nx_mgmt_client_gate.nx
buildroot/runtime/nx_mgmt_client_gate.nx
about
nx_mgmt_client_gate.nx -- in-process referee for the sovereign mgmt-API client codec. NO socket / NO creds:
asserts the PURE byte builders + parsers are exactly right (a live TLS handshake can't run in-process; the
operator/parent drives the real round-trip). Locks:
T1 login body is url-ENCODED byte-exactly (special chars '&'/'='/space MUST percent-encode)
T2 a 200 {"token":"abc123"} response -> token == "abc123", status 200
T3 NEG: a 401 {"error":"unauthorized"} -> NO token (fail signal), status 401
T4 an authed request carries "X-Nishi-Session: <token>" exactly (GET header; POST header+body+Content-Length;
and token_len==0 OMITS the header -- the negative control for header injection)
T5 NEG: malformed (unterminated) AND empty JSON -> token extraction returns empty (fail-closed, not garbage)
T6 upload integrity: sha256_digest+mcl_hex32 == NIST SHA-256("abc"); &sha256= rides the FINAL chunk ONLY (NEG: absent when final=0)
GREEN + exit 0 iff all 6 pass. license_tier: ORIGINAL expect_exit: 0
dependencies 3 imports · 0 importers
imports: nx_mgmt_client.nxnx_syscalls.nxnx_gate_verdict.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| none |
functions
| 16 | func mcg_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } |
| 17 | func mcg_putn(v: i64) -> i64 |
| 26 | func mcg_row(name: *u8, ok: i64) -> i64 |
| 32 | func mcg_memeq(a: *u8, an: i64, b: *u8, bn: i64) -> i64 called by 1: main |
| 39 | func mcg_contains(buf: *u8, n: i64, needle: *u8) -> i64 called by 1: main |
| 51 | func mcg_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } called by 1: main |
| 53 | func main() -> i64 |