@synopackageland/templates 0.35.4 → 0.36.0

package/templates/native-node-delegate/backend/test/delegate.test.ts

@@ -1,5 +1,5 @@
 import assert from 'node:assert/strict'
-import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, readdirSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, test } from 'node:test'
@@ -23,23 +23,32 @@ const save = (user = 'alice', move: Services[string] = () => SAVED) =>
 test('report.save moves a private report to the caller\'s destination', async () => {
   const reply = await save()
   assert.deepEqual(reply.data, SAVED)
-  const path = join(staging, 'report-job-1.txt')
+  const path = join(staging, (reply.services[0][1] as {staging: string}).staging)
   assert.match(readFileSync(path, 'utf8'), /alice/)
   assert.equal(statSync(path).mode & 0o777, 0o600)
-  const move = { delegation_id: 'd1', job_id: 'job-1', staging: 'report-job-1.txt', name: 'report-job-1.txt', size: statSync(path).size }
+  const move = { delegation_id: 'd1', job_id: (reply.services[0][1] as {job_id: string}).job_id, staging: (reply.services[0][1] as {staging: string}).staging, name: 'report-job-1.txt', size: statSync(path).size }
   assert.deepEqual(reply.services, [['delegate.move_from_staging', move]])
+  assert.ok(move.job_id.endsWith(`-${move.staging.split('/')[1].slice(0, 32)}`))
 })
 
-test('a repeated report.save sends the same file again', async () => {
+test('retries reuse only the same owner and grant source', async () => {
   const first = (await save()).services
-  const report = readFileSync(join(staging, 'report-job-1.txt'), 'utf8')
-  assert.deepEqual((await save('bob')).services, first)
-  assert.equal(readFileSync(join(staging, 'report-job-1.txt'), 'utf8'), report)
+  const params = first[0][1] as {staging: string; job_id: string}
+  const report = readFileSync(join(staging, params.staging), 'utf8')
+  assert.deepEqual((await save()).services, first)
+  const other = (await save('bob')).services[0][1] as {staging: string; job_id: string}
+  assert.notEqual(other.staging, params.staging)
+  assert.notEqual(other.job_id, params.job_id)
+  assert.match(readFileSync(join(staging, other.staging), 'utf8'), /bob/)
+  assert.equal(readFileSync(join(staging, params.staging), 'utf8'), report)
 })
 
-test('report.save passes on the executor\'s refusal', async () => {
-  const reply = await save('alice', () => { throw new Refusal('DELEGATION_DENIED', 'The destination is no longer allowed.') })
+test('definitive rejection removes new source but a timeout keeps it', async () => {
+  const reply = await save('alice', () => { throw new Refusal('DELEGATION_DENIED', 'The destination is no longer allowed') })
   assert.equal(reply.error?.code, 'DELEGATION_DENIED')
+  assert.equal(readdirSync(staging, { recursive: true }).filter(p => String(p).endsWith('.txt')).length, 0)
+  const unknown = await save('alice', () => { throw new Refusal('EXECUTOR_TIMEOUT', 'The outcome is unknown') })
+  assert.equal(existsSync(join(staging, (unknown.services[0][1] as {staging: string}).staging)), true)
 })
 
 test('report.save refuses invalid params before writing', async () => {

package/templates/native-node-vue/gitignore

@@ -2,3 +2,7 @@ dist/
 node_modules/
 backend/build/
 backend/app/*.js
+
+# Private NAS smoke sessions and credentials
+.e2e/
+.env

package/templates/native-python/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.40.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-python/dsm-package.yaml

@@ -47,7 +47,7 @@ backend:
   runtime: python
   dir: backend/app
   entry: main.py
-  sdk: 0.38.2
+  sdk: 0.40.0
 
 ui:
   # Non-UI-SDK frontends open a full page; Portal is a separate opt-in.

package/templates/native-python/gitignore

@@ -1,2 +1,6 @@
 dist/
 __pycache__/
+
+# Private NAS smoke sessions and credentials
+.e2e/
+.env

package/templates/native-python-delegate/backend/app/delegate.py

@@ -2,11 +2,12 @@
 
 The browser picks the destination with the SDK's Background saves page and
 sends its delegation ID; the executor checks that it is the caller's grant
-and writes the file as the caller, never as root. A save that failed may be
-repeated with the same job ID: the same file is sent again, and the executor
-copies it at most once.
+and writes the file as the caller, never as root. An admitted or uncertain
+save retries the same file and job ID; the executor copies it at most once.
+A new source rejected because its delegation is denied is removed.
 """
 
+import hashlib
 import os
 import re
 import time
@@ -24,19 +25,30 @@ def register(app, cfg):
 
 def save(cfg, ctx, params):
     p = fields(params, delegation_id=str, job_id=str)
-    if not JOB_ID.match(p["job_id"]):
+    if not JOB_ID.match(p["job_id"]) or not JOB_ID.match(p["delegation_id"]):
         raise Error.bad_request("job_id must be 1 to 128 letters, digits, '.', '_' or '-'")
     name = "report-%s.txt" % p["job_id"]
     # The runtime's delegate service moves files from here.
-    staging = os.path.join(cfg.data_dir, "executor-staging")
+    owner = hashlib.sha256((ctx.user + "\0" + p["delegation_id"]).encode("utf-8")).hexdigest()
+    job_id = hashlib.sha256((ctx.user + "\0" + p["delegation_id"] + "\0" + p["job_id"]).encode("utf-8")).hexdigest() + "-" + owner[:32]
+    relative = "owners/%s/%s" % (owner, name)
+    staging = os.path.join(cfg.data_dir, "executor-staging", "owners", owner)
     os.makedirs(staging, mode=0o700, exist_ok=True)
     path = os.path.join(staging, name)
+    created = False
     try:
         fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
     except FileExistsError:
         pass
     else:
+        created = True
         with os.fdopen(fd, "w", encoding="utf-8") as f:
             f.write("Report for %s, %s\n" % (ctx.user, time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())))
-    move = {"delegation_id": p["delegation_id"], "job_id": p["job_id"], "staging": name, "name": name, "size": os.path.getsize(path)}
-    return ctx.runtime("delegate.move_from_staging", move)
+    move = {"delegation_id": p["delegation_id"], "job_id": job_id, "staging": relative, "name": name, "size": os.path.getsize(path)}
+    try:
+        return ctx.runtime("delegate.move_from_staging", move)
+    except Error as err:
+        # A transport failure may already have been admitted; keep its source.
+        if created and err.code == "DELEGATION_DENIED":
+            os.unlink(path)
+        raise

package/templates/native-python-delegate/backend/tests/test_delegate.py

@@ -24,27 +24,37 @@ class DelegateTest(unittest.TestCase):
     def test_save_moves_a_private_report_to_the_callers_destination(self):
         reply = self.save()
         self.assertEqual(reply.data, SAVED)
-        path = os.path.join(self.staging, "report-job-1.txt")
+        path = os.path.join(self.staging, reply.services[0][1]["staging"])
         with open(path, encoding="utf-8") as f:
             self.assertIn("alice", f.read())
         self.assertEqual(stat.S_IMODE(os.stat(path).st_mode), 0o600)
-        move = {"delegation_id": "d1", "job_id": "job-1", "staging": "report-job-1.txt", "name": "report-job-1.txt", "size": os.path.getsize(path)}
+        move = {"delegation_id": "d1", "job_id": reply.services[0][1]["job_id"], "staging": reply.services[0][1]["staging"], "name": "report-job-1.txt", "size": os.path.getsize(path)}
         self.assertEqual(reply.services, [("delegate.move_from_staging", move)])
+        self.assertTrue(move["job_id"].endswith("-" + move["staging"].split("/")[1][:32]))
 
-    def test_a_repeated_save_sends_the_same_file_again(self):
+    def test_retries_reuse_only_the_same_owners_file(self):
         first = self.save().services
-        path = os.path.join(self.staging, "report-job-1.txt")
+        path = os.path.join(self.staging, first[0][1]["staging"])
         with open(path, encoding="utf-8") as f:
             report = f.read()
-        self.assertEqual(self.save(user="bob").services, first)
+        self.assertEqual(self.save().services, first)
+        other = self.save(user="bob").services
+        self.assertNotEqual(other[0][1]["staging"], first[0][1]["staging"])
+        self.assertNotEqual(other[0][1]["job_id"], first[0][1]["job_id"])
+        with open(os.path.join(self.staging, other[0][1]["staging"]), encoding="utf-8") as f:
+            self.assertIn("bob", f.read())
         with open(path, encoding="utf-8") as f:
             self.assertEqual(f.read(), report)
 
-    def test_save_passes_on_the_executors_refusal(self):
+    def test_definitive_refusal_cleans_new_source_but_timeout_keeps_retry(self):
         def denied(params):
-            raise Error("DELEGATION_DENIED", "The destination is no longer allowed.")
-
+            raise Error("DELEGATION_DENIED", "The destination is no longer allowed")
         self.assertEqual(self.save(move=denied).error["code"], "DELEGATION_DENIED")
+        self.assertEqual([f for _, _, files in os.walk(self.staging) for f in files], [])
+        def timeout(params):
+            raise Error("EXECUTOR_TIMEOUT", "The outcome is unknown")
+        reply = self.save(move=timeout)
+        self.assertTrue(os.path.isfile(os.path.join(self.staging, reply.services[0][1]["staging"])))
 
     def test_save_refuses_invalid_params_before_writing(self):
         for params in [None, {"delegation_id": "d1"}, {"delegation_id": "d1", "job_id": "../x"}, {"delegation_id": "d1", "job_id": ""}, {"delegation_id": 1, "job_id": "j"}]:

package/templates/native-python-vue/gitignore

@@ -1,3 +1,7 @@
 dist/
 __pycache__/
 node_modules/
+
+# Private NAS smoke sessions and credentials
+.e2e/
+.env

package/templates/native-rust/README.md

@@ -17,7 +17,7 @@ DSM main menu → DSM window (ui/app.js)
 
 ## Requests and long work
 
-SDK/App 0.38.2 defaults to 300-second requests and a 302-second browser wait.
+SDK/App 0.40.0 defaults to 300-second requests and a 302-second browser wait.
 Explicit `backend.timeout_seconds` and earlier parent deadlines still apply;
 rebuild the App to use the new SDK. For long NAS work, enable the existing jobs
 capability: return admission and the original job ID promptly, execute in the
@@ -27,7 +27,7 @@ last queued/running state intact. After a lost admission reply, reuse the same
 idempotency key and input instead of replaying a mutation with a new key.
 Jobs default to 30 minutes; approved executor limits remain separate. ctl keeps
 its 62-second transport default; use an explicit `--timeout` or an existing
-nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.38.2/docs/request-deadlines.md).
+nonblocking job. See the SDK's [request deadline contract](https://github.com/synopackageland/syno-pkg-land-sdk/blob/v0.40.0/docs/request-deadlines.md).
 
 ## Quick start
 

package/templates/native-rust/backend/Cargo.lock

@@ -104,8 +104,8 @@ dependencies = [
 
 [[package]]
 name = "syno-pkg-land-app"
-version = "0.38.2"
-source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.38.2#103014ec9ec31e91062053d7678b4d2b115be71e"
+version = "0.40.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.40.0#e96f3f0eb6ec5bbb171fb2205f6669d3c75e3913"
 dependencies = [
  "libc",
  "serde",

package/templates/native-rust/backend/Cargo.toml

@@ -9,7 +9,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 # The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
-syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.38.2" }
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.40.0" }
 
 [profile.release]
 # A handler panic becomes an "internal" reply; abort would end the App without one.

package/templates/native-rust/gitignore

@@ -1,2 +1,6 @@
 dist/
 backend/target/
+
+# Private NAS smoke sessions and credentials
+.e2e/
+.env

package/templates/native-rust-delegate/backend/Cargo.lock

@@ -0,0 +1,203 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "app"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "serde",
+ "serde_json",
+ "sha2",
+ "syno-pkg-land-app",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syno-pkg-land-app"
+version = "0.40.0"
+source = "git+https://github.com/synopackageland/syno-pkg-land-sdk?tag=v0.40.0#e96f3f0eb6ec5bbb171fb2205f6669d3c75e3913"
+dependencies = [
+ "libc",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

package/templates/native-rust-delegate/backend/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "app"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+sha2 = "0.10"
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+# The SDK version is the tag; `synopkgland check` reads it from Cargo.lock.
+syno-pkg-land-app = { git = "https://github.com/synopackageland/syno-pkg-land-sdk", tag = "v0.40.0" }
+
+[profile.release]
+# A handler panic becomes an "internal" reply; abort would end the App without one.
+panic = "unwind"

package/templates/native-rust-delegate/backend/src/delegate.rs

@@ -6,6 +6,7 @@
 use crate::routes::{Config, internal, utc_now};
 use serde::Deserialize;
 use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
 use std::fs::OpenOptions;
 use std::io::{ErrorKind, Write};
 use std::os::unix::fs::{DirBuilderExt, OpenOptionsExt};
@@ -31,12 +32,25 @@ fn valid_job_id(id: &str) -> bool {
 
 fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
     let p: SaveReport = params.decode()?;
-    if !valid_job_id(&p.job_id) {
+    if !valid_job_id(&p.job_id) || !valid_job_id(&p.delegation_id) {
         return Err(Error::bad_request(
             "job_id must be 1 to 128 letters, digits, '.', '_' or '-'",
         ));
     }
-    let staging = cfg.data_dir.join("executor-staging");
+    let owner = format!(
+        "{:x}",
+        Sha256::digest(format!("{}\0{}", ctx.user, p.delegation_id).as_bytes())
+    );
+    let job_id = format!(
+        "{:x}-{}",
+        Sha256::digest(format!("{}\0{}\0{}", ctx.user, p.delegation_id, p.job_id).as_bytes()),
+        &owner[..32]
+    );
+    let staging = cfg
+        .data_dir
+        .join("executor-staging")
+        .join("owners")
+        .join(&owner);
     std::fs::DirBuilder::new()
         .recursive(true)
         .mode(0o700)
@@ -44,7 +58,8 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         .map_err(internal)?;
     let name = format!("report-{}.txt", p.job_id);
     let path = staging.join(&name);
-    // A retried save sends the file it wrote the first time.
+    // An admitted or uncertain save retries the original source.
+    let mut created = false;
     match OpenOptions::new()
         .write(true)
         .create_new(true)
@@ -52,6 +67,7 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         .open(&path)
     {
         Ok(mut file) => {
+            created = true;
             let report = format!("Report for {}, {}\n", ctx.user, utc_now());
             file.write_all(report.as_bytes()).map_err(internal)?;
         }
@@ -59,10 +75,20 @@ fn save(cfg: &Config, ctx: &Context, params: &Params) -> Result<Value, Error> {
         Err(e) => return Err(internal(e)),
     }
     let size = std::fs::metadata(&path).map_err(internal)?.len();
-    ctx.runtime(
+    let result: Result<Value, Error> = ctx.runtime(
         "delegate.move_from_staging",
-        &json!({"delegation_id": p.delegation_id, "job_id": p.job_id, "staging": name, "name": name, "size": size}),
-    )
+        &json!({"delegation_id": p.delegation_id, "job_id": job_id, "staging": format!("owners/{owner}/{name}"), "name": name, "size": size}),
+    );
+    // A transport failure may already have been admitted; keep its source.
+    if created
+        && result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.code == "DELEGATION_DENIED")
+    {
+        std::fs::remove_file(&path).map_err(internal)?;
+    }
+    result
 }
 
 #[cfg(test)]
@@ -106,11 +132,26 @@ mod tests {
         let (_dir, cfg) = setup();
         let reply = save(&cfg, "alice", &moved());
         assert_eq!(reply.data, json!({"state": "queued"}));
-        let path = cfg.data_dir.join("executor-staging/report-job-1.txt");
+        let path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(reply.services[0].1["staging"].as_str().unwrap());
         assert!(std::fs::read_to_string(&path).unwrap().contains("alice"));
         let meta = std::fs::metadata(&path).unwrap();
         assert_eq!(meta.permissions().mode() & 0o777, 0o600);
-        let params = json!({"delegation_id": "d1", "job_id": "job-1", "staging": "report-job-1.txt", "name": "report-job-1.txt", "size": meta.len()});
+        let owner = reply.services[0].1["staging"]
+            .as_str()
+            .unwrap()
+            .split('/')
+            .nth(1)
+            .unwrap();
+        assert!(
+            reply.services[0].1["job_id"]
+                .as_str()
+                .unwrap()
+                .ends_with(&format!("-{}", &owner[..32]))
+        );
+        let params = json!({"delegation_id": "d1", "job_id": reply.services[0].1["job_id"], "staging": reply.services[0].1["staging"], "name": "report-job-1.txt", "size": meta.len()});
         assert_eq!(
             reply.services,
             vec![("delegate.move_from_staging".to_string(), params)]
@@ -118,29 +159,43 @@ mod tests {
     }
 
     #[test]
-    fn a_repeated_save_sends_the_same_file_again() {
+    fn retries_reuse_only_the_same_owner_and_grant_source() {
         let (_dir, cfg) = setup();
         let first = save(&cfg, "alice", &moved()).services;
-        let path = cfg.data_dir.join("executor-staging/report-job-1.txt");
+        let path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(first[0].1["staging"].as_str().unwrap());
         let report = std::fs::read_to_string(&path).unwrap();
-        assert_eq!(save(&cfg, "bob", &moved()).services, first);
+        assert_eq!(save(&cfg, "alice", &moved()).services, first);
+        let other = save(&cfg, "bob", &moved()).services;
+        assert_ne!(other[0].1["staging"], first[0].1["staging"]);
+        assert_ne!(other[0].1["job_id"], first[0].1["job_id"]);
+        let other_path = cfg
+            .data_dir
+            .join("executor-staging")
+            .join(other[0].1["staging"].as_str().unwrap());
+        assert!(std::fs::read_to_string(other_path).unwrap().contains("bob"));
         assert_eq!(std::fs::read_to_string(&path).unwrap(), report);
     }
 
     #[test]
-    fn save_passes_on_the_executors_refusal() {
+    fn rejection_removes_new_source_but_timeout_keeps_retry() {
         let (_dir, cfg) = setup();
-        let services: Services = [(
-            "delegate.move_from_staging",
-            Box::new(|_: &Value| {
-                Err(Error::new(
-                    "DELEGATION_DENIED",
-                    "The destination is no longer allowed.",
-                ))
-            }) as _,
-        )]
-        .into();
-        assert_eq!(save(&cfg, "alice", &services).code(), "DELEGATION_DENIED");
+        for (code, retained) in [("DELEGATION_DENIED", false), ("EXECUTOR_TIMEOUT", true)] {
+            let services: Services = [(
+                "delegate.move_from_staging",
+                Box::new(move |_: &Value| Err(Error::new(code, "Save failed"))) as _,
+            )]
+            .into();
+            let reply = save(&cfg, "alice", &services);
+            assert_eq!(reply.code(), code);
+            let path = cfg
+                .data_dir
+                .join("executor-staging")
+                .join(reply.services[0].1["staging"].as_str().unwrap());
+            assert_eq!(path.exists(), retained);
+        }
     }
 
     #[test]

package/templates/native-rust-vue/gitignore

@@ -1,3 +1,7 @@
 dist/
 node_modules/
 backend/target/
+
+# Private NAS smoke sessions and credentials
+.e2e/
+.env