@synopackageland/templates 0.9.8 → 0.10.0

package/templates/native-rust-jobs/backend/src/app/background_routes.rs

@@ -1,109 +0,0 @@
-use std::sync::Arc;
-
-use syno_pkg_land_sdk::api::Route;
-
-#[cfg(test)]
-use super::test_support::{Sample, sample};
-use super::{BackgroundApi, Config, system_uid_lookup};
-
-impl Config {
-    /// Serves the owner-scoped background job API. Jobs run in the
-    /// package-user worker unit (conf/systemd), never as root.
-    pub(super) fn background_routes(self: &Arc<Self>) -> Vec<Route> {
-        let uid_lookup = self.uid_lookup.clone().unwrap_or_else(system_uid_lookup);
-        BackgroundApi::production(&self.data_dir, uid_lookup).routes()
-    }
-}
-
-/// Valid params for every background route. The fixture has no DSM cookie, so
-/// import is refused before reading a file, and its fresh data directory has
-/// no jobs or schedules.
-#[cfg(test)]
-pub(super) fn samples() -> Vec<Sample> {
-    let id = r#"{"id":"missing"}"#;
-    vec![
-        sample(
-            "bg.jobs.purge",
-            r#"{"owner":{"user":"missing","uid":"9999"}}"#,
-            "",
-        ),
-        sample("bg.schedules.list", "{}", ""),
-        sample(
-            "bg.schedules.create",
-            r#"{"key":"schedule","jobId":"missing","intervalSeconds":3600,"consent":true}"#,
-            "not_found",
-        ),
-        sample("bg.schedules.disable", id, "not_found"),
-        sample("bg.schedules.delete", id, "not_found"),
-        sample(
-            "bg.schedules.enable",
-            r#"{"id":"missing","consent":true}"#,
-            "not_found",
-        ),
-        sample("bg.status", "{}", ""),
-        sample("bg.browse", "{}", "session_required"),
-        sample(
-            "bg.jobs.submit",
-            r#"{"key":"k1","folder":"/share","relative":"a.bin"}"#,
-            "session_required",
-        ),
-        sample("bg.jobs.list", "{}", ""),
-        sample("bg.jobs.get", id, "not_found"),
-        sample("bg.jobs.cancel", id, "not_found"),
-        sample("bg.jobs.pause", id, "not_found"),
-        sample("bg.jobs.resume", id, "not_found"),
-        sample("bg.jobs.result", id, "not_found"),
-    ]
-}
-
-#[cfg(test)]
-mod tests {
-    use std::time::{Duration, Instant};
-
-    use syno_pkg_land_sdk::background::{REQUEST_LOCK_TIMEOUT, Store};
-    use syno_pkg_land_sdk::ctx::Context;
-
-    use super::super::test_support::*;
-
-    /// Holds the spool's journal lock, as a busy worker does.
-    struct Flock(std::fs::File);
-
-    impl Flock {
-        fn exclusive(path: &std::path::Path) -> Flock {
-            use std::os::fd::AsRawFd;
-            let file = std::fs::OpenOptions::new()
-                .read(true)
-                .write(true)
-                .open(path)
-                .unwrap();
-            // SAFETY: the descriptor is open for the file's lifetime.
-            let rc = unsafe { libc::flock(file.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) };
-            assert_eq!(rc, 0, "{}", std::io::Error::last_os_error());
-            Flock(file)
-        }
-    }
-
-    impl Drop for Flock {
-        fn drop(&mut self) {
-            use std::os::fd::AsRawFd;
-            // SAFETY: the descriptor is open for the file's lifetime.
-            unsafe { libc::flock(self.0.as_raw_fd(), libc::LOCK_UN) };
-        }
-    }
-
-    #[test]
-    fn a_busy_spool_is_reported_within_the_request_budget() {
-        let fixture = Fixture::new();
-        let dir = fixture.cfg.data_dir.join("background");
-        // The first read creates the spool and its lock.
-        Store::new_request(&dir)
-            .list(&Context::background())
-            .unwrap();
-        let _held = Flock::exclusive(&dir.join("lock"));
-
-        let start = Instant::now();
-        let (code, out) = call(&fixture.cfg, &alice(), "bg.jobs.list", "{}");
-        assert_eq!(code, "jobs_busy", "{out}");
-        assert!(start.elapsed() < REQUEST_LOCK_TIMEOUT + Duration::from_secs(1));
-    }
-}

package/templates/native-rust-root-ops/backend/src/app/root_routes.rs

@@ -1,475 +0,0 @@
-use std::io::Read;
-use std::os::unix::fs::DirBuilderExt;
-use std::sync::Arc;
-use std::time::Duration;
-
-use serde::Deserialize;
-use serde_json::Value;
-use syno_pkg_land_sdk::BoxError;
-use syno_pkg_land_sdk::api::{self, Caller, Route};
-use syno_pkg_land_sdk::ctx::Context;
-use syno_pkg_land_sdk::delegate::{
-    self, Auth, CODE_EXECUTOR_UNAVAILABLE, CODE_POLICY_DENIED, Client, ExecutorClient,
-    ExecutorStatus,
-};
-use syno_pkg_land_sdk::http::Request;
-use syno_pkg_land_sdk::jsonx::Empty;
-
-use super::Config;
-use super::routes::{decode_params, write_file_atomic};
-#[cfg(test)]
-use super::test_support::{Sample, sample};
-
-impl Config {
-    pub(super) fn root_routes(self: &Arc<Self>) -> Vec<Route> {
-        vec![
-            self.handle("executor.control", Config::executor_control),
-            self.handle("executor.status", Config::executor_status),
-            self.handle_request("root.run", Config::executor_root_run),
-        ]
-    }
-
-    /// API permissions default to administrators for unlisted methods. Check
-    /// here too: control mutates the fixed package-owned control file before
-    /// DSM runs it.
-    fn executor_control(
-        &self,
-        _: &Context,
-        caller: &Caller,
-        raw: &[u8],
-    ) -> Result<Value, BoxError> {
-        api::require_admin(caller)?;
-        #[derive(Default, Deserialize)]
-        #[serde(deny_unknown_fields)]
-        struct Params {
-            #[serde(default)]
-            action: String,
-        }
-        let params: Params = decode_params(raw)?;
-        if !["start", "stop", "purge"].contains(&params.action.as_str()) {
-            return Err(api::Error::bad_request("executor_control_invalid").into());
-        }
-        let dir = self.data_dir.join("executor");
-        std::fs::DirBuilder::new()
-            .recursive(true)
-            .mode(0o700)
-            .create(&dir)?;
-        let info = std::fs::symlink_metadata(&dir)?;
-        if !info.is_dir() || info.file_type().is_symlink() {
-            return Err("executor_control_directory_invalid".into());
-        }
-        write_file_atomic(&dir.join("control"), params.action.as_bytes())?;
-        Ok(serde_json::json!({"written": true}))
-    }
-
-    /// The executor closes its socket while paused: the package is stopped,
-    /// or an upgrade changed the pins and awaits administrator approval.
-    fn executor_status(&self, ctx: &Context, _: &Caller, _: &[u8]) -> Result<Value, BoxError> {
-        match delegate::call::<_, Value>(&*self.executor(), ctx, "status", &Auth::new(), &Empty {})
-        {
-            Err(err)
-                if api::find_error::<api::Error>(&*err)
-                    .is_some_and(|refusal| refusal.code == CODE_EXECUTOR_UNAVAILABLE) =>
-            {
-                let next = if self.start_requested() {
-                    "The package is running: an administrator approves background access again in Administrator setup; the executor log names the cause."
-                } else {
-                    "Start the package."
-                };
-                Ok(serde_json::json!({
-                    "ready": false, "state": "paused",
-                    "reason": "executor_not_listening", "next": next,
-                }))
-            }
-            status => status,
-        }
-    }
-
-    /// Package start and stop write the lifecycle mailbox; its last request
-    /// tells a stopped package from a running one whose executor stays paused.
-    fn start_requested(&self) -> bool {
-        let Ok(mut file) = std::fs::File::open(self.data_dir.join("executor").join("control"))
-        else {
-            return false;
-        };
-        let mut buf = [0u8; 16];
-        let n = file.read(&mut buf).unwrap_or(0);
-        String::from_utf8_lossy(&buf[..n]).trim() == "start"
-    }
-
-    fn executor_root_run(
-        &self,
-        ctx: &Context,
-        caller: &Caller,
-        req: &Request,
-        raw: &[u8],
-    ) -> Result<Value, BoxError> {
-        api::require_admin(caller)?;
-        #[derive(Default, Deserialize)]
-        #[serde(deny_unknown_fields)]
-        struct Params {
-            #[serde(default)]
-            name: String,
-        }
-        let params: Params = decode_params(raw)?;
-        // The executor independently verifies both session values and the
-        // administrator identity.
-        let auth = api::dsm_session(req)?;
-        self.executor_holds_this_build(ctx)?;
-        delegate::call(
-            &*self.executor(),
-            ctx,
-            "root.run",
-            &auth,
-            &serde_json::json!({"name": params.name}),
-        )
-    }
-
-    /// Refuses, as delegate does, an executor pinned to another build's
-    /// policy or executor: its approved scripts are not this build's.
-    fn executor_holds_this_build(&self, ctx: &Context) -> Result<(), BoxError> {
-        let pins: ExecutorStatus =
-            delegate::call(&*self.executor(), ctx, "status", &Auth::new(), &Empty {})?;
-        if (!self.executor_digest.is_empty() && pins.executor_digest != self.executor_digest)
-            || (!self.policy_digest.is_empty() && pins.policy_digest != self.policy_digest)
-        {
-            return Err(api::Error::new(
-                CODE_POLICY_DENIED,
-                "the executor holds another build's approved policy; an administrator approves this build in Administrator setup",
-            )
-            .into());
-        }
-        Ok(())
-    }
-
-    /// Keeps the executor's protocol v1 refusal codes (POLICY_DENIED,
-    /// EXECUTOR_UNAVAILABLE, ...) as the API error code.
-    fn executor(&self) -> Arc<dyn ExecutorClient> {
-        self.executor.clone().unwrap_or_else(|| {
-            Arc::new(Client {
-                timeout: Duration::from_secs(30),
-                ..Client::local(&self.package_id)
-            })
-        })
-    }
-}
-
-/// Valid params for the root routes. root.run needs a DSM session the
-/// fixture does not have.
-#[cfg(test)]
-pub(super) fn samples() -> Vec<Sample> {
-    vec![
-        sample("executor.control", r#"{"action":"stop"}"#, ""),
-        sample("executor.status", "{}", ""),
-        sample("root.run", r#"{"name":"whoami"}"#, "session_required"),
-    ]
-}
-
-#[cfg(test)]
-mod tests {
-    use std::io::{BufRead, BufReader, Write};
-    use std::os::unix::net::UnixListener;
-    use std::path::PathBuf;
-    use std::sync::Mutex;
-    use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
-
-    use super::super::test_support::*;
-    use super::*;
-    use crate::permissions::permissions;
-
-    /// Unix socket paths are limited to about 100 bytes, so the executor's
-    /// fake lives in a short directory under /tmp.
-    struct SocketBase(PathBuf);
-
-    impl SocketBase {
-        fn new() -> Self {
-            static NEXT: AtomicU64 = AtomicU64::new(0);
-            let base = PathBuf::from(format!(
-                "/tmp/exec-{}-{}",
-                std::process::id(),
-                NEXT.fetch_add(1, Ordering::SeqCst)
-            ));
-            let _ = std::fs::remove_dir_all(&base);
-            std::fs::create_dir_all(&base).unwrap();
-            SocketBase(base)
-        }
-
-        fn socket(&self, cfg: &Config) -> PathBuf {
-            let dir = self.0.join(&cfg.package_id);
-            std::fs::create_dir_all(&dir).unwrap();
-            dir.join("executor.sock")
-        }
-
-        /// Points cfg at an executor under this base.
-        fn attach(&self, cfg: &mut Config) {
-            cfg.executor = Some(Arc::new(Client {
-                socket: self.socket(cfg).to_string_lossy().into_owned(),
-                timeout: Duration::from_secs(5),
-            }));
-        }
-    }
-
-    impl Drop for SocketBase {
-        fn drop(&mut self) {
-            let _ = std::fs::remove_dir_all(&self.0);
-        }
-    }
-
-    /// Answers each v1 request with replies[op] and records the ops.
-    struct FakeExecutor {
-        ops: Arc<Mutex<Vec<String>>>,
-        stop: Arc<AtomicBool>,
-        socket: PathBuf,
-    }
-
-    impl FakeExecutor {
-        fn start(base: &SocketBase, cfg: &mut Config, replies: &[(&str, String)]) -> Self {
-            base.attach(cfg);
-            let socket = base.socket(cfg);
-            let listener = UnixListener::bind(&socket).unwrap();
-            let replies: Vec<(String, String)> = replies
-                .iter()
-                .map(|(op, reply)| (op.to_string(), reply.clone()))
-                .collect();
-            let ops = Arc::new(Mutex::new(Vec::new()));
-            let stop = Arc::new(AtomicBool::new(false));
-            let (seen, done) = (ops.clone(), stop.clone());
-            std::thread::spawn(move || {
-                for conn in listener.incoming() {
-                    if done.load(Ordering::SeqCst) {
-                        return;
-                    }
-                    let Ok(mut conn) = conn else { return };
-                    let mut line = String::new();
-                    let _ = BufReader::new(&conn).read_line(&mut line);
-                    let request: Value = serde_json::from_str(&line).unwrap_or_default();
-                    let op = request["op"].as_str().unwrap_or("").to_string();
-                    let reply = replies
-                        .iter()
-                        .find(|(name, _)| *name == op)
-                        .map(|(_, reply)| reply.clone())
-                        .unwrap_or_default();
-                    seen.lock().unwrap().push(op);
-                    let _ = writeln!(conn, "{reply}");
-                }
-            });
-            FakeExecutor { ops, stop, socket }
-        }
-
-        fn received(&self) -> Vec<String> {
-            self.ops.lock().unwrap().clone()
-        }
-    }
-
-    impl Drop for FakeExecutor {
-        fn drop(&mut self) {
-            self.stop.store(true, Ordering::SeqCst);
-            let _ = std::os::unix::net::UnixStream::connect(&self.socket);
-        }
-    }
-
-    fn data(out: &Value) -> &Value {
-        &out["data"]
-    }
-
-    #[test]
-    fn executor_control_accepts_only_fixed_actions() {
-        let fixture = Fixture::new();
-        let cfg = &fixture.cfg;
-        for action in ["start", "stop", "purge"] {
-            let (code, out) = call(
-                cfg,
-                &alice(),
-                "executor.control",
-                &format!(r#"{{"action":"{action}"}}"#),
-            );
-            assert_eq!(code, "", "{action}: {out}");
-            let written = std::fs::read_to_string(cfg.data_dir.join("executor/control")).unwrap();
-            assert_eq!(written, action);
-        }
-        for raw in [
-            r#"{"action":"start;id"}"#,
-            r#"{"action":"start\nstop"}"#,
-            r#"{"action":""}"#,
-            r#"{"action":"stop","path":"/etc/passwd"}"#,
-        ] {
-            assert_eq!(
-                call(cfg, &alice(), "executor.control", raw).0,
-                "bad_request",
-                "{raw}"
-            );
-        }
-    }
-
-    #[test]
-    fn executor_control_rejects_a_symlinked_directory() {
-        let fixture = Fixture::new();
-        let outside = fixture.scratch();
-        std::os::unix::fs::symlink(&outside, fixture.cfg.data_dir.join("executor")).unwrap();
-        let (code, _) = call(
-            &fixture.cfg,
-            &alice(),
-            "executor.control",
-            r#"{"action":"stop"}"#,
-        );
-        assert_ne!(code, "", "accepted symlink");
-        assert!(
-            !outside.join("control").exists(),
-            "wrote outside data directory"
-        );
-    }
-
-    #[test]
-    fn root_run_requires_the_current_dsm_cookie() {
-        let fixture = Fixture::new();
-        let (code, _) = call(&fixture.cfg, &alice(), "root.run", r#"{"name":"whoami"}"#);
-        assert_ne!(code, "", "root.run accepted an absent DSM cookie");
-    }
-
-    /// The executor closes its listener while paused (package stopped, or pins
-    /// awaiting administrator approval). Status then answers, not "internal".
-    #[test]
-    fn executor_status_reports_a_paused_executor() {
-        let mut fixture = Fixture::new();
-        let base = SocketBase::new();
-        base.attach(&mut fixture.cfg);
-        let check = |name: &str| {
-            let (code, out) = call(&fixture.cfg, &alice(), "executor.status", "{}");
-            let d = data(&out);
-            assert_eq!(code, "", "{name}: {out}");
-            assert_eq!(d["ready"], false, "{name}: {out}");
-            assert_eq!(d["state"], "paused", "{name}: {out}");
-            assert_eq!(d["reason"], "executor_not_listening", "{name}: {out}");
-            assert!(
-                !d["next"].as_str().unwrap_or("").is_empty(),
-                "{name}: {out}"
-            );
-        };
-        check("no socket");
-        let (code, _) = call(&fixture.cfg, &bob(), "executor.status", "{}");
-        assert_eq!(
-            code, "",
-            "an authenticated user cannot read a paused status"
-        );
-        drop(UnixListener::bind(base.socket(&fixture.cfg)).unwrap());
-        check("closed listener");
-    }
-
-    /// next follows the last lifecycle request: a running package needs
-    /// approval again, not a start.
-    #[test]
-    fn executor_status_next_follows_the_lifecycle_request() {
-        let mut fixture = Fixture::new();
-        let base = SocketBase::new();
-        base.attach(&mut fixture.cfg);
-        let next = || {
-            let (_, out) = call(&fixture.cfg, &alice(), "executor.status", "{}");
-            data(&out)["next"].as_str().unwrap_or("").to_string()
-        };
-        assert!(
-            next().starts_with("Start the package."),
-            "no request: {}",
-            next()
-        );
-        let mailbox = fixture.cfg.data_dir.join("executor");
-        std::fs::create_dir_all(&mailbox).unwrap();
-        for (request, start) in [("stop\n", true), ("start\n", false), ("start", false)] {
-            std::fs::write(mailbox.join("control"), request).unwrap();
-            let got = next();
-            assert_eq!(
-                got.starts_with("Start the package"),
-                start,
-                "{request:?}: {got}"
-            );
-            assert!(!got.is_empty());
-        }
-    }
-
-    const READY: &str = r#"{"ok":true,"result":{"executor_digest":"e1","policy_digest":"p1","ready":true,"disabled":false,"version":"1"}}"#;
-    const WHOAMI: &str = r#"{"ok":true,"result":{"output":"0\n"}}"#;
-
-    fn pinned() -> Fixture {
-        let mut fixture = Fixture::new();
-        fixture.cfg.executor_digest = "e1".into();
-        fixture.cfg.policy_digest = "p1".into();
-        fixture
-    }
-
-    /// root.run as an administrator with a current DSM session.
-    fn root_run(cfg: &Config, name: &str) -> (String, Value) {
-        let mut req = api_request("root.run", &format!(r#"{{"name":"{name}"}}"#));
-        req.header.set("Cookie", "id=session");
-        req.header.set("X-SYNO-TOKEN", "token");
-        serve(cfg, &alice(), req, permissions().unwrap())
-    }
-
-    #[test]
-    fn root_run_runs_when_the_executor_holds_this_builds_pins() {
-        let mut fixture = pinned();
-        let base = SocketBase::new();
-        let _executor = FakeExecutor::start(
-            &base,
-            &mut fixture.cfg,
-            &[("status", READY.into()), ("root.run", WHOAMI.into())],
-        );
-        let (code, out) = root_run(&fixture.cfg, "whoami");
-        assert_eq!(code, "", "{out}");
-        assert_eq!(data(&out)["output"], "0\n");
-    }
-
-    /// Like delegate: an executor pinned to another build's policy or
-    /// executor refuses the operation, it does not run it.
-    #[test]
-    fn root_run_refuses_an_executor_pinned_to_another_build() {
-        for (name, status) in [
-            ("policy", READY.replacen("\"p1\"", "\"p2\"", 1)),
-            ("executor", READY.replacen("\"e1\"", "\"e2\"", 1)),
-        ] {
-            let mut fixture = pinned();
-            let base = SocketBase::new();
-            let executor = FakeExecutor::start(
-                &base,
-                &mut fixture.cfg,
-                &[("status", status), ("root.run", WHOAMI.into())],
-            );
-            let (code, out) = root_run(&fixture.cfg, "whoami");
-            assert_eq!(code, "POLICY_DENIED", "{name} digest mismatch: {out}");
-            assert!(
-                !executor.received().contains(&"root.run".to_string()),
-                "{name} digest mismatch: root.run reached the executor"
-            );
-        }
-    }
-
-    /// Refusals keep the protocol v1 code (spec/protocol/v1/errors.json),
-    /// never "internal".
-    #[test]
-    fn root_run_reports_the_executors_refusal_code() {
-        let mut fixture = pinned();
-        let base = SocketBase::new();
-        base.attach(&mut fixture.cfg);
-        let (code, _) = root_run(&fixture.cfg, "whoami");
-        assert_eq!(
-            code, "EXECUTOR_UNAVAILABLE",
-            "paused or awaiting approval (no socket)"
-        );
-        for refusal in [
-            "POLICY_DENIED",
-            "INVALID_REQUEST",
-            "EXECUTOR_PAUSED",
-            "ROOT_FAILED",
-            "ADMIN_REQUIRED",
-        ] {
-            let mut fixture = pinned();
-            let base = SocketBase::new();
-            let reply = format!(r#"{{"ok":false,"code":"{refusal}","message":"refused"}}"#);
-            let _executor = FakeExecutor::start(
-                &base,
-                &mut fixture.cfg,
-                &[("status", READY.into()), ("root.run", reply)],
-            );
-            let (code, out) = root_run(&fixture.cfg, "whoami");
-            assert_eq!(code, refusal, "{out}");
-        }
-    }
-}