@synopackageland/templates 0.0.0-stage → 0.9.1

package/templates/native-go/backend/internal/app/routes.go

@@ -0,0 +1,137 @@
+// Package app holds this package's business operations. Add a route here and
+// register its handler here. App permissions live in internal/api/permissions.json; SDK capability routes
+// use the immutable SDK policy.
+// unlisted methods require membership in DSM's administrators group.
+//
+//line __PACKAGE__/internal/app/routes.go:1
+package app
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"time"
+	"unicode/utf8"
+
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/filestation"
+)
+
+// Config is fixed at build time and startup, never taken from a request.
+type Config struct {
+	DelegateScope                                                      string
+	DelegateOperationsJSON, DelegateDestinationsJSON, DelegateLifetime string
+	ExecutorDigest, PolicyDigest                                       string
+
+	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
+	SessionFiles *filestation.Service
+	PackageID    string
+	Version      string
+	// DataDir is the package's persistent, package-owned directory
+	// (/var/packages/<package>/var). It survives upgrades.
+	DataDir string
+	// VolumeRoot is where /volumeN lives; empty means "/". Tests set it.
+	VolumeRoot string
+	// Portal serves portal.status; PortalConfig overrides DSM's saved
+	// AppPortal.json path in tests.
+	Portal       bool
+	PortalConfig string
+}
+
+func Routes(cfg Config) []api.Route {
+	routes := cfg.delegateRoutes()
+	routes = append(routes, []api.Route{
+		api.Handle("app.status", cfg.status),
+		api.Handle("greeting.get", cfg.getGreeting),
+		api.Handle("greeting.set", cfg.setGreeting),
+	}...)
+	routes = append(routes, cfg.SessionFiles.Routes()...)
+	routes = append(routes, cfg.backgroundRoutes()...)
+	routes = append(routes, cfg.portalRoutes()...)
+	return append(routes, cfg.rootRoutes()...)
+}
+
+func (cfg Config) status(_ context.Context, caller api.Caller, _ json.RawMessage) (any, error) {
+	return cfg.withSharedFolders(map[string]any{
+		"package":    cfg.PackageID,
+		"version":    cfg.Version,
+		"user":       caller.User(),
+		"admin":      caller.Admin(),
+		"process":    map[string]int{"uid": os.Getuid(), "gid": os.Getgid()},
+		"go_version": runtime.Version(),
+		"platform":   runtime.GOOS + "/" + runtime.GOARCH,
+		"time":       time.Now().UTC().Format(time.RFC3339),
+	}), nil
+}
+
+type greeting struct {
+	Text      string `json:"text"`
+	UpdatedBy string `json:"updated_by,omitempty"`
+}
+
+func (cfg Config) greetingPath() string { return filepath.Join(cfg.DataDir, "greeting.json") }
+
+func (cfg Config) getGreeting(context.Context, api.Caller, json.RawMessage) (any, error) {
+	data, err := os.ReadFile(cfg.greetingPath())
+	if errors.Is(err, fs.ErrNotExist) {
+		return greeting{Text: "Hello"}, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var g greeting
+	return g, json.Unmarshal(data, &g)
+}
+
+func (cfg Config) setGreeting(_ context.Context, caller api.Caller, params json.RawMessage) (any, error) {
+	var in struct {
+		Text string `json:"text"`
+	}
+	if err := decodeParams(params, &in); err != nil {
+		return nil, err
+	}
+	if n := utf8.RuneCountInString(in.Text); n < 1 || n > 200 {
+		return nil, api.BadRequest("text must be 1 to 200 characters")
+	}
+	g := greeting{Text: in.Text, UpdatedBy: caller.User()}
+	data, err := json.Marshal(g)
+	if err != nil {
+		return nil, err
+	}
+	return g, writeFileAtomic(cfg.greetingPath(), data)
+}
+
+// decodeParams decodes params strictly: unknown fields are an error.
+func decodeParams(params json.RawMessage, into any) error {
+	if len(params) == 0 {
+		params = json.RawMessage(`{}`)
+	}
+	dec := json.NewDecoder(bytes.NewReader(params))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(into); err != nil {
+		return api.BadRequest("invalid params: " + err.Error())
+	}
+	return nil
+}
+
+// writeFileAtomic replaces path in one rename, so readers never see half a file.
+func writeFileAtomic(path string, data []byte) error {
+	tmp, err := os.CreateTemp(filepath.Dir(path), ".tmp-*")
+	if err != nil {
+		return err
+	}
+	defer os.Remove(tmp.Name())
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp.Name(), path)
+}

package/templates/native-go/backend/internal/app/routes_test.go

@@ -0,0 +1,207 @@
+package app
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/synopackageland/syno-pkg-land-sdk/api"
+
+	appapi "__PACKAGE__/internal/api"
+)
+
+type stubAuth struct {
+	identity api.Identity
+	err      error
+}
+
+func (s stubAuth) Authenticate(*http.Request) (api.Identity, error) { return s.identity, s.err }
+
+func testConfig(t *testing.T) Config {
+	return Config{PackageID: "HelloGo", Version: "0.1.0-0001", DataDir: t.TempDir()}
+}
+
+// rule is the access rule the server applies to r: the App policy for App
+// methods, the SDK policy (reported by the route) for SDK methods.
+func rule(t *testing.T, r api.Route) string {
+	t.Helper()
+	raw, err := appapi.Permissions()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var policy struct{ Methods map[string]string }
+	if err := json.Unmarshal(raw, &policy); err != nil {
+		t.Fatal(err)
+	}
+	switch value, ok := policy.Methods[r.Method()]; {
+	case ok:
+		return value
+	case r.Public():
+		return "public"
+	case r.AdminOnly():
+		return api.AdministratorPermission
+	}
+	return "authenticated"
+}
+
+// call returns the envelope's error code ("" on success) and the envelope.
+func call(t *testing.T, cfg Config, auth api.Authenticator, method, params string, permissionJSON ...[]byte) (string, map[string]any) {
+	t.Helper()
+	previous := lookupSubmitterUID
+	lookupSubmitterUID = func(string) string { return "1024" }
+	defer func() { lookupSubmitterUID = previous }()
+	permissions, err := appapi.Permissions()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(permissionJSON) != 0 {
+		permissions = permissionJSON[0]
+	}
+	return serve(t, cfg, auth, apiRequest(method, params), permissions)
+}
+
+func apiRequest(method, params string) *http.Request {
+	body := `{"method":"` + method + `","params":` + params + `}`
+	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return req
+}
+
+// serve runs req through the App's server and returns as call does.
+func serve(t *testing.T, cfg Config, auth api.Authenticator, req *http.Request, permissions []byte) (string, map[string]any) {
+	t.Helper()
+	srv, err := api.NewServerWithPermissions(auth, permissions, Routes(cfg)...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, req)
+	var out map[string]any
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatalf("not JSON: %s", rec.Body.String())
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("HTTP %d: DSM replaces non-200 CGI bodies", rec.Code)
+	}
+	code := ""
+	if e, ok := out["error"].(map[string]any); ok {
+		code, _ = e["code"].(string)
+	}
+	return code, out
+}
+
+var (
+	alice  = stubAuth{identity: api.Identity{User: "alice", Admin: true}}
+	bob    = stubAuth{identity: api.Identity{User: "bob"}}
+	nobody = stubAuth{err: api.ErrNoSession}
+)
+
+// sampleParams holds valid params for every route, so the denial test below
+// proves the refusal came from the policy and not from bad input.
+// Expected domain errors for routes an overlay adds (fresh store, no DSM cookie).
+var sampleOutcome = map[string]string{}
+
+var sampleParams = map[string]string{
+	"app.status":   `{}`,
+	"greeting.get": `{}`,
+	"greeting.set": `{"text":"Hi"}`,
+}
+
+func TestEveryRouteHasSampleParamsAndNoneIsPublic(t *testing.T) {
+	routes := Routes(testConfig(t))
+	if len(routes) != len(sampleParams) {
+		t.Fatalf("%d routes but %d sample params: add the new route to sampleParams", len(routes), len(sampleParams))
+	}
+	for _, r := range routes {
+		if _, ok := sampleParams[r.Method()]; !ok {
+			t.Errorf("route %s has no sample params", r.Method())
+		}
+		if rule(t, r) == "public" {
+			t.Errorf("route %s is public; this template ships none", r.Method())
+		}
+	}
+}
+
+func TestEveryRouteRefusesCallersWithoutASessionAndChangesNothing(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, nobody, r.Method(), sampleParams[r.Method()])
+		if code != "session_required" {
+			t.Errorf("%s: %q, want session_required", r.Method(), code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func TestAdministratorRoutesRefuseOrdinaryUsersAndChangeNothing(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		if rule(t, r) != api.AdministratorPermission {
+			continue
+		}
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, bob, r.Method(), sampleParams[r.Method()])
+		if code != "admin_required" {
+			t.Errorf("%s: %q, want admin_required", r.Method(), code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func TestEveryRouteSucceedsForAnAdmin(t *testing.T) {
+	for _, r := range Routes(testConfig(t)) {
+		code, out := call(t, testConfig(t), alice, r.Method(), sampleParams[r.Method()])
+		want := sampleOutcome[r.Method()]
+		if strings.HasPrefix(r.Method(), "jobs.") {
+			want = "unavailable"
+		}
+		if code != want {
+			t.Errorf("%s: %q %v", r.Method(), code, out)
+		}
+	}
+}
+
+func TestStatusReportsPackageAndCaller(t *testing.T) {
+	code, out := call(t, testConfig(t), alice, "app.status", `{}`)
+	data := out["data"].(map[string]any)
+	if code != "" || data["package"] != "HelloGo" || data["version"] != "0.1.0-0001" || data["user"] != "alice" || data["admin"] != true {
+		t.Fatalf("got %q %v", code, out)
+	}
+}
+
+func TestGreetingDefaultsAndAdminCanChangeIt(t *testing.T) {
+	cfg := testConfig(t)
+	_, out := call(t, cfg, alice, "greeting.get", `{}`)
+	if got := out["data"].(map[string]any)["text"]; got != "Hello" {
+		t.Fatalf("default greeting = %v", got)
+	}
+	if code, out := call(t, cfg, alice, "greeting.set", `{"text":"Hi from DSM"}`); code != "" {
+		t.Fatalf("set: %q %v", code, out)
+	}
+	_, out = call(t, cfg, alice, "greeting.get", `{}`)
+	data := out["data"].(map[string]any)
+	if data["text"] != "Hi from DSM" || data["updated_by"] != "alice" {
+		t.Fatalf("after set: %v", data)
+	}
+}
+
+func TestGreetingSetValidatesText(t *testing.T) {
+	for _, params := range []string{`{}`, `{"text":""}`, `{"text":"` + strings.Repeat("x", 201) + `"}`, `{"text":7}`, `{"text":"ok","extra":1}`} {
+		cfg := testConfig(t)
+		code, _ := call(t, cfg, alice, "greeting.set", params)
+		if code != "bad_request" {
+			t.Errorf("%s: %q, want bad_request", params, code)
+		}
+		assertDataDirEmpty(t, cfg)
+	}
+}
+
+func assertDataDirEmpty(t *testing.T, cfg Config) {
+	t.Helper()
+	entries, err := os.ReadDir(cfg.DataDir)
+	if err != nil || len(entries) != 0 {
+		t.Fatalf("data dir changed: %v %v", entries, err)
+	}
+}

package/templates/native-go/backend/internal/app/session_files.go

@@ -0,0 +1,9 @@
+package app
+
+// FileStationSession selects the interactive File Station adapter using the caller’s DSM session.
+const FileStationSession = "session"
+
+// SessionFilesEnabled accepts only the fixed build-time session setting.
+func SessionFilesEnabled(fileStation string) bool {
+	return fileStation == FileStationSession
+}

package/templates/native-go/backend/internal/app/session_files_test.go

@@ -0,0 +1,14 @@
+package app
+
+import "testing"
+
+func TestSessionFilesEnabledByTrustedBuildSetting(t *testing.T) {
+	for _, tc := range []struct {
+		value string
+		want  bool
+	}{{"", false}, {"session", true}, {"yes", false}} {
+		if got := SessionFilesEnabled(tc.value); got != tc.want {
+			t.Errorf("%q: got %v, want %v", tc.value, got, tc.want)
+		}
+	}
+}

package/templates/native-go/backend/internal/app/shared_folder.go

@@ -0,0 +1,144 @@
+package app
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"syscall"
+)
+
+// The install wizard stores the chosen Shared Folder's *name* in
+// <DataDir>/config.json (see dsm-package.yaml install.sharedFolder). The path
+// is resolved on every call, so a Shared Folder moved to another volume keeps
+// working. config.json is written by the package's postinst/postupgrade, not
+// by the app.
+
+var (
+	ErrSharedFolderNotFound  = errors.New("shared folder not found on any volume")
+	ErrSharedFolderAmbiguous = errors.New("shared folder name matches more than one volume")
+)
+
+// SharedFolder says where one configured Shared Folder is right now and what
+// the package account may do there.
+type SharedFolder struct {
+	Key      string `json:"key"`
+	Name     string `json:"name"`
+	Path     string `json:"path,omitempty"`
+	Exists   bool   `json:"exists"`
+	Readable bool   `json:"readable"`
+	Writable bool   `json:"writable"`
+	Error    string `json:"error,omitempty"`
+}
+
+func validShareName(name string) bool {
+	return name != "" && !strings.ContainsAny(name, "/\\\x00") && !strings.Contains(name, "..") &&
+		!strings.HasPrefix(name, "@") && !strings.HasPrefix(name, ".")
+}
+
+// ReadSharedFolders returns the Shared Folder names the installer stored, by
+// key. A package without config.json has none.
+func ReadSharedFolders(dataDir string) (map[string]string, error) {
+	data, err := os.ReadFile(filepath.Join(dataDir, "config.json"))
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var cfg struct {
+		Schema        int               `json:"schema"`
+		SharedFolders map[string]string `json:"shared_folders"`
+	}
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		return nil, fmt.Errorf("config.json: %w", err)
+	}
+	if cfg.Schema != 1 {
+		return nil, fmt.Errorf("config.json: unsupported schema %d", cfg.Schema)
+	}
+	for key, name := range cfg.SharedFolders {
+		if !validShareName(name) {
+			return nil, fmt.Errorf("config.json: invalid shared folder name for %q", key)
+		}
+	}
+	return cfg.SharedFolders, nil
+}
+
+// ResolveSharedFolder finds /volumeN/<name> under root ("/" on a NAS).
+func ResolveSharedFolder(root, name string) (string, error) {
+	if !validShareName(name) {
+		return "", fmt.Errorf("invalid shared folder name %q", name)
+	}
+	volumes, err := filepath.Glob(filepath.Join(root, "volume[0-9]*"))
+	if err != nil {
+		return "", err
+	}
+	var found []string
+	for _, volume := range volumes {
+		path := filepath.Join(volume, name)
+		if info, err := os.Stat(path); err == nil && info.IsDir() {
+			found = append(found, path)
+		}
+	}
+	switch len(found) {
+	case 0:
+		return "", ErrSharedFolderNotFound
+	case 1:
+		return found[0], nil
+	}
+	return "", ErrSharedFolderAmbiguous
+}
+
+const (
+	accessRead  = 0x4 // R_OK
+	accessWrite = 0x2 // W_OK
+	accessExec  = 0x1 // X_OK
+)
+
+// SharedFolders reports every configured Shared Folder, sorted by key. The
+// error is a corrupt config.json.
+func (cfg Config) SharedFolders() ([]SharedFolder, error) {
+	names, err := ReadSharedFolders(cfg.DataDir)
+	if err != nil {
+		return nil, err
+	}
+	root := cfg.VolumeRoot
+	if root == "" {
+		root = "/"
+	}
+	keys := make([]string, 0, len(names))
+	for key := range names {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	folders := make([]SharedFolder, 0, len(keys))
+	for _, key := range keys {
+		folder := SharedFolder{Key: key, Name: names[key]}
+		path, err := ResolveSharedFolder(root, folder.Name)
+		if err != nil {
+			folder.Error = err.Error()
+		} else {
+			folder.Path, folder.Exists = path, true
+			folder.Readable = syscall.Access(path, accessRead|accessExec) == nil
+			folder.Writable = syscall.Access(path, accessWrite|accessExec) == nil
+		}
+		folders = append(folders, folder)
+	}
+	return folders, nil
+}
+
+// withSharedFolders adds the configured Shared Folders to an app.status
+// answer; a package that configures none is answered exactly as before.
+func (cfg Config) withSharedFolders(status map[string]any) map[string]any {
+	folders, err := cfg.SharedFolders()
+	if err != nil {
+		status["shared_folders_error"] = err.Error()
+	} else if len(folders) > 0 {
+		status["shared_folders"] = folders
+	}
+	return status
+}

package/templates/native-go/backend/internal/app/shared_folder_test.go

@@ -0,0 +1,158 @@
+package app
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeConfig(t *testing.T, dir, body string) {
+	t.Helper()
+	if err := os.WriteFile(filepath.Join(dir, "config.json"), []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestReadSharedFoldersWithoutConfigIsEmpty(t *testing.T) {
+	got, err := ReadSharedFolders(t.TempDir())
+	if err != nil || len(got) != 0 {
+		t.Fatalf("got %v %v", got, err)
+	}
+}
+
+func TestReadSharedFoldersReturnsNamesByKey(t *testing.T) {
+	dir := t.TempDir()
+	writeConfig(t, dir, `{"schema":1,"shared_folders":{"media":"Family Photos"}}`)
+	got, err := ReadSharedFolders(dir)
+	if err != nil || got["media"] != "Family Photos" || len(got) != 1 {
+		t.Fatalf("got %v %v", got, err)
+	}
+}
+
+func TestReadSharedFoldersRefusesUnknownSchemaAndBadNames(t *testing.T) {
+	for _, body := range []string{
+		`{"schema":2,"shared_folders":{"media":"x"}}`,
+		`{"schema":1,"shared_folders":{"media":"a/b"}}`,
+		`{"schema":1,"shared_folders":{"media":".."}}`,
+		`{"schema":1,"shared_folders":{"media":"@appdata"}}`,
+		`{"schema":1,"shared_folders":{"media":""}}`,
+		`not json`,
+	} {
+		dir := t.TempDir()
+		writeConfig(t, dir, body)
+		if _, err := ReadSharedFolders(dir); err == nil {
+			t.Errorf("%s: want an error", body)
+		}
+	}
+}
+
+func TestResolveSharedFolderFindsTheNameOnItsVolume(t *testing.T) {
+	root := t.TempDir()
+	for _, d := range []string{"volume1/other", "volume2/Photos", "volume2/@appdata"} {
+		if err := os.MkdirAll(filepath.Join(root, d), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	got, err := ResolveSharedFolder(root, "Photos")
+	if err != nil || got != filepath.Join(root, "volume2", "Photos") {
+		t.Fatalf("got %q %v", got, err)
+	}
+}
+
+func TestResolveSharedFolderFollowsAMovedShare(t *testing.T) {
+	root := t.TempDir()
+	os.MkdirAll(filepath.Join(root, "volume1", "Photos"), 0o755)
+	first, _ := ResolveSharedFolder(root, "Photos")
+	os.Rename(filepath.Join(root, "volume1", "Photos"), filepath.Join(root, "Photos.tmp"))
+	os.MkdirAll(filepath.Join(root, "volume2"), 0o755)
+	os.Rename(filepath.Join(root, "Photos.tmp"), filepath.Join(root, "volume2", "Photos"))
+	second, err := ResolveSharedFolder(root, "Photos")
+	if err != nil || first == second || second != filepath.Join(root, "volume2", "Photos") {
+		t.Fatalf("%q -> %q %v", first, second, err)
+	}
+}
+
+func TestResolveSharedFolderErrors(t *testing.T) {
+	root := t.TempDir()
+	if _, err := ResolveSharedFolder(root, "Missing"); !errors.Is(err, ErrSharedFolderNotFound) {
+		t.Fatalf("missing: %v", err)
+	}
+	os.MkdirAll(filepath.Join(root, "volume1", "Dup"), 0o755)
+	os.MkdirAll(filepath.Join(root, "volume2", "Dup"), 0o755)
+	if _, err := ResolveSharedFolder(root, "Dup"); !errors.Is(err, ErrSharedFolderAmbiguous) {
+		t.Fatalf("ambiguous: %v", err)
+	}
+	for _, bad := range []string{"", "..", "a/b", "@appdata", ".x"} {
+		if _, err := ResolveSharedFolder(root, bad); err == nil {
+			t.Errorf("%q: want an error", bad)
+		}
+	}
+}
+
+func TestResolveSharedFolderIgnoresAFileOfThatName(t *testing.T) {
+	root := t.TempDir()
+	os.MkdirAll(filepath.Join(root, "volume1"), 0o755)
+	os.WriteFile(filepath.Join(root, "volume1", "Notes"), nil, 0o644)
+	if _, err := ResolveSharedFolder(root, "Notes"); !errors.Is(err, ErrSharedFolderNotFound) {
+		t.Fatalf("got %v", err)
+	}
+}
+
+func TestStatusOmitsSharedFoldersWhenNoneConfigured(t *testing.T) {
+	_, out := call(t, testConfig(t), alice, "app.status", `{}`)
+	if _, present := out["data"].(map[string]any)["shared_folders"]; present {
+		t.Fatalf("unexpected shared_folders: %v", out)
+	}
+}
+
+func TestStatusReportsEachConfiguredSharedFolder(t *testing.T) {
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	os.MkdirAll(filepath.Join(cfg.VolumeRoot, "volume1", "Photos"), 0o755)
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Photos","gone":"Missing"}}`)
+	_, out := call(t, cfg, alice, "app.status", `{}`)
+	rows := out["data"].(map[string]any)["shared_folders"].([]any)
+	if len(rows) != 2 {
+		t.Fatalf("rows: %v", rows)
+	}
+	byKey := map[string]map[string]any{}
+	for _, r := range rows {
+		m := r.(map[string]any)
+		byKey[m["key"].(string)] = m
+	}
+	media, gone := byKey["media"], byKey["gone"]
+	if media["name"] != "Photos" || media["exists"] != true || media["readable"] != true || media["writable"] != true || media["path"] != filepath.Join(cfg.VolumeRoot, "volume1", "Photos") {
+		t.Fatalf("media: %v", media)
+	}
+	if gone["exists"] != false || gone["readable"] != false || gone["writable"] != false || gone["error"] == nil || gone["path"] != nil {
+		t.Fatalf("gone: %v", gone)
+	}
+}
+
+func TestStatusReportsAFolderThePackageAccountCannotWrite(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores directory modes")
+	}
+	cfg := testConfig(t)
+	cfg.VolumeRoot = t.TempDir()
+	dir := filepath.Join(cfg.VolumeRoot, "volume1", "Locked")
+	os.MkdirAll(dir, 0o755)
+	os.Chmod(dir, 0o555)
+	t.Cleanup(func() { os.Chmod(dir, 0o755) })
+	writeConfig(t, cfg.DataDir, `{"schema":1,"shared_folders":{"media":"Locked"}}`)
+	_, out := call(t, cfg, alice, "app.status", `{}`)
+	row := out["data"].(map[string]any)["shared_folders"].([]any)[0].(map[string]any)
+	if row["exists"] != true || row["readable"] != true || row["writable"] != false {
+		t.Fatalf("row: %v", row)
+	}
+}
+
+func TestStatusReportsACorruptConfigWithoutFailing(t *testing.T) {
+	cfg := testConfig(t)
+	writeConfig(t, cfg.DataDir, `not json`)
+	code, out := call(t, cfg, alice, "app.status", `{}`)
+	if code != "" || out["data"].(map[string]any)["shared_folders_error"] == nil {
+		t.Fatalf("%q %v", code, out)
+	}
+}