@synopackageland/cli 0.8.0 → 0.9.1

package/templates/native-go-delegate/backend/internal/delegate/client_test.go

@@ -1,214 +0,0 @@
-package delegate
-
-import (
-	"bufio"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"errors"
-	"net"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-func executor(t *testing.T, serve func(Request) string) *Client {
-	t.Helper()
-	dir, err := os.MkdirTemp("", "ds-")
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { os.RemoveAll(dir) })
-	socket := filepath.Join(dir, "s")
-	l, err := net.Listen("unix", socket)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { l.Close() })
-	go func() {
-		for {
-			conn, e := l.Accept()
-			if e != nil {
-				return
-			}
-			go func() {
-				defer conn.Close()
-				var q Request
-				json.NewDecoder(bufio.NewReader(conn)).Decode(&q)
-				_, _ = conn.Write([]byte(serve(q)))
-			}()
-		}
-	}()
-	return &Client{Socket: socket, Timeout: 100 * time.Millisecond}
-}
-func code(t *testing.T, err error, want string) {
-	t.Helper()
-	var e *api.Error
-	if !errors.As(err, &e) || e.Code != want {
-		t.Fatalf("got %v, want %s", err, want)
-	}
-}
-func TestClientProtocolAndStableRefusals(t *testing.T) {
-	for _, stable := range []string{"DENIED", "DELEGATION_EXPIRED", "SCOPE_DENIED", "ACCOUNT_DISABLED", "POLICY_DENIED", "FILE_EXISTS", "FUTURE_CODE"} {
-		t.Run(stable, func(t *testing.T) {
-			c := executor(t, func(q Request) string {
-				if q.V != 1 || q.Op != "status" {
-					t.Errorf("wire: %+v", q)
-				}
-				return `{"ok":false,"code":"` + stable + `","message":"secret cookie"}` + "\n"
-			})
-			code(t, c.Call(context.Background(), "status", nil, nil, nil), stable)
-		})
-	}
-}
-func TestClientUnavailableTimeoutAndCancellation(t *testing.T) {
-	c := &Client{Socket: filepath.Join(t.TempDir(), "absent")}
-	code(t, c.Call(context.Background(), "status", nil, nil, nil), "EXECUTOR_UNAVAILABLE")
-	c = executor(t, func(Request) string { time.Sleep(150 * time.Millisecond); return "" })
-	code(t, c.Call(context.Background(), "status", nil, nil, nil), "EXECUTOR_TIMEOUT")
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	code(t, c.Call(ctx, "status", nil, nil, nil), "canceled")
-}
-func TestClientBoundsAndMalformedResponses(t *testing.T) {
-	for _, response := range []string{`{}`, `{"ok":true}`, `{"ok":true,"result":{}} trailing` + "\n", strings.Repeat("x", MaxFrame+1), `{"ok":true,"result":{}}`} {
-		t.Run(response[:min(len(response), 24)], func(t *testing.T) {
-			c := executor(t, func(Request) string { return response })
-			if c.Call(context.Background(), "status", nil, nil, nil) == nil {
-				t.Fatal("accepted invalid frame")
-			}
-		})
-	}
-	c := executor(t, func(Request) string { t.Error("oversized request sent"); return "" })
-	code(t, c.Call(context.Background(), "status", nil, map[string]string{"x": strings.Repeat("x", MaxFrame)}, nil), "EXECUTOR_TOO_LARGE")
-}
-func TestFilesStagingAndTypedOperations(t *testing.T) {
-	dir := t.TempDir()
-	os.Chmod(dir, 0700)
-	seen := map[string]bool{}
-	c := executor(t, func(q Request) string {
-		seen[q.Op] = true
-		if q.Auth != nil {
-			t.Error("offline op had auth")
-		}
-		var p map[string]any
-		json.Unmarshal(q.Params, &p)
-		if p["delegation_id"] != "d1" || p["job_id"] != "j1" {
-			t.Errorf("binding %+v", p)
-		}
-		if q.Op == "files.write" {
-			name := p["staging"].(string)
-			if filepath.Base(name) != name || name == "chosen.txt" {
-				t.Error("unsafe staging")
-			}
-			b, e := os.ReadFile(filepath.Join(dir, name))
-			if e != nil || string(b) != "content" {
-				t.Errorf("staged %q %v", b, e)
-			}
-		}
-		switch q.Op {
-		case "files.list":
-			for key := range p {
-				if key != "path" && key != "delegation_id" && key != "job_id" {
-					return `{"ok":false,"code":"INVALID_REQUEST"}` + "\n"
-				}
-			}
-			return `{"ok":true,"result":{"files":[],"total":0,"offset":0}}` + "\n"
-		case "files.info":
-			return `{"ok":true,"result":{"files":[{"path":"/home","name":"home","isdir":true}]}}` + "\n"
-		default:
-			return `{"ok":true,"result":{}}` + "\n"
-		}
-	})
-	f := JobContext{Client: c, JobID: "j1", DelegationID: "d1", StagingDir: dir}.Files()
-	if _, e := f.List(context.Background(), "/home", ListOptions{}); e != nil {
-		t.Fatal(e)
-	}
-	if info, e := f.Info(context.Background(), "/home"); e != nil || !info.IsDir || info.Path != "/home" {
-		t.Fatalf("info: %+v %v", info, e)
-	}
-	if e := f.CreateFolder(context.Background(), "/home", "new"); e != nil {
-		t.Fatal(e)
-	}
-	if e := f.CheckPermission(context.Background(), "/home"); e != nil {
-		t.Fatal(e)
-	}
-	if e := f.Write(context.Background(), "/home", "chosen.txt", strings.NewReader("content"), 7); e != nil {
-		t.Fatal(e)
-	}
-	entries, _ := os.ReadDir(dir)
-	if len(entries) != 0 || len(seen) != 5 {
-		t.Fatalf("cleanup %v ops %v", entries, seen)
-	}
-}
-func TestStagingCleanupOnRefusalLimitAndReadFailure(t *testing.T) {
-	c := executor(t, func(Request) string { return `{"ok":false,"code":"DENIED"}` + "\n" })
-	dir := t.TempDir()
-	os.Chmod(dir, 0700)
-	f := JobContext{Client: c, JobID: "j", DelegationID: "d", StagingDir: dir}.Files()
-	code(t, f.Write(context.Background(), "/home", "a", strings.NewReader("abc"), 3), "DENIED")
-	code(t, f.Write(context.Background(), "/home", "../bad", strings.NewReader("a"), 1), "invalid-request")
-	code(t, f.Write(context.Background(), "/home", "a", strings.NewReader("abc"), 2), "limit-exceeded")
-	if files, _ := os.ReadDir(dir); len(files) != 0 {
-		t.Fatal("staging leaked")
-	}
-}
-
-func TestClientRejectsNonObjectAndInvalidRefusalCodes(t *testing.T) {
-	for _, response := range []string{`{"ok":true,"result":[]}`, `{"ok":false,"code":"secret\nvalue"}`} {
-		c := executor(t, func(Request) string { return response + "\n" })
-		code(t, c.Call(context.Background(), "status", nil, nil, nil), "EXECUTOR_PROTOCOL")
-	}
-}
-
-type brokenReader struct{}
-
-func (brokenReader) Read([]byte) (int, error) { return 0, errors.New("source failed") }
-func TestWriteCleansStagingWhenSourceFails(t *testing.T) {
-	c := executor(t, func(Request) string { t.Error("failed read reached executor"); return "" })
-	dir := t.TempDir()
-	os.Chmod(dir, 0700)
-	f := JobContext{Client: c, JobID: "j", DelegationID: "d", StagingDir: dir}.Files()
-	code(t, f.Write(context.Background(), "/home", "file", brokenReader{}, 3), "STAGING_UNAVAILABLE")
-	if files, _ := os.ReadDir(dir); len(files) != 0 {
-		t.Fatal("staging leaked")
-	}
-}
-
-func TestDialFailureIsDistinctFromAcceptedRequestFailure(t *testing.T) {
-	c := &Client{Socket: filepath.Join(t.TempDir(), "missing")}
-	var dial *dialFailure
-	err := c.Call(context.Background(), "files.write", nil, nil, nil)
-	if !errors.As(err, &dial) {
-		t.Fatalf("missing socket must be safe to retry: %v", err)
-	}
-	code(t, err, "EXECUTOR_UNAVAILABLE")
-	// A socket inode without a listener produces ECONNREFUSED.
-	c = executor(t, func(Request) string { return "" })
-	l, err := net.Listen("unix", filepath.Join(t.TempDir(), "refused"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	l.(*net.UnixListener).SetUnlinkOnClose(false)
-	c.Socket = l.Addr().String()
-	l.Close()
-	err = c.Call(context.Background(), "files.write", nil, nil, nil)
-	if !errors.As(err, &dial) {
-		t.Fatalf("refused dial must be safe to retry: %v", err)
-	}
-	c = executor(t, func(Request) string { return "" })
-	err = c.Call(context.Background(), "files.write", nil, nil, nil)
-	dial = nil
-	if errors.As(err, &dial) {
-		t.Fatalf("accepted request must never be replayed: %v", err)
-	}
-	code(t, err, "EXECUTOR_PROTOCOL")
-	c = executor(t, func(Request) string { return `{"ok":false,"code":"EXECUTOR_UNAVAILABLE"}` + "\n" })
-	err = c.Call(context.Background(), "files.write", nil, nil, nil)
-	if errors.As(err, &dial) {
-		t.Fatal("executor refusal must not be treated as a dial failure")
-	}
-	code(t, err, "EXECUTOR_UNAVAILABLE")
-}

package/templates/native-go-delegate/backend/internal/delegate/destination.go

@@ -1,110 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"net/http"
-	"time"
-)
-
-// DestinationSession verifies the authenticated caller and the write permission
-// with the same request's DSM session. No session material is persisted.
-type DestinationSession interface {
-	CheckPermission(context.Context, api.Caller, *http.Request, string) error
-}
-
-type SelectDestinationParams struct {
-	Key  string `json:"key"`
-	Path string `json:"path"`
-}
-
-func contains(values []string, value string) bool {
-	for _, candidate := range values {
-		if candidate == value {
-			return true
-		}
-	}
-	return false
-}
-
-// SelectDestination makes only explicitly configured permanent destinations.
-// Executor independently verifies the session, scope, policy and subject.
-func (s *Service) selectDestination(ctx context.Context, caller api.Caller, r *http.Request, in SelectDestinationParams) (Grant, error) {
-	var out Grant
-	auth, err := api.DSMSession(r)
-	if err != nil {
-		return out, err
-	}
-	owner, err := s.owner(caller)
-	if err != nil {
-		return out, err
-	}
-	if s.Lifetime != "until-revoked" || !contains(s.Operations, "files.moveFromStaging") {
-		return out, fail("unsupported")
-	}
-	if !contains(s.Destinations, in.Key) || !validPath(in.Path) || in.Path == "/" {
-		return out, fail("invalid-destination")
-	}
-	if s.SessionFiles == nil {
-		return out, fail("session_required")
-	}
-	if err = s.SessionFiles.CheckPermission(ctx, caller, r, in.Path); err != nil {
-		return out, err
-	}
-	err = s.Client.Call(ctx, "delegate.create", auth, map[string]any{
-		"ops": []string{"files.moveFromStaging"}, "scope": s.Scope, "path": in.Path,
-		"destination": in.Key, "lifetime": "until-revoked",
-	}, &out)
-	if err != nil {
-		return Grant{}, err
-	}
-	if out.DelegationID == "" || out.Subject.Username != owner.User || out.Subject.UIDString() != owner.UID || out.Lifetime != "until-revoked" || !out.ExpiresAt.IsZero() || out.Destination != in.Key || out.Path != in.Path {
-		if out.DelegationID != "" {
-			cleanup, done := context.WithTimeout(context.Background(), 10*time.Second)
-			defer done()
-			_ = s.Client.Call(cleanup, "delegate.revoke", auth, map[string]string{"delegation_id": out.DelegationID}, nil)
-		}
-		return Grant{}, fail("EXECUTOR_PROTOCOL")
-	}
-	return out, nil
-}
-
-// DestinationGrant is the picker-facing reference from the frozen W1a DTO.
-// It intentionally excludes numeric identities and legacy job/expiry metadata.
-type DestinationGrant struct {
-	ID       string `json:"id"`
-	Key      string `json:"key"`
-	Path     string `json:"path"`
-	Username string `json:"username"`
-	Lifetime string `json:"lifetime"`
-}
-
-func (s *Service) SelectDestination(ctx context.Context, caller api.Caller, r *http.Request, in SelectDestinationParams) (DestinationGrant, error) {
-	grant, err := s.selectDestination(ctx, caller, r, in)
-	if err != nil {
-		return DestinationGrant{}, err
-	}
-	return DestinationGrant{ID: grant.DelegationID, Key: in.Key, Path: grant.Path, Username: grant.Subject.Username, Lifetime: grant.Lifetime}, nil
-}
-
-// verifyOperationOwner avoids writing even an App-owned operation mirror for
-// another user's grant. The executor's session-filtered list supplies subjects;
-// it still rechecks live grant/ACL/fence on every subsequent operation.
-func (s *Service) verifyOperationOwner(ctx context.Context, caller api.Caller, auth map[string]string, id string) error {
-	owner, err := s.owner(caller)
-	if err != nil {
-		return err
-	}
-	var out struct {
-		Delegations []Grant `json:"delegations"`
-	}
-	if err = s.Client.Call(ctx, "delegate.list", auth, nil, &out); err != nil {
-		return err
-	}
-	for _, grant := range out.Delegations {
-		if grant.DelegationID == id && grant.Subject.Username == owner.User && grant.Subject.UIDString() == owner.UID {
-			return nil
-		}
-	}
-	return fail("DELEGATION_DENIED")
-}

package/templates/native-go-delegate/backend/internal/delegate/destination_state.go

@@ -1,117 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"net/http"
-	"os"
-	"strings"
-)
-
-// ScopeSelection is executor evidence; an installation draft is never authority.
-type ScopeSelection struct {
-	Scope      string `json:"scope"`
-	Root       string `json:"root"`
-	Generation uint64 `json:"generation"`
-}
-
-// DestinationState contains only this caller's destination reference. Keep this
-// reference with an App job; do not persist the caller's DSM session.
-type DestinationState struct {
-	Key         string            `json:"key"`
-	Selection   *ScopeSelection   `json:"selection"`
-	Destination *DestinationGrant `json:"destination"`
-	Status      string            `json:"status"`
-}
-
-func virtualScope(scope string) string {
-	if scope == "home" {
-		return "/home"
-	}
-	if strings.HasPrefix(scope, "shared:") {
-		name := strings.TrimPrefix(scope, "shared:")
-		if validName(name) && !strings.ContainsAny(name, "\\:") && strings.TrimSpace(name) == name {
-			return "/" + name
-		}
-	}
-	return ""
-}
-func validSelection(value *ScopeSelection, dynamic bool) bool {
-	return value != nil && virtualScope(value.Scope) != "" && value.Root == virtualScope(value.Scope) && value.Generation <= 1<<53-1 && (!dynamic || value.Generation > 0)
-}
-
-// Never use this package-owned draft for authorization or executor parameters.
-func (s *Service) decorateScope(out *Capability) {
-	out.ScopeMode = s.Scope
-	if s.Scope != "install-selected" || s.InstallDraftPath == "" {
-		return
-	}
-	info, err := os.Lstat(s.InstallDraftPath)
-	if err != nil || !info.Mode().IsRegular() || info.Size() > 4096 {
-		return
-	}
-	b, err := os.ReadFile(s.InstallDraftPath)
-	var draft struct {
-		Schema int    `json:"schema"`
-		Scope  string `json:"scope"`
-	}
-	if err != nil || len(b) > 4096 || json.Unmarshal(b, &draft) != nil || draft.Schema != 1 || virtualScope(draft.Scope) == "" {
-		return
-	}
-	out.Preselection = draft.Scope
-	out.Mismatch = out.Selection != nil && out.Selection.Scope != draft.Scope
-}
-
-// Destination is the single caller-bound lookup for the chosen scope,
-// destination and grant status. Selection comes from matching executor pins.
-func (s *Service) Destination(ctx context.Context, caller api.Caller, r *http.Request, key string) (DestinationState, error) {
-	out := DestinationState{Key: key, Status: "missing"}
-	if s.Lifetime != "until-revoked" || !contains(s.Destinations, key) {
-		return out, fail("invalid-destination")
-	}
-	owner, err := s.owner(caller)
-	if err != nil {
-		return out, err
-	}
-	auth, err := api.DSMSession(r)
-	if err != nil {
-		return out, err
-	}
-	status := s.Status(ctx)
-	if status.State == "needs-scope-confirmation" {
-		out.Status = status.State
-		return out, nil
-	}
-	if status.State != "ready" && status.State != "disabled" {
-		return out, fail("EXECUTOR_UNAVAILABLE")
-	}
-	out.Selection = status.Selection
-	if !validSelection(out.Selection, s.Scope == "install-selected") {
-		return out, fail("EXECUTOR_PROTOCOL")
-	}
-	var list struct {
-		Delegations []Grant `json:"delegations"`
-	}
-	if err = s.Client.Call(ctx, "delegate.list", auth, nil, &list); err != nil {
-		return out, err
-	}
-	for _, grant := range list.Delegations {
-		if grant.Subject.Username != owner.User || grant.Subject.UIDString() != owner.UID || grant.Destination != key || grant.Lifetime != "until-revoked" {
-			continue
-		}
-		if out.Destination == nil {
-			out.Status = "reselection-required"
-		}
-		if grant.Revoked || grant.Scope != out.Selection.Scope || grant.ScopeGeneration != out.Selection.Generation || !validPath(grant.Path) || !(grant.Path == out.Selection.Root || strings.HasPrefix(grant.Path, out.Selection.Root+"/")) {
-			continue
-		}
-		out.Destination = &DestinationGrant{ID: grant.DelegationID, Key: key, Path: grant.Path, Username: grant.Subject.Username, Lifetime: grant.Lifetime}
-		out.Status = "active"
-	}
-	if status.State == "disabled" {
-		out.Status = "disabled"
-		out.Destination = nil
-	}
-	return out, nil
-}

package/templates/native-go-delegate/backend/internal/delegate/destination_state_test.go

@@ -1,60 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestDestinationUsesProtectedSelectionAndThisOwnerOnly(t *testing.T) {
-	s := service(t, nil)
-	s.Scope = "install-selected"
-	s.Lifetime = "until-revoked"
-	s.Destinations = []string{"save"}
-	s.InstallDraftPath = filepath.Join(t.TempDir(), "delegate-install.json")
-	os.WriteFile(s.InstallDraftPath, []byte(`{"schema":1,"scope":"shared:untrusted"}`), 0600)
-	grants := `[{"delegation_id":"old","destination":"save","scope":"shared:reports","scope_generation":1,"path":"/reports/old","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"},{"delegation_id":"other","destination":"save","scope":"shared:reports","scope_generation":2,"path":"/reports/other","subject":{"username":"bob","uid":1206},"lifetime":"until-revoked"},{"delegation_id":"current","destination":"save","scope":"shared:reports","scope_generation":2,"path":"/reports/export","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"}]`
-	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, _ any, out any) error {
-		if op == "status" {
-			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false,"scope_state":"","selection":{"scope":"shared:reports","root":"/reports","generation":2}}`), out)
-		}
-		if op != "delegate.list" || auth["dsm_cookie"] != "fake-cookie" {
-			t.Fatal(op, auth)
-		}
-		return json.Unmarshal([]byte(`{"delegations":`+grants+`}`), out)
-	})
-	status := s.Status(context.Background())
-	if !status.Mismatch || status.Preselection != "shared:untrusted" || status.Selection.Scope != "shared:reports" {
-		t.Fatal(status)
-	}
-	got, err := s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save")
-	if err != nil || got.Status != "active" || got.Destination.ID != "current" || got.Selection.Scope != "shared:reports" {
-		t.Fatal(got, err)
-	}
-	grants = `[{"delegation_id":"old","destination":"save","scope":"home","scope_generation":1,"path":"/home","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked"}]`
-	got, err = s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "save")
-	if err != nil || got.Status != "reselection-required" || got.Destination != nil {
-		t.Fatal(got, err)
-	}
-	if _, err = s.Destination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), "unknown"); err == nil {
-		t.Fatal("unknown key allowed")
-	}
-}
-func TestSelectedScopeMissingAndMalformedEvidenceNeverBecomeAuthority(t *testing.T) {
-	for _, wire := range []string{
-		`{"scope":"shared:reports","root":"/wrong","generation":1}`,
-		`{"scope":"shared:reports","root":"/reports","generation":0}`,
-		`{"scope":"shared:reports","root":"/reports","generation":9007199254740992}`,
-	} {
-		s := service(t, nil)
-		s.Scope = "install-selected"
-		s.Client = fakeExecutor(func(_ context.Context, _ string, _ map[string]string, _ any, out any) error {
-			return json.Unmarshal([]byte(`{"executor_digest":"e","policy_digest":"p","version":"1","ready":true,"disabled":false,"selection":`+wire+`}`), out)
-		})
-		if got := s.Status(context.Background()); got.State != "blocked" || got.Selection != nil {
-			t.Fatal(got)
-		}
-	}
-}

package/templates/native-go-delegate/backend/internal/delegate/destination_test.go

@@ -1,116 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-type fakeExecutor func(context.Context, string, map[string]string, any, any) error
-
-func (f fakeExecutor) Call(ctx context.Context, op string, auth map[string]string, in, out any) error {
-	return f(ctx, op, auth, in, out)
-}
-
-type fakeSession struct {
-	err        error
-	calls      int
-	user, path string
-}
-
-func (f *fakeSession) CheckPermission(_ context.Context, caller api.Caller, _ *http.Request, path string) error {
-	f.calls++
-	f.user, f.path = caller.User(), path
-	return f.err
-}
-func destinationCaller(t *testing.T, user string) api.Caller {
-	t.Helper()
-	var caller api.Caller
-	route := api.HandleRequest("test.caller", func(_ context.Context, c api.Caller, _ *http.Request, _ json.RawMessage) (any, error) {
-		caller = c
-		return struct{}{}, nil
-	})
-	srv, err := api.NewServerWithPermissions(identity{user}, []byte(`{"schema":1,"default":"administrators","methods":{"test.caller":"authenticated"}}`), route)
-	if err != nil {
-		t.Fatal(err)
-	}
-	r := httptest.NewRequest("POST", "/", strings.NewReader(`{"method":"test.caller","params":{}}`))
-	r.Header.Set("Content-Type", "application/json")
-	srv.ServeHTTP(httptest.NewRecorder(), r)
-	return caller
-}
-func destinationRequest() *http.Request {
-	r := httptest.NewRequest("POST", "/", nil)
-	r.AddCookie(&http.Cookie{Name: "id", Value: "fake-cookie"})
-	r.Header.Set("X-SYNO-TOKEN", "fake-token")
-	return r
-}
-func TestSelectDestinationChecksSessionBeforeSavingManifestBoundGrant(t *testing.T) {
-	session := &fakeSession{}
-	s := service(t, nil)
-	s.SessionFiles = session
-	s.Destinations = []string{"save"}
-	s.Operations = []string{"files.moveFromStaging"}
-	s.Lifetime = "until-revoked"
-	calls := 0
-	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
-		calls++
-		if session.calls != 1 || session.user != "alice" || session.path != "/home" || op != "delegate.create" || auth["dsm_cookie"] != "fake-cookie" {
-			t.Fatal("grant saved before verifying caller write permission")
-		}
-		data, _ := json.Marshal(in)
-		if strings.Contains(string(data), "username") || strings.Contains(string(data), "uid") || strings.Contains(string(data), "job_id") || strings.Contains(string(data), "ttl_seconds") {
-			t.Fatal("caller authority or legacy job leaked into grant")
-		}
-		return json.Unmarshal([]byte(`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked","destination":"save","path":"/home"}`), out)
-	})
-	caller := destinationCaller(t, "alice")
-	grant, err := s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"})
-	if err != nil || grant.ID != "grant" || calls != 1 {
-		t.Fatal(grant, err, calls)
-	}
-	session.err = errors.New("denied")
-	if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil || calls != 1 {
-		t.Fatal("failed write check saved grant")
-	}
-	session.err = nil
-	for _, in := range []SelectDestinationParams{{Key: "other", Path: "/home"}, {Key: "save", Path: "/home/../etc"}, {Key: "save", Path: "/"}} {
-		if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), in); err == nil || calls != 1 {
-			t.Fatal("unbound destination saved grant")
-		}
-	}
-	s.Lifetime = ""
-	if _, err = s.SelectDestination(context.Background(), caller, destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil || calls != 1 {
-		t.Fatal("legacy config silently made permanent")
-	}
-}
-func TestSelectDestinationRejectsExecutorSubjectMismatch(t *testing.T) {
-	for _, body := range []string{
-		`{"delegation_id":"grant","subject":{"username":"bob","uid":1205},"lifetime":"until-revoked","destination":"save","path":"/home"}`,
-		`{"delegation_id":"grant","subject":{"username":"alice","uid":1206},"lifetime":"until-revoked","destination":"save","path":"/home"}`,
-		`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"lifetime":"until-revoked","destination":"other","path":"/home"}`,
-		`{"delegation_id":"grant","subject":{"username":"alice","uid":1205},"expires_at":"2030-01-01T00:00:00Z"}`,
-	} {
-		t.Run(body, func(t *testing.T) {
-			s := service(t, nil)
-			s.SessionFiles = &fakeSession{}
-			s.Destinations = []string{"save"}
-			s.Operations = []string{"files.moveFromStaging"}
-			s.Lifetime = "until-revoked"
-			s.Client = fakeExecutor(func(_ context.Context, op string, _ map[string]string, in, out any) error {
-				if op == "delegate.revoke" {
-					return nil
-				}
-				return json.Unmarshal([]byte(body), out)
-			})
-			if _, err := s.SelectDestination(context.Background(), destinationCaller(t, "alice"), destinationRequest(), SelectDestinationParams{Key: "save", Path: "/home"}); err == nil {
-				t.Fatal("unverified grant accepted")
-			}
-		})
-	}
-}