code wiki / _hdl_build / nx_adnet_apply_gate.nx
nx_adnet_apply_gate.nx source
↩ module page · 136 lines · 9526 B
1// nx_adnet_apply_gate.nx -- GATE for the public advertiser intake page (nx_adnet_apply).
2// A public page is a PROMISE, so the teeth check that the promise matches the machine:
3// * THE SPEC ON THE PAGE MUST MATCH THE VALIDATOR. 728x90 and the 64KB ceiling are what
4// nx_adnet_creative actually enforces. A spec page that drifts from its validator produces a support
5// queue full of rejected uploads and an advertiser who thinks we moved the goalposts.
6// * THE VIEWABLE CLAIM MUST BE STATED, because it is the one thing that makes the invoice defensible.
7// * STAGED-NEVER-LIVE MUST BE SAID OUT LOUD in the acknowledgement -- an ack that implies the ad is
8// running is a lie the operator has to walk back.
9// * NO VISITOR FIELD. The form must collect a BUSINESS contact and nothing that could be a visitor
10// record; this is a paired control (business fields present AND tracking fields absent) so the tooth
11// is proven able to fail.
12// expect_exit: 0 license_tier: ORIGINAL
13import "nx_syscalls.nx"
14import "_hdl_build/nx_adnet_apply.nx"
15import "nx_gate_verdict.nx"
16
17func ta_slen(s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { i = i + 1 } return i }
18func ta_puts(s: *u8) -> i64 { sys_write(1, s, ta_slen(s)); return 0 }
19func ta_pn(v: i64) -> i64 {
20 let b: *u8 = sys_mmap(32)
21 if v == 0 { b[0] = 48 as u8; sys_write(1, b, 1); return 0 }
22 var n: i64 = 0
23 var x: i64 = v
24 while x > 0 { b[n] = ((x - (x / 10) * 10) + 48) as u8; n = n + 1; x = x / 10 }
25 let r: *u8 = sys_mmap(32)
26 var i: i64 = 0
27 while i < n { r[i] = b[n - 1 - i]; i = i + 1 }
28 sys_write(1, r, n)
29 return 0
30}
31func ta_has(buf: *u8, n: i64, pat: *u8) -> i64 {
32 let pl: i64 = ta_slen(pat)
33 if pl == 0 { return 0 }
34 if pl > n { return 0 }
35 var i: i64 = 0
36 while i <= n - pl {
37 var k: i64 = 0
38 var ok: i64 = 1
39 while k < pl { if buf[i + k] != pat[k] { ok = 0; break } k = k + 1 }
40 if ok == 1 { return 1 }
41 i = i + 1
42 }
43 return 0
44}
45func ta_check(name: *u8, cond: i64) -> i64 {
46 if cond == 1 { ta_puts(" PASS " as *u8) } else { ta_puts(" FAIL " as *u8) }
47 ta_puts(name); ta_puts("\n" as *u8)
48 return cond
49}
50
51func main() -> i64 {
52 ta_puts("=== nx_adnet_apply_gate ===\n" as *u8)
53 var pass: i64 = 0
54 var total: i64 = 0
55 let buf: *u8 = sys_mmap(8192)
56
57 let n: i64 = aap_page(buf, 8192)
58 pass = pass + ta_check("page emitted" as *u8, n > 0); total = total + 1
59
60 // ---- the spec on the page must match what nx_adnet_creative enforces ----
61 pass = pass + ta_check("spec states 728 width (matches validator)" as *u8, ta_has(buf, n, "728" as *u8)); total = total + 1
62 pass = pass + ta_check("spec states 90 height (matches validator)" as *u8, ta_has(buf, n, "90" as *u8)); total = total + 1
63 pass = pass + ta_check("spec states the 64KB ceiling (matches validator)" as *u8, ta_has(buf, n, "64KB" as *u8)); total = total + 1
64 pass = pass + ta_check("spec says PNG" as *u8, ta_has(buf, n, "PNG" as *u8)); total = total + 1
65
66 // ---- the claims that make the invoice defensible ----
67 pass = pass + ta_check("states billing is on VIEWABLE not served" as *u8, ta_has(buf, n, "viewable impressions, not served" as *u8)); total = total + 1
68 pass = pass + ta_check("states the MRC threshold (50% for one continuous second)" as *u8, ta_has(buf, n, "one continuous second" as *u8)); total = total + 1
69 pass = pass + ta_check("promises the delivery ratio is shown" as *u8, ta_has(buf, n, "served and viewable side by side" as *u8)); total = total + 1
70 pass = pass + ta_check("states budget stops SERVING not just billing" as *u8, ta_has(buf, n, "stops being shown" as *u8)); total = total + 1
71
72 // ---- PAIRED PRIVACY CONTROL: business fields present AND tracking fields absent ----
73 pass = pass + ta_check("privacy control positive: business contact field IS present" as *u8, ta_has(buf, n, "name=email" as *u8)); total = total + 1
74 pass = pass + ta_check("privacy control positive: company field IS present" as *u8, ta_has(buf, n, "name=company" as *u8)); total = total + 1
75 pass = pass + ta_check("no cookie field anywhere on the form" as *u8, ta_has(buf, n, "name=cookie" as *u8) == 0); total = total + 1
76 pass = pass + ta_check("no visitor field anywhere on the form" as *u8, ta_has(buf, n, "name=visitor" as *u8) == 0); total = total + 1
77 pass = pass + ta_check("states the no-tracking stance publicly" as *u8, ta_has(buf, n, "no cross-site tracking" as *u8)); total = total + 1
78
79 // ---- the form must actually point somewhere ----
80 pass = pass + ta_check("form posts to /advertise/apply" as *u8, ta_has(buf, n, "action=\"/advertise/apply\"" as *u8)); total = total + 1
81 pass = pass + ta_check("form method is post" as *u8, ta_has(buf, n, "method=post" as *u8)); total = total + 1
82
83 // ---- the acknowledgement must not imply the ad is live ----
84 let a: i64 = aap_ack(buf, 8192)
85 pass = pass + ta_check("ack emitted" as *u8, a > 0); total = total + 1
86 pass = pass + ta_check("ack says STAGED FOR REVIEW" as *u8, ta_has(buf, a, "staged for review" as *u8)); total = total + 1
87 pass = pass + ta_check("ack says nothing goes live automatically" as *u8, ta_has(buf, a, "Nothing goes live automatically" as *u8)); total = total + 1
88
89 // ---- APPLICATION ROW: an application is not an inventory row ----
90 let rb: *u8 = sys_mmap(2048)
91 let rn: i64 = aap_row("Acme Widgets" as *u8, "ops@acme.example" as *u8, "https://acme.example/" as *u8, "q3 campaign" as *u8, 1785518618, rb, 2048)
92 pass = pass + ta_check("application row emitted" as *u8, rn > 0); total = total + 1
93 pass = pass + ta_check("row carries company" as *u8, ta_has(rb, rn, "Acme Widgets" as *u8)); total = total + 1
94 pass = pass + ta_check("row carries contact email" as *u8, ta_has(rb, rn, "ops@acme.example" as *u8)); total = total + 1
95 pass = pass + ta_check("row carries received_at (passed in, not clock-read)" as *u8, ta_has(rb, rn, "1785518618" as *u8)); total = total + 1
96 pass = pass + ta_check("empty company -> REFUSED" as *u8, aap_row("" as *u8, "a@b.c" as *u8, "https://x/" as *u8, "" as *u8, 1, rb, 2048) == 0); total = total + 1
97 pass = pass + ta_check("empty email -> REFUSED" as *u8, aap_row("Acme" as *u8, "" as *u8, "https://x/" as *u8, "" as *u8, 1, rb, 2048) == 0); total = total + 1
98 let inj: i64 = aap_row("Acme Evil
99fake" as *u8, "a@b.c" as *u8, "https://x/" as *u8, "" as *u8, 1, rb, 2048)
100 pass = pass + ta_check("TAB/newline injection stripped (cannot forge a second row)" as *u8, ta_has(rb, inj, "AcmeEvilfake" as *u8)); total = total + 1
101
102 // ---- FORM PARSING: boundary-matched, url-decoded, bounded ----
103 let fb: *u8 = sys_mmap(512)
104 let body: *u8 = "company=Acme+Widgets&email=ops%40acme.example&clickurl=https%3A%2F%2Facme.example%2F¬e=" as *u8
105 let bl: i64 = ta_slen(body)
106 aap_field(body, bl, "company" as *u8, fb, 512)
107 pass = pass + ta_check("form: plus decoded to space" as *u8, ta_has(fb, ta_slen(fb), "Acme Widgets" as *u8)); total = total + 1
108 aap_field(body, bl, "email" as *u8, fb, 512)
109 pass = pass + ta_check("form: %40 decoded to @" as *u8, ta_has(fb, ta_slen(fb), "ops@acme.example" as *u8)); total = total + 1
110 aap_field(body, bl, "clickurl" as *u8, fb, 512)
111 pass = pass + ta_check("form: %3A%2F%2F decoded to ://" as *u8, ta_has(fb, ta_slen(fb), "https://acme.example/" as *u8)); total = total + 1
112 pass = pass + ta_check("form: absent field -> 0" as *u8, aap_field(body, bl, "nosuch" as *u8, fb, 512) == 0); total = total + 1
113 let tricky: *u8 = "notemail=evil&email=real@x.y" as *u8
114 aap_field(tricky, ta_slen(tricky), "email" as *u8, fb, 512)
115 pass = pass + ta_check("form: BOUNDARY match, notemail does not satisfy email" as *u8, ta_has(fb, ta_slen(fb), "real@x.y" as *u8)); total = total + 1
116
117 // ---- ABUSE BOUNDS on a public unauthenticated route ----
118 pass = pass + ta_check("normal form body accepted" as *u8, aap_body_ok(200) == 1); total = total + 1
119 pass = pass + ta_check("empty body REFUSED" as *u8, aap_body_ok(0) == 0); total = total + 1
120 pass = pass + ta_check("oversize body REFUSED (memory exhaustion)" as *u8, aap_body_ok(1048576) == 0); total = total + 1
121 pass = pass + ta_check("body cap boundary is inclusive" as *u8, aap_body_ok(8192) == 1); total = total + 1
122 pass = pass + ta_check("one byte over the cap REFUSED" as *u8, aap_body_ok(8193) == 0); total = total + 1
123 pass = pass + ta_check("small journal accepts appends" as *u8, aap_journal_ok(1024) == 1); total = total + 1
124 pass = pass + ta_check("journal at ceiling REFUSES append (disk exhaustion)" as *u8, aap_journal_ok(4194304) == 0); total = total + 1
125 pass = pass + ta_check("unstattable journal does NOT block a real applicant" as *u8, aap_journal_ok(0 - 1) == 1); total = total + 1
126
127 ta_puts("pass=" as *u8); ta_pn(pass); ta_puts(" fail=" as *u8); ta_pn(total - pass); ta_puts("\n" as *u8)
128 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check
129 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled
130 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify.
131 let ctr__dry: *i64 = gv_ctr()
132 ctr__dry[0] = pass
133 ctr__dry[1] = total
134 let rc__dry: i64 = gv_verdict("ADNET-APPLY-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8)
135 sys_exit(rc__dry)
136 return rc__dry
137}