nx_cap_mint_gate.nx source
↩ module page · 45 lines · 3117 B
1// nx_cap_mint_gate.nx -- proves the root minter cm_mint (a) issues a capability that grants exactly the listed
2// tools and DENIES others (least authority carried through the mint), (b) supports "*" (grant-all), and -- the
3// hardening added 2026-07-07 -- (c) FAILS CLOSED when handed the forgeable baked placeholder secret, so a
4// production token can never be signed with a secret that is public in the source. Mirrors nx_cap_token_gate;
5// drives the pure core in-process with a real (non-placeholder) test key. license_tier: ORIGINAL expect_exit: 0
6import "nx_cap_mint.nx" // cm_mint + CM_PLACEHOLDER (+ transitive nx_cap_token: capt_verify/capt_slen/CAPT_*)
7import "nx_gate.nx" // gw / gn
8
9func mg_expect(actual: i64, expected: i64, pass: *i64, tot: *i64, label: *u8) -> i64 {
10 tot[0] = tot[0] + 1
11 if actual == expected { pass[0] = pass[0] + 1; gw(" [PASS] " as *u8) } else { gw(" [FAIL got=" as *u8); gn(actual); gw(" want=" as *u8); gn(expected); gw("] " as *u8) }
12 gw(label); gw("\n" as *u8)
13 return 0
14}
15
16func main() -> i64 {
17 gw("=== nx_cap_mint_gate: root minter -- least-authority + FAIL-CLOSED on the forgeable placeholder ===\n" as *u8)
18 let key: *u8 = "nishi-cap-mint-test-secret-key-01" as *u8 // a REAL (non-placeholder) 32-byte test key
19 let klen: i64 = capt_slen(key)
20 let now: i64 = 1782000000
21 let pbox: *i64 = sys_mmap(16) as *i64; pbox[0] = 0
22 let tbox: *i64 = sys_mmap(16) as *i64; tbox[0] = 0
23
24 // T1/T2: mint a 2-tool cap -> grants the listed tools, denies an unlisted one
25 let out: *u8 = sys_mmap(1024)
26 let tn: i64 = cm_mint(key, klen, "nx_mgmt_client,nx_https_get" as *u8, 27, 9999999999, 11, out, 1024)
27 mg_expect(capt_verify(key, klen, out, tn, "nx_mgmt_client" as *u8, 14, now), CAPT_OK, pbox, tbox, "T1 minted cap grants a listed tool (nx_mgmt_client)" as *u8)
28 mg_expect(capt_verify(key, klen, out, tn, "nx_aw_hostctl" as *u8, 13, now), CAPT_DENY_TOOL, pbox, tbox, "T2 minted cap DENIES an unlisted tool (least authority through the mint)" as *u8)
29
30 // T3 (the hardening): minting against the forgeable placeholder secret is REFUSED
31 let out2: *u8 = sys_mmap(1024)
32 let tn2: i64 = cm_mint(CM_PLACEHOLDER, capt_slen(CM_PLACEHOLDER), "nx_mgmt_client" as *u8, 14, 9999999999, 12, out2, 1024)
33 var t3: i64 = 0
34 if tn2 <= 0 { t3 = 1 }
35 mg_expect(t3, 1, pbox, tbox, "T3 minting against the forgeable placeholder -> REFUSED (fail-closed, no forgeable token)" as *u8)
36
37 // T4: "*" allow -> grants any tool name
38 let out3: *u8 = sys_mmap(1024)
39 let tn3: i64 = cm_mint(key, klen, "*" as *u8, 1, 9999999999, 13, out3, 1024)
40 mg_expect(capt_verify(key, klen, out3, tn3, "any_tool_name" as *u8, 13, now), CAPT_OK, pbox, tbox, "T4 star-allow cap grants any tool name" as *u8)
41
42 gw("\n=== nx_cap_mint_gate " as *u8); gn(pbox[0]); gw("/" as *u8); gn(tbox[0]); gw(" ===\n" as *u8)
43 if pbox[0] == tbox[0] { gw("CAP-MINT GREEN -- least-authority mint + fail-closed on the forgeable placeholder (GAP 1 hardened)\n" as *u8); sys_exit(0); return 0 }
44 gw("CAP-MINT RED\n" as *u8); sys_exit(1); return 1
45}