code wiki / _hdl_build / nx_brand_tokens_gate.nx
`nx_brand_tokens_gate.nx` source

1import "nx_gate_gn.nx"
2import "nx_gate_base.nx"
3// nx_brand_tokens_gate.nx -- the GATE for R1 design-token SSOT (nx_brand_tokens). PRESENCE + boundary-defense,
4// not an exceed claim. Drives bt_emit_root_buf over: default brand, re-theme override, and HOSTILE brands.
5// Negative controls prove injection + sovereignty rejection FIRES (a value with ;}{<> or script/src=/url( can
6// never reach the CSS). 100% sovereign (nx_cc->nxasm, no gcc/JS).  license_tier: ORIGINAL  expect_exit: 0
7import "nx_syscalls.nx"
8import "nx_brand_tokens.nx"
9
10func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw("  PASS " as *u8) } else { gw("  FAIL " as *u8) } gw(name); gw("
11" as *u8); return ok }
12
13// out contains lit?
14func g_has(s: *u8, n: i64, lit: *u8) -> i64 { if bt_find(s, n, lit, bt_len(lit)) >= 0 { return 1 } return 0 }
15// count occurrences of a byte
16func g_count(s: *u8, n: i64, ch: i64) -> i64 { var c: i64=0; var i: i64=0; while i<n { if s[i]==(ch as u8){c=c+1} i=i+1 } return c }
17// byte-equal length-n
18func g_eq(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
19
20func t_row(name: *u8, ok: i64, tot: *i64) -> i64 {
21    if ok == 1 { gw("  PASS  " as *u8); tot[0]=tot[0]+1 } else { gw("  FAIL  " as *u8); tot[1]=tot[1]+1 }
22    gw(name); gw("\n" as *u8); return 0
23}
24
25func main() -> i64 {
26    let tot: *i64 = sys_mmap(32) as *i64
27    tot[0]=0; tot[1]=0
28    let cap: i64 = 65536
29    let a: *u8 = sys_mmap(cap)
30    let b: *u8 = sys_mmap(cap)
31    gw("=== nx_brand_tokens_gate -- R1 design-token SSOT (presence + boundary defense) ===\n" as *u8)
32
33    // T1: default brand -> a valid :root with the seed tokens
34    let w1: i64 = bt_default_emit(a, cap)
35    var t1: i64 = 0
36    if w1 > 0 {
37        if g_has(a, w1, ":root{" as *u8) == 1 {
38            if g_has(a, w1, "--nx-color-primary: #0b2545" as *u8) == 1 {
39                if g_has(a, w1, "--nx-font-sans: system-ui" as *u8) == 1 {
40                    if g_has(a, w1, "--nx-space-2: 16px" as *u8) == 1 { t1 = 1 }
41                }
42            }
43        }
44    }
45    t_row("T1 default brand emits a valid :root token block (color+font+space)" as *u8, t1, tot)
46
47    // T2: RE-THEME -- a custom brand overrides primary, no code change
48    let red: *u8 = "token|color|primary|#ff0000\ntoken|color|accent|#00ff88\n" as *u8
49    let w2: i64 = bt_emit_root_buf(red, bt_len(red), a, cap)
50    var t2: i64 = 0
51    if w2 > 0 { if g_has(a, w2, "--nx-color-primary: #ff0000" as *u8) == 1 { if g_has(a, w2, "--nx-color-accent: #00ff88" as *u8) == 1 { t2 = 1 } } }
52    t_row("T2 re-theme: custom brand DATA overrides tokens (no code change)" as *u8, t2, tot)
53
54    // T3 NEG: CSS rule-injection in a value is REJECTED (no breakout)
55    let inj: *u8 = "token|color|primary|#fff;}body{display:none\n" as *u8
56    let w3: i64 = bt_emit_root_buf(inj, bt_len(inj), a, cap)
57    let alen3: i64 = bt_len(a)
58    var t3: i64 = 0
59    // rejected => no valid token (w3<0), no 'display', and exactly the root's single {..}
60    if w3 < 0 { if g_has(a, alen3, "display" as *u8) == 0 { if g_count(a, alen3, 123) == 1 { if g_count(a, alen3, 125) == 1 { t3 = 1 } } } }
61    t_row("T3 NEG: CSS rule-injection (;}body{) rejected -- no breakout, no extra braces" as *u8, t3, tot)
62
63    // T4 NEG: sovereignty -- <script> and url(...) values REJECTED
64    let sov: *u8 = "token|color|x|<script>alert(1)</script>\ntoken|color|y|url(http://evil.example)\n" as *u8
65    let w4: i64 = bt_emit_root_buf(sov, bt_len(sov), a, cap)
66    let alen4: i64 = bt_len(a)
67    var t4: i64 = 0
68    if g_has(a, alen4, "script" as *u8) == 0 { if g_has(a, alen4, "url(" as *u8) == 0 { if g_has(a, alen4, "evil" as *u8) == 0 { t4 = 1 } } }
69    t_row("T4 NEG: sovereignty -- <script>/url() values rejected (no 3rd-party JS/fetch)" as *u8, t4, tot)
70
71    // T5: SELECTIVE rejection -- a good token survives while a hostile sibling is dropped
72    let mix: *u8 = "token|color|primary|#00ff00\ntoken|color|evil|x;}@import bad\n" as *u8
73    let w5: i64 = bt_emit_root_buf(mix, bt_len(mix), a, cap)
74    var t5: i64 = 0
75    if w5 > 0 { if g_has(a, w5, "--nx-color-primary: #00ff00" as *u8) == 1 { if g_has(a, w5, "import" as *u8) == 0 { t5 = 1 } } }
76    t_row("T5 selective: good token survives, hostile sibling dropped (no whole-set nuke)" as *u8, t5, tot)
77
78    // T6: distinct themes -> distinct output (the multi-brand property)
79    let wd: i64 = bt_default_emit(a, cap)
80    let red2: *u8 = "token|color|primary|#ff0000\n" as *u8
81    let wr: i64 = bt_emit_root_buf(red2, bt_len(red2), b, cap)
82    var t6: i64 = 0
83    if wd > 0 { if wr > 0 { if g_has(a, wd, "#0b2545" as *u8) == 1 { if g_has(b, wr, "#ff0000" as *u8) == 1 { if wd != wr { t6 = 1 } else { if g_eq(a, b, wd) == 0 { t6 = 1 } } } } } }
84    t_row("T6 multi-brand: two brand DATA sets -> two distinct :root blocks" as *u8, t6, tot)
85
86    // T7: DETERMINISM -- same brand DATA -> byte-identical (no vendor lock; reproducible)
87    let we1: i64 = bt_default_emit(a, cap)
88    let we2: i64 = bt_default_emit(b, cap)
89    var t7: i64 = 0
90    if we1 == we2 { if we1 > 0 { if g_eq(a, b, we1) == 1 { t7 = 1 } } }
91    t_row("T7 determinism: same brand DATA -> byte-identical emit (portable/reproducible)" as *u8, t7, tot)
92
93    gw("\nrows pass=" as *u8); gn(tot[0]); gw(" fail=" as *u8); gn(tot[1]); gw("\n" as *u8)
94    if tot[1] == 0 { gw("VERDICT=GREEN -- design-token SSOT works + injection/sovereignty-safe by construction\n" as *u8); return 0 }
95    gw("VERDICT=RED\n" as *u8)
96    return 1
97}
nx_brand_tokens_gate.nx source

`nx_brand_tokens_gate.nx` source
