@synopackageland/cli 0.8.0 → 0.9.1

package/templates/native-go/backend/internal/filestation/check_permission.go

@@ -1,71 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"net/http"
-	"time"
-)
-
-// CheckPermission is an online write check with the current user's session.
-// It creates no probe file and does not grant any offline authority.
-func (c *Client) CheckPermission(ctx context.Context, r *http.Request, path string) error {
-	auth, err := api.DSMSession(r)
-	if err != nil {
-		return err
-	}
-	r = r.Clone(ctx)
-	r.Header.Set("X-SYNO-TOKEN", auth["dsm_synotoken"])
-	if !validPath(path) {
-		return fail("invalid-request")
-	}
-	v := fields("SYNO.FileStation.CheckPermission", "write", "3")
-	v.Set("path", path)
-	v.Set("filename", ".synopkgland-permission-probe")
-	v.Set("overwrite", "false")
-	v.Set("size", "0")
-	var data map[string]json.RawMessage
-	if err := c.call(ctx, r, v, &data); err != nil {
-		return err
-	}
-	var skip *bool
-	if json.Unmarshal(data["blSkip"], &skip) != nil || skip == nil || *skip {
-		return fail("denied")
-	}
-	// File Station can return per-file refusal inside a success envelope.
-	for _, key := range []string{"error", "errors"} {
-		if raw := data[key]; len(raw) != 0 && string(raw) != "null" && string(raw) != "[]" {
-			return fail("denied")
-		}
-	}
-	return nil
-}
-
-// Keep the original DSMClient contract usable by existing read-only adapters.
-// An adapter lacking the new method refuses the write check.
-type permissionClient interface {
-	CheckPermission(context.Context, *http.Request, string) error
-}
-
-func (s *Service) CheckPermission(ctx context.Context, caller api.Caller, r *http.Request, path string) error {
-	if !validPath(path) {
-		return fail("invalid-request")
-	}
-	auth, err := api.DSMSession(r)
-	if err != nil {
-		return err
-	}
-	r = r.Clone(ctx)
-	r.Header.Set("X-SYNO-TOKEN", auth["dsm_synotoken"])
-	ctx, cancel := context.WithTimeout(ctx, 20*time.Second)
-	defer cancel()
-	if err := s.verify(ctx, caller, r); err != nil {
-		return err
-	}
-	client, ok := s.client.(permissionClient)
-	if !ok {
-		return fail("unsupported")
-	}
-	return client.CheckPermission(ctx, r, path)
-}

package/templates/native-go/backend/internal/filestation/check_permission_test.go

@@ -1,77 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestCheckPermissionRequiresVerifiedSessionAndExplicitWriteResult(t *testing.T) {
-	for _, body := range []string{`{"blSkip":false}`, `{}`, `{"blSkip":true}`, `{"blSkip":null}`, `{"blSkip":false,"errors":[{"code":407}]}`} {
-		t.Run(body, func(t *testing.T) {
-			checks := 0
-			client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-				r.ParseForm()
-				switch r.Form.Get("api") {
-				case "SYNO.Core.NormalUser":
-					fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
-				case "SYNO.FileStation.CheckPermission":
-					checks++
-					if r.Form.Get("version") != "3" || r.Form.Get("method") != "write" || r.Form.Get("path") != "/home" || r.Form.Get("filename") != ".synopkgland-permission-probe" || r.Form.Get("overwrite") != "false" || r.Form.Get("size") != "0" || r.Header.Get("Cookie") != "id=test-session" || r.Header.Get("X-SYNO-TOKEN") != "test-token" {
-						t.Error("incorrect permission check transport")
-					}
-					fmt.Fprintf(w, `{"success":true,"data":%s}`, body)
-				default:
-					t.Error("unexpected API")
-				}
-			})
-			service := NewService(client)
-			err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home")
-			if (err == nil) != (body == `{"blSkip":false}`) || checks != 1 {
-				t.Fatalf("checks=%d err=%v", checks, err)
-			}
-			checks = 0
-			if err := service.CheckPermission(context.Background(), callerFor(t, "bob"), sessionRequest(), "/home"); err == nil || checks != 0 {
-				t.Fatal("mismatched subject checked write permission")
-			}
-			if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), sessionRequest(), "/home/../etc"); err == nil || checks != 0 {
-				t.Fatal("invalid path checked")
-			}
-		})
-	}
-}
-
-func TestCheckPermissionValidatesCredentialPairBeforeDSM(t *testing.T) {
-	calls := 0
-	client := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		calls++
-		r.ParseForm()
-		if r.Form.Get("api") == "SYNO.Core.NormalUser" {
-			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
-		} else {
-			fmt.Fprint(w, `{"success":true,"data":{"blSkip":false}}`)
-		}
-	})
-	service := NewService(client)
-	for index, r := range []*http.Request{nil, httptest.NewRequest("POST", "/", nil), sessionRequest(), sessionRequest()} {
-		if r != nil && r.Header.Get("X-SYNO-TOKEN") != "" {
-			if index == 2 {
-				r.Header.Del("X-SYNO-TOKEN")
-			} else {
-				r.Header.Set("SynoToken", "different")
-			}
-		}
-		before := calls
-		if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err == nil || calls != before {
-			t.Fatal("invalid session reached DSM", err, calls)
-		}
-	}
-	r := sessionRequest()
-	r.Header.Del("X-SYNO-TOKEN")
-	r.Header.Set("SynoToken", "test-token")
-	if err := service.CheckPermission(context.Background(), callerFor(t, "alice"), r, "/home"); err != nil {
-		t.Fatal("canonical alias refused", err)
-	}
-}

package/templates/native-go/backend/internal/filestation/client.go

@@ -1,337 +0,0 @@
-package filestation
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"mime"
-	"net"
-	"net/http"
-	"net/url"
-	"path"
-	"strconv"
-	"strings"
-	"time"
-
-	"dsmapp/internal/api"
-)
-
-const MaxBytes = 512 * 1024
-const maxMetadata = 1024 * 1024
-const PageSize = 100
-
-// downloadPeek bounds how much of a DSM 7.1 download is inspected for an error envelope.
-const downloadPeek = 4096
-
-// Client has no cookie jar or credentials. The destination is startup-owned,
-// literal loopback only; proxies, redirects and automatic retries are disabled.
-type Client struct {
-	endpoint string
-	http     *http.Client
-}
-
-func NewClient(base string) (*Client, error) {
-	u, e := url.Parse(base)
-	if e != nil || u.Scheme != "http" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || (u.Path != "" && u.Path != "/") || net.ParseIP(u.Hostname()) == nil || !net.ParseIP(u.Hostname()).IsLoopback() {
-		return nil, fail("unavailable")
-	}
-	tr := &http.Transport{Proxy: nil, DialContext: (&net.Dialer{Timeout: 3 * time.Second}).DialContext, DisableKeepAlives: true, ResponseHeaderTimeout: 10 * time.Second, MaxResponseHeaderBytes: 32 * 1024, DisableCompression: true}
-	return &Client{endpoint: strings.TrimRight(base, "/") + "/webapi/entry.cgi", http: &http.Client{Transport: tr, Timeout: 15 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}}, nil
-}
-func fail(code string) error {
-	return &api.Error{Code: code, Message: "File Station operation refused"}
-}
-func wireError(code int) error {
-	switch code {
-	case 106, 107, 119:
-		return fail("session_required")
-	case 105, 403, 407, 408:
-		return fail("denied")
-	case 414, 1805:
-		return fail("conflict")
-	case 400:
-		return fail("invalid-request")
-	default:
-		return fail("unavailable")
-	}
-}
-func fields(family, method, version string) url.Values {
-	return url.Values{"api": {family}, "method": {method}, "version": {version}}
-}
-func array(s string) string { b, _ := json.Marshal([]string{s}); return string(b) }
-func validPath(p string) bool {
-	return len(p) > 1 && len(p) <= 4096 && strings.HasPrefix(p, "/") && path.Clean(p) == p && !strings.ContainsAny(p, "\x00\r\n\\,\"")
-}
-func (c *Client) send(ctx context.Context, original *http.Request, body io.Reader, contentType string) (*http.Response, error) {
-	if c == nil || original == nil {
-		return nil, fail("unavailable")
-	}
-	cookies := original.CookiesNamed("id")
-	token := original.Header.Get("X-SYNO-TOKEN")
-	if len(cookies) != 1 || cookies[0].Value == "" || len(cookies[0].Value) > 4096 || len(token) > 4096 || strings.ContainsAny(token, "\r\n\x00") {
-		return nil, fail("session_required")
-	}
-	method, endpoint := http.MethodPost, c.endpoint
-	if contentType == "" {
-		method = http.MethodGet
-		encoded, err := io.ReadAll(body)
-		if err != nil {
-			return nil, fail("unavailable")
-		}
-		endpoint += "?" + string(encoded)
-		body = nil
-	}
-	req, e := http.NewRequestWithContext(ctx, method, endpoint, body)
-	if e != nil {
-		return nil, fail("unavailable")
-	}
-	req.Header.Set("Content-Type", contentType)
-	req.AddCookie(cookies[0])
-	req.Header.Set("X-SYNO-TOKEN", token)
-	// Never forward caller Host, Authorization, forwarding headers or URLs.
-	resp, e := c.http.Do(req)
-	if e != nil {
-		if ctx.Err() != nil {
-			return nil, fail("canceled")
-		}
-		return nil, fail("unavailable")
-	}
-	if resp.StatusCode != http.StatusOK {
-		resp.Body.Close()
-		return nil, fail("unavailable")
-	}
-	return resp, nil
-}
-func (c *Client) form(ctx context.Context, r *http.Request, v url.Values) (*http.Response, error) {
-	if r == nil {
-		return nil, fail("unavailable")
-	}
-	v.Set("SynoToken", r.Header.Get("X-SYNO-TOKEN"))
-	return c.send(ctx, r, strings.NewReader(v.Encode()), "application/x-www-form-urlencoded")
-}
-func decode(resp *http.Response, into any) error {
-	defer resp.Body.Close()
-	b, e := io.ReadAll(io.LimitReader(resp.Body, maxMetadata+1))
-	if e != nil || len(b) > maxMetadata {
-		return fail("unavailable")
-	}
-	var envelope struct {
-		Success *bool           `json:"success"`
-		Data    json.RawMessage `json:"data"`
-		Error   struct {
-			Code int `json:"code"`
-		} `json:"error"`
-	}
-	if json.Unmarshal(b, &envelope) != nil || envelope.Success == nil {
-		return fail("unavailable")
-	}
-	if !*envelope.Success {
-		return wireError(envelope.Error.Code)
-	}
-	if into != nil && json.Unmarshal(envelope.Data, into) != nil {
-		return fail("unavailable")
-	}
-	return nil
-}
-func (c *Client) call(ctx context.Context, r *http.Request, v url.Values, into any) error {
-	resp, e := c.form(ctx, r, v)
-	if e != nil {
-		return e
-	}
-	return decode(resp, into)
-}
-
-// Verify checks that loopback WebAPI resolves the same user as authenticate.cgi.
-// Failure (including DSM IP-bound sessions) never falls back to admin credentials.
-func (c *Client) Verify(ctx context.Context, r *http.Request, user string) error {
-	var d struct {
-		Username string `json:"username"`
-	}
-	if e := c.call(ctx, r, fields("SYNO.Core.NormalUser", "get", "1"), &d); e != nil {
-		return e
-	}
-	if user == "" || d.Username != user {
-		return fail("session_required")
-	}
-	return nil
-}
-
-type Entry struct {
-	Path       string `json:"path"`
-	Name       string `json:"name"`
-	IsDir      bool   `json:"isdir"`
-	Additional struct {
-		Size int64 `json:"size"`
-	} `json:"additional"`
-}
-type Page struct {
-	Files  []Entry `json:"files"`
-	Shares []Entry `json:"shares,omitempty"`
-	Total  int     `json:"total"`
-	Offset int     `json:"offset"`
-}
-
-type ListOptions struct {
-	Offset        int    `json:"offset"`
-	Limit         int    `json:"limit"`
-	SortBy        string `json:"sortBy"`
-	SortDirection string `json:"sortDirection"`
-}
-
-func (c *Client) page(ctx context.Context, r *http.Request, p string, opts ListOptions) (Page, error) {
-	offset := opts.Offset
-	if opts.Limit == 0 {
-		opts.Limit = PageSize
-	}
-	if opts.SortBy == "" {
-		opts.SortBy = "name"
-	}
-	if opts.SortDirection == "" {
-		opts.SortDirection = "ASC"
-	}
-	if opts.Limit < 1 || opts.Limit > PageSize || (opts.SortBy != "name" && opts.SortBy != "size" && opts.SortBy != "type" && opts.SortBy != "mtime") || (opts.SortDirection != "ASC" && opts.SortDirection != "DESC") {
-		return Page{}, fail("invalid-request")
-	}
-	var d Page
-	if offset < 0 || offset > 1000000 || (p != "" && !validPath(p)) {
-		return d, fail("invalid-request")
-	}
-	method := "list"
-	if p == "" {
-		method = "list_share"
-	}
-	v := fields("SYNO.FileStation.List", method, "2")
-	v.Set("offset", strconv.Itoa(offset))
-	v.Set("limit", strconv.Itoa(opts.Limit))
-	v.Set("sort_by", opts.SortBy)
-	v.Set("sort_direction", opts.SortDirection)
-	v.Set("additional", `["size"]`)
-	if p != "" {
-		v.Set("folder_path", p)
-	}
-	e := c.call(ctx, r, v, &d)
-	if d.Files == nil {
-		d.Files = []Entry{}
-	}
-	if len(d.Files) > opts.Limit || len(d.Shares) > opts.Limit {
-		return Page{}, fail("unavailable")
-	}
-	return d, e
-}
-func (c *Client) Discover(ctx context.Context, r *http.Request, offset int) (Page, error) {
-	return c.page(ctx, r, "", ListOptions{Offset: offset})
-}
-func (c *Client) List(ctx context.Context, r *http.Request, p string, opts ListOptions) (Page, error) {
-	if !validPath(p) {
-		return Page{}, fail("invalid-request")
-	}
-	return c.page(ctx, r, p, opts)
-}
-func (c *Client) Stat(ctx context.Context, r *http.Request, p string) (Entry, error) {
-	var d Page
-	if !validPath(p) {
-		return Entry{}, fail("invalid-request")
-	}
-	v := fields("SYNO.FileStation.List", "getinfo", "2")
-	v.Set("path", array(p))
-	v.Set("additional", `["size"]`)
-	if e := c.call(ctx, r, v, &d); e != nil {
-		return Entry{}, e
-	}
-	if len(d.Files) != 1 || d.Files[0].Path != p || d.Files[0].Name == "" {
-		return Entry{}, fail("not_found")
-	}
-	return d.Files[0], nil
-}
-
-// Download owns an open response body; the caller must close it. No file bytes
-// are buffered and JSON error envelopes never become successful content.
-type Download struct {
-	Body               io.ReadCloser
-	ContentType        string
-	ContentDisposition string
-	ContentLength      int64
-}
-
-func (c *Client) DownloadStream(ctx context.Context, r *http.Request, p string) (Download, error) {
-	if !validPath(p) {
-		return Download{}, fail("invalid-request")
-	}
-	v := fields("SYNO.FileStation.Download", "download", "2")
-	v.Set("path", array(p))
-	v.Set("mode", "download")
-	if c == nil {
-		return Download{}, fail("unavailable")
-	}
-	transfer := *c
-	httpClient := *c.http
-	httpClient.Timeout = 20 * time.Minute
-	transfer.http = &httpClient
-	resp, e := transfer.send(ctx, r, strings.NewReader(v.Encode()), "")
-	if e != nil {
-		return Download{}, e
-	}
-	body := resp.Body
-	raw := resp.Header.Values("Content-Disposition")
-	if len(raw) == 0 {
-		// DSM 7.1 sends no Content-Disposition at all. Only a short body that is
-		// a complete DSM envelope is an error; everything else is the file.
-		if body, e = unlessEnvelope(resp); e != nil {
-			return Download{}, e
-		}
-	} else if disposition, _, _ := mime.ParseMediaType(raw[0]); len(raw) != 1 || disposition != "attachment" {
-		e = decode(resp, nil)
-		if e == nil {
-			e = fail("unavailable")
-		}
-		return Download{}, e
-	}
-	return Download{Body: body, ContentType: resp.Header.Get("Content-Type"), ContentDisposition: resp.Header.Get("Content-Disposition"), ContentLength: resp.ContentLength}, nil
-}
-
-// unlessEnvelope returns the whole body as a stream unless it fits in the peek
-// and decodes as a DSM envelope, which is refused and never becomes content.
-func unlessEnvelope(resp *http.Response) (io.ReadCloser, error) {
-	head, e := io.ReadAll(io.LimitReader(resp.Body, downloadPeek+1))
-	if e != nil {
-		resp.Body.Close()
-		return nil, fail("read_failed")
-	}
-	if len(head) <= downloadPeek {
-		var envelope struct {
-			Success *bool `json:"success"`
-		}
-		if json.Unmarshal(head, &envelope) == nil && envelope.Success != nil {
-			resp.Body = io.NopCloser(bytes.NewReader(head))
-			if e = decode(resp, nil); e == nil {
-				e = fail("unavailable")
-			}
-			return nil, e
-		}
-	}
-	return struct {
-		io.Reader
-		io.Closer
-	}{io.MultiReader(bytes.NewReader(head), resp.Body), resp.Body}, nil
-}
-
-// Read is the bounded package-private job import, using the same stream.
-func (c *Client) Read(ctx context.Context, r *http.Request, p string) ([]byte, error) {
-	stream, e := c.DownloadStream(ctx, r, p)
-	if e != nil {
-		return nil, e
-	}
-	defer stream.Body.Close()
-	b, e := io.ReadAll(io.LimitReader(stream.Body, MaxBytes+1))
-	if e != nil {
-		return nil, fail("read_failed")
-	}
-	if len(b) > MaxBytes {
-		return nil, fail("limit-exceeded")
-	}
-	if stream.ContentLength >= 0 && stream.ContentLength != int64(len(b)) {
-		return nil, fail("read_failed")
-	}
-	return bytes.Clone(b), nil
-}

package/templates/native-go/backend/internal/filestation/client_test.go

@@ -1,155 +0,0 @@
-package filestation
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func fakeClient(t *testing.T, h http.HandlerFunc) *Client {
-	t.Helper()
-	s := httptest.NewServer(h)
-	t.Cleanup(s.Close)
-	c, err := NewClient(s.URL)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return c
-}
-func sessionRequest() *http.Request {
-	r := httptest.NewRequest("POST", "http://package/api", nil)
-	r.AddCookie(&http.Cookie{Name: "id", Value: "test-session"})
-	r.Header.Set("X-SYNO-TOKEN", "test-token")
-	return r
-}
-func TestReadOperationsUseOnlyCurrentSession(t *testing.T) {
-	calls := 0
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		calls++
-		if (r.Method != "GET" && r.URL.RawQuery != "") || r.Header.Get("X-SYNO-TOKEN") != "test-token" || r.Header.Get("Cookie") != "id=test-session" {
-			t.Error("incorrect session transport")
-		}
-		r.ParseForm()
-		if r.Form.Get("_sid") != "" || (r.Method != "GET" && r.Form.Get("SynoToken") != "test-token") {
-			t.Error("incorrect form carriers")
-		}
-		switch r.Form.Get("method") {
-		case "get":
-			fmt.Fprint(w, `{"success":true,"data":{"username":"alice"}}`)
-		case "list_share":
-			fmt.Fprint(w, `{"success":true,"data":{"shares":[{"path":"/home","name":"home","isdir":true}],"total":1}}`)
-		case "list":
-			if r.Form.Get("folder_path") != "/home" || r.Form.Get("limit") != "100" {
-				t.Error("list fields")
-			}
-			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/a","name":"a","isdir":false}],"total":1}}`)
-		case "getinfo":
-			fmt.Fprint(w, `{"success":true,"data":{"files":[{"path":"/home/a","name":"a","isdir":false,"additional":{"size":3}}]}}`)
-		case "download":
-			if r.Form.Get("path") != `["/home/a"]` {
-				t.Error("download path")
-			}
-			w.Header().Set("Content-Type", "application/octet-stream")
-			w.Header().Set("Content-Disposition", `attachment; filename="a"`)
-			fmt.Fprint(w, "abc")
-		default:
-			t.Error("unexpected method")
-		}
-	})
-	r := sessionRequest()
-	if err := c.Verify(context.Background(), r, "alice"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := c.Discover(context.Background(), r, 0); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := c.List(context.Background(), r, "/home", ListOptions{}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := c.Stat(context.Background(), r, "/home/a"); err != nil {
-		t.Fatal(err)
-	}
-	b, err := c.Read(context.Background(), r, "/home/a")
-	if err != nil || string(b) != "abc" {
-		t.Fatal(err)
-	}
-	if calls != 5 {
-		t.Fatal(calls)
-	}
-}
-func TestRefusalAndBoundedErrors(t *testing.T) {
-	for _, tt := range []struct{ body, want string }{
-		{`{"success":false,"error":{"code":119,"secret":"test-session"}}`, "session_required"},
-		{`{"success":false,"error":{"code":407}}`, "denied"},
-		{`{"success":false,"error":{"code":408}}`, "denied"},
-		{`{"success":false,"error":{"code":1805}}`, "conflict"},
-		{`{"success":false,"error":{"code":9999}}`, "unavailable"},
-		{`{"data":{}}`, "unavailable"}, {`not json`, "unavailable"},
-	} {
-		t.Run(tt.want+tt.body, func(t *testing.T) {
-			c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) { fmt.Fprint(w, tt.body) })
-			_, err := c.List(context.Background(), sessionRequest(), "/home", ListOptions{})
-			if err == nil || !strings.Contains(err.Error(), tt.want) || strings.Contains(err.Error(), "test-session") {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-func TestNoSessionRedirectOrRemoteDestination(t *testing.T) {
-	for _, url := range []string{"https://example.com", "http://localhost:5000", "http://127.0.0.1:5000/evil", "http://user@127.0.0.1:5000", "http://127.0.0.1:5000?x=y"} {
-		if _, err := NewClient(url); err == nil {
-			t.Fatal("accepted", url)
-		}
-	}
-	calls := 0
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		calls++
-		http.Redirect(w, r, "http://127.0.0.1:1/leak", 302)
-	})
-	if _, err := c.List(context.Background(), httptest.NewRequest("POST", "/", nil), "/home", ListOptions{}); err == nil || calls != 0 {
-		t.Fatal("missing session sent")
-	}
-	if _, err := c.List(context.Background(), sessionRequest(), "/home", ListOptions{}); err == nil || calls != 1 {
-		t.Fatal("redirect accepted")
-	}
-}
-func TestDownloadDoesNotTurnErrorsIntoFileBytes(t *testing.T) {
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]any{"success": false, "error": map[string]int{"code": 407}})
-	})
-	if b, err := c.Read(context.Background(), sessionRequest(), "/home/a"); err == nil || len(b) != 0 {
-		t.Fatal("error bytes escaped")
-	}
-}
-
-func TestBoundariesCancellationAndIdentityMismatch(t *testing.T) {
-	c := fakeClient(t, func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Query().Get("method") == "download" {
-			w.Header().Set("Content-Disposition", `attachment; filename="large"`)
-			fmt.Fprint(w, strings.Repeat("x", MaxBytes+1))
-			return
-		}
-		fmt.Fprint(w, `{"success":true,"data":{"username":"someone-else"}}`)
-	})
-	if e := c.Verify(context.Background(), sessionRequest(), "alice"); e == nil {
-		t.Fatal("identity mismatch admitted")
-	}
-	if b, e := c.Read(context.Background(), sessionRequest(), "/home/large"); e == nil || len(b) != 0 {
-		t.Fatal("oversized read escaped")
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	if _, e := c.List(ctx, sessionRequest(), "/home", ListOptions{}); e == nil {
-		t.Fatal("canceled request succeeded")
-	}
-	r := sessionRequest()
-	r.AddCookie(&http.Cookie{Name: "id", Value: "other"})
-	if _, e := c.List(context.Background(), r, "/home", ListOptions{}); e == nil {
-		t.Fatal("ambiguous session accepted")
-	}
-}

package/templates/native-go/backend/internal/filestation/doc.go

@@ -1,4 +0,0 @@
-// Package filestation implements interactive NAS operations using the current
-// DSM user's session. It never opens NAS data paths or retains credentials.
-// Every typed operation uses a request-scoped session; DSM alone decides access.
-package filestation