@synopackageland/cli 0.8.0 → 0.9.1

package/templates/native-go/backend/internal/identity/README.md

@@ -1,59 +0,0 @@
-# Standalone identity
-
-Enable only with `-X main.identity=standalone`. The CGI creates this service from
-its package var directory and trusted `SCRIPT_NAME`; `internal/app/identity.go`
-registers the transport. The Vue shell discovers `identity.status` at runtime.
-The CLI worker must wire `capabilities.identity: standalone` to the ldflag.
-
-The transport accepts same-origin JSON POST requests:
-
-- `identity.status {}` reports whether this transport is enabled.
-- `identity.session {bootstrap: true}` exchanges the incoming DSM `id` cookie
-  for an app session when no app cookie is present. Without bootstrap it reads
-  the app session. Expired app cookies are cleared before another bootstrap.
-- `identity.login {account, password, otp}` verifies credentials with DSM Auth
-  v7, without a `session=DSM` argument. `otp_required` requests the second step.
-- `identity.logout {}` removes the app session and clears the cookie.
-
-NormalUser.get is the only DSM cookie identity check; anonymous Initdata success
-cannot establish identity. DSM web logins enable SynoToken, and DSM refuses
-their cookie alone (119), so the check also forwards the request's single
-`X-SYNO-TOKEN` header, which the DSM window's `ctx.call` sends. Sessions without
-SynoToken still verify with the cookie alone. The token is never put in a URL,
-logged or stored. Local `user.Lookup` binds the username to its UID.
-Auth login creates a temporary SID, then immediately logs it out before issuing
-an app session. A logout failure refuses the app login. No password, OTP, DSM SID
-or DSM cookie is logged or persisted. Only hashes of app bearer IDs are stored.
-
-The package-private store uses directory mode 0700, files mode 0600, atomic
-replacement and a cross-process lock, so CGI restarts preserve sessions and
-rate limits. Sessions have a default 15-minute expiry. Sliding requires a live
-DSM cookie; password-only sessions cannot extend themselves indefinitely.
-Login limits are five attempts per account and twenty per IP per minute;
-forwarded client address and HTTPS headers are not trusted.
-
-Cookies are host-only, HttpOnly, Secure and SameSite=Lax, scoped to the app path,
-with a package-specific name. Lax supports top-level app navigation. JSON POST
-requires an exact Origin scheme/host/port and rejects cross-site Fetch Metadata.
-Password login and cookie bootstrap require HTTPS, determined by Go's TLS state
-(the CGI library maps the trusted `HTTPS` environment variable to that state).
-
-The package account has no verified disabled-account reader. Every operation
-except the explicit read-only `app.status` and `greeting.get` therefore requires
-both a matching local UID and live DSM cookie verification. Missing DSM cookies
-produce `session_revalidation_required`; invalid cookies revoke the app session.
-Password-only login supports those basic reads for at most 15 minutes. Different
-hostnames need a same-host DSM login before sensitive operations can succeed.
-App business permissions live in `internal/api/permissions.json`; SDK-owned
-routes use `internal/api/sdk-permissions.json`, verified against the CLI policy.
-app identity grants no File Station authority and does not create a NAS session.
-
-New business methods default to live revalidation. Do not add a read exception
-for sensitive data or state-changing operations. Unavailable account checks fail
-closed. Tests use a fake DSM server; actual DSM/Web Station deployment remains
-an integration acceptance step.
-
-File metadata and transfers return `dsm_session_required` for an App session
-without a DSM cookie. Sign in to DSM on the same hostname to use File Station.
-HTTP streaming transfers pass through the central API policy and identity
-revalidation without JSON buffering.

package/templates/native-go/backend/internal/identity/dsm.go

@@ -1,115 +0,0 @@
-package identity
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-	"unicode"
-)
-
-type dsmReply struct {
-	Success bool `json:"success"`
-	Data    struct {
-		Username string `json:"username"`
-		SID      string `json:"sid"`
-	} `json:"data"`
-	Error struct {
-		Code  int `json:"code"`
-		Types []struct {
-			Type string `json:"type"`
-		} `json:"types"`
-	} `json:"error"`
-}
-
-// dsmCall sends token only as X-SYNO-TOKEN: DSM web logins enable SynoToken,
-// and their cookie alone is refused with 119.
-func (s *Service) dsmCall(ctx context.Context, form url.Values, cookie, token string) (dsmReply, error) {
-	var out dsmReply
-	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-	req, err := http.NewRequestWithContext(ctx, "POST", s.cfg.Endpoint, strings.NewReader(form.Encode()))
-	if err != nil {
-		return out, errors.New("DSM unavailable")
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	if cookie != "" {
-		req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
-	}
-	if token != "" {
-		req.Header.Set("X-SYNO-TOKEN", token)
-	}
-	res, err := s.cfg.Client.Do(req)
-	if err != nil {
-		return out, errors.New("DSM unavailable")
-	}
-	defer res.Body.Close()
-	raw, err := io.ReadAll(io.LimitReader(res.Body, (64<<10)+1))
-	if err != nil || len(raw) > 64<<10 || res.StatusCode != 200 || json.Unmarshal(raw, &out) != nil {
-		return out, errors.New("DSM unavailable")
-	}
-	return out, nil
-}
-
-// verify checks the caller's DSM session with the request's cookie and, when the
-// browser sent one, its SynoToken. Neither is stored or logged.
-func (s *Service) verify(r *http.Request, cookie string) (Subject, error) {
-	token := synoToken(r)
-	out, err := s.dsmCall(r.Context(), url.Values{"api": {"SYNO.Core.NormalUser"}, "method": {"get"}, "version": {"1"}}, cookie, token)
-	if err != nil || !out.Success {
-		return Subject{}, errors.New("DSM session refused")
-	}
-	return s.resolve(out.Data.Username)
-}
-
-// synoToken returns the single, well-formed X-SYNO-TOKEN header or "".
-func synoToken(r *http.Request) string {
-	values := r.Header.Values("X-SYNO-TOKEN")
-	if len(values) != 1 || len(values[0]) > 4096 || strings.ContainsFunc(values[0], unicode.IsControl) {
-		return ""
-	}
-	return values[0]
-}
-func (s *Service) login(ctx context.Context, account, password, otp string) (Subject, string) {
-	form := url.Values{"api": {"SYNO.API.Auth"}, "method": {"login"}, "version": {"7"}, "account": {account}, "passwd": {password}, "format": {"sid"}}
-	if otp != "" {
-		form.Set("otp_code", otp)
-	}
-	out, err := s.dsmCall(ctx, form, "", "")
-	if err != nil {
-		return Subject{}, "auth_unavailable"
-	}
-	if !out.Success {
-		switch out.Error.Code {
-		case 400:
-			return Subject{}, "invalid_credentials"
-		case 401:
-			return Subject{}, "account_disabled"
-		case 403:
-			for _, kind := range out.Error.Types {
-				if kind.Type == "otp" {
-					return Subject{}, "otp_required"
-				}
-			}
-		}
-		return Subject{}, "login_not_permitted"
-	}
-	if out.Data.SID == "" {
-		return Subject{}, "auth_unavailable"
-	}
-	// The temporary DSM session exists only to prove identity. Dispose of it
-	// before issuing an application session, including when local lookup fails.
-	loggedOut, err := s.dsmCall(context.WithoutCancel(ctx), url.Values{"api": {"SYNO.API.Auth"}, "method": {"logout"}, "version": {"7"}, "_sid": {out.Data.SID}}, "", "")
-	if err != nil || !loggedOut.Success {
-		return Subject{}, "auth_unavailable"
-	}
-	sub, err := s.resolve(account)
-	if err != nil {
-		return Subject{}, "invalid_credentials"
-	}
-	return sub, ""
-}

package/templates/native-go/backend/internal/identity/http.go

@@ -1,291 +0,0 @@
-package identity
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"errors"
-	"io"
-	"mime"
-	"net"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-)
-
-type request struct {
-	Method string          `json:"method"`
-	Params json.RawMessage `json:"params"`
-}
-
-func decode(raw []byte, into any) error {
-	d := json.NewDecoder(bytes.NewReader(raw))
-	d.DisallowUnknownFields()
-	if err := d.Decode(into); err != nil {
-		return err
-	}
-	if d.Decode(new(any)) != io.EOF {
-		return errors.New("trailing JSON")
-	}
-	return nil
-}
-func reply(w http.ResponseWriter, data any, code string) {
-	out := map[string]any{"success": code == ""}
-	if code == "" {
-		out["data"] = data
-	} else {
-		out["error"] = map[string]string{"code": code, "message": "Sign-in could not be completed."}
-	}
-	raw, _ := json.Marshal(out)
-	h := w.Header()
-	h.Set("Content-Type", "application/json")
-	h.Set("Cache-Control", "no-store")
-	h.Set("X-Content-Type-Options", "nosniff")
-	h.Set("Content-Length", strconv.Itoa(len(raw)))
-	w.WriteHeader(200)
-	_, _ = w.Write(raw)
-}
-func sameOrigin(r *http.Request) bool {
-	scheme := "http"
-	if r.TLS != nil {
-		scheme = "https"
-	}
-	origin, err := url.Parse(r.Header.Get("Origin"))
-	if err != nil || origin.Scheme != scheme || origin.Host != r.Host || origin.User != nil || origin.Path != "" || origin.RawQuery != "" || origin.Fragment != "" {
-		return false
-	}
-	site := r.Header.Get("Sec-Fetch-Site")
-	return site == "" || site == "same-origin"
-}
-
-// Routes registers identity operations under the central immutable SDK policy.
-func (s *Service) Routes() []api.Route {
-	routes := []api.Route{}
-	for _, method := range []string{"identity.status", "identity.login", "identity.session", "identity.logout"} {
-		name := method
-		routes = append(routes, api.HandleResponse(name, func(_ context.Context, _ api.Caller, w http.ResponseWriter, r *http.Request, p json.RawMessage) error {
-			if len(p) == 0 {
-				p = []byte(`{}`)
-			}
-			s.handle(w, r, request{Method: name, Params: p})
-			return nil
-		}))
-	}
-	return routes
-}
-
-// Wrap revalidates App identity before business JSON and HTTP transfers.
-// Identity operations use the same central policy engine with no App methods.
-func (s *Service) Wrap(next http.Handler) http.Handler {
-	identityServer, err := api.NewServerWithPermissions(s, []byte(`{"schema":1,"default":"administrators","methods":{}}`), s.Routes()...)
-	if err != nil {
-		panic(err)
-	}
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		defer io.Copy(io.Discard, r.Body)
-		if r.URL.Query().Get("method") != "" {
-			if e := api.PrepareTransferRequest(w, r); e != nil {
-				reply(w, nil, e.Code)
-				return
-			}
-			if !s.guard(w, r, r.URL.Query().Get("method")) {
-				return
-			}
-			next.ServeHTTP(w, r)
-			return
-		}
-		if r.Method != "POST" {
-			reply(w, nil, "method_not_allowed")
-			return
-		}
-		if !sameOrigin(r) {
-			reply(w, nil, "csrf_rejected")
-			return
-		}
-		media, _, err := mime.ParseMediaType(r.Header.Get("Content-Type"))
-		if err != nil || media != "application/json" {
-			reply(w, nil, "json_required")
-			return
-		}
-		raw, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
-		if err != nil {
-			reply(w, nil, "request_too_large")
-			return
-		}
-		var req request
-		if decode(raw, &req) != nil || req.Method == "" {
-			reply(w, nil, "bad_request")
-			return
-		}
-		if len(req.Params) == 0 {
-			req.Params = []byte(`{}`)
-		}
-		if strings.HasPrefix(req.Method, "identity.") {
-			r.Body = io.NopCloser(bytes.NewReader(raw))
-			identityServer.ServeHTTP(w, r)
-			return
-		}
-		if !s.guard(w, r, req.Method) {
-			return
-		}
-		r.Body = io.NopCloser(bytes.NewReader(raw))
-		next.ServeHTTP(w, r)
-	})
-}
-func (s *Service) guard(w http.ResponseWriter, r *http.Request, method string) bool {
-	// Every business request rechecks identity: no developer-maintained list of
-	// sensitive method names can accidentally omit a write operation.
-	var token string
-	var rec record
-	revalidate := method != "app.status" && method != "greeting.get"
-	err := s.transaction(func(st *state) error { var e error; token, rec, e = s.current(st, r, revalidate); return e })
-	if err != nil {
-		code := "session_required"
-		if errors.Is(err, errRevalidation) {
-			code = "session_revalidation_required"
-			if strings.HasPrefix(method, "nas.") || method == "bg.browse" || method == "bg.jobs.submit" {
-				code = "dsm_session_required"
-			}
-		}
-		reply(w, nil, code)
-		return false
-	}
-	if revalidate {
-		s.cookie(w, token, rec.Expires)
-	}
-
-	return true
-}
-func (s *Service) handle(w http.ResponseWriter, r *http.Request, req request) {
-	if req.Method == "identity.status" {
-		if decode(req.Params, &struct{}{}) != nil {
-			reply(w, nil, "bad_request")
-			return
-		}
-		reply(w, map[string]bool{"enabled": true}, "")
-		return
-	}
-	if req.Method == "identity.login" && r.TLS == nil {
-		reply(w, nil, "https_required")
-		return
-	}
-	var token string
-	var rec record
-	code := ""
-	err := s.transaction(func(st *state) error {
-		switch req.Method {
-		case "identity.login":
-			var in struct {
-				Account  string `json:"account"`
-				Password string `json:"password"`
-				OTP      string `json:"otp"`
-			}
-			if decode(req.Params, &in) != nil || in.Account == "" || in.Password == "" || len(in.Account) > 1024 || len(in.Password) > 4096 || len(in.OTP) > 128 {
-				code = "bad_request"
-				return nil
-			}
-			ip, _, err := net.SplitHostPort(r.RemoteAddr)
-			if err != nil {
-				ip = r.RemoteAddr
-			}
-			if s.limited(st, ip, strings.ToLower(in.Account)) {
-				code = "rate_limited"
-				return nil
-			}
-			sub, c := s.login(r.Context(), in.Account, in.Password, in.OTP)
-			code = c
-			if code != "" {
-				return nil
-			}
-			if len(st.Sessions) >= 4096 {
-				code = "auth_unavailable"
-				return nil
-			}
-			// Rotation also removes the caller's previous session.
-			if old, err := r.Cookie(s.cookieName); err == nil {
-				delete(st.Sessions, digest(old.Value))
-			}
-			token, err = randomID()
-			if err != nil {
-				return err
-			}
-			rec = record{Subject: sub, Expires: s.cfg.Now().Add(s.cfg.TTL)}
-			st.Sessions[digest(token)] = rec
-		case "identity.session":
-			var in struct {
-				Bootstrap bool `json:"bootstrap"`
-			}
-			if decode(req.Params, &in) != nil {
-				code = "bad_request"
-				return nil
-			}
-			_, hasDSM := r.Cookie("id")
-			var e error
-			token, rec, e = s.current(st, r, hasDSM == nil)
-			// Explicit bootstrap only when there is no application cookie. An expired
-			// application session must return to the login surface before reissuing.
-			_, appErr := r.Cookie(s.cookieName)
-			if e != nil && in.Bootstrap && appErr != nil {
-				if r.TLS == nil {
-					code = "https_required"
-					return nil
-				}
-				dc, err := r.Cookie("id")
-				if err != nil {
-					code = "session_required"
-					return nil
-				}
-				sub, err := s.verify(r, dc.Value)
-				if err != nil {
-					code = "session_required"
-					return nil
-				}
-				if len(st.Sessions) >= 4096 {
-					code = "auth_unavailable"
-					return nil
-				}
-				token, err = randomID()
-				if err != nil {
-					return err
-				}
-				rec = record{Subject: sub, Expires: s.cfg.Now().Add(s.cfg.TTL)}
-				st.Sessions[digest(token)] = rec
-				e = nil
-			}
-			if e != nil {
-				code = "session_required"
-			}
-		case "identity.logout":
-			if decode(req.Params, &struct{}{}) != nil {
-				code = "bad_request"
-				return nil
-			}
-			if old, err := r.Cookie(s.cookieName); err == nil {
-				delete(st.Sessions, digest(old.Value))
-			}
-		default:
-			code = "unknown_method"
-		}
-		return nil
-	})
-	if err != nil {
-		reply(w, nil, "auth_unavailable")
-		return
-	}
-	if code != "" {
-		if code == "session_required" {
-			s.cookie(w, "", rec.Expires)
-		}
-		reply(w, nil, code)
-		return
-	}
-	if req.Method == "identity.logout" {
-		s.cookie(w, "", rec.Expires)
-		reply(w, map[string]bool{"loggedOut": true}, "")
-		return
-	}
-	s.cookie(w, token, rec.Expires)
-	reply(w, map[string]any{"user": rec.Subject.User, "uid": rec.Subject.UID, "expiresAt": rec.Expires}, "")
-}