nx_audit_server_main.nx source

1// nx_audit_server_main.nx -- live phase-2 dashboard server. 2// 3// Composes the full phase-2 chain end-to-end (per 4// NISHI_AUDIT_DASHBOARD_ROADMAP.md): 5// 6// nx_http_server -- bind/listen/accept on 127.0.0.1:8472 7// nx_pages_static -- file-backed route handler 8// nx_path_canonicalize -- CWE-22 prevention at URL boundary 9// 10// Serves docs/audit/index.html under URL path /audit/index.html 11// (plus snapshot.json under /audit/snapshot.json). Accepts ONE 12// request then exits -- this is a deterministic bench probe, not 13// a daemon. For daemon mode, caller wraps in a loop + supervisor 14// (nx_supervisor.nx queued). 15// 16// Usage from bench/nx_pages_static_loopback.sh: 17// 18// ./nx_audit_server & 19// curl http://127.0.0.1:8472/audit/index.html | diff - docs/audit/index.html 20// wait 21// 22// expect_exit: 0 23 24import "nx_syscalls_x86_64.nx" 25import "nx_http_server.nx" 26import "nx_pages_static.nx" 27 28const NX_AUDIT_PORT: i64 = 51847 29const NX_AUDIT_REQ_CAP: i64 = 8192 30const NX_AUDIT_RESP_CAP: i64 = 524288 // 512 KB (dashboard HTML ~13 KB) 31 32func main() -> i64 { 33 // Build sockaddr_in for 127.0.0.1:8472. 34 let addr: *u8 = sys_mmap(16) 35 let a_rc: i64 = nx_http_server_addr_loopback(addr, NX_AUDIT_PORT) 36 if a_rc != 16 { return 10 } 37 38 // Bind + listen. 39 let lv: *i64 = sys_mmap(8) as *i64 40 let lfd: i64 = nx_http_server_listen(addr, 4, lv) 41 if lfd < 0 { return 20 + lv[0] } 42 43 // Accept ONE connection. 44 let av: *i64 = sys_mmap(8) as *i64 45 let cfd: i64 = nx_http_server_accept_one(lfd, av) 46 if cfd < 0 { return 40 + av[0] } 47 48 // Read request. 49 let req_buf: *u8 = sys_mmap(NX_AUDIT_REQ_CAP) 50 let om: *i64 = sys_mmap(8) as *i64 51 let opo: *i64 = sys_mmap(8) as *i64 52 let opl: *i64 = sys_mmap(8) as *i64 53 let ocl: *i64 = sys_mmap(8) as *i64 54 let obo: *i64 = sys_mmap(8) as *i64 55 let orn: *i64 = sys_mmap(8) as *i64 56 let rrc: i64 = nx_http_server_read_request(cfd, req_buf, NX_AUDIT_REQ_CAP, 57 om, opo, opl, ocl, obo, orn) 58 if rrc != NXS_OK { return 60 } 59 60 // Compute pointer to path bytes within req_buf. 61 let path_ptr: *u8 = ((req_buf as i64) + opo[0]) as *u8 62 let path_n: i64 = opl[0] 63 64 // Serve from caller-relative docs/ (so URL /audit/index.html 65 // resolves to docs/audit/index.html on disk). The bench runs 66 // from the nxc2 root. 67 let base: *u8 = "docs" as *u8 68 let base_n: i64 = 4 69 70 let resp_buf: *u8 = sys_mmap(NX_AUDIT_RESP_CAP) 71 let resp_n: *i64 = sys_mmap(8) as *i64 72 let sv: i64 = nx_pages_serve_file(path_ptr, path_n, 73 base, base_n, 74 om[0], 75 resp_buf, NX_AUDIT_RESP_CAP, resp_n) 76 // sv is a serve-verdict: OK / NOT_FOUND / FORBIDDEN / METHOD_NOT_ALLOWED. 77 // The response was emitted to resp_buf regardless -- we just 78 // need to write it back to the client. 79 80 let wv: i64 = nx_http_server_send_response(cfd, resp_buf, resp_n[0]) 81 if wv != NXS_OK { return 70 } 82 83 sys_close(lfd) 84 return 0 85}