nx_authz_gate.nx source

1// nx_authz_gate.nx -- proves per-realm PERMISSION LEVELS (nx_authz): not all authenticated users share the same 2// access. Two realms with their OWN policy + user tables: 3// nishifamily: /pub/ (lvl0) < /family/ (lvl1) < /private/ incl NSFW (lvl2); users alice=0, bob=1, carol=2 4// andelinwest: /portal/ (lvl1 client) < /staff/ (lvl2 lawyer); users clientX=1, lawyerY=2 5// Proves: NSFW/private is NOT served to public/family users; andelinwest lawyers and clients are on different 6// levels; policies are REALM-SCOPED (a nishifamily level grants nothing on an andelinwest-style path); deny-by- 7// default; and handle->level resolution (unknown handle -> -1 -> caller denies). license_tier: ORIGINAL 8import "nx_authz.nx" 9import "nx_syscalls.nx" 10 11func az_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 12func az_slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 13func az_row(id: i64, ok: i64, what: *u8) -> i64 { az_w("AZROW " as *u8); let b: *u8=sys_mmap(8); b[0]=(48+id) as u8; sys_write(1,b,1); az_w(" " as *u8); if ok==1 { az_w("PASS " as *u8) } else { az_w("FAIL " as *u8) } az_w(what); az_w("\n" as *u8); return ok } 14// convenience: allow check with the req length computed from the string 15func az_allow(level: i64, paths: *i64, lens: *i64, lvl: *i64, n: i64, req: *u8) -> i64 { 16 return authz_level_allow(level, paths, lens, lvl, n, req, az_slen(req)) 17} 18 19func main() -> i64 { 20 az_w("authz gate: per-realm permission LEVELS over OPAQUE (nsfw/private + lawyer/client separation)\n" as *u8) 21 22 // ---- nishifamily realm policy + users ---- 23 let nfp: *i64 = sys_mmap(8*8) as *i64 24 let nfl: *i64 = sys_mmap(8*8) as *i64 25 let nfv: *i64 = sys_mmap(8*8) as *i64 26 nfp[0]="/pub/" as *u8 as i64; nfl[0]=az_slen("/pub/" as *u8); nfv[0]=0 27 nfp[1]="/family/" as *u8 as i64; nfl[1]=az_slen("/family/" as *u8); nfv[1]=1 28 nfp[2]="/private/" as *u8 as i64; nfl[2]=az_slen("/private/" as *u8); nfv[2]=2 29 let nfn: i64 = 3 30 let uh: *i64 = sys_mmap(8*8) as *i64 31 let uhl: *i64 = sys_mmap(8*8) as *i64 32 let ul: *i64 = sys_mmap(8*8) as *i64 33 uh[0]="alice" as *u8 as i64; uhl[0]=az_slen("alice" as *u8); ul[0]=0 34 uh[1]="bob" as *u8 as i64; uhl[1]=az_slen("bob" as *u8); ul[1]=1 35 uh[2]="carol" as *u8 as i64; uhl[2]=az_slen("carol" as *u8); ul[2]=2 36 let un: i64 = 3 37 38 // ---- andelinwest realm policy + users (SEPARATE tables = realm-scoped) ---- 39 let awp: *i64 = sys_mmap(8*8) as *i64 40 let awl: *i64 = sys_mmap(8*8) as *i64 41 let awv: *i64 = sys_mmap(8*8) as *i64 42 awp[0]="/portal/" as *u8 as i64; awl[0]=az_slen("/portal/" as *u8); awv[0]=1 43 awp[1]="/staff/" as *u8 as i64; awl[1]=az_slen("/staff/" as *u8); awv[1]=2 44 let awn: i64 = 2 45 46 var rows: i64 = 0 47 var pass: i64 = 0 48 var ok: i64 = 0 49 50 // R0: carol (private, lvl2) CAN see nsfw/private 51 ok = 0; if az_allow(2, nfp, nfl, nfv, nfn, "/private/nsfw.jpg" as *u8)==AUTHZ_ALLOW { ok=1 } 52 rows=rows+1; pass=pass+az_row(0, ok, "nishifamily: private-level user CAN see /private/nsfw" as *u8) 53 54 // R1: bob (family, lvl1) CANNOT see nsfw/private -- the "not shared by all" property 55 ok = 0; if az_allow(1, nfp, nfl, nfv, nfn, "/private/nsfw.jpg" as *u8)==AUTHZ_DENY { if az_allow(0, nfp, nfl, nfv, nfn, "/private/nsfw.jpg" as *u8)==AUTHZ_DENY { ok=1 } } 56 rows=rows+1; pass=pass+az_row(1, ok, "nishifamily: family + public users DENIED /private/nsfw (not shared by all)" as *u8) 57 58 // R2: family content -- bob (lvl1) yes, alice (lvl0) no 59 ok = 0; if az_allow(1, nfp, nfl, nfv, nfn, "/family/reunion.jpg" as *u8)==AUTHZ_ALLOW { if az_allow(0, nfp, nfl, nfv, nfn, "/family/reunion.jpg" as *u8)==AUTHZ_DENY { ok=1 } } 60 rows=rows+1; pass=pass+az_row(2, ok, "nishifamily: /family content -> family yes, public no" as *u8) 61 62 // R3: public content -- everyone (lvl0) yes 63 ok = 0; if az_allow(0, nfp, nfl, nfv, nfn, "/pub/blog" as *u8)==AUTHZ_ALLOW { ok=1 } 64 rows=rows+1; pass=pass+az_row(3, ok, "nishifamily: /pub content -> public yes (everyone)" as *u8) 65 66 // R4: andelinwest -- lawyer (lvl2) sees /staff, client (lvl1) does NOT 67 ok = 0; if az_allow(1, awp, awl, awv, awn, "/staff/casefiles" as *u8)==AUTHZ_DENY { if az_allow(2, awp, awl, awv, awn, "/staff/casefiles" as *u8)==AUTHZ_ALLOW { ok=1 } } 68 rows=rows+1; pass=pass+az_row(4, ok, "andelinwest: /staff -> lawyer yes, client DENIED (different levels)" as *u8) 69 70 // R5: andelinwest -- client (lvl1) sees /portal 71 ok = 0; if az_allow(1, awp, awl, awv, awn, "/portal/mycase" as *u8)==AUTHZ_ALLOW { ok=1 } 72 rows=rows+1; pass=pass+az_row(5, ok, "andelinwest: /portal -> client yes" as *u8) 73 74 // R6: REALM-SCOPED + deny-default -- a nishifamily lvl2 user gets NOTHING on an andelinwest-style path via the 75 // nishifamily policy, and an unlisted path is denied 76 ok = 0; if az_allow(2, nfp, nfl, nfv, nfn, "/staff/casefiles" as *u8)==AUTHZ_DENY { if az_allow(2, nfp, nfl, nfv, nfn, "/random/thing" as *u8)==AUTHZ_DENY { ok=1 } } 77 rows=rows+1; pass=pass+az_row(6, ok, "realm-scoped + deny-by-default: nishifamily lvl2 grants nothing on /staff or unlisted paths" as *u8) 78 79 // R7: handle->level resolution (unknown handle -> -1 -> caller denies) 80 ok = 0; if authz_level_of("carol" as *u8, az_slen("carol" as *u8), uh, uhl, ul, un)==2 { if authz_level_of("ghost" as *u8, az_slen("ghost" as *u8), uh, uhl, ul, un)==(0-1) { ok=1 } } 81 rows=rows+1; pass=pass+az_row(7, ok, "handle->level resolves (carol=2); unknown handle -> -1 (caller denies)" as *u8) 82 83 az_w("NX-AUTHZ-GATE rows=" as *u8); let rb: *u8=sys_mmap(8); rb[0]=(48+rows) as u8; sys_write(1,rb,1); az_w(" pass=" as *u8); let pb: *u8=sys_mmap(8); pb[0]=(48+pass) as u8; sys_write(1,pb,1); az_w("\n" as *u8) 84 if pass == rows { 85 let line: *u8 = "CMSGATE row=nx_authz per-realm-permission-levels rows=8 pass=8 verdict=PASS\n" as *u8 86 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 87 if gf >= 0 { sys_write(gf, line, az_slen(line)); sys_close(gf) } 88 az_w("NX-AUTHZ-GATE GREEN 8/8 (permission levels: nsfw/private not shared by all; lawyer/client separated; realm-scoped)\n" as *u8) 89 sys_exit(0); return 0 90 } 91 az_w("NX-AUTHZ-GATE RED\n" as *u8) 92 sys_exit(1); return 1 93}