nx_adnet_view_gate.nx source

1// nx_adnet_view_gate.nx -- GATE for nx_adnet_view (MRC viewable-impression measurement). 2// Proves, by independent re-derivation rather than by calling the code under test to describe itself: 3// (1) the emitted observer carries BOTH MRC thresholds, sourced from the consts (script/const drift = RED) 4// (2) the second is CONTINUOUS, not cumulative -- the timer is cancelled when the creative leaves view 5// (3) it fires AT MOST ONCE per page (disconnect + latch), so a scroll-by cannot inflate the count 6// (4) FAIL-CLOSED: a malformed id journals NOTHING while still answering 204 (no id oracle) 7// (5) PRIVACY BY CONSTRUCTION: the beacon carries no cookie/visitor/referrer token -- a PAIRED control, 8// asserting a known-present token present AND a known-absent token absent, so the gate is proven 9// able to fail rather than trivially green. 10// expect_exit: 0 license_tier: ORIGINAL 11import "nx_syscalls.nx" 12import "_hdl_build/nx_adnet_view.nx" 13import "nx_gate_verdict.nx" 14 15func tv_slen(s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { i = i + 1 } return i } 16func tv_puts(s: *u8) -> i64 { sys_write(1, s, tv_slen(s)); return 0 } 17func tv_pn(v: i64) -> i64 { 18 let b: *u8 = sys_mmap(32) 19 if v == 0 { b[0] = 48 as u8; sys_write(1, b, 1); return 0 } 20 var n: i64 = 0 21 var x: i64 = v 22 while x > 0 { b[n] = ((x - (x / 10) * 10) + 48) as u8; n = n + 1; x = x / 10 } 23 let r: *u8 = sys_mmap(32) 24 var i: i64 = 0 25 while i < n { r[i] = b[n - 1 - i]; i = i + 1 } 26 sys_write(1, r, n) 27 return 0 28} 29func tv_has(buf: *u8, n: i64, pat: *u8) -> i64 { 30 let pl: i64 = tv_slen(pat) 31 if pl == 0 { return 0 } 32 if pl > n { return 0 } 33 var i: i64 = 0 34 while i <= n - pl { 35 var k: i64 = 0 36 var ok: i64 = 1 37 while k < pl { if buf[i + k] != pat[k] { ok = 0; break } k = k + 1 } 38 if ok == 1 { return 1 } 39 i = i + 1 40 } 41 return 0 42} 43func tv_check(name: *u8, cond: i64) -> i64 { 44 if cond == 1 { tv_puts(" PASS " as *u8) } else { tv_puts(" FAIL " as *u8) } 45 tv_puts(name); tv_puts("\n" as *u8) 46 return cond 47} 48 49func main() -> i64 { 50 tv_puts("=== nx_adnet_view_gate ===\n" as *u8) 51 var pass: i64 = 0 52 var total: i64 = 0 53 let buf: *u8 = sys_mmap(8192) 54 let idb: *u8 = sys_mmap(128) 55 56 // ---- the emitted observer ---- 57 let n1: i64 = aview_script(buf, 8192, "ha-video" as *u8) 58 pass = pass + tv_check("valid id -> script emitted" as *u8, n1 > 0); total = total + 1 59 pass = pass + tv_check("script carries the MRC ratio 50" as *u8, tv_has(buf, n1, "*100>=50" as *u8)); total = total + 1 60 pass = pass + tv_check("script carries the MRC dwell 1000ms" as *u8, tv_has(buf, n1, "},1000)" as *u8)); total = total + 1 61 pass = pass + tv_check("script targets the ad id" as *u8, tv_has(buf, n1, "/ad/view/ha-video" as *u8)); total = total + 1 62 pass = pass + tv_check("beacon is first-party sendBeacon" as *u8, tv_has(buf, n1, "navigator.sendBeacon" as *u8)); total = total + 1 63 pass = pass + tv_check("dwell is CONTINUOUS (timer cancelled on exit)" as *u8, tv_has(buf, n1, "clearTimeout" as *u8)); total = total + 1 64 pass = pass + tv_check("fires at most once (observer disconnects)" as *u8, tv_has(buf, n1, "o.disconnect()" as *u8)); total = total + 1 65 66 // ---- PAIRED PRIVACY CONTROL: a known-present token AND a known-absent token ---- 67 pass = pass + tv_check("privacy control positive: slot selector IS present" as *u8, tv_has(buf, n1, ".nx-ad-slot img" as *u8)); total = total + 1 68 pass = pass + tv_check("privacy: no cookie token in the beacon path" as *u8, tv_has(buf, n1, "cookie" as *u8) == 0); total = total + 1 69 pass = pass + tv_check("privacy: no referrer token in the beacon path" as *u8, tv_has(buf, n1, "referrer" as *u8) == 0); total = total + 1 70 71 // ---- fail-closed id handling ---- 72 let n2: i64 = aview_script(buf, 8192, "bad id!" as *u8) 73 pass = pass + tv_check("malformed id -> script REFUSED" as *u8, n2 == 0); total = total + 1 74 75 // ---- the beacon endpoint ---- 76 let r1: i64 = aview_resp("/ad/view/ha-video" as *u8, 17, buf, 8192, idb) 77 pass = pass + tv_check("valid beacon -> 204 emitted" as *u8, tv_has(buf, r1, "204 No Content" as *u8)); total = total + 1 78 pass = pass + tv_check("valid beacon -> id journalled" as *u8, tv_has(idb, tv_slen(idb), "ha-video" as *u8)); total = total + 1 79 let r2: i64 = aview_resp("/ad/view/bad id!" as *u8, 16, buf, 8192, idb) 80 pass = pass + tv_check("malformed beacon -> still 204 (no id oracle)" as *u8, tv_has(buf, r2, "204 No Content" as *u8)); total = total + 1 81 pass = pass + tv_check("malformed beacon -> NOTHING journalled" as *u8, idb[0] == (0 as u8)); total = total + 1 82 let r3: i64 = aview_resp("/code/pulse" as *u8, 11, buf, 8192, idb) 83 pass = pass + tv_check("non-beacon path -> not handled" as *u8, r3 == 0); total = total + 1 84 85 tv_puts("pass=" as *u8); tv_pn(pass); tv_puts(" fail=" as *u8); tv_pn(total - pass); tv_puts("\n" as *u8) 86 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 87 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 88 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 89 let ctr__dry: *i64 = gv_ctr() 90 ctr__dry[0] = pass 91 ctr__dry[1] = total 92 let rc__dry: i64 = gv_verdict("ADNET-VIEW-GATE" as *u8, ctr__dry, "teeth unchanged; verdict emission migrated onto the shared base class" as *u8) 93 sys_exit(rc__dry) 94 return rc__dry 95}