nx_api_gateway_gate.nx source

1// nx_api_gateway_gate.nx -- GATE: the S-class-exceed remote API gateway (NAS ecosystem from ANY network). 2// T1 DEFAULT-DENY -- no/blank token -> 401 (nothing is reachable without auth). 3// T2 AUTHORIZED -- valid token + an exposed endpoint -> 200 (dispatch). 4// T3 ALLOW-LIST -- valid token + an INTERNAL path (id 100) -> 404 (internals never reachable remotely). 5// T4 FORGE-RESIST -- a tampered token -> 401 (you cannot forge access). (liar-kill) 6// T5 RATE-LIMIT -- too many requests -> 429. 7// T6 ANY-NETWORK -- the SAME valid token works regardless of origin (auth-gated, not IP-gated) + deterministic. 8// GREEN iff all. Sovereign nx_cc->nxasm. Deploys behind *.nishifamily.com TLS on the sites-daemon. expect_exit: 0 license_tier: ORIGINAL 9import "nx_api_gateway.nx" 10import "nx_syscalls.nx" 11import "nx_gate_verdict.nx" 12 13func w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 14func wn(v: i64) -> i64 { var m: i64=v; if m<0{w("-" as *u8);m=0-m} let t:*u8=sys_mmap(24); var k:i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i:i64=0; let o:*u8=sys_mmap(24); while i<k{o[i]=t[k-1-i];i=i+1} sys_write(1,o,k); return 0 } 15 16func main() -> i64 { 17 w("=== nx_api_gateway_gate: S-class remote API to the NAS ecosystem from ANY network ===\n" as *u8) 18 var pass: i64 = 0; var total: i64 = 0 19 20 let user: i64 = 4242 21 let tok: i64 = api_token_for(user) // the OPAQUE-login-issued bearer token 22 23 // T1 default-deny 24 let s1: i64 = api_handle(user, 0, 0, 1, 100) 25 total=total+1; if s1==401 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 26 w("T1 default-deny: no token -> " as *u8); wn(s1); w(" (401)\n" as *u8) 27 28 // T2 authorized dispatch (e.g. /api/research/fetch = id 0) 29 let s2: i64 = api_handle(user, tok, 0, 1, 100) 30 total=total+1; if s2==200 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 31 w("T2 authorized: valid token + /api/research/fetch -> " as *u8); wn(s2); w(" (200 dispatch)\n" as *u8) 32 33 // T3 allow-list: internal path id 100 34 let s3: i64 = api_handle(user, tok, 100, 1, 100) 35 total=total+1; if s3==404 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 36 w("T3 allow-list: internal path -> " as *u8); wn(s3); w(" (404, internals never exposed)\n" as *u8) 37 38 // T4 forge-resistance 39 let s4: i64 = api_handle(user, tok + 1, 0, 1, 100) 40 total=total+1; if s4==401 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 41 w("T4 forge-resist: tampered token -> " as *u8); wn(s4); w(" (401, cannot forge)\n" as *u8) 42 43 // T5 rate-limit 44 let s5: i64 = api_handle(user, tok, 0, 200, 100) 45 total=total+1; if s5==429 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } 46 w("T5 rate-limit: 200 reqs > 100 cap -> " as *u8); wn(s5); w(" (429)\n" as *u8) 47 48 // T6 any-network + deterministic: the same token authorizes regardless of where it came from 49 let s6a: i64 = api_handle(user, tok, 1, 1, 100) // /api/research/query 50 let s6b: i64 = api_handle(user, tok, 1, 1, 100) 51 total=total+1; if s6a==200 { if s6b==200 { pass=pass+1; w(" [PASS] " as *u8) } else { w(" [FAIL] " as *u8) } } else { w(" [FAIL] " as *u8) } 52 w("T6 any-network: auth-gated (not IP) -> same token works anywhere, deterministic (" as *u8); wn(s6a); w(")\n" as *u8) 53 54 w("\n=== nx_api_gateway_gate " as *u8); wn(pass); w("/" as *u8); wn(total) 55 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 56 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 57 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 58 let ctr__dry: *i64 = gv_ctr() 59 ctr__dry[0] = pass 60 ctr__dry[1] = total 61 let rc__dry: i64 = gv_verdict("API-GATEWAY-GATE" as *u8, ctr__dry, "S-class API gateway: default-deny auth, allow-list, rate-limit, forge-resistant, any-network; deploy behind nishifamily.com TLS)" as *u8) 62 sys_exit(rc__dry) 63 return rc__dry 64}