code wiki / _hdl_build / nx_mgmt_tools_register_gate.nx

nx_mgmt_tools_register_gate.nx

buildroot/runtime/_hdl_build/nx_mgmt_tools_register_gate.nx

13401 B221 linesdepth 18pulls 86 transitivereach 0 importersview sourcekind gate/prooftopic mgmt

docs dependencies structs consts functions

about

nx_mgmt_tools_register_gate.nx -- prove POST /api/tools/register is fail-closed + idempotent. In-process referee (no socket): crafts request BYTES, feeds the pure handler ma_do_tools_register. Auth is the SAME ma_level_of gate as every other write route, so this focuses on the NEW logic: T1 missing name -> 400 T2 path-escape elf basename ("../x") -> 400 invalid basename (sanitize refuses) T3 no confirm=yes -> 400 T4 IDEMPOTENT: a name already in tool_allowlist.conf -> ALREADY-REGISTERED, file UNCHANGED (no dup row) T5 elf not a real ELF under nishihost -> 400 (never register a phantom tool) (The positive append is proven LIVE post-deploy -- its ELF path is the NAS-absolute nishihost dir.) Runs FS under /tmp. license_tier: ORIGINAL expect_exit: 0

dependencies 3 imports · 0 importers

imports: nx_mgmt_api.nxnx_syscalls.nxnx_gate_verdict.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

16	const GT_ARGCAP: i64 = 4096

functions

18	func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } called by 1: main calls 1: sys_write
19	func pn(v: i64) -> i64 calls 2: sys_mmap sys_write
28	func glen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } called by 3: gcontains mkreq main
29	func gcat(d: u8, o: i64, s: u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){d[o+i]=s[i]; i=i+1} return o+i } called by 1: mkreq
30	func gcatn(d: u8, o: i64, s: u8, n: i64) -> i64 { var i: i64=0; while i<n {d[o+i]=s[i]; i=i+1} return o+n } called by 1: mkreq
31	func gcontains(hay: u8, n: i64, needle: u8) -> i64 called by 1: main calls 1: glen
42	func mkreq(dst: u8, line: u8, bod: *u8) -> i64 called by 1: main calls 4: glen gcat sys_mmap gcatn
55	func wfile(path: u8, buf: u8, n: i64) -> i64 called by 1: main calls 3: sys_openat_wr sys_write sys_close
59	func fsize(path: *u8) -> i64 called by 1: main calls 2: sys_mmap sys_read_file
66	func main() -> i64 calls 14: w sys_mkdir sys_chdir sys_mmap wfile glen+8