@synopackageland/templates 0.9.0 → 0.9.1

package/README.md

@@ -21,7 +21,7 @@ An overlay may replace `internal/app/*_none.go` (the CLI deletes the matching
 The placeholders `__PACKAGE__` (also the Go module path), `__DISPLAY_NAME__` and
 `__BACKGROUND_ENABLED__` are substituted by `init`.
 
-`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.9.0`; that line is
+`backend/go.mod` requires `github.com/synopackageland/syno-pkg-land-sdk v0.9.1`; that line is
 the single source of the SDK version and `frontend/package.json` pins
 `@synopackageland/sdk` to the same version.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synopackageland/templates",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Project templates for synopkgland init: native-go (plain or Vue, with jobs, delegate and root-ops overlays), binary and compose.",
   "license": "MIT",
   "repository": {"type": "git", "url": "git+https://github.com/synopackageland/syno-pkg-land-templates.git"},

package/templates/_shared/AGENTS.md

@@ -32,10 +32,13 @@ call `greeting.set`.
 
 ## DSM Application Portal (`portal`)
 
-`synopkgland add portal` (or `portal: {}` / `portal: {alias: my-app}` in
-dsm-package.yaml; Compose: `integration.web.portal` for a DSM-window app behind
-the auth gateway) registers `https://<nas>/<alias>/`, which opens the app after
-DSM sign-in. Read `synopkgland skill show portal` before changing it.
+Only an App with the root executor (`rootOps` or `delegate`) may declare a
+portal: its uninstall then reloads nginx so the alias stops answering, which a
+no-privilege App cannot do without root. `synopkgland add portal` (with
+`root-ops` or `delegate` in the same call or already declared; or `portal: {}` /
+`portal: {alias: my-app}` in dsm-package.yaml) registers
+`https://<nas>/<alias>/`, which opens the app after DSM sign-in. Compose Apps
+cannot declare a portal. Read `synopkgland skill show portal` before changing it.
 The install wizard only proposes the alias; an administrator activates it from
 the app's portal panel (`ctx.portal`, DSM's own `SYNO.Core.AppPortal` in the
 admin's session) or Control Panel > Login Portal > Applications. Ordinary users

package/templates/native-go/README.md

@@ -297,7 +297,11 @@ refusal for unknown methods.
 
 ## DSM Application Portal link
 
-`synopkgland add portal` adds `portal: {}` to dsm-package.yaml so
+Only an App with the root executor (`rootOps` or `delegate`) can declare a
+portal; `synopkgland add root-ops portal` declares both. Uninstall then
+removes the App's Application Privileges rules and reloads nginx once DSM has
+removed the alias, so it stops answering. `synopkgland add portal` adds
+`portal: {}` to dsm-package.yaml so
 `https://<nas>/<alias>/` opens this app right after DSM sign-in. The install
 wizard proposes the alias (the package name in lowercase by default); an
 administrator turns it on from the app's portal panel or Control Panel >

package/templates/native-go/backend/THIRD_PARTY_NOTICES.txt

@@ -1,6 +1,6 @@
 Native Go package build dependencies
 
-github.com/synopackageland/syno-pkg-land-sdk v0.9.0 (MIT)
+github.com/synopackageland/syno-pkg-land-sdk v0.9.1 (MIT)
 
 Copyright (c) 2026 synopkgland
 

package/templates/native-go/backend/go.mod

@@ -4,6 +4,6 @@ go 1.25.0
 
 toolchain go1.26.9
 
-require github.com/synopackageland/syno-pkg-land-sdk v0.9.0
+require github.com/synopackageland/syno-pkg-land-sdk v0.9.1
 
 require golang.org/x/sys v0.44.0 // indirect

package/templates/native-go/backend/go.sum

@@ -1,4 +1,4 @@
-github.com/synopackageland/syno-pkg-land-sdk v0.9.0 h1:dAQcppyVC14P1mXhixgo5905suPf02cDXqMOq6J8AR0=
-github.com/synopackageland/syno-pkg-land-sdk v0.9.0/go.mod h1:JNoqISvR4biA9IuLi0CFe4c272tsKzCN9Nyj71nrXsQ=
+github.com/synopackageland/syno-pkg-land-sdk v0.9.1 h1:Mni+769M/fldZTlv0IOZKeaK3xGu6hTSkTeWIALPqBg=
+github.com/synopackageland/syno-pkg-land-sdk v0.9.1/go.mod h1:JNoqISvR4biA9IuLi0CFe4c272tsKzCN9Nyj71nrXsQ=
 golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
 golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package/templates/native-go/backend/internal/app/delegate_config.go

@@ -32,7 +32,7 @@ func ParseDelegateConfig(cfg Config) (DelegateSettings, error) {
 		seen := map[string]bool{}
 		for _, op := range out.Operations {
 			switch op {
-			case "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write":
+			case "files.list", "files.info", "files.createFolder", "files.checkPermission", "files.write", "files.read", "files.rename", "files.copy", "files.move", "files.delete":
 			default:
 				return DelegateSettings{}, invalid
 			}

package/templates/native-go/backend/internal/app/delegate_config_test.go

@@ -26,3 +26,11 @@ func TestDelegateBuildConfigStrictlySeparatesLegacyAndPermanent(t *testing.T) {
 		}
 	}
 }
+
+func TestDelegateBuildConfigAcceptsEveryTimeLimitedFileOperation(t *testing.T) {
+	ops := `["files.checkPermission","files.copy","files.createFolder","files.delete","files.info","files.list","files.move","files.read","files.rename","files.write"]`
+	settings, err := ParseDelegateConfig(Config{DelegateScope: "shared:media", DelegateOperationsJSON: ops, DelegateDestinationsJSON: `[]`})
+	if err != nil || len(settings.Operations) != 10 || settings.Lifetime != "" {
+		t.Fatal(settings, err)
+	}
+}

package/templates/native-go/backend/internal/app/routes_test.go

@@ -60,13 +60,23 @@ func call(t *testing.T, cfg Config, auth api.Authenticator, method, params strin
 	if len(permissionJSON) != 0 {
 		permissions = permissionJSON[0]
 	}
+	return serve(t, cfg, auth, apiRequest(method, params), permissions)
+}
+
+func apiRequest(method, params string) *http.Request {
+	body := `{"method":"` + method + `","params":` + params + `}`
+	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return req
+}
+
+// serve runs req through the App's server and returns as call does.
+func serve(t *testing.T, cfg Config, auth api.Authenticator, req *http.Request, permissions []byte) (string, map[string]any) {
+	t.Helper()
 	srv, err := api.NewServerWithPermissions(auth, permissions, Routes(cfg)...)
 	if err != nil {
 		t.Fatal(err)
 	}
-	body := `{"method":"` + method + `","params":` + params + `}`
-	req := httptest.NewRequest(http.MethodPost, "/api.cgi", strings.NewReader(body))
-	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 	srv.ServeHTTP(rec, req)
 	var out map[string]any

package/templates/native-go-root-ops/backend/internal/app/executor.go

@@ -1,19 +1,17 @@
 package app
 
 import (
-	"bufio"
 	"context"
 	"encoding/json"
 	"errors"
-	"net"
 	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/synopackageland/syno-pkg-land-sdk/api"
+	"github.com/synopackageland/syno-pkg-land-sdk/delegate"
 )
 
 func (cfg Config) rootRoutes() []api.Route {
@@ -56,8 +54,10 @@ func (cfg Config) executorControl(_ context.Context, caller api.Caller, raw json
 // The executor closes its socket while paused: the package is stopped, or an
 // upgrade changed the pins and awaits administrator approval.
 func (cfg Config) executorStatus(ctx context.Context, _ api.Caller, _ json.RawMessage) (any, error) {
-	status, err := cfg.executorRequest(ctx, "status", nil, nil)
-	if errors.Is(err, syscall.ENOENT) || errors.Is(err, syscall.ECONNREFUSED) {
+	var status json.RawMessage
+	err := cfg.executor().Call(ctx, "status", nil, nil, &status)
+	var refusal *api.Error
+	if errors.As(err, &refusal) && refusal.Code == delegate.CodeExecutorUnavailable {
 		next := "Start the package."
 		if cfg.startRequested() {
 			next = "The package is running: an administrator approves background access again in Administrator setup; the executor log names the cause."
@@ -95,46 +95,34 @@ func (cfg Config) executorRootRun(ctx context.Context, caller api.Caller, req *h
 	if err != nil {
 		return nil, err
 	}
-	return cfg.executorRequest(ctx, "root.run", auth, map[string]string{"name": in.Name})
-}
-
-// executorSocketBase is a variable so tests can use a temporary directory.
-var executorSocketBase = "/run/synopkgland"
-
-func (cfg Config) executorRequest(ctx context.Context, op string, auth, params any) (any, error) {
-	conn, err := (&net.Dialer{Timeout: 5 * time.Second}).DialContext(ctx, "unix", filepath.Join(executorSocketBase, cfg.PackageID, "executor.sock"))
-	if err != nil {
-		return nil, err
-	}
-	defer conn.Close()
-	if err := conn.SetDeadline(time.Now().Add(30 * time.Second)); err != nil {
+	if err := cfg.executorHoldsThisBuild(ctx); err != nil {
 		return nil, err
 	}
-	if auth == nil {
-		auth = map[string]any{}
-	}
-	if params == nil {
-		params = map[string]any{}
-	}
-	if err := json.NewEncoder(conn).Encode(map[string]any{"v": 1, "op": op, "auth": auth, "params": params}); err != nil {
+	var out json.RawMessage
+	if err := cfg.executor().Call(ctx, "root.run", auth, map[string]string{"name": in.Name}, &out); err != nil {
 		return nil, err
 	}
-	scanner := bufio.NewScanner(conn)
-	scanner.Buffer(make([]byte, 4096), 64*1024)
-	if !scanner.Scan() {
-		return nil, errors.New("executor_response_invalid")
-	}
-	var response struct {
-		OK      bool            `json:"ok"`
-		Result  json.RawMessage `json:"result"`
-		Code    string          `json:"code"`
-		Message string          `json:"message"`
-	}
-	if err := json.Unmarshal(scanner.Bytes(), &response); err != nil {
-		return nil, err
+	return out, nil
+}
+
+// executorHoldsThisBuild refuses, as delegate does, an executor pinned to
+// another build's policy or executor: its approved scripts are not this build's.
+func (cfg Config) executorHoldsThisBuild(ctx context.Context) error {
+	var pins delegate.ExecutorStatus
+	if err := cfg.executor().Call(ctx, "status", nil, nil, &pins); err != nil {
+		return err
 	}
-	if !response.OK {
-		return nil, errors.New(response.Code + ": " + response.Message)
+	if (cfg.ExecutorDigest != "" && pins.ExecutorDigest != cfg.ExecutorDigest) || (cfg.PolicyDigest != "" && pins.PolicyDigest != cfg.PolicyDigest) {
+		return &api.Error{Code: delegate.CodePolicyDenied, Message: "the executor holds another build's approved policy; an administrator approves this build in Administrator setup"}
 	}
-	return response.Result, nil
+	return nil
+}
+
+// executorSocketBase is a variable so tests can use a temporary directory.
+var executorSocketBase = "/run/synopkgland"
+
+// executor keeps the executor's protocol v1 refusal codes (POLICY_DENIED,
+// EXECUTOR_UNAVAILABLE, ...) as the API error code.
+func (cfg Config) executor() *delegate.Client {
+	return &delegate.Client{Socket: filepath.Join(executorSocketBase, cfg.PackageID, "executor.sock"), Timeout: 30 * time.Second}
 }

package/templates/native-go-root-ops/backend/internal/app/executor_test.go

@@ -1,11 +1,16 @@
 package app
 
 import (
+	"bufio"
+	"encoding/json"
 	"net"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
+
+	appapi "__PACKAGE__/internal/api"
 )
 
 func init() {
@@ -59,14 +64,7 @@ func TestExecutorRootRunRequiresCurrentDSMCookie(t *testing.T) {
 // awaiting administrator approval). Status then answers, not "internal".
 func TestExecutorStatusReportsAPausedExecutor(t *testing.T) {
 	cfg := testConfig(t)
-	previous := executorSocketBase
-	// A short base: unix socket paths are limited to about 100 bytes.
-	base, err := os.MkdirTemp("/tmp", "exec")
-	if err != nil {
-		t.Fatal(err)
-	}
-	executorSocketBase = base
-	defer func() { executorSocketBase = previous; os.RemoveAll(base) }()
+	useExecutorSocketBase(t)
 	check := func(name string) {
 		t.Helper()
 		code, envelope := call(t, cfg, alice, "executor.status", `{}`)
@@ -94,9 +92,7 @@ func TestExecutorStatusReportsAPausedExecutor(t *testing.T) {
 // again, not a start.
 func TestExecutorStatusNextFollowsTheLifecycleRequest(t *testing.T) {
 	cfg := testConfig(t)
-	previous := executorSocketBase
-	executorSocketBase = t.TempDir()
-	defer func() { executorSocketBase = previous }()
+	useExecutorSocketBase(t)
 	next := func() string {
 		t.Helper()
 		_, envelope := call(t, cfg, alice, "executor.status", `{}`)
@@ -116,3 +112,126 @@ func TestExecutorStatusNextFollowsTheLifecycleRequest(t *testing.T) {
 		}
 	}
 }
+
+// fakeExecutor answers each v1 request with replies[op] and records the ops.
+type fakeExecutor struct {
+	mu  sync.Mutex
+	ops []string
+}
+
+func (f *fakeExecutor) received() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.ops...)
+}
+
+func startFakeExecutor(t *testing.T, cfg Config, replies map[string]string) *fakeExecutor {
+	t.Helper()
+	useExecutorSocketBase(t)
+	dir := filepath.Join(executorSocketBase, cfg.PackageID)
+	if err := os.MkdirAll(dir, 0700); err != nil {
+		t.Fatal(err)
+	}
+	ln, err := net.Listen("unix", filepath.Join(dir, "executor.sock"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { ln.Close() })
+	f := &fakeExecutor{}
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			var req struct{ Op string }
+			line, _ := bufio.NewReader(conn).ReadBytes('\n')
+			json.Unmarshal(line, &req)
+			f.mu.Lock()
+			f.ops = append(f.ops, req.Op)
+			f.mu.Unlock()
+			conn.Write([]byte(replies[req.Op] + "\n"))
+			conn.Close()
+		}
+	}()
+	return f
+}
+
+// useExecutorSocketBase points the CGI at a short temporary directory: unix
+// socket paths are limited to about 100 bytes.
+func useExecutorSocketBase(t *testing.T) {
+	t.Helper()
+	previous := executorSocketBase
+	base, err := os.MkdirTemp("/tmp", "exec")
+	if err != nil {
+		t.Fatal(err)
+	}
+	executorSocketBase = base
+	t.Cleanup(func() { executorSocketBase = previous; os.RemoveAll(base) })
+}
+
+// rootRun calls root.run as an administrator with a current DSM session.
+func rootRun(t *testing.T, cfg Config, name string) (string, map[string]any) {
+	t.Helper()
+	permissions, err := appapi.Permissions()
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := apiRequest("root.run", `{"name":"`+name+`"}`)
+	req.Header.Set("Cookie", "id=session")
+	req.Header.Set("X-SYNO-TOKEN", "token")
+	return serve(t, cfg, alice, req, permissions)
+}
+
+const readyStatus = `{"ok":true,"result":{"executor_digest":"e1","policy_digest":"p1","ready":true,"disabled":false,"version":"1"}}`
+
+func pinnedConfig(t *testing.T) Config {
+	cfg := testConfig(t)
+	cfg.ExecutorDigest, cfg.PolicyDigest = "e1", "p1"
+	return cfg
+}
+
+func TestExecutorRootRunRunsWhenTheExecutorHoldsThisBuildsPins(t *testing.T) {
+	cfg := pinnedConfig(t)
+	startFakeExecutor(t, cfg, map[string]string{"status": readyStatus, "root.run": `{"ok":true,"result":{"output":"0\n"}}`})
+	code, out := rootRun(t, cfg, "whoami")
+	if data, _ := out["data"].(map[string]any); code != "" || data["output"] != "0\n" {
+		t.Fatalf("%s %v", code, out)
+	}
+}
+
+// Like delegate: an executor pinned to another build's policy or executor
+// refuses the operation, it does not run it.
+func TestExecutorRootRunRefusesAnExecutorPinnedToAnotherBuild(t *testing.T) {
+	for name, status := range map[string]string{
+		"policy":   strings.Replace(readyStatus, `"p1"`, `"p2"`, 1),
+		"executor": strings.Replace(readyStatus, `"e1"`, `"e2"`, 1),
+	} {
+		cfg := pinnedConfig(t)
+		f := startFakeExecutor(t, cfg, map[string]string{"status": status, "root.run": `{"ok":true,"result":{"output":"0\n"}}`})
+		if code, out := rootRun(t, cfg, "whoami"); code != "POLICY_DENIED" {
+			t.Errorf("%s digest mismatch: %q %v", name, code, out)
+		}
+		for _, op := range f.received() {
+			if op == "root.run" {
+				t.Errorf("%s digest mismatch: root.run reached the executor", name)
+			}
+		}
+	}
+}
+
+// Refusals keep the protocol v1 code (spec/protocol/v1/errors.json), never "internal".
+func TestExecutorRootRunReportsTheExecutorsRefusalCode(t *testing.T) {
+	cfg := pinnedConfig(t)
+	useExecutorSocketBase(t)
+	if code, _ := rootRun(t, cfg, "whoami"); code != "EXECUTOR_UNAVAILABLE" {
+		t.Errorf("paused or awaiting approval (no socket): %q", code)
+	}
+	for _, refusal := range []string{"POLICY_DENIED", "INVALID_REQUEST", "EXECUTOR_PAUSED", "ROOT_FAILED", "ADMIN_REQUIRED"} {
+		cfg := pinnedConfig(t)
+		startFakeExecutor(t, cfg, map[string]string{"status": readyStatus, "root.run": `{"ok":false,"code":"` + refusal + `","message":"refused"}`})
+		if code, out := rootRun(t, cfg, "whoami"); code != refusal {
+			t.Errorf("%s: %q %v", refusal, code, out)
+		}
+	}
+}

package/templates/native-go-vue/README.md

@@ -9,7 +9,7 @@ files, portal, jobs and delegate components come from `@synopackageland/sdk/vue`
 
 ```sh
 cd frontend
-npm install
+npm ci
 npm test
 npm run build
 ```
@@ -22,7 +22,7 @@ subscriptions; unmount disposes subscriptions and ignores late responses.
 operations. `--with jobs` adds package-account jobs and schedules; it combines with root-ops and files. `--with files` enables current-session File Station access,
 and the background picker uses the retained session provider.
 
-With `portal:` declared (`synopkgland add portal`), the status page shows
+With `portal:` declared (`synopkgland add portal`, executor Apps only), the status page shows
 the SDK's `PortalSettings`: the DSM Application Portal link, the alias form
 for administrators, and the Control Panel shortcut.
 

package/templates/native-go-vue/frontend/package-lock.json

@@ -7,7 +7,7 @@
       "name": "native-dsm-vue-app",
       "dependencies": {
         "@lucide/vue": "1.48.0",
-        "@synopackageland/sdk": "0.9.0",
+        "@synopackageland/sdk": "0.9.1",
         "@synopackageland/ui": "0.9.0",
         "vue": "3.5.43"
       },
@@ -1148,9 +1148,9 @@
       }
     },
     "node_modules/@synopackageland/sdk": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.9.0.tgz",
-      "integrity": "sha512-dtk+F2KBQbdNs200Iz18pRQNYOyzc3EaUL5+c2JnmEEUysSTZFpEqu9gD37aQXUfH402EUsOBUtcCqDpRPMUvg==",
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/@synopackageland/sdk/-/sdk-0.9.1.tgz",
+      "integrity": "sha512-V7V2Ad7KTcQGo3fgMl2PofqhwDvHzCxYJG4q3DqVRuJgNNhxeflZUSYTWHtO/xTB9OZ5KPGoN8hqHIrNDyzAXg==",
       "license": "MIT",
       "peerDependencies": {
         "@lucide/vue": "^1.48.0",

package/templates/native-go-vue/frontend/package.json

@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@lucide/vue": "1.48.0",
-    "@synopackageland/sdk": "0.9.0",
+    "@synopackageland/sdk": "0.9.1",
     "@synopackageland/ui": "0.9.0",
     "vue": "3.5.43"
   },