code wiki / _hdl_build / nx_apistack_svctoken_gate.nx
`nx_apistack_svctoken_gate.nx` source

1import "nx_gate_gn.nx"
2import "nx_gate_base.nx"
3// nx_apistack_svctoken_gate.nx -- hermetic gate for CAP-API-SVCTOKEN. Proves a presented token resolves to its
4// service+level via the HASHED store, unknown tokens are denied, and the store holds only the hash (not the token).
5// expect_exit: 0
6import "nx_syscalls.nx"
7import "nx_apistack_svctoken.nx"
8
9func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw("  PASS " as *u8) } else { gw("  FAIL " as *u8) } gw(name); gw("
10" as *u8); return ok }
11func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
12func g_app(buf: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){buf[off+i]=s[i];i=i+1} return off+i }
13func g_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
14func g_contains(hay: *u8, hlen: i64, needle: *u8) -> i64 { let nl: i64=g_slen(needle); var i: i64=0; while i+nl<=hlen { var j: i64=0; var m: i64=1; while j<nl { if hay[i+j]!=needle[j] { m=0; j=nl } else { j=j+1 } } if m==1 { return 1 } i=i+1 } return 0 }
15
16func main(argc: i64, argv: *i64) -> i64 {
17    gp("=== nx_apistack_svctoken_gate (scoped hashed service tokens) ===\n" as *u8)
18    let C: *u8 = "/tmp/svctokens.conf" as *u8
19    let tok: *u8 = "deploy-bot-secret-abc123" as *u8; let tokn: i64 = g_slen(tok)
20    // build the store row: HASH(token) TAB deploy-bot TAB 3
21    let th: *u8 = sys_mmap(24); st_hex16(st_fnv(tok, tokn), th)
22    let sf: *u8 = sys_mmap(256); var sn: i64 = 0
23    var i: i64 = 0; while i < 16 { sf[sn] = th[i]; sn = sn + 1; i = i + 1 }
24    sf[sn] = 9 as u8; sn = sn + 1; sn = g_app(sf, sn, "deploy-bot" as *u8); sf[sn] = 9 as u8; sn = sn + 1; sf[sn] = 51 as u8; sn = sn + 1; sf[sn] = 10 as u8; sn = sn + 1
25    let fd: i64 = sys_openat_wr(C, 0x1a4); if fd >= 0 { sys_write(fd, sf, sn); sys_close(fd) }
26    var pass: i64 = 0; var fail: i64 = 0
27
28    // T1 valid token -> service + level
29    let svc: *u8 = sys_mmap(64); let lvl: *i64 = sys_mmap(8) as *i64
30    if st_resolve(C, tok, tokn, svc, 64, lvl) == 1 { if g_eq(svc, "deploy-bot" as *u8, 10) == 1 { if lvl[0] == 3 { pass=pass+1; gp("  T1 token -> deploy-bot / level 3 PASS\n" as *u8) } else { fail=fail+1; gp("  T1 FAIL level\n" as *u8) } } else { fail=fail+1; gp("  T1 FAIL service\n" as *u8) } } else { fail=fail+1; gp("  T1 FAIL not resolved\n" as *u8) }
31
32    // T2 unknown token -> denied
33    let svc2: *u8 = sys_mmap(64); let lvl2: *i64 = sys_mmap(8) as *i64
34    if st_resolve(C, "wrong-token" as *u8, 11, svc2, 64, lvl2) == 0 { if lvl2[0] == 0 { pass=pass+1; gp("  T2 unknown token -> denied (level 0) PASS\n" as *u8) } else { fail=fail+1; gp("  T2 FAIL level\n" as *u8) } } else { fail=fail+1; gp("  T2 FAIL resolved\n" as *u8) }
35
36    // T3 store holds only the HASH, not the plaintext token
37    if g_contains(sf, sn, "deploy-bot-secret" as *u8) == 0 { pass=pass+1; gp("  T3 store holds hash NOT the token (leak-safe) PASS\n" as *u8) } else { fail=fail+1; gp("  T3 FAIL plaintext token in store\n" as *u8) }
38
39    gp("RESULT pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail)
40    if fail == 0 { gp(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 }
41    gp(" verdict=RED\n" as *u8); sys_exit(1); return 1
42}
nx_apistack_svctoken_gate.nx source

`nx_apistack_svctoken_gate.nx` source
