@synopackageland/templates 0.0.0-stage → 0.9.0

package/templates/native-go/backend/internal/app/background.go

@@ -0,0 +1,249 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log"
+	"net/http"
+	"os/user"
+	"path"
+	"path/filepath"
+	"time"
+
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
+)
+
+// workerFresh is how recent the worker heartbeat must be to count as running.
+const workerFresh = 15 * time.Second
+
+// lookupSubmitterUID resolves the authenticated DSM username on every request.
+// Unknown UIDs fail closed for owners and submission.
+var lookupSubmitterUID = osLookupUID
+
+func osLookupUID(name string) string {
+	u, err := user.Lookup(name)
+	if err != nil {
+		return ""
+	}
+	return u.Uid
+}
+
+type backgroundFiles interface {
+	Browse(ctx context.Context, c api.Caller, r *http.Request, folder string, offset int) (filestation.Page, error)
+	ReadFile(ctx context.Context, c api.Caller, r *http.Request, folder, rel string) ([]byte, error)
+}
+
+type backgroundAPI struct {
+	store *background.Store
+	files backgroundFiles
+}
+
+// BackgroundRoutes is the production assembly of the opt-in background jobs
+// API. `synopkgland init --with jobs` wires it in through background.go's
+// replacement of background_none.go; nothing else references it.
+func BackgroundRoutes(dataDir string) []api.Route {
+	return newBackgroundRoutes(background.NewRequestStore(filepath.Join(dataDir, "background")), filestation.Local(dataDir))
+}
+
+// Every request authenticates against DSM afresh. Owner routes are available
+// to signed-in users; schedule reapproval and owner cleanup are admin-only.
+func newBackgroundRoutes(store *background.Store, files backgroundFiles) []api.Route {
+	b := backgroundAPI{store: store, files: files}
+	return []api.Route{
+		api.HandleRequest("bg.status", b.owner(b.status)),
+		api.HandleRequest("bg.schedules.list", b.owner(b.schedules)),
+		api.HandleRequest("bg.schedules.create", b.owner(b.createSchedule)),
+		api.HandleRequest("bg.schedules.disable", b.owner(b.disableSchedule)),
+		api.HandleRequest("bg.schedules.delete", b.owner(b.deleteSchedule)),
+		api.HandleRequest("bg.schedules.enable", b.admin(b.enableSchedule)),
+		api.HandleRequest("bg.jobs.purge", b.admin(b.purge)),
+		api.HandleRequest("bg.browse", b.owner(b.browse)),
+		api.HandleRequest("bg.jobs.submit", b.owner(b.submit)),
+		api.HandleRequest("bg.jobs.list", b.owner(b.list)),
+		api.HandleRequest("bg.jobs.get", b.owner(b.get)),
+		api.HandleRequest("bg.jobs.cancel", b.owner(b.cancel)),
+		api.HandleRequest("bg.jobs.result", b.owner(b.result)),
+	}
+}
+
+type backgroundHandler func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error)
+
+func (backgroundAPI) admin(h backgroundHandler) api.RequestHandler {
+	return func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+		if !c.Admin() {
+			return nil, &api.Error{Code: "unsupported", Message: "background jobs need a DSM administrator"}
+		}
+		return h(ctx, c, r, params)
+	}
+}
+
+type idParams struct {
+	ID string `json:"id"`
+}
+
+type jobView struct {
+	Job background.Job `json:"job"`
+}
+
+func (b backgroundAPI) status(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	st, err := b.store.StatusFor(ctx, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	var worker map[string]any
+	if st.Worker != nil {
+		worker = map[string]any{"pid": st.Worker.PID, "uid": st.Worker.UID, "username": st.Worker.Username,
+			"revision": st.Worker.Revision, "at": st.Worker.At, "alive": workerAlive(*st.Worker, time.Now())}
+	}
+	return map[string]any{
+		"owner": accessFrom(ctx).Owner, "supported": true, "admin": accessFrom(ctx).Admin, "algorithm": st.Algorithm, "revision": st.Revision,
+		"queued": st.Queued, "running": st.Running, "worker": worker,
+		"limits": map[string]any{"maxInputBytes": background.MaxInputBytes, "maxQueued": background.MaxQueued,
+			"maxSchedules": background.MaxSchedules, "intervalSeconds": []int{3600, 86400, 604800}, "maxTotalBytes": background.MaxTotalBytes, "maxOwnerPending": background.MaxOwnerPending, "maxOwnerBytes": background.MaxOwnerBytes, "jobTimeoutSeconds": int(background.JobTimeout / time.Second)},
+	}, nil
+}
+
+func workerAlive(w background.WorkerInfo, now time.Time) bool {
+	return now.Sub(w.At) <= workerFresh
+}
+
+// browse lists what the caller's own File Station session can see, so
+// the panel can pick a file instead of typing a path. It grants nothing:
+// submit still reads through the same session.
+func (b backgroundAPI) browse(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Folder string `json:"folder"`
+		Offset int    `json:"offset"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if in.Offset < 0 {
+		return nil, api.BadRequest("offset must not be negative")
+	}
+	return b.files.Browse(ctx, c, r, in.Folder, in.Offset)
+}
+
+func (b backgroundAPI) submit(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Key      string `json:"key"`
+		Folder   string `json:"folder"`
+		Relative string `json:"relative"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if in.Key == "" || in.Folder == "" || in.Relative == "" {
+		return nil, api.BadRequest("key, folder and relative are required")
+	}
+	access := accessFrom(ctx)
+	if !access.Owner.Valid() {
+		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
+	}
+	data, err := b.files.ReadFile(ctx, c, r, in.Folder, in.Relative)
+	if err != nil {
+		return nil, err
+	}
+	job, duplicate, err := b.store.Submit(ctx, background.SubmitRequest{
+		Key: in.Key, Name: path.Base(in.Relative), Data: data, Submitter: access.Owner,
+	})
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"job": job, "duplicate": duplicate}, nil
+}
+
+func (b backgroundAPI) list(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	if err := decodeParams(params, &struct{}{}); err != nil {
+		return nil, err
+	}
+	jobs, err := b.store.ListFor(ctx, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	newestFirst := make([]background.Job, len(jobs))
+	for i, j := range jobs {
+		newestFirst[len(jobs)-1-i] = j
+	}
+	return map[string]any{"jobs": newestFirst}, nil
+}
+
+func (b backgroundAPI) get(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	job, err := b.store.GetFor(ctx, in.ID, accessFrom(ctx))
+	return jobOrError(job, err)
+}
+
+func (b backgroundAPI) cancel(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	job, err := b.store.CancelFor(ctx, in.ID, accessFrom(ctx))
+	return jobOrError(job, err)
+}
+
+func jobOrError(job background.Job, err error) (any, error) {
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return jobView{Job: job}, nil
+}
+
+func (b backgroundAPI) result(ctx context.Context, _ api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	job, err := b.store.GetFor(ctx, in.ID, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	if job.State != background.StateSucceeded || job.Result == nil {
+		return nil, &api.Error{Code: "not_ready", Message: "the job has no result"}
+	}
+	return map[string]any{"job": job, "result": map[string]any{
+		"jobId": job.ID, "worker": job.Worker, "workerRevision": job.WorkerRevision, "algorithm": "sha256",
+		"sha256": job.Result.SHA256, "bytes": job.Result.Bytes, "inputDigest": job.InputDigest, "name": job.Name,
+	}}, nil
+}
+
+func backgroundError(err error) error {
+	switch {
+	case errors.Is(err, background.ErrBusy):
+		return &api.Error{Code: "jobs_busy", Message: "background jobs are busy; retry later"}
+	case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+		return err
+	case errors.Is(err, background.ErrScheduleFull):
+		return &api.Error{Code: "schedule-full", Message: "the schedule limit has been reached"}
+	case errors.Is(err, background.ErrInputUnavailable):
+		return &api.Error{Code: "input-unavailable", Message: "import the private copy again"}
+	case errors.Is(err, background.ErrOwnerQueueFull):
+		return &api.Error{Code: "owner-queue-full", Message: "your pending job limit has been reached"}
+	case errors.Is(err, background.ErrOwnerQuota):
+		return &api.Error{Code: "owner-quota-exceeded", Message: "your background storage limit has been reached"}
+	case errors.Is(err, background.ErrInvalid):
+		return api.BadRequest("invalid background request")
+	case errors.Is(err, background.ErrTooLarge):
+		return &api.Error{Code: "limit-exceeded", Message: "the file is larger than the background limit"}
+	case errors.Is(err, background.ErrQueueFull):
+		return &api.Error{Code: "queue-full", Message: "the background queue is full"}
+	case errors.Is(err, background.ErrQuota):
+		return &api.Error{Code: "quota-exceeded", Message: "the background spool is full"}
+	case errors.Is(err, background.ErrKeyConflict), errors.Is(err, background.ErrNotCancelable):
+		return &api.Error{Code: "conflict", Message: "the request conflicts with the job's current state"}
+	case errors.Is(err, background.ErrNotFound):
+		return &api.Error{Code: "not_found", Message: "job not found"}
+	}
+	log.Printf("background spool error: %v", err)
+	return &api.Error{Code: "unavailable", Message: "the background spool is unavailable"}
+}

package/templates/native-go/backend/internal/app/background_none.go

@@ -0,0 +1,8 @@
+package app
+
+import "github.com/synopackageland/syno-pkg-land-sdk/api"
+
+// backgroundRoutes is empty: this package did not opt in to background jobs.
+// `synopkgland init --background` replaces this file with background_on.go,
+// which serves BackgroundRoutes for the package-user worker unit.
+func (Config) backgroundRoutes() []api.Route { return nil }

package/templates/native-go/backend/internal/app/background_owner.go

@@ -0,0 +1,38 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+	"net/http"
+)
+
+type backgroundAccessKey struct{}
+
+func accessFrom(ctx context.Context) background.Access {
+	return ctx.Value(backgroundAccessKey{}).(background.Access)
+}
+func (b backgroundAPI) owner(h backgroundHandler) api.RequestHandler {
+	return func(ctx context.Context, c api.Caller, r *http.Request, params json.RawMessage) (any, error) {
+		access := background.Access{Admin: c.Admin()}
+		access.Owner = background.Submitter{User: c.User(), UID: lookupSubmitterUID(c.User())}
+		if !access.Admin && !access.Owner.Valid() {
+			return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
+		}
+		return h(context.WithValue(ctx, backgroundAccessKey{}, access), c, r, params)
+	}
+}
+func (b backgroundAPI) purge(ctx context.Context, c api.Caller, _ *http.Request, params json.RawMessage) (any, error) {
+	var in struct {
+		Owner *background.Submitter `json:"owner"`
+	}
+	if err := decodeParams(params, &in); err != nil || in.Owner == nil {
+		return nil, api.BadRequest("exact owner is required")
+	}
+	audit, err := b.store.PurgeOwner(ctx, *in.Owner, c.User())
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return audit, nil
+}

package/templates/native-go/backend/internal/app/background_owner_test.go

@@ -0,0 +1,163 @@
+package app
+
+import (
+	"context"
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+	"strings"
+	"testing"
+)
+
+func ordinaryEnv(t *testing.T) *bgEnv {
+	e := newBgEnv(t)
+	lookupSubmitterUID = func(name string) string {
+		switch name {
+		case "alice":
+			return "1024"
+		case "bob":
+			return "1025"
+		case "carol":
+			return "1026"
+		}
+		return ""
+	}
+	return e
+}
+
+var carol = stubAuth{identity: api.Identity{User: "carol"}}
+
+func ownerSubmit(t *testing.T, e *bgEnv, a api.Authenticator, key string) string {
+	t.Helper()
+	code, out := e.call(a, "bg.jobs.submit", `{"key":"`+key+`","folder":"/share","relative":"a.txt"}`)
+	if code != "" {
+		t.Fatalf("submit %s: %s %v", key, code, out)
+	}
+	return data(out)["job"].(map[string]any)["id"].(string)
+}
+func TestBackgroundOwnersAreIsolatedIncludingKeysAndCounts(t *testing.T) {
+	e := ordinaryEnv(t)
+	a := ownerSubmit(t, e, alice, "same")
+	b := ownerSubmit(t, e, bob, "same")
+	c := ownerSubmit(t, e, carol, "same")
+	if a == b || b == c {
+		t.Fatal("idempotency key leaked across owners")
+	}
+	for _, auth := range []api.Authenticator{bob, carol} {
+		code, out := e.call(auth, "bg.jobs.list", `{}`)
+		if code != "" || len(data(out)["jobs"].([]any)) != 1 {
+			t.Fatalf("list: %s %v", code, out)
+		}
+		_, out = e.call(auth, "bg.status", `{}`)
+		if data(out)["queued"] != float64(1) || data(out)["admin"] != false {
+			t.Fatalf("status leaks: %v", out)
+		}
+	}
+	for _, method := range []string{"bg.jobs.get", "bg.jobs.cancel", "bg.jobs.result"} {
+		for _, id := range []string{a, c, strings.Repeat("0", 32)} {
+			if code, out := e.call(bob, method, `{"id":"`+id+`"}`); code != "not_found" {
+				t.Fatalf("%s %s: %s %v", method, id, code, out)
+			}
+		}
+	}
+	_, out := e.call(alice, "bg.jobs.list", `{}`)
+	if len(data(out)["jobs"].([]any)) != 3 {
+		t.Fatal("admin must see all")
+	}
+	if code, _ := e.call(alice, "bg.jobs.cancel", `{"id":"`+b+`"}`); code != "" {
+		t.Fatal(code)
+	}
+}
+func TestBackgroundOwnerResultAndUIDChangeFailClosed(t *testing.T) {
+	e := ordinaryEnv(t)
+	id := ownerSubmit(t, e, bob, "one")
+	ctx := context.Background()
+	_, _ = e.store.Claim(ctx)
+	if err := e.store.Finish(ctx, id, background.Outcome{State: background.StateSucceeded, Result: &background.Result{SHA256: "digest", Bytes: 5}}); err != nil {
+		t.Fatal(err)
+	}
+	if code, _ := e.call(bob, "bg.jobs.result", `{"id":"`+id+`"}`); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(carol, "bg.jobs.result", `{"id":"`+id+`"}`); code != "not_found" {
+		t.Fatal(code)
+	}
+	lookupSubmitterUID = func(string) string { return "2000" }
+	_, out := e.call(bob, "bg.jobs.list", `{}`)
+	if len(data(out)["jobs"].([]any)) != 0 {
+		t.Fatal("same name with new UID saw old jobs")
+	}
+	if code, _ := e.call(bob, "bg.jobs.get", `{"id":"`+id+`"}`); code != "not_found" {
+		t.Fatal(code)
+	}
+	lookupSubmitterUID = func(string) string { return "" }
+	if code, _ := e.call(bob, "bg.jobs.list", `{}`); code != "identity_unavailable" {
+		t.Fatal(code)
+	}
+}
+func TestBackgroundPersonalQuotaAndAdminPurge(t *testing.T) {
+	e := ordinaryEnv(t)
+	for _, method := range []string{"bg.jobs.purge"} {
+		if code, _ := e.call(bob, method, `{}`); code != "admin_required" {
+			t.Fatalf("%s: %s", method, code)
+		}
+	}
+	ownerSubmit(t, e, bob, "one")
+	ownerSubmit(t, e, bob, "two")
+	if code, _ := e.call(bob, "bg.jobs.submit", `{"key":"three","folder":"/share","relative":"a.txt"}`); code != "owner-queue-full" {
+		t.Fatal(code)
+	}
+	ownerSubmit(t, e, carol, "one")
+
+}
+func TestBackgroundPurgeRequiresAdminAndExactOwner(t *testing.T) {
+	e := ordinaryEnv(t)
+	id := ownerSubmit(t, e, bob, "one")
+	ownerSubmit(t, e, carol, "one")
+	code, out := e.call(alice, "bg.jobs.purge", `{"owner":{"user":"bob","uid":"1025"}}`)
+	if code != "" || data(out)["removed"] != float64(1) {
+		t.Fatalf("purge: %s %v", code, out)
+	}
+	if code, _ := e.call(alice, "bg.jobs.get", `{"id":"`+id+`"}`); code != "not_found" {
+		t.Fatal(code)
+	}
+	_, out = e.call(alice, "bg.jobs.list", `{}`)
+	if len(data(out)["jobs"].([]any)) != 1 {
+		t.Fatal("purge touched another owner")
+	}
+}
+
+func TestFreshOrdinaryUserJobsNeedNoAdminSetup(t *testing.T) {
+	e := newBgEnv(t)
+	lookupSubmitterUID = func(name string) string {
+		if name == "bob" {
+			return "1025"
+		}
+		return "1026"
+	}
+	code, out := e.call(bob, "bg.status", `{}`)
+	if code != "" {
+		t.Fatalf("fresh status: %s %v", code, out)
+	}
+	for _, key := range []string{"enabled", "allowOrdinaryUsers"} {
+		if _, exists := data(out)[key]; exists {
+			t.Fatalf("obsolete status switch %s", key)
+		}
+	}
+	id := ownerSubmit(t, e, bob, "fresh")
+	for _, method := range []string{"bg.jobs.get", "bg.jobs.cancel"} {
+		if code, _ := e.call(carol, method, `{"id":"`+id+`"}`); code != "not_found" {
+			t.Fatalf("other owner %s: %s", method, code)
+		}
+	}
+	if code, _ := e.call(bob, "bg.jobs.get", `{"id":"`+id+`"}`); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(bob, "bg.jobs.cancel", `{"id":"`+id+`"}`); code != "" {
+		t.Fatal(code)
+	}
+	for _, method := range []string{"bg.mode.set", "bg.users.set"} {
+		if code, _ := e.call(alice, method, `{}`); code != "unknown_method" {
+			t.Fatalf("obsolete route %s: %s", method, code)
+		}
+	}
+}

package/templates/native-go/backend/internal/app/background_schedule.go

@@ -0,0 +1,69 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+	"net/http"
+)
+
+func (b backgroundAPI) schedules(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	if err := decodeParams(p, &struct{}{}); err != nil {
+		return nil, err
+	}
+	list, err := b.store.Schedules(ctx, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedules": list}, nil
+}
+func (b backgroundAPI) createSchedule(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in background.ScheduleRequest
+	if err := decodeParams(p, &in); err != nil {
+		return nil, err
+	}
+	if !accessFrom(ctx).Owner.Valid() {
+		return nil, &api.Error{Code: "identity_unavailable", Message: "DSM user UID could not be resolved"}
+	}
+	sc, dup, err := b.store.CreateSchedule(ctx, in, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedule": sc, "duplicate": dup}, nil
+}
+func (b backgroundAPI) disableSchedule(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(p, &in); err != nil {
+		return nil, err
+	}
+	sc, err := b.store.SetSchedule(ctx, in.ID, false, accessFrom(ctx))
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedule": sc}, nil
+}
+func (b backgroundAPI) enableSchedule(ctx context.Context, c api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in struct {
+		ID      string `json:"id"`
+		Consent bool   `json:"consent"`
+	}
+	if err := decodeParams(p, &in); err != nil || !in.Consent {
+		return nil, api.BadRequest("explicit consent is required")
+	}
+	sc, err := b.store.SetSchedule(ctx, in.ID, true, background.Access{Admin: true, Owner: background.Submitter{User: c.User(), UID: lookupSubmitterUID(c.User())}})
+	if err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]any{"schedule": sc}, nil
+}
+func (b backgroundAPI) deleteSchedule(ctx context.Context, _ api.Caller, _ *http.Request, p json.RawMessage) (any, error) {
+	var in idParams
+	if err := decodeParams(p, &in); err != nil {
+		return nil, err
+	}
+	if err := b.store.DeleteSchedule(ctx, in.ID, accessFrom(ctx)); err != nil {
+		return nil, backgroundError(err)
+	}
+	return map[string]bool{"deleted": true}, nil
+}

package/templates/native-go/backend/internal/app/background_schedule_test.go

@@ -0,0 +1,62 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"github.com/synopackageland/syno-pkg-land-sdk/background"
+	"testing"
+)
+
+func TestBackgroundScheduleRoutesConsentOwnerAndAdmin(t *testing.T) {
+	e := ordinaryEnv(t)
+	id := ownerSubmit(t, e, bob, "copy")
+	ctx := context.Background()
+	_, _ = e.store.Claim(ctx)
+	_ = e.store.Finish(ctx, id, background.Outcome{State: background.StateSucceeded, Result: &background.Result{Bytes: 5}})
+	params := fmt.Sprintf(`{"key":"s","jobId":%q,"intervalSeconds":3600,"consent":true}`, id)
+	if code, _ := e.call(carol, "bg.schedules.create", params); code != "not_found" {
+		t.Fatal(code)
+	}
+	for _, p := range []string{fmt.Sprintf(`{"key":"s","jobId":%q,"intervalSeconds":3600}`, id), fmt.Sprintf(`{"key":"s","jobId":%q,"intervalSeconds":3600,"consent":true,"owner":"carol"}`, id)} {
+		if code, _ := e.call(bob, "bg.schedules.create", p); code != "bad_request" {
+			t.Fatal(code)
+		}
+	}
+	code, out := e.call(bob, "bg.schedules.create", params)
+	if code != "" {
+		t.Fatalf("create %s %v", code, out)
+	}
+	sid := data(out)["schedule"].(map[string]any)["id"].(string)
+	_, out = e.call(carol, "bg.schedules.list", `{}`)
+	if len(data(out)["schedules"].([]any)) != 0 {
+		t.Fatal("list leak")
+	}
+	_, out = e.call(alice, "bg.schedules.list", `{}`)
+	if len(data(out)["schedules"].([]any)) != 1 {
+		t.Fatal("admin list")
+	}
+	for _, m := range []string{"bg.schedules.disable", "bg.schedules.delete"} {
+		if code, _ := e.call(carol, m, fmt.Sprintf(`{"id":%q}`, sid)); code != "not_found" {
+			t.Fatal(code)
+		}
+	}
+	if code, _ := e.call(bob, "bg.schedules.enable", fmt.Sprintf(`{"id":%q,"consent":true}`, sid)); code != "admin_required" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(alice, "bg.schedules.disable", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(alice, "bg.schedules.enable", fmt.Sprintf(`{"id":%q}`, sid)); code != "bad_request" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(alice, "bg.schedules.enable", fmt.Sprintf(`{"id":%q,"consent":true}`, sid)); code != "" {
+		t.Fatal(code)
+	}
+	if code, _ := e.call(bob, "bg.schedules.delete", fmt.Sprintf(`{"id":%q}`, sid)); code != "" {
+		t.Fatal(code)
+	}
+	// No scheduling route calls File Station, uses a root grant or stores a session.
+	if e.files.calls != 1 {
+		t.Fatalf("schedule read File Station %d", e.files.calls)
+	}
+}