nx_brane_test.nx source
↩ module page · 67 lines · 2845 B
1// nx_brane_test.nx -- smoke for nx_brane.
2
3import "nx_syscalls.nx"
4import "nx_brane.nx"
5
6func main() -> i64 {
7 // 1: cap kind enum sealed
8 if NX_CAP_N_KINDS != 10 { return 1 }
9 if nx_cap_kind_is_valid(NX_CAP_FILE_READ) != 1 { return 2 }
10 if nx_cap_kind_is_valid(NX_CAP_DRONE_ACTUATE) != 1 { return 3 }
11 if nx_cap_kind_is_valid(10) != 0 { return 4 }
12
13 // 2: construction
14 let b: *NxBrane = nx_brane_new(100, 16)
15 if b.cell_id != 100 { return 5 }
16 if b.capacity != 16 { return 6 }
17 if b.count != 0 { return 7 }
18
19 // 3: empty brane denies any check
20 if nx_brane_check(b, NX_CAP_FILE_READ, 0, 1000) != NX_BR_DENIED { return 8 }
21
22 // 4: grant full-scope cap, then check passes
23 nx_brane_grant(b, NX_CAP_FILE_READ, 0, 0, 1000) // never expires
24 if nx_brane_check(b, NX_CAP_FILE_READ, 0, 2000) != NX_BR_GRANTED { return 9 }
25 if nx_brane_check(b, NX_CAP_FILE_READ, 0xabc, 2000) != NX_BR_GRANTED { return 10 }
26 if nx_brane_check(b, NX_CAP_FILE_WRITE, 0, 2000) != NX_BR_DENIED { return 11 }
27
28 // 5: scope-narrow grant + check
29 nx_brane_grant(b, NX_CAP_NET_EGRESS, 0xdeadbeef, 0, 1000)
30 if nx_brane_check(b, NX_CAP_NET_EGRESS, 0xdeadbeef, 2000) != NX_BR_GRANTED { return 12 }
31 if nx_brane_check(b, NX_CAP_NET_EGRESS, 0xbadc0de, 2000) != NX_BR_DENIED { return 13 }
32
33 // 6: expiring grant
34 nx_brane_grant(b, NX_CAP_PEER_MESSAGE, 0xfee71, 5000, 1000)
35 if nx_brane_check(b, NX_CAP_PEER_MESSAGE, 0xfee71, 3000) != NX_BR_GRANTED { return 14 }
36 if nx_brane_check(b, NX_CAP_PEER_MESSAGE, 0xfee71, 6000) != NX_BR_EXPIRED { return 15 }
37
38 // 7: revoke specific (kind, scope)
39 let removed: nx_int = nx_brane_revoke(b, NX_CAP_NET_EGRESS, 0xdeadbeef)
40 if removed != 1 { return 16 }
41 if nx_brane_check(b, NX_CAP_NET_EGRESS, 0xdeadbeef, 2000) != NX_BR_DENIED { return 17 }
42
43 // 8: revoke nonexistent returns 0
44 if nx_brane_revoke(b, NX_CAP_NET_EGRESS, 0xdead9999) != 0 { return 18 }
45
46 // 9: count_active before/after expiry
47 let active1: nx_int = nx_brane_count_active(b, 3000)
48 let active2: nx_int = nx_brane_count_active(b, 7000)
49 if active2 >= active1 { return 19 } // some expired between 3000 and 7000
50
51 // 10: revoke_all clears all tokens
52 let all_removed: nx_int = nx_brane_revoke_all(b)
53 if all_removed < 1 { return 20 }
54 if b.count != 0 { return 21 }
55 if nx_brane_check(b, NX_CAP_FILE_READ, 0, 2000) != NX_BR_DENIED { return 22 }
56
57 // 11: bad kind refused
58 if nx_brane_grant(b, 99, 0, 0, 1000) != NX_BR_ERR_BAD_KIND { return 23 }
59
60 // 12: FULL when at capacity
61 let small: *NxBrane = nx_brane_new(200, 2)
62 nx_brane_grant(small, NX_CAP_FILE_READ, 0, 0, 1000)
63 nx_brane_grant(small, NX_CAP_FILE_WRITE, 0, 0, 1000)
64 if nx_brane_grant(small, NX_CAP_NET_EGRESS, 0, 0, 1000) != NX_BR_ERR_FULL { return 24 }
65
66 return 0
67}