nx_api_gateway_gate.nx source

1// nx_api_gateway_gate.nx -- GATE: the S-class-exceed remote API gateway (NAS ecosystem from ANY network). 2// T1 DEFAULT-DENY -- no/blank token -> 401 (nothing is reachable without auth). 3// T2 AUTHORIZED -- valid token + an exposed endpoint -> 200 (dispatch). 4// T3 ALLOW-LIST -- valid token + an INTERNAL path (id 100) -> 404 (internals never reachable remotely). 5// T4 FORGE-RESIST -- a tampered token -> 401 (you cannot forge access). (liar-kill) 6// T5 RATE-LIMIT -- too many requests -> 429. 7// T6 ANY-NETWORK -- the SAME valid token works regardless of origin (auth-gated, not IP-gated) + deterministic. 8// GREEN iff all. Sovereign nx_cc->nxasm. Deploys behind *.nishifamily.com TLS on the sites-daemon. expect_exit: 0 license_tier: ORIGINAL 9import "nx_api_gateway.nx" 10import "nx_syscalls.nx" 11 12func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 13func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 14 15func main() -> i64 { 16 w("=== nx_api_gateway_gate: S-class remote API to the NAS ecosystem from ANY network ===\n" as *u8) 17 var pass: i64 = 0; var total: i64 = 0 18 19 let user: i64 = 4242 20 let tok: i64 = api_token_for(user) // the OPAQUE-login-issued bearer token 21 22 // T1 default-deny 23 let s1: i64 = api_handle(user, 0, 0, 1, 100) 24 total=total+1; if s1==401 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 25 w("T1 default-deny: no token -> " as *u8); wn(s1); w(" (401)\n" as *u8) 26 27 // T2 authorized dispatch (e.g. /api/research/fetch = id 0) 28 let s2: i64 = api_handle(user, tok, 0, 1, 100) 29 total=total+1; if s2==200 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 30 w("T2 authorized: valid token + /api/research/fetch -> " as *u8); wn(s2); w(" (200 dispatch)\n" as *u8) 31 32 // T3 allow-list: internal path id 100 33 let s3: i64 = api_handle(user, tok, 100, 1, 100) 34 total=total+1; if s3==404 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 35 w("T3 allow-list: internal path -> " as *u8); wn(s3); w(" (404, internals never exposed)\n" as *u8) 36 37 // T4 forge-resistance 38 let s4: i64 = api_handle(user, tok + 1, 0, 1, 100) 39 total=total+1; if s4==401 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 40 w("T4 forge-resist: tampered token -> " as *u8); wn(s4); w(" (401, cannot forge)\n" as *u8) 41 42 // T5 rate-limit 43 let s5: i64 = api_handle(user, tok, 0, 200, 100) 44 total=total+1; if s5==429 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 45 w("T5 rate-limit: 200 reqs > 100 cap -> " as *u8); wn(s5); w(" (429)\n" as *u8) 46 47 // T6 any-network + deterministic: the same token authorizes regardless of where it came from 48 let s6a: i64 = api_handle(user, tok, 1, 1, 100) // /api/research/query 49 let s6b: i64 = api_handle(user, tok, 1, 1, 100) 50 total=total+1; if s6a==200 { if s6b==200 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } } else { w(" [FAIL] " as *u8) } 51 w("T6 any-network: auth-gated (not IP) -> same token works anywhere, deterministic (" as *u8); wn(s6a); w(")\n" as *u8) 52 53 w("\n=== nx_api_gateway_gate " as *u8); wn(pass); w("/" as *u8); wn(total) 54 if pass == total { w(" GREEN (S-class API gateway: default-deny auth, allow-list, rate-limit, forge-resistant, any-network; deploy behind nishifamily.com TLS)\n" as *u8); sys_exit(0); return 0 } 55 w(" RED\n" as *u8); sys_exit(1); return 1 56}