@synopackageland/templates 0.9.5 → 0.9.6

package/templates/native-rust/backend/src/app/shared_folder.rs

@@ -0,0 +1,383 @@
+use std::collections::BTreeMap;
+use std::ffi::CString;
+use std::fmt;
+use std::os::unix::ffi::OsStrExt;
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use syno_pkg_land_sdk::{BoxError, jsonx};
+
+use super::Config;
+
+// The install wizard stores the chosen Shared Folder's *name* in
+// <data_dir>/config.json (see dsm-package.yaml install.sharedFolder). The path
+// is resolved on every call, so a Shared Folder moved to another volume keeps
+// working. config.json is written by the package's postinst/postupgrade, not
+// by the app.
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum SharedFolderError {
+    InvalidName(String),
+    NotFound,
+    Ambiguous,
+}
+
+impl fmt::Display for SharedFolderError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            SharedFolderError::InvalidName(name) => {
+                write!(f, "invalid shared folder name {name:?}")
+            }
+            SharedFolderError::NotFound => f.write_str("shared folder not found on any volume"),
+            SharedFolderError::Ambiguous => {
+                f.write_str("shared folder name matches more than one volume")
+            }
+        }
+    }
+}
+
+impl std::error::Error for SharedFolderError {}
+
+/// Says where one configured Shared Folder is right now and what the package
+/// account may do there.
+#[derive(Debug, Default, Serialize)]
+pub struct SharedFolder {
+    pub key: String,
+    pub name: String,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub path: String,
+    pub exists: bool,
+    pub readable: bool,
+    pub writable: bool,
+    #[serde(skip_serializing_if = "String::is_empty")]
+    pub error: String,
+}
+
+fn valid_share_name(name: &str) -> bool {
+    !name.is_empty()
+        && !name.contains(['/', '\\', '\0'])
+        && !name.contains("..")
+        && !name.starts_with(['@', '.'])
+}
+
+#[derive(Default, Deserialize)]
+struct SharedFoldersFile {
+    #[serde(default, deserialize_with = "jsonx::null_default")]
+    schema: i64,
+    #[serde(default, deserialize_with = "jsonx::null_default")]
+    shared_folders: BTreeMap<String, String>,
+}
+
+/// Returns the Shared Folder names the installer stored, by key. A package
+/// without config.json has none.
+pub fn read_shared_folders(data_dir: &Path) -> Result<BTreeMap<String, String>, BoxError> {
+    let data = match std::fs::read(data_dir.join("config.json")) {
+        Ok(data) => data,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(BTreeMap::new()),
+        Err(e) => return Err(e.into()),
+    };
+    let file: SharedFoldersFile =
+        serde_json::from_slice(&data).map_err(|e| format!("config.json: {e}"))?;
+    if file.schema != 1 {
+        return Err(format!("config.json: unsupported schema {}", file.schema).into());
+    }
+    if let Some((key, _)) = file
+        .shared_folders
+        .iter()
+        .find(|(_, name)| !valid_share_name(name))
+    {
+        return Err(format!("config.json: invalid shared folder name for {key:?}").into());
+    }
+    Ok(file.shared_folders)
+}
+
+/// Whether name is a volume directory: "volume", a digit, then anything.
+fn is_volume(name: &std::ffi::OsStr) -> bool {
+    name.as_bytes()
+        .strip_prefix(b"volume")
+        .and_then(<[u8]>::first)
+        .is_some_and(u8::is_ascii_digit)
+}
+
+/// Finds /volumeN/<name> under root ("/" on a NAS).
+pub fn resolve_shared_folder(root: &Path, name: &str) -> Result<PathBuf, SharedFolderError> {
+    if !valid_share_name(name) {
+        return Err(SharedFolderError::InvalidName(name.to_string()));
+    }
+    let volumes = std::fs::read_dir(root)
+        .map(|entries| entries.flatten().collect::<Vec<_>>())
+        .unwrap_or_default();
+    let mut found: Vec<PathBuf> = volumes
+        .iter()
+        .filter(|volume| is_volume(&volume.file_name()))
+        .map(|volume| volume.path().join(name))
+        .filter(|path| path.is_dir())
+        .collect();
+    match found.len() {
+        0 => Err(SharedFolderError::NotFound),
+        1 => Ok(found.remove(0)),
+        _ => Err(SharedFolderError::Ambiguous),
+    }
+}
+
+const ACCESS_READ: libc::c_int = libc::R_OK;
+const ACCESS_WRITE: libc::c_int = libc::W_OK;
+const ACCESS_EXEC: libc::c_int = libc::X_OK;
+
+/// Whether the package account has every access in mode to path.
+fn accessible(path: &Path, mode: libc::c_int) -> bool {
+    let Ok(path) = CString::new(path.as_os_str().as_bytes()) else {
+        return false;
+    };
+    // SAFETY: path is a valid NUL-terminated string that outlives the call.
+    unsafe { libc::access(path.as_ptr(), mode) == 0 }
+}
+
+impl Config {
+    /// Reports every configured Shared Folder, sorted by key. The error is a
+    /// corrupt config.json.
+    pub fn shared_folders(&self) -> Result<Vec<SharedFolder>, BoxError> {
+        let names = read_shared_folders(&self.data_dir)?;
+        let root = self.volume_root.as_deref().unwrap_or(Path::new("/"));
+        // A BTreeMap iterates in key order.
+        Ok(names
+            .into_iter()
+            .map(|(key, name)| {
+                let mut folder = SharedFolder {
+                    key,
+                    name,
+                    ..SharedFolder::default()
+                };
+                match resolve_shared_folder(root, &folder.name) {
+                    Err(e) => folder.error = e.to_string(),
+                    Ok(path) => {
+                        folder.readable = accessible(&path, ACCESS_READ | ACCESS_EXEC);
+                        folder.writable = accessible(&path, ACCESS_WRITE | ACCESS_EXEC);
+                        folder.path = path.to_string_lossy().into_owned();
+                        folder.exists = true;
+                    }
+                }
+                folder
+            })
+            .collect())
+    }
+
+    /// Adds the configured Shared Folders to an app.status answer; a package
+    /// that configures none is answered exactly as before.
+    pub(super) fn with_shared_folders(&self, mut status: Value) -> Value {
+        match self.shared_folders() {
+            Err(e) => status["shared_folders_error"] = e.to_string().into(),
+            Ok(folders) if !folders.is_empty() => {
+                status["shared_folders"] = serde_json::to_value(folders).unwrap_or_default();
+            }
+            Ok(_) => {}
+        }
+        status
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::fs;
+    use std::os::unix::fs::PermissionsExt;
+
+    use super::super::test_support::*;
+    use super::*;
+
+    fn write_config(dir: &Path, body: &str) {
+        fs::write(dir.join("config.json"), body).unwrap();
+    }
+
+    fn mkdirs(root: &Path, dirs: &[&str]) {
+        for dir in dirs {
+            fs::create_dir_all(root.join(dir)).unwrap();
+        }
+    }
+
+    #[test]
+    fn read_shared_folders_without_config_is_empty() {
+        let fixture = Fixture::new();
+        assert!(
+            read_shared_folders(&fixture.cfg.data_dir)
+                .unwrap()
+                .is_empty()
+        );
+    }
+
+    #[test]
+    fn read_shared_folders_returns_names_by_key() {
+        let fixture = Fixture::new();
+        write_config(
+            &fixture.cfg.data_dir,
+            r#"{"schema":1,"shared_folders":{"media":"Family Photos"}}"#,
+        );
+        let got = read_shared_folders(&fixture.cfg.data_dir).unwrap();
+        assert_eq!(
+            got,
+            BTreeMap::from([("media".into(), "Family Photos".into())])
+        );
+    }
+
+    #[test]
+    fn read_shared_folders_refuses_unknown_schema_and_bad_names() {
+        for body in [
+            r#"{"schema":2,"shared_folders":{"media":"x"}}"#,
+            r#"{"schema":1,"shared_folders":{"media":"a/b"}}"#,
+            r#"{"schema":1,"shared_folders":{"media":".."}}"#,
+            r#"{"schema":1,"shared_folders":{"media":"@appdata"}}"#,
+            r#"{"schema":1,"shared_folders":{"media":""}}"#,
+            "not json",
+        ] {
+            let fixture = Fixture::new();
+            write_config(&fixture.cfg.data_dir, body);
+            assert!(
+                read_shared_folders(&fixture.cfg.data_dir).is_err(),
+                "{body}"
+            );
+        }
+    }
+
+    #[test]
+    fn resolve_shared_folder_finds_the_name_on_its_volume() {
+        let fixture = Fixture::new();
+        let root = fixture.scratch();
+        mkdirs(
+            &root,
+            &["volume1/other", "volume2/Photos", "volume2/@appdata"],
+        );
+        assert_eq!(
+            resolve_shared_folder(&root, "Photos").unwrap(),
+            root.join("volume2/Photos")
+        );
+    }
+
+    #[test]
+    fn resolve_shared_folder_follows_a_moved_share() {
+        let fixture = Fixture::new();
+        let root = fixture.scratch();
+        mkdirs(&root, &["volume1/Photos"]);
+        let first = resolve_shared_folder(&root, "Photos").unwrap();
+        fs::rename(root.join("volume1/Photos"), root.join("Photos.tmp")).unwrap();
+        mkdirs(&root, &["volume2"]);
+        fs::rename(root.join("Photos.tmp"), root.join("volume2/Photos")).unwrap();
+        let second = resolve_shared_folder(&root, "Photos").unwrap();
+        assert_ne!(first, second);
+        assert_eq!(second, root.join("volume2/Photos"));
+    }
+
+    #[test]
+    fn resolve_shared_folder_errors() {
+        let fixture = Fixture::new();
+        let root = fixture.scratch();
+        assert_eq!(
+            resolve_shared_folder(&root, "Missing"),
+            Err(SharedFolderError::NotFound)
+        );
+        mkdirs(&root, &["volume1/Dup", "volume2/Dup"]);
+        assert_eq!(
+            resolve_shared_folder(&root, "Dup"),
+            Err(SharedFolderError::Ambiguous)
+        );
+        for bad in ["", "..", "a/b", "@appdata", ".x"] {
+            assert!(resolve_shared_folder(&root, bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn resolve_shared_folder_ignores_a_file_of_that_name() {
+        let fixture = Fixture::new();
+        let root = fixture.scratch();
+        mkdirs(&root, &["volume1"]);
+        fs::write(root.join("volume1/Notes"), "").unwrap();
+        assert_eq!(
+            resolve_shared_folder(&root, "Notes"),
+            Err(SharedFolderError::NotFound)
+        );
+    }
+
+    #[test]
+    fn only_volume_directories_are_searched() {
+        let fixture = Fixture::new();
+        let root = fixture.scratch();
+        mkdirs(
+            &root,
+            &[
+                "volumes/Photos",
+                "volume/Photos",
+                "volumeX/Photos",
+                "volume10/Photos",
+            ],
+        );
+        assert_eq!(
+            resolve_shared_folder(&root, "Photos").unwrap(),
+            root.join("volume10/Photos")
+        );
+    }
+
+    #[test]
+    fn status_omits_shared_folders_when_none_configured() {
+        let (_, out) = call(&Fixture::new().cfg, &alice(), "app.status", "{}");
+        assert!(out["data"].get("shared_folders").is_none(), "{out}");
+    }
+
+    #[test]
+    fn status_reports_each_configured_shared_folder() {
+        let mut fixture = Fixture::new();
+        let root = fixture.scratch();
+        mkdirs(&root, &["volume1/Photos"]);
+        fixture.cfg.volume_root = Some(root.clone());
+        write_config(
+            &fixture.cfg.data_dir,
+            r#"{"schema":1,"shared_folders":{"media":"Photos","gone":"Missing"}}"#,
+        );
+        let (_, out) = call(&fixture.cfg, &alice(), "app.status", "{}");
+        let rows = out["data"]["shared_folders"].as_array().unwrap();
+        assert_eq!(rows.len(), 2);
+        let by_key = |key: &str| rows.iter().find(|r| r["key"] == key).unwrap();
+        let (media, gone) = (by_key("media"), by_key("gone"));
+        assert_eq!(media["name"], "Photos");
+        assert_eq!(media["exists"], true);
+        assert_eq!(media["readable"], true);
+        assert_eq!(media["writable"], true);
+        assert_eq!(media["path"], root.join("volume1/Photos").to_str().unwrap());
+        assert_eq!(gone["exists"], false);
+        assert_eq!(gone["readable"], false);
+        assert_eq!(gone["writable"], false);
+        assert!(gone["error"].is_string());
+        assert!(gone.get("path").is_none());
+    }
+
+    #[test]
+    fn status_reports_a_folder_the_package_account_cannot_write() {
+        // SAFETY: geteuid takes no arguments and cannot fail.
+        if unsafe { libc::geteuid() } == 0 {
+            return; // root ignores directory modes
+        }
+        let mut fixture = Fixture::new();
+        let root = fixture.scratch();
+        mkdirs(&root, &["volume1/Locked"]);
+        let dir = root.join("volume1/Locked");
+        fs::set_permissions(&dir, fs::Permissions::from_mode(0o555)).unwrap();
+        fixture.cfg.volume_root = Some(root);
+        write_config(
+            &fixture.cfg.data_dir,
+            r#"{"schema":1,"shared_folders":{"media":"Locked"}}"#,
+        );
+        let (_, out) = call(&fixture.cfg, &alice(), "app.status", "{}");
+        fs::set_permissions(&dir, fs::Permissions::from_mode(0o755)).unwrap();
+        let row = &out["data"]["shared_folders"][0];
+        assert_eq!(row["exists"], true);
+        assert_eq!(row["readable"], true);
+        assert_eq!(row["writable"], false);
+    }
+
+    #[test]
+    fn status_reports_a_corrupt_config_without_failing() {
+        let fixture = Fixture::new();
+        write_config(&fixture.cfg.data_dir, "not json");
+        let (code, out) = call(&fixture.cfg, &alice(), "app.status", "{}");
+        assert_eq!(code, "");
+        assert!(out["data"]["shared_folders_error"].is_string(), "{out}");
+    }
+}

package/templates/native-rust/backend/src/app/test_support.rs

@@ -0,0 +1,200 @@
+//! Helpers shared by the unit tests: a data directory, stub authenticators and
+//! a call through the App's server.
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use serde_json::Value;
+use syno_pkg_land_sdk::api::{
+    ADMINISTRATOR_PERMISSION, AuthError, Authenticator, Identity, Route, Server,
+};
+use syno_pkg_land_sdk::http::{Handler, Recorder, Request};
+
+use super::{Config, routes};
+use crate::permissions::permissions;
+
+/// A private directory removed on drop, like Go's t.TempDir.
+pub struct TempDir(PathBuf);
+
+impl TempDir {
+    pub fn new() -> Self {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        let n = NEXT.fetch_add(1, Ordering::SeqCst);
+        let path = std::env::temp_dir().join(format!("app-test-{}-{n}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&path);
+        std::fs::create_dir_all(&path).unwrap();
+        TempDir(path)
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.0
+    }
+}
+
+impl Drop for TempDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+/// A Config over a fresh data directory that lives as long as the fixture.
+pub struct Fixture {
+    pub cfg: Config,
+    dir: TempDir,
+}
+
+impl Fixture {
+    pub fn new() -> Self {
+        let dir = TempDir::new();
+        let cfg = Config {
+            package_id: "HelloRust".into(),
+            version: "0.1.0-0001".into(),
+            data_dir: dir.path().join("var"),
+            uid_lookup: Some(Arc::new(|_| "1024".into())),
+            ..Config::default()
+        };
+        std::fs::create_dir(&cfg.data_dir).unwrap();
+        Fixture { cfg, dir }
+    }
+
+    /// A scratch directory next to the data directory.
+    pub fn scratch(&self) -> PathBuf {
+        let path = self.dir.path().join("scratch");
+        std::fs::create_dir_all(&path).unwrap();
+        path
+    }
+
+    pub fn assert_data_dir_empty(&self) {
+        let entries: Vec<_> = std::fs::read_dir(&self.cfg.data_dir)
+            .unwrap()
+            .map(|e| e.unwrap().file_name())
+            .collect();
+        assert!(entries.is_empty(), "data dir changed: {entries:?}");
+    }
+}
+
+/// What DSM's authentication decided about a request.
+#[derive(Clone)]
+pub enum Stub {
+    Signed(Identity),
+    NoSession,
+}
+
+impl Authenticator for Stub {
+    fn authenticate(&self, _: &Request) -> Result<Identity, AuthError> {
+        match self {
+            Stub::Signed(identity) => Ok(identity.clone()),
+            Stub::NoSession => Err(AuthError::NoSession),
+        }
+    }
+}
+
+pub fn user(name: &str, admin: bool) -> Stub {
+    Stub::Signed(Identity {
+        user: name.into(),
+        admin,
+    })
+}
+
+pub fn alice() -> Stub {
+    user("alice", true)
+}
+
+pub fn bob() -> Stub {
+    user("bob", false)
+}
+
+pub fn carol() -> Stub {
+    user("carol", false)
+}
+
+pub fn nobody() -> Stub {
+    Stub::NoSession
+}
+
+/// The access rule the server applies to r: the App policy for App methods,
+/// the SDK policy (reported by the route) for SDK methods.
+pub fn rule(r: &Route) -> String {
+    let policy: Value = serde_json::from_slice(permissions().unwrap()).unwrap();
+    match policy["methods"][r.method()].as_str() {
+        Some(rule) => rule.to_string(),
+        None if r.public() => "public".into(),
+        None if r.admin_only() => ADMINISTRATOR_PERMISSION.into(),
+        None => "authenticated".into(),
+    }
+}
+
+/// A JSON API call, as the browser sends it.
+pub fn api_request(method: &str, params: &str) -> Request {
+    let body = format!(r#"{{"method":"{method}","params":{params}}}"#);
+    let mut req = Request::new("POST", "/api.cgi").with_body(body);
+    req.header.set("Content-Type", "application/json");
+    req
+}
+
+/// Returns the envelope's error code ("" on success) and the envelope.
+pub fn call(cfg: &Config, auth: &Stub, method: &str, params: &str) -> (String, Value) {
+    serve(
+        cfg,
+        auth,
+        api_request(method, params),
+        permissions().unwrap(),
+    )
+}
+
+/// Runs req through the App's server and returns as [`call`] does.
+pub fn serve(cfg: &Config, auth: &Stub, mut req: Request, permissions: &[u8]) -> (String, Value) {
+    let server = Server::new_with_permissions(auth.clone(), permissions, routes(cfg.clone()))
+        .expect("the App's routes and policy are valid");
+    respond(&server, &mut req)
+}
+
+/// The envelope a handler wrote for req.
+pub fn respond(handler: &dyn Handler, req: &mut Request) -> (String, Value) {
+    let mut rec = Recorder::default();
+    handler.serve_http(&mut rec, req);
+    let out: Value = serde_json::from_slice(&rec.body)
+        .unwrap_or_else(|_| panic!("not JSON: {}", String::from_utf8_lossy(&rec.body)));
+    assert_eq!(rec.status, Some(200), "DSM replaces non-200 CGI bodies");
+    let code = out["error"]["code"].as_str().unwrap_or("").to_string();
+    (code, out)
+}
+
+/// Valid params for one route, so a denial test proves the refusal came from
+/// the policy and not from bad input, and the outcome the route has for an
+/// administrator on a fresh data directory ("" is success).
+pub struct Sample {
+    pub method: &'static str,
+    pub params: String,
+    pub outcome: &'static str,
+}
+
+pub fn sample(method: &'static str, params: &str, outcome: &'static str) -> Sample {
+    Sample {
+        method,
+        params: params.into(),
+        outcome,
+    }
+}
+
+/// The samples of every route the build has: the base's and each overlay's.
+pub fn samples() -> Vec<Sample> {
+    let mut samples = vec![
+        sample("app.status", "{}", ""),
+        sample("greeting.get", "{}", ""),
+        sample("greeting.set", r#"{"text":"Hi"}"#, ""),
+    ];
+    samples.extend(super::background_routes::samples());
+    samples.extend(super::root_routes::samples());
+    samples.extend(super::delegate_routes::samples());
+    samples
+}
+
+pub fn params_of(method: &str) -> String {
+    samples()
+        .into_iter()
+        .find(|s| s.method == method)
+        .unwrap_or_else(|| panic!("route {method} has no sample params"))
+        .params
+}

package/templates/native-rust/backend/src/app/uninstall.rs

@@ -0,0 +1,38 @@
+//! The App's purge hook (dsm-package.yaml `uninstall.purge`): DSM runs
+//! `api.cgi uninstall` as the package account before the executor is removed,
+//! with the admin's "delete state" answer.
+
+use std::io::{self, ErrorKind};
+use std::path::Path;
+
+/// Release here what the App holds outside the package. With `delete_state`
+/// it deletes the state `uninstall.state` lists, the background job spool;
+/// package data stays for DSM's own "remove data" option.
+pub fn uninstall(data_dir: &Path, delete_state: bool) -> io::Result<()> {
+    if !delete_state {
+        return Ok(());
+    }
+    match std::fs::remove_dir_all(data_dir.join("background")) {
+        Err(e) if e.kind() == ErrorKind::NotFound => Ok(()),
+        other => other,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::app::test_support::TempDir;
+
+    #[test]
+    fn uninstall_deletes_the_job_spool_only_when_asked() {
+        let dir = TempDir::new();
+        let spool = dir.path().join("background");
+        std::fs::create_dir_all(spool.join("inputs")).unwrap();
+        uninstall(dir.path(), false).unwrap();
+        assert!(spool.exists(), "kept state is gone");
+        uninstall(dir.path(), true).unwrap();
+        assert!(!spool.exists(), "state not deleted");
+        assert!(dir.path().exists(), "package data must stay");
+        uninstall(dir.path(), true).expect("nothing left to delete");
+    }
+}

package/templates/native-rust/backend/src/bin/api.rs

@@ -0,0 +1,72 @@
+//! The package backend. DSM runs it as a CGI (ui/cgi/api.cgi in the package)
+//! under the package account, once per request, and as the uninstall hook
+//! (`api.cgi uninstall`) when dsm-package.yaml declares one.
+
+use std::path::Path;
+use std::process::exit;
+use std::sync::Arc;
+
+use app::app::{migrate, parse_delegate_config, routes, standalone_identity, uninstall};
+use app::build_env::Build;
+use app::permissions::permissions;
+use syno_pkg_land_sdk::BoxError;
+use syno_pkg_land_sdk::api::{Authenticator, Server, with_request_deadline};
+use syno_pkg_land_sdk::dsm;
+use syno_pkg_land_sdk::http::{Handler, cgi};
+
+fn main() {
+    let build = Build::compiled();
+    let cgi = !std::env::var("GATEWAY_INTERFACE")
+        .unwrap_or_default()
+        .is_empty();
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    if !cgi && args == ["uninstall"] {
+        let delete_state = std::env::var("SYNOPKGLAND_DELETE_STATE").as_deref() == Ok("1");
+        if let Err(e) = uninstall(Path::new(&build.data_dir()), delete_state) {
+            eprintln!("{}: uninstall: {e}", build.package_id);
+            exit(1);
+        }
+        return;
+    }
+    if !cgi {
+        eprintln!(
+            "{} {}: this program runs as the package's DSM CGI; open the app from the DSM main menu.",
+            build.package_id, build.version
+        );
+        exit(2);
+    }
+    if let Err(e) = run(&build) {
+        eprintln!("{}: {e}", build.package_id);
+        exit(1);
+    }
+}
+
+fn run(build: &Build) -> Result<(), BoxError> {
+    let cfg = build.config();
+    parse_delegate_config(&cfg)?;
+    // Kernels without memfd_create stage DSM's bridges in the package's own temp.
+    dsm::set_bridge_fallback_dir(format!("/var/packages/{}/tmp", build.package_id));
+    let mut auth: Arc<dyn Authenticator> = Arc::new(dsm::Authenticator::new());
+    let mut standalone = None;
+    if build.identity == "standalone" {
+        let script_name = std::env::var("SCRIPT_NAME").unwrap_or_default();
+        let service = Arc::new(
+            standalone_identity(&cfg, &script_name)
+                .map_err(|_| "identity configuration unavailable")?,
+        );
+        auth = service.clone();
+        standalone = Some(service);
+    }
+    let auth = dsm::new_entry_gate(auth, build.entry, build.package_id, &cfg.data_dir)?;
+    let server = Server::new_with_permissions(auth, permissions()?, routes(cfg.clone()))?;
+    migrate(&cfg).map_err(|e| format!("schema migration failed: {e}"))?;
+    match standalone {
+        Some(identity) => serve(identity.wrap(server))?,
+        None => serve(server)?,
+    }
+    Ok(())
+}
+
+fn serve(handler: impl Handler) -> std::io::Result<()> {
+    cgi::serve(&with_request_deadline(handler))
+}