@synopackageland/cli 0.8.0 → 0.9.1

package/templates/_executor/dsm.go

@@ -1,369 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"errors"
-	"io"
-	"net/http"
-	"net/url"
-	"os/user"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-)
-
-type Command interface {
-	Exec(context.Context, string, []string) ([]byte, error)
-}
-type Accounts interface{ Lookup(string) (Subject, error) }
-type localAccounts struct{}
-
-func (localAccounts) Lookup(name string) (Subject, error) {
-	var s Subject
-	u, err := user.Lookup(name)
-	if err != nil || u.Username != name {
-		return s, errors.New("account")
-	}
-	uid, err := strconv.Atoi(u.Uid)
-	if err != nil {
-		return s, err
-	}
-	gid, err := strconv.Atoi(u.Gid)
-	if err != nil {
-		return s, err
-	}
-	gs, err := u.GroupIds()
-	if err != nil {
-		return s, err
-	}
-	admin, err := user.LookupGroup("administrators")
-	if err != nil {
-		return s, err
-	}
-	s = Subject{Username: name, UID: uid, GID: gid, Home: u.HomeDir}
-	for _, v := range gs {
-		g, err := strconv.Atoi(v)
-		if err != nil {
-			return Subject{}, err
-		}
-		s.Groups = append(s.Groups, g)
-		if v == admin.Gid {
-			s.Admin = true
-		}
-	}
-	sort.Ints(s.Groups)
-	return s, nil
-}
-
-type HTTPDoer interface {
-	Do(*http.Request) (*http.Response, error)
-}
-type liveDSM struct {
-	Command  Command
-	Accounts Accounts
-	HTTP     HTTPDoer
-	Endpoint string
-}
-
-func newDSM() *liveDSM {
-	return &liveDSM{Command: processCommand{}, Accounts: localAccounts{}, HTTP: &http.Client{Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}, Endpoint: "http://127.0.0.1:5000/webapi/entry.cgi"}
-}
-
-type envelope struct {
-	Success bool            `json:"success"`
-	Data    json.RawMessage `json:"data"`
-}
-
-// dsmError keeps the DSM error code of a refused call; the message stays generic.
-type dsmError struct{ Code int }
-
-func (*dsmError) Error() string { return "DSM refused" }
-
-func decodeEnvelope(b []byte) (json.RawMessage, error) {
-	data, err := decodeSuccess(b)
-	if err == nil && (len(data) == 0 || string(data) == "null") {
-		return nil, &dsmError{}
-	}
-	return data, err
-}
-
-// decodeSuccess accepts a success without data: scheduler deletes answer
-// {"success":true}, sometimes with httpd_restart, and that confirms the delete.
-func decodeSuccess(b []byte) (json.RawMessage, error) {
-	var r envelope
-	d := json.NewDecoder(bytes.NewReader(b))
-	if uniqueValue(d, false) != nil || hasDSMError(b) || json.Unmarshal(b, &r) != nil || !r.Success {
-		var refused struct {
-			Error struct {
-				Code int `json:"code"`
-			} `json:"error"`
-		}
-		json.Unmarshal(b, &refused)
-		return nil, &dsmError{Code: refused.Error.Code}
-	}
-	return r.Data, nil
-}
-func (d *liveDSM) Verify(ctx context.Context, cookie, token string) (string, error) {
-	form := url.Values{"api": {"SYNO.Core.NormalUser"}, "version": {"1"}, "method": {"get"}}
-	req, err := http.NewRequestWithContext(ctx, "POST", d.Endpoint, strings.NewReader(form.Encode()))
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.AddCookie(&http.Cookie{Name: "id", Value: cookie})
-	req.Header.Set("X-SYNO-TOKEN", token)
-	res, err := d.HTTP.Do(req)
-	if err != nil {
-		return "", errors.New("session")
-	}
-	defer res.Body.Close()
-	b, err := io.ReadAll(io.LimitReader(res.Body, maxRequest+1))
-	if err != nil || len(b) > maxRequest || res.StatusCode != 200 {
-		return "", errors.New("session")
-	}
-	data, err := decodeEnvelope(b)
-	if err != nil {
-		return "", err
-	}
-	var out struct {
-		Username string `json:"username"`
-	}
-	if json.Unmarshal(data, &out) != nil || out.Username == "" || strings.ContainsFunc(out.Username, func(r rune) bool { return r < 32 }) {
-		return "", errors.New("session")
-	}
-	return out.Username, nil
-}
-func (d *liveDSM) call(ctx context.Context, api, method, version, runner string, params map[string]any) (json.RawMessage, error) {
-	b, err := d.exec(ctx, api, method, version, runner, params)
-	if err != nil {
-		return nil, err
-	}
-	return decodeEnvelope(b)
-}
-
-// mutate runs a call whose success carries no data, such as a scheduler delete.
-func (d *liveDSM) mutate(ctx context.Context, api, method, version string, params map[string]any) error {
-	b, err := d.exec(ctx, api, method, version, "", params)
-	if err == nil {
-		_, err = decodeSuccess(b)
-	}
-	return err
-}
-func (d *liveDSM) exec(ctx context.Context, api, method, version, runner string, params map[string]any) ([]byte, error) {
-	args := []string{"--exec", "api=" + api, "method=" + method, "version=" + version}
-	if runner != "" {
-		args = append(args, "runner="+runner)
-	}
-	keys := make([]string, 0, len(params))
-	for k := range params {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	for _, k := range keys {
-		b, err := json.Marshal(params[k])
-		if err != nil {
-			return nil, err
-		}
-		args = append(args, k+"="+string(b))
-	}
-	b, err := d.Command.Exec(ctx, "/usr/syno/bin/synowebapi", args)
-	if err != nil {
-		if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
-			return nil, err
-		}
-		return nil, errors.New("DSM command")
-	}
-	return b, nil
-}
-func (d *liveDSM) Account(ctx context.Context, name string) (Subject, error) {
-	s, err := d.Accounts.Lookup(name)
-	if err != nil {
-		return s, err
-	}
-	data, err := d.call(ctx, "SYNO.Core.User", "get", "1", "", map[string]any{"name": name, "additional": []string{"expired"}})
-	if err != nil {
-		return Subject{}, err
-	}
-	var out struct {
-		Users []struct {
-			Name    string `json:"name"`
-			UID     *int   `json:"uid"`
-			Expired string `json:"expired"`
-		} `json:"users"`
-	}
-	if json.Unmarshal(data, &out) != nil || len(out.Users) != 1 || out.Users[0].Name != name || out.Users[0].UID == nil || *out.Users[0].UID != s.UID || out.Users[0].Expired != "normal" {
-		return Subject{}, errors.New("account ineligible")
-	}
-	s.Expired = out.Users[0].Expired
-	return s, nil
-}
-
-// Allow is the executor's offline App Privileges decision. It follows the CGI
-// EntryGate: administrators pass, admin-only refuses everyone else, and
-// app-privilege requires DSM's own allow. Preview lists only effective allows
-// (user, group and everyone rules), so an absent App is allowed only when the
-// package declares no entry mode and DSM therefore never manages its App.
-func (d *liveDSM) Allow(ctx context.Context, s Subject, app, entry string) error {
-	if !contains([]string{"", "admin-only", "app-privilege"}, entry) {
-		return errors.New("entry mode")
-	}
-	data, err := d.call(ctx, "SYNO.Core.AppPriv.App", "preview", "2", "", map[string]any{"username": s.Username})
-	if err != nil {
-		return err
-	}
-	// An explicit deny/custom entry or malformed/ambiguous response refuses.
-	var out struct {
-		Apps *[]json.RawMessage `json:"applications"`
-	}
-	if json.Unmarshal(data, &out) != nil || out.Apps == nil || app == "" {
-		return errors.New("app privilege")
-	}
-	count := 0
-	for _, raw := range *out.Apps {
-		var a struct {
-			ID        string `json:"app_id"`
-			Privilege string `json:"privilelge"`
-		}
-		if json.Unmarshal(raw, &a) != nil || a.ID == "" || !contains([]string{"allow", "deny", "custom"}, a.Privilege) {
-			return errors.New("app privilege entry")
-		}
-		if a.ID == app {
-			count++
-			if a.Privilege != "allow" {
-				return errors.New("app denied")
-			}
-		}
-	}
-	if count > 1 {
-		return errors.New("app ambiguous")
-	}
-	if entry == "" || s.Admin || entry == "app-privilege" && count == 1 {
-		return nil
-	}
-	return errors.New("app denied")
-}
-func (d *liveDSM) ScopeRoot(ctx context.Context, s Subject, scope string) (string, error) {
-	if scope == "home" {
-		if !cleanPath(s.Home) || s.Home == "/" {
-			return "", errors.New("home")
-		}
-		return filepath.EvalSymlinks(s.Home)
-	}
-	if scopeVirtual(scope) == "" {
-		return "", errors.New("scope")
-	}
-	name := strings.TrimPrefix(scope, "shared:")
-	data, err := d.call(ctx, "SYNO.Core.Share", "get", "1", "", map[string]any{"name": name})
-	if err != nil {
-		return "", err
-	}
-	// DSM Share.get returns one share and its volume, not Share.list's array.
-	var out struct {
-		Name   string `json:"name"`
-		Volume string `json:"vol_path"`
-	}
-	if json.Unmarshal(data, &out) != nil || out.Name != name || !validSelectedScope(scope) || !cleanPath(out.Volume) || out.Volume == "/" {
-		return "", errors.New("share")
-	}
-	return filepath.EvalSymlinks(filepath.Join(out.Volume, out.Name))
-}
-func (d *liveDSM) API(ctx context.Context, runner, op string, p map[string]any) (json.RawMessage, error) {
-	if runner == "" {
-		return nil, errors.New("runner")
-	}
-	api, method := "", ""
-	version := "2"
-	params := map[string]any{}
-	switch op {
-	case "files.list":
-		api = "SYNO.FileStation.List"
-		method = "list"
-		params["folder_path"] = p["path"]
-	case "files.info":
-		api = "SYNO.FileStation.List"
-		method = "getinfo"
-		params["path"] = []any{p["path"]}
-	case "files.createFolder":
-		api = "SYNO.FileStation.CreateFolder"
-		method = "create"
-		params["folder_path"] = p["path"]
-		params["name"] = p["name"]
-		params["force_parent"] = false
-	case "files.checkPermission":
-		api = "SYNO.FileStation.CheckPermission"
-		method = "write"
-		version = "3"
-		params["path"] = p["path"]
-		params["filename"] = ".synopkgland-permission-probe"
-		params["overwrite"] = false
-		params["size"] = 0
-	default:
-		return nil, errors.New("operation")
-	}
-	data, err := d.call(ctx, api, method, version, runner, params)
-	if err != nil {
-		return nil, err
-	}
-	// Some File Station methods report per-file errors inside success:true.
-	if hasDSMError(data) {
-		return nil, errors.New("DSM file error")
-	}
-	var shape map[string]json.RawMessage
-	if json.Unmarshal(data, &shape) != nil {
-		return nil, errors.New("DSM data")
-	}
-	if op == "files.checkPermission" {
-		var skip *bool
-		if json.Unmarshal(shape["blSkip"], &skip) != nil || skip == nil || *skip {
-			return nil, errors.New("permission not confirmed")
-		}
-	} else {
-		key := "files"
-		if op == "files.createFolder" {
-			key = "folders"
-		}
-		var entries []json.RawMessage
-		if json.Unmarshal(shape[key], &entries) != nil || entries == nil {
-			return nil, errors.New("missing files")
-		}
-		if (op == "files.info" || op == "files.createFolder") && len(entries) != 1 {
-			return nil, errors.New("missing target")
-		}
-	}
-	return data, nil
-}
-func hasDSMError(data json.RawMessage) bool {
-	var v any
-	if json.Unmarshal(data, &v) != nil {
-		return true
-	}
-	var walk func(any) bool
-	walk = func(v any) bool {
-		switch x := v.(type) {
-		case map[string]any:
-			for k, v := range x {
-				if k == "error" {
-					return true
-				}
-				if k == "success" && v == false {
-					return true
-				}
-				if walk(v) {
-					return true
-				}
-			}
-		case []any:
-			for _, v := range x {
-				if walk(v) {
-					return true
-				}
-			}
-		}
-		return false
-	}
-	return walk(v)
-}

package/templates/_executor/dsm_test.go

@@ -1,290 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-type accountsStub struct {
-	s   Subject
-	err error
-}
-
-func (a accountsStub) Lookup(string) (Subject, error) { return a.s, a.err }
-
-type cmdStub struct {
-	reply string
-	args  []string
-	path  string
-	err   error
-}
-
-func TestDSMCommandDeadlineStaysDistinctFromDenial(t *testing.T) {
-	for _, cause := range []error{context.DeadlineExceeded, errors.New("explicit DSM refusal")} {
-		d := &liveDSM{Command: &cmdStub{err: cause}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
-		_, err := d.ScopeRoot(context.Background(), Subject{Username: "alice"}, "shared:reports")
-		if errors.Is(err, context.DeadlineExceeded) != errors.Is(cause, context.DeadlineExceeded) {
-			t.Fatal("lost deadline identity", err)
-		}
-		e := &Executor{DSM: d, Policy: Policy{App: "app"}}
-		_, code := e.eligible(context.Background(), "alice", 1200, true)
-		want := "INELIGIBLE"
-		if errors.Is(cause, context.DeadlineExceeded) {
-			want = "EXECUTOR_PAUSED"
-		}
-		if code != want {
-			t.Fatal(code, want)
-		}
-	}
-}
-
-func (c *cmdStub) Exec(ctx context.Context, p string, args []string) ([]byte, error) {
-	c.path = p
-	c.args = args
-	return []byte(c.reply), c.err
-}
-func TestDSMAccountFailClosed(t *testing.T) {
-	for _, tc := range []struct {
-		name, reply string
-		pass        bool
-	}{
-		{"valid", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"normal"}]}}`, true},
-		{"success empty", `{"success":true,"data":{}}`, false},
-		{"success no user", `{"success":true,"data":{"users":[]}}`, false},
-		{"missing expiry", `{"success":true,"data":{"users":[{"name":"alice","uid":1200}]}}`, false},
-		{"disabled", `{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"now"}]}}`, false},
-		{"uid mismatch", `{"success":true,"data":{"users":[{"name":"alice","uid":1201,"expired":"normal"}]}}`, false},
-		{"name mismatch", `{"success":true,"data":{"users":[{"name":"bob","uid":1200,"expired":"normal"}]}}`, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			c := &cmdStub{reply: tc.reply}
-			d := &liveDSM{Command: c, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200}}}
-			_, err := d.Account(context.Background(), "alice")
-			if (err == nil) != tc.pass {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-func TestDSMAppPrivilege(t *testing.T) {
-	for _, tc := range []struct {
-		name, reply string
-		pass        bool
-	}{
-		{"allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`, true},
-		{"deny", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`, false},
-		{"custom", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"custom"}]}}`, false},
-		{"default allow", `{"success":true,"data":{"applications":[]}}`, true},
-		{"missing applications", `{"success":true,"data":{}}`, false},
-		{"null applications", `{"success":true,"data":{"applications":null}}`, false},
-		{"deny overrides allow", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"deny"}]}}`, false},
-		{"duplicate", `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"},{"app_id":"app","privilelge":"allow"}]}}`, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			c := &cmdStub{reply: tc.reply}
-			d := &liveDSM{Command: c}
-			err := d.Allow(context.Background(), Subject{Username: "alice"}, "app", "")
-			if (err == nil) != tc.pass {
-				t.Fatal(err)
-			}
-			if !reflect.DeepEqual(c.args, []string{"--exec", "api=SYNO.Core.AppPriv.App", "method=preview", "version=2", `username="alice"`}) {
-				t.Fatal(c.args)
-			}
-		})
-	}
-}
-
-// Preview lists only effective allows, so an absent App means "not allowed"
-// unless DSM never manages the App (no entry mode). Mirrors the CGI EntryGate.
-func TestDSMAppPrivilegeByEntryMode(t *testing.T) {
-	const (
-		absent    = `{"success":true,"data":{"applications":[{"app_id":"other","privilelge":"allow"}]}}`
-		allowed   = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"allow"}]}}`
-		denied    = `{"success":true,"data":{"applications":[{"app_id":"app","privilelge":"deny"}]}}`
-		allowAll  = `{"success":true,"data":{"applications":[{"app_id":"SYNO.ALLOW.ALL.APPLICATIONS","privilelge":"allow"}]}}`
-		malformed = `{"success":true,"data":{}}`
-	)
-	user, admin := Subject{Username: "alice"}, Subject{Username: "root-admin", Admin: true}
-	for _, tc := range []struct {
-		name, entry, reply string
-		s                  Subject
-		pass               bool
-	}{
-		{"legacy absent", "", absent, user, true},
-		{"app-privilege absent", "app-privilege", absent, user, false},
-		{"app-privilege allowed", "app-privilege", allowed, user, true},
-		{"app-privilege denied", "app-privilege", denied, user, false},
-		{"app-privilege admin", "app-privilege", allowAll, admin, true},
-		{"app-privilege admin malformed", "app-privilege", malformed, admin, false},
-		{"admin-only user allowed rule", "admin-only", allowed, user, false},
-		{"admin-only admin", "admin-only", allowAll, admin, true},
-		{"unknown mode", "everyone", allowed, user, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			d := &liveDSM{Command: &cmdStub{reply: tc.reply}}
-			if err := d.Allow(context.Background(), tc.s, "app", tc.entry); (err == nil) != tc.pass {
-				t.Fatal(err)
-			}
-		})
-	}
-}
-func TestDSMVerify(t *testing.T) {
-	for _, reply := range []string{`{"success":true,"data":{"username":"alice"}}`, `{"success":true,"data":{}}`, `{"success":false}`, strings.Repeat("x", maxRequest+1)} {
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			c, err := r.Cookie("id")
-			if err != nil || c.Value != "cookie" || r.Header.Get("X-SYNO-TOKEN") != "token" {
-				t.Error("cookie")
-			}
-			w.Write([]byte(reply))
-		}))
-		d := &liveDSM{HTTP: srv.Client(), Endpoint: srv.URL}
-		name, err := d.Verify(context.Background(), "cookie", "token")
-		srv.Close()
-		if strings.Contains(reply, `"alice"`) {
-			if err != nil || name != "alice" {
-				t.Fatal(name, err)
-			}
-		} else if err == nil {
-			t.Fatal("invalid identity accepted")
-		}
-	}
-}
-func TestDSMArgvAndEmbeddedError(t *testing.T) {
-	c := &cmdStub{reply: `{"success":true,"data":{"files":[{"error":{"code":407}}]}}`}
-	d := &liveDSM{Command: c}
-	_, err := d.API(context.Background(), "alice", "files.createFolder", map[string]any{"path": "/home", "name": "$(touch nope);`x`"})
-	if err == nil || c.path != "/usr/syno/bin/synowebapi" || !contains(c.args, "runner=alice") {
-		t.Fatal(err, c)
-	}
-	if !contains(c.args, `name="$(touch nope);`+"`x`"+`"`) {
-		t.Fatal(c.args)
-	}
-	c.err = errors.New("unavailable")
-	if _, err = d.API(context.Background(), "alice", "files.list", map[string]any{"path": "/home"}); err == nil {
-		t.Fatal("command error")
-	}
-}
-
-type rootStub struct {
-	calls int
-	err   error
-}
-
-func (r *rootStub) Run(context.Context, string, string) (string, error) {
-	r.calls++
-	return "root", r.err
-}
-func TestRootRequiresVerifiedAdmin(t *testing.T) {
-	e, f, _ := setup(t)
-	r := &rootStub{}
-	e.Runner = r
-	e.Policy.Root = map[string]string{"whoami": strings.Repeat("a", 64)}
-	out := request(e, "root.run", map[string]any{"name": "whoami"})
-	if out.Code != "ADMIN_REQUIRED" || r.calls != 0 {
-		t.Fatal(out)
-	}
-	f.user.Admin = true
-	if out = request(e, "root.run", map[string]any{"name": "whoami"}); !out.OK || r.calls != 1 {
-		t.Fatal(out)
-	}
-	if out = request(e, "root.run", map[string]any{"name": "other"}); out.Code != "POLICY_DENIED" {
-		t.Fatal(out)
-	}
-}
-func TestSubdirectoryBinding(t *testing.T) {
-	e, f, _ := setup(t)
-	f.root = t.TempDir()
-	f.root = realTestPath(t, f.root)
-	if err := makeTestDir(f.root + "/downloads"); err != nil {
-		t.Fatal(err)
-	}
-	out := request(e, "delegate.create", map[string]any{"job_id": "j", "ops": []string{"files.list"}, "scope": "home", "path": "/home/downloads", "ttl_seconds": 60})
-	if !out.OK {
-		t.Fatal(out)
-	}
-}
-
-func TestDSMEmptyOperationDataDenied(t *testing.T) {
-	for _, op := range []string{"files.list", "files.info", "files.createFolder", "files.checkPermission"} {
-		c := &cmdStub{reply: `{"success":true,"data":{}}`}
-		d := &liveDSM{Command: c}
-		if _, err := d.API(context.Background(), "alice", op, map[string]any{"path": "/home", "name": "new"}); err == nil {
-			t.Fatal(op, "empty success accepted")
-		}
-	}
-}
-
-type eligibilityCommand struct{ expired, deniedApp string }
-
-func (c eligibilityCommand) Exec(_ context.Context, _ string, args []string) ([]byte, error) {
-	if contains(args, "api=SYNO.Core.User") {
-		return []byte(`{"success":true,"data":{"users":[{"name":"alice","uid":1200,"expired":"` + c.expired + `"}]}}`), nil
-	}
-	if c.deniedApp != "" {
-		return []byte(`{"success":true,"data":{"applications":[{"app_id":"` + c.deniedApp + `","privilelge":"deny"}]}}`), nil
-	}
-	return []byte(`{"success":true,"data":{"applications":[]}}`), nil
-}
-func TestDefaultAppPrivilegeNeverBypassesExplicitDenialOrDisabledAccount(t *testing.T) {
-	for _, tc := range []struct{ name, expiry, deny, want string }{
-		{"ordinary defaults", "normal", "", ""},
-		{"explicit App deny", "normal", "app", "APP_DENIED"},
-		{"explicit File Station deny", "normal", "SYNO.SDS.App.FileStation3.Instance", "APP_DENIED"},
-		{"disabled with default Apps", "now", "", "INELIGIBLE"},
-		{"unknown account state", "", "", "INELIGIBLE"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			e, _, _ := setup(t)
-			e.DSM = &liveDSM{Command: eligibilityCommand{expired: tc.expiry, deniedApp: tc.deny}, Accounts: accountsStub{s: Subject{Username: "alice", UID: 1200, GID: 100, Groups: []int{100}}}}
-			_, code := e.eligible(context.Background(), "alice", 1200, true)
-			if code != tc.want {
-				t.Fatal(code, tc.want)
-			}
-		})
-	}
-}
-
-func TestDSMSharedScopeUsesMeasuredGetVolumeContract(t *testing.T) {
-	volume := t.TempDir()
-	volume, err := filepath.EvalSymlinks(volume)
-	if err != nil {
-		t.Fatal(err)
-	}
-	share := filepath.Join(volume, "reports")
-	if err := os.Mkdir(share, 0700); err != nil {
-		t.Fatal(err)
-	}
-	for _, tc := range []struct {
-		name, data string
-		pass       bool
-	}{
-		{"DSM single share", `{"name":"reports","vol_path":` + strconv.Quote(volume) + `,"desc":"test","uuid":"fixture"}`, true},
-		{"different share", `{"name":"other","vol_path":` + strconv.Quote(volume) + `}`, false},
-		{"missing volume", `{"name":"reports"}`, false},
-		{"relative volume", `{"name":"reports","vol_path":"relative"}`, false},
-		{"unclean volume", `{"name":"reports","vol_path":"/volume1/../etc"}`, false},
-		{"root volume", `{"name":"reports","vol_path":"/"}`, false},
-		{"null", `null`, false},
-		{"invented list contract", `{"shares":[{"name":"reports","path":` + strconv.Quote(share) + `}]}`, false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			cmd := &cmdStub{reply: `{"success":true,"data":` + tc.data + `}`}
-			d := &liveDSM{Command: cmd}
-			root, err := d.ScopeRoot(context.Background(), Subject{}, "shared:reports")
-			if (err == nil) != tc.pass || tc.pass && root != share {
-				t.Fatalf("root=%q err=%v", root, err)
-			}
-			if !reflect.DeepEqual(cmd.args, []string{"--exec", "api=SYNO.Core.Share", "method=get", "version=1", `name="reports"`}) {
-				t.Fatal(cmd.args)
-			}
-		})
-	}
-}