code wiki / _hdl_build / nx_apistack_oidc_gate.nx
`nx_apistack_oidc_gate.nx` source

1import "nx_gate_gn.nx"
2import "nx_gate_base.nx"
3// nx_apistack_oidc_gate.nx -- hermetic gate for CAP-API-OIDC. Proves JWT structure validation, a base64url
4// encode/decode round-trip, and claim extraction from a real (self-built) JWT payload. expect_exit: 0
5import "nx_syscalls.nx"
6import "nx_apistack_oidc.nx"
7
8func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw("  PASS " as *u8) } else { gw("  FAIL " as *u8) } gw(name); gw("
9" as *u8); return ok }
10func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
11func g_app(buf: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){buf[off+i]=s[i];i=i+1} return off+i }
12func g_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
13
14func main(argc: i64, argv: *i64) -> i64 {
15    gp("=== nx_apistack_oidc_gate (JWT parse + base64url + claim extract) ===\n" as *u8)
16    var pass: i64 = 0; var fail: i64 = 0
17
18    // T1/T2 structure
19    if oidc_valid_structure("h.p.s" as *u8, 5) == 1 { pass=pass+1; gp("  T1 3-part JWT -> valid structure PASS\n" as *u8) } else { fail=fail+1; gp("  T1 FAIL\n" as *u8) }
20    if oidc_valid_structure("h.p" as *u8, 3) == 0 { pass=pass+1; gp("  T2 2-part -> invalid structure PASS\n" as *u8) } else { fail=fail+1; gp("  T2 FAIL\n" as *u8) }
21
22    // T3 base64url encode/decode round-trip
23    let enc: *u8 = sys_mmap(256); let en: i64 = oidc_b64url_encode("hello" as *u8, 5, enc)
24    let dec: *u8 = sys_mmap(256); let dn: i64 = oidc_b64url_decode(enc, en, dec)
25    if dn == 5 { if g_eq(dec, "hello" as *u8, 5) == 1 { pass=pass+1; gp("  T3 b64url encode->decode round-trip PASS\n" as *u8) } else { fail=fail+1; gp("  T3 FAIL content\n" as *u8) } } else { fail=fail+1; gp("  T3 FAIL len=" as *u8); gn(dn); gp("\n" as *u8) }
26
27    // build a JWT with payload {"sub":"ops","level":"3"}
28    let pl: *u8 = "{\"sub\":\"ops\",\"level\":\"3\"}" as *u8; let pln: i64 = g_slen(pl)
29    let penc: *u8 = sys_mmap(512); let pen: i64 = oidc_b64url_encode(pl, pln, penc)
30    let jwt: *u8 = sys_mmap(1024); var jn: i64 = g_app(jwt, 0, "aGVhZGVy." as *u8)
31    var i: i64 = 0; while i < pen { jwt[jn] = penc[i]; jn = jn + 1; i = i + 1 }
32    jn = g_app(jwt, jn, ".c2ln" as *u8)
33
34    // T4 extract sub
35    let o1: *u8 = sys_mmap(128); let n1: i64 = oidc_extract_claim(jwt, jn, "sub" as *u8, 3, o1, 128)
36    gp("  claim sub='" as *u8); sys_write(1, o1, n1); gp("'\n" as *u8)
37    if g_eq(o1, "ops" as *u8, 3) == 1 { if n1 == 3 { pass=pass+1; gp("  T4 extract claim sub -> 'ops' PASS\n" as *u8) } else { fail=fail+1; gp("  T4 FAIL len\n" as *u8) } } else { fail=fail+1; gp("  T4 FAIL\n" as *u8) }
38
39    // T5 extract level
40    let o2: *u8 = sys_mmap(128); let n2: i64 = oidc_extract_claim(jwt, jn, "level" as *u8, 5, o2, 128)
41    if g_eq(o2, "3" as *u8, 1) == 1 { if n2 == 1 { pass=pass+1; gp("  T5 extract claim level -> '3' PASS\n" as *u8) } else { fail=fail+1; gp("  T5 FAIL len\n" as *u8) } } else { fail=fail+1; gp("  T5 FAIL\n" as *u8) }
42
43    gp("RESULT pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail)
44    if fail == 0 { gp(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 }
45    gp(" verdict=RED\n" as *u8); sys_exit(1); return 1
46}
nx_apistack_oidc_gate.nx source

`nx_apistack_oidc_gate.nx` source
