code wiki / _hdl_build / nx_audio_gate_proof_test.nx
nx_audio_gate_proof_test.nx source
↩ module page · 68 lines · 3369 B
1// nx_audio_gate_proof_test.nx -- prove the /audio protection DETERMINISTICALLY.
2// The opaque daemon's GET /audio serves the page iff olg_whoami(token)==NX_MAUTH_OK.
3// This gate runs that exact decision in-process: register -> login -> a VALID
4// session passes (would SERVE); an EMPTY or BOGUS token is rejected (would 401).
5// No daemon/network -> no flakiness. expect_exit: 0.
6
7import "nx_syscalls.nx"
8import "nx_opaque_login.nx" // olg_ctx_setup / olg_register / olg_login / olg_whoami + NxAuthContext + NX_MAUTH_OK
9
10func w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
11func wn(v: i64) -> i64 {
12 let b: *u8 = sys_mmap(28); var m: i64 = v
13 if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) }
14 let t: *u8 = sys_mmap(28); var k: i64 = 0
15 if m == 0 { t[0] = 48 as u8; k = 1 }
16 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
17 var i: i64 = 0; while i < k { b[i] = t[k - 1 - i]; i = i + 1 }
18 sys_write(1, b, k); return 0
19}
20func chk(cond: i64, pass: *i64, fail: *i64, label: *u8) -> i64 {
21 if cond == 1 { pass[0] = pass[0] + 1; w(" ok " as *u8); w(label); w("\n" as *u8) }
22 else { fail[0] = fail[0] + 1; w(" XX " as *u8); w(label); w("\n" as *u8) }
23 return 0
24}
25
26func main() -> i64 {
27 let pass: *i64 = (sys_mmap(8)) as *i64
28 let fail: *i64 = (sys_mmap(8)) as *i64
29 pass[0] = 0
30 fail[0] = 0
31 w("=== /audio gating proof (only allowed users; in-process) ===\n" as *u8)
32
33 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
34 if olg_ctx_setup(ctx, "/tmp/agp_keys" as *u8, "/tmp/agp_store" as *u8,
35 "nishi_site_admin" as *u8, 16, "Nishi site admin" as *u8, 16, 8, 3, 4) != 0 {
36 w("CTX-INIT-FAIL\n" as *u8); return 1
37 }
38
39 let mn: *u8 = sys_mmap(512); let mnn: *i64 = sys_mmap(16) as *i64
40 let rr: i64 = olg_register(ctx, "elder" as *u8, 5, "test-pass-1234" as *u8, 14, mn, 512, mnn)
41 chk(rr == NX_MAUTH_OK, pass, fail, "register a user" as *u8)
42
43 let tok: *u8 = sys_mmap(512); let tokn: *i64 = sys_mmap(16) as *i64
44 let lr: i64 = olg_login(ctx, "elder" as *u8, 5, "test-pass-1234" as *u8, 14, tok, 512, tokn)
45 chk(lr == NX_MAUTH_OK, pass, fail, "login -> session token" as *u8)
46 w(" token chars=" as *u8); wn(tokn[0]); w("\n" as *u8)
47
48 let now: i64 = sys_now_realtime_sec()
49 let uh: *u8 = sys_mmap(64); let uhn: *i64 = sys_mmap(16) as *i64
50
51 // THE EXACT DECISION GET /audio MAKES:
52 let dv: i64 = olg_whoami(ctx, tok, tokn[0], now, uh, 64, uhn)
53 chk(dv == NX_MAUTH_OK, pass, fail, "VALID session -> /audio SERVES" as *u8)
54
55 let de: i64 = olg_whoami(ctx, "" as *u8, 0, now, uh, 64, uhn)
56 chk(de != NX_MAUTH_OK, pass, fail, "NO token -> /audio DENIED (401)" as *u8)
57
58 let db: i64 = olg_whoami(ctx, "bogus-not-a-real-token" as *u8, 22, now, uh, 64, uhn)
59 chk(db != NX_MAUTH_OK, pass, fail, "BOGUS token -> /audio DENIED (401)" as *u8)
60
61 if tok[10] == (65 as u8) { tok[10] = 66 as u8 } else { tok[10] = 65 as u8 } // corrupt one base64 char (real tamper)
62 let dt: i64 = olg_whoami(ctx, tok, tokn[0], now, uh, 64, uhn)
63 chk(dt != NX_MAUTH_OK, pass, fail, "CORRUPTED token -> /audio DENIED (401)" as *u8)
64
65 w("=== VERDICT pass=" as *u8); wn(pass[0]); w(" fail=" as *u8); wn(fail[0]); w(" ===\n" as *u8)
66 if fail[0] == 0 { return 0 }
67 return 1
68}