string
-	if err := json.Unmarshal(sdkPermissionsJSON, &capabilities); err != nil {
-		panic(err)
-	}
-	for _, methods := range capabilities {
-		if value, ok := methods[method]; ok {
-			rule, valid := permissionValue(value)
-			if !valid {
-				panic("invalid SDK policy")
-			}
-			return rule, true
-		}
-	}
-	return policyUnset, false
-}
-
-// Set by the CLI to bind the exact policy used for launcher generation to the
-// compiled CGI. Empty is permitted for direct Go development builds only.
-var expectedPermissionsDigest string
-var expectedSDKPermissionsDigest string
-
-type permissions struct {
-	methods map[string]policy
-}
-
-func permissionValue(value string) (policy, bool) {
-	switch value {
-	case AdministratorPermission:
-		return policyAdmin, true
-	case "authenticated":
-		return policyUser, true
-	case "public":
-		return policyPublic, true
-	}
-	return policyUnset, false
-}
-
-func (p permissions) forMethod(method string) policy {
-	if rule, ok := p.methods[method]; ok {
-		return rule
-	}
-	return policyAdmin
-}
-
-// Parse only this fixed JSON shape; aliases, duplicates, missing fields and
-// unknown permission names must fail closed instead of falling back to User.
-func parsePermissions(raw []byte) (permissions, error) {
-	invalid := func() (permissions, error) { return permissions{}, fmt.Errorf("invalid API permissions JSON") }
-	if len(raw) > MaxPermissionsBytes || !utf8.Valid(raw) {
-		return invalid()
-	}
-	d := json.NewDecoder(bytes.NewReader(raw))
-	if token, err := d.Token(); err != nil || token != json.Delim('{') {
-		return invalid()
-	}
-	p := permissions{methods: map[string]policy{}}
-	seen := map[string]bool{}
-	for d.More() {
-		token, err := d.Token()
-		key, ok := token.(string)
-		if err != nil || !ok || seen[key] {
-			return invalid()
-		}
-		seen[key] = true
-		switch key {
-		case "schema":
-			var schema float64
-			if d.Decode(&schema) != nil || schema != 1 {
-				return invalid()
-			}
-		case "default":
-			var value string
-			if d.Decode(&value) != nil || value != AdministratorPermission {
-				return invalid()
-			}
-		case "methods":
-			if token, err := d.Token(); err != nil || token != json.Delim('{') {
-				return invalid()
-			}
-			for d.More() {
-				token, err := d.Token()
-				method, ok := token.(string)
-				if err != nil || !ok || len(method) > 128 || !methodName.MatchString(method) || len(p.methods) >= MaxPermissionMethods {
-					return invalid()
-				}
-				if _, duplicate := p.methods[method]; duplicate {
-					return invalid()
-				}
-				var value string
-				if d.Decode(&value) != nil {
-					return invalid()
-				}
-				rule, ok := permissionValue(value)
-				if !ok {
-					return invalid()
-				}
-				p.methods[method] = rule
-			}
-			if token, err := d.Token(); err != nil || token != json.Delim('}') {
-				return invalid()
-			}
-		default:
-			return invalid()
-		}
-	}
-	if token, err := d.Token(); err != nil || token != json.Delim('}') || len(seen) != 3 || d.Decode(new(any)) != io.EOF {
-		return invalid()
-	}
-	return p, nil
-}
-
-func bundledPolicy() (permissions, error) {
-	if expectedSDKPermissionsDigest != "" && fmt.Sprintf("%x", sha256.Sum256(sdkPermissionsJSON)) != expectedSDKPermissionsDigest {
-		return permissions{}, fmt.Errorf("SDK policy does not match package build policy")
-	}
-	if expectedPermissionsDigest != "" && fmt.Sprintf("%x", sha256.Sum256(bundledPermissions)) != expectedPermissionsDigest {
-		return permissions{}, fmt.Errorf("API permissions do not match package build policy")
-	}
-	return parsePermissions(bundledPermissions)
-}
-
-func (r Route) declaredPermission() policy {
-	if r.policy != policyUnset {
-		return r.policy
-	}
-	p, err := bundledPolicy()
-	if err != nil {
-		return policyAdmin
-	}
-	if rule, ok := sdkPolicy(r.method); ok {
-		return rule
-	}
-	return p.forMethod(r.method)
-}

package/templates/native-go/backend/internal/api/permissions.json

@@ -1,5 +0,0 @@
-{
-  "schema": 1,
-  "default": "administrators",
-  "methods": {}
-}

package/templates/native-go/backend/internal/api/permissions_test.go

@@ -1,113 +0,0 @@
-package api
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"testing"
-)
-
-func TestDefaultPermissionsRequireAdministratorGroup(t *testing.T) {
-	for _, makeRoute := range []func(string, Handler) Route{User, Public, Admin} {
-		for method, code := range map[string]string{"future.read": "admin_required", "future.unknown": "unknown_method"} {
-			executed := 0
-			auth := &fakeAuth{user: "admin"} // Name alone confers no group membership.
-			srv, err := NewServer(auth, makeRoute("future.read", func(context.Context, Caller, json.RawMessage) (any, error) {
-				executed++
-				return nil, nil
-			}))
-			if err != nil {
-				t.Fatal(err)
-			}
-			_, env := post(t, srv, `{"method":"`+method+`","params":{"admin":true,"groups":["administrators"]}}`)
-			if env.Error == nil || env.Error.Code != code || executed != 0 || auth.calls != 1 {
-				t.Fatalf("method=%s error=%+v executed=%d auth=%d", method, env.Error, executed, auth.calls)
-			}
-		}
-	}
-}
-
-func TestCentralPermissionsAreTheOnlyAccessDecision(t *testing.T) {
-	called := 0
-	h := func(context.Context, Caller, json.RawMessage) (any, error) { called++; return nil, nil }
-	// A public constructor is unable to widen the default. The JSON explicitly
-	// opens only these two methods; an admin constructor cannot override it.
-	raw := []byte(`{"schema":1,"default":"administrators","methods":{"demo.user":"authenticated","demo.ping":"public"}}`)
-	auth := &fakeAuth{user: "bob"}
-	srv, err := NewServerWithPermissions(auth, raw, Admin("demo.user", h), Handle("demo.ping", h), Public("demo.private", h))
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct{ method, code string }{
-		{"demo.user", ""}, {"demo.ping", ""}, {"demo.private", "admin_required"}, {"future.unknown", "unknown_method"},
-	} {
-		_, env := post(t, srv, `{"method":"`+tc.method+`"}`)
-		if tc.code == "" {
-			if !env.Success {
-				t.Fatalf("%s: %+v", tc.method, env.Error)
-			}
-		} else if env.Error == nil || env.Error.Code != tc.code {
-			t.Fatalf("%s: %+v", tc.method, env.Error)
-		}
-	}
-	if called != 2 || auth.calls != 3 {
-		t.Fatalf("called=%d auth=%d", called, auth.calls)
-	}
-	auth.err = ErrNoSession
-	if _, env := post(t, srv, `{"method":"demo.user"}`); env.Error == nil || env.Error.Code != "session_required" {
-		t.Fatal(env)
-	}
-}
-
-func TestPermissionsRefuseUnknownMethods(t *testing.T) {
-	s, err := NewServerWithPermissions(&fakeAuth{}, []byte(`{"schema":1,"default":"administrators","methods":{"typo.method":"authenticated"}}`))
-	if err == nil || s != nil {
-		t.Fatal("accepted unregistered permission")
-	}
-}
-
-func TestAdministratorGroupMembershipDoesNotDependOnAccountName(t *testing.T) {
-	auth := &fakeAuth{user: "alice", admin: true}
-	s, err := NewServer(auth, Handle("demo.read", func(_ context.Context, c Caller, _ json.RawMessage) (any, error) { return c.User(), nil }))
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, env := post(t, s, `{"method":"demo.read"}`); !env.Success {
-		t.Fatal(env)
-	}
-	auth.admin = false
-	if _, env := post(t, s, `{"method":"demo.read"}`); env.Error == nil || env.Error.Code != "admin_required" {
-		t.Fatal(env)
-	}
-}
-
-func TestBuildPolicyDigestMismatchFailsClosed(t *testing.T) {
-	before := expectedPermissionsDigest
-	t.Cleanup(func() { expectedPermissionsDigest = before })
-	expectedPermissionsDigest = "mismatch"
-	if srv, err := NewServer(&fakeAuth{}, Handle("demo.read", func(context.Context, Caller, json.RawMessage) (any, error) { return nil, nil })); err == nil || srv != nil {
-		t.Fatal("digest mismatch accepted")
-	}
-}
-
-func TestPermissionParserSharedContract(t *testing.T) {
-	raw, err := os.ReadFile("testdata/permissions-cases.json")
-	if err != nil {
-		t.Fatal(err)
-	}
-	var cases []struct {
-		Name, JSON string
-		Valid      bool
-	}
-	if err = json.Unmarshal(raw, &cases); err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range cases {
-		t.Run(tc.Name, func(t *testing.T) {
-			_, err := parsePermissions([]byte(tc.JSON))
-			if (err == nil) != tc.Valid {
-				t.Fatalf("valid=%v error=%v", tc.Valid, err)
-			}
-		})
-	}
-}

package/templates/native-go/backend/internal/api/policy_fixture_test.go

@@ -1,8 +0,0 @@
-package api
-
-// API unit tests register synthetic demo/future methods rather than App routes.
-// Use an empty App policy for these isolated registries. Tests in internal/app
-// and internal/delegate still exercise the actual bundled package policy.
-func init() {
-	bundledPermissions = []byte(`{"schema":1,"default":"administrators","methods":{}}`)
-}