Syno Package Land

Identity and files

DSM login is the user. Containers never receive DSM cookies or passwords. File access follows DSM ACL on every call.

Identity

  • App User — App User is whoever is signed into DSM (local, LDAP/domain, or admin-configured SSO). There is no separate platform account password for the default Web App entry.
  • Broker Session — Broker Session is SynoPkgLandService's confirmation of that DSM login for your App. It is not a DSM session cookie copied into containers.
  • User Context — User Context is a short-lived, audience-limited token your Integrated App verifies through Platform SDK. Use it to map platform identity to your own roles and data.
  • Trusted App Entry — Trusted App Entry — generated SPK and Web Station ingress reach your App without forwarding DSM authentication cookies. Protected resources still require SDK verification.

Declare integration.identity.mode: broker-managed in App Contract. Developer Kit wires launcher, callback path, and SDK bootstrap. v1 default does not require Publisher-supplied domain or OIDC configuration.

Files

Shared Folder Mount (Personal App default)

NAS Administrator picks an existing DSM Shared Folder at install. App Package materializes a bind mount for the whole App Instance. ACL follows the Shared Folder — it does not switch with the current App User.

User File Scope

Broader grant: Integrated App may act on files the current App User can access in DSM. Requires explicit human confirmation during install or upgrade — Skill Pack must surface this in plain language, not hide it in technical defaults.

File Gateway

Platform SDK File API calls go through SynoPkgLandService File Gateway. Every operation checks current DSM ACL for that App User. Containers do not get direct DSM file APIs or volume paths as shortcuts around permission checks.

What never enters a container

  • DSM session cookies or passwords.
  • Broker private keys or signing material.
  • Unscoped permanent user tokens standing in for ACL checks.