nx_ciq_family_gate.nx source

1// nx_ciq_family_gate.nx -- the OPAQUE family-level gate for the CIQ publish (operator: "opaque gate it behind 2// the family level"). Defines + PROVES the authz policy the wiki render daemon adopts for the /wiki/family/ 3// route prefix, composing the proven nx_authz longest-prefix level rule (no reinvention): 4// policy: /wiki/ -> level 0 (public) ; /wiki/family/ -> level 2 (family) [longer prefix wins] 5// "OPAQUE" (the operator's word) = stronger than a visible 403: authz_filter OMITS family items from a 6// non-family user's listing entirely, so an anonymous/public visitor never even SEES that the CIQ analysis 7// exists. PROVES by construction: 8// (1) anon (lvl0) requesting /wiki/family/ciq.html -> DENY ; family (lvl2) -> ALLOW ; public page -> ALLOW 9// (2) OPAQUE: a public listing filters OUT the family items (count drops); a family listing keeps them. 10// This is the gating LOGIC, tested; wiring it into nx_wiki_doc_render's serve path = the wiki workstream's 11// coordinated adoption step. 100% sovereign. license_tier: ORIGINAL expect_exit: 0 12import "nx_syscalls.nx" 13import "nx_authz.nx" 14 15func fw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 16func fn(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 } 17func slen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 18 19const LVL_PUBLIC: i64 = 0 20const LVL_FAMILY: i64 = 2 21 22func main() -> i64 { 23 // resource policy (data-driven, rule 11): two prefix rules, longest wins 24 let paths: *i64 = sys_mmap(8 * 4) as *i64 25 let lens: *i64 = sys_mmap(8 * 4) as *i64 26 let reql: *i64 = sys_mmap(8 * 4) as *i64 27 paths[0] = "/wiki/" as *u8 as i64; lens[0] = slen("/wiki/" as *u8); reql[0] = LVL_PUBLIC 28 paths[1] = "/wiki/family/" as *u8 as i64; lens[1] = slen("/wiki/family/" as *u8); reql[1] = LVL_FAMILY 29 let npol: i64 = 2 30 31 let r_fam: *u8 = "/wiki/family/ciq.html" as *u8 32 let r_pub: *u8 = "/wiki/start.html" as *u8 33 34 fw("=== nx_ciq_family_gate -- opaque family-level gate for the CIQ publish ===\n" as *u8) 35 fw("policy: /wiki/ -> level 0 (public) ; /wiki/family/ -> level 2 (family)\n" as *u8) 36 37 // (1) access control 38 let a_anon_fam: i64 = authz_level_allow(LVL_PUBLIC, paths, lens, reql, npol, r_fam, slen(r_fam)) 39 let a_fam_fam: i64 = authz_level_allow(LVL_FAMILY, paths, lens, reql, npol, r_fam, slen(r_fam)) 40 let a_anon_pub: i64 = authz_level_allow(LVL_PUBLIC, paths, lens, reql, npol, r_pub, slen(r_pub)) 41 fw(" anon -> /wiki/family/ciq.html : " as *u8); if a_anon_fam==0 { fw("DENY (correct)\n" as *u8) } else { fw("ALLOW (WRONG)\n" as *u8) } 42 fw(" family-> /wiki/family/ciq.html : " as *u8); if a_fam_fam==1 { fw("ALLOW (correct)\n" as *u8) } else { fw("DENY (WRONG)\n" as *u8) } 43 fw(" anon -> /wiki/start.html : " as *u8); if a_anon_pub==1 { fw("ALLOW (correct)\n" as *u8) } else { fw("DENY (WRONG)\n" as *u8) } 44 45 // (2) OPAQUE listing: a public listing must OMIT the family items (not even visible) 46 let items: *i64 = sys_mmap(8 * 8) as *i64 47 let ilen: *i64 = sys_mmap(8 * 8) as *i64 48 items[0] = "/wiki/start.html" as *u8 as i64; ilen[0] = slen(items[0] as *u8) 49 items[1] = "/wiki/family/ciq.html" as *u8 as i64; ilen[1] = slen(items[1] as *u8) 50 items[2] = "/wiki/family/ciq_ai.md" as *u8 as i64; ilen[2] = slen(items[2] as *u8) 51 items[3] = "/wiki/family/ciq_machine.nxr" as *u8 as i64; ilen[3] = slen(items[3] as *u8) 52 let nit: i64 = 4 53 let out: *i64 = sys_mmap(8 * 8) as *i64 54 let vis_anon: i64 = authz_filter(LVL_PUBLIC, items, ilen, nit, paths, lens, reql, npol, out) 55 let vis_fam: i64 = authz_filter(LVL_FAMILY, items, ilen, nit, paths, lens, reql, npol, out) 56 fw(" OPAQUE listing: anon sees " as *u8); fn(vis_anon); fw("/" as *u8); fn(nit); fw(" items (family items omitted), family sees " as *u8); fn(vis_fam); fw("/" as *u8); fn(nit); fw("\n" as *u8) 57 58 // GATE: access control correct AND opaque listing hides exactly the 3 family items from anon 59 var ok: i64 = 1 60 if a_anon_fam != 0 { ok = 0 } // anon must be DENIED the family page 61 if a_fam_fam != 1 { ok = 0 } // family must be ALLOWED 62 if a_anon_pub != 1 { ok = 0 } // anon must see public pages 63 if vis_anon != 1 { ok = 0 } // anon listing: only the 1 public item survives (3 family OMITTED) 64 if vis_fam != nit { ok = 0 } // family listing: all items visible 65 fw("--- gate --- access-control correct & opaque-listing hides family items from non-family: " as *u8); if ok==1 { fw("PASS" as *u8) } else { fw("FAIL" as *u8) } fw("\n" as *u8) 66 if ok == 1 { fw("FAMILYGATEGATE verdict=GREEN (CIQ publish is opaque-gated behind family level; ready for wiki-daemon adoption on /wiki/family/)\n" as *u8); sys_exit(0); return 0 } 67 fw("FAMILYGATEGATE verdict=RED\n" as *u8); sys_exit(1); return 1 68}