code wiki / _hdl_build / nx_cms_webdev_gate.nx
nx_cms_webdev_gate.nx source
↩ module page · 170 lines · 11826 B
1// nx_cms_webdev_gate.nx -- SOVEREIGN gate for the CAPABILITY-ADAPTIVE studio behind the CMS login (no shells,
2// no curl). Forks the admin daemon, then drives it over raw sovereign sockets: GET /webdev BLOCKED without a
3// session; POST /admin/login issues nsess; WITH the session the PICKER is served at /webdev and each tier
4// surface at /webdev/{guided,freeform}; POST /webdev/build is forbidden without a session and, with it, builds
5// each tier through se_build_tier (guided->page, freeform->canvas, raw .site->block). Proves the full multi-tier
6// studio is behind OUR login, end-to-end. Appends a CMSGATE row to knowledge/status/cms_gate.log on all-pass.
7// PRE: ./_offc/nx_sov_build_run.elf nx_cms_admin --build-only (produces /tmp/nx_cms_admin.sov.elf). license_tier: ORIGINAL
8import "nx_http_client.nx"
9import "nx_connect.nx" // bounded connect: a raw sys_connect hangs ~127s on a black-holed host
10import "nx_cms_store.nx"
11import "nx_sha256.nx"
12import "nx_syscalls.nx"
13
14const W_PORT: i64 = 8092
15const W_SITE: *u8 = "/mnt/c/Users/elder/AppData/Local/Temp/awcms" as *u8
16const W_ADMIN: *u8 = "/tmp/nx_cms_admin.sov.elf" as *u8
17
18func wg_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
19func wg_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
20func wg_cat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
21func wg_catn(dst: *u8, off: i64, s: *u8, n: i64) -> i64 { var o: i64=off; var k: i64=0; while k<n{dst[o]=s[k];o=o+1;k=k+1} return o }
22func wg_num(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o }
23func wg_find(buf: *u8, n: i64, pat: *u8, plen: i64) -> i64 {
24 if plen==0 { return 0-1 }
25 var i: i64=0
26 while i+plen<=n { var j: i64=0; var ok: i64=1; while j<plen { if (buf[i+j] as i64)!=(pat[j] as i64){ok=0;j=plen} else {j=j+1} } if ok==1 { return i } i=i+1 }
27 return 0-1
28}
29func wg_has(buf: *u8, n: i64, s: *u8) -> i64 { if wg_find(buf,n,s,wg_len(s))>=0 { return 1 } return 0 }
30func wg_row(id: i64, ok: i64, what: *u8) -> i64 { wg_w("WDROW " as *u8); let b: *u8=sys_mmap(8); b[0]=(48+id) as u8; sys_write(1,b,1); wg_w(" " as *u8); if ok==1 { wg_w("PASS " as *u8) } else { wg_w("FAIL " as *u8) } wg_w(what); wg_w("\n" as *u8); return ok }
31
32func wg_setpw(outpath: *u8, pw: *u8) -> i64 {
33 let n: i64=wg_len(pw)
34 let dig: *u8=sys_mmap(32); sha256_digest(pw, n, dig)
35 let hx: *u8="0123456789abcdef" as *u8; let hexs: *u8=sys_mmap(80); var i: i64=0
36 while i<32 { hexs[i*2]=hx[((dig[i] as i64)>>4)&15]; hexs[i*2+1]=hx[(dig[i] as i64)&15]; i=i+1 }
37 let fd: i64=sys_openat_wr(outpath, 0x180); if fd<0 { return 0 } sys_write(fd, hexs, 64); sys_close(fd); return 1
38}
39// copy web_assets/_studio/<file> -> <W_SITE>/_studio/<file>
40func wg_copy(file: *u8, buf: *u8, cap: i64) -> i64 {
41 let src: *u8=sys_mmap(512); var so: i64=wg_cat(src,0,"web_assets/_studio/" as *u8); so=wg_cat(src,so,file); src[so]=0 as u8
42 let dst: *u8=sys_mmap(512); var d: i64=wg_cat(dst,0,W_SITE); d=wg_cat(dst,d,"/_studio/" as *u8); d=wg_cat(dst,d,file); dst[d]=0 as u8
43 let n: i64=cst_read(src, buf, cap); if n<0 { return 0 }
44 let fd: i64=sys_openat_wr(dst, 0x1a4); if fd<0 { return 0 } sys_write(fd, buf, n); sys_close(fd); return 1
45}
46func wg_send(reqbuf: *u8, reqlen: i64, resp: *u8, cap: i64) -> i64 {
47 let addr: *u8 = sys_mmap(16)
48 nx_http_client_sockaddr_ipv4(addr, 127, 0, 0, 1, W_PORT)
49 let fd: i64 = sys_socket(2, 1, 0)
50 if fd < 0 { return 0 - 1 }
51 if nx_connect_bounded(fd, addr, 16, NX_CONN_DEFAULT_MS) < 0 { sys_close(fd); return 0 - 1 }
52 sys_write(fd, reqbuf, reqlen)
53 var off: i64 = 0; var keep: i64 = 1
54 while keep == 1 { if off >= cap { keep = 0 } else { let r: i64 = sys_read(fd, (resp + off) as *u8, cap - off); if r <= 0 { keep = 0 } else { off = off + r } } }
55 sys_close(fd); return off
56}
57func wg_get(req: *u8, path: *u8, tok: *u8, toklen: i64) -> i64 {
58 var o: i64 = wg_cat(req, 0, "GET " as *u8); o = wg_cat(req, o, path)
59 o = wg_cat(req, o, " HTTP/1.1\r\nHost: 127.0.0.1\r\n" as *u8)
60 if toklen > 0 { o = wg_cat(req, o, "Cookie: nsess=" as *u8); o = wg_catn(req, o, tok, toklen); o = wg_cat(req, o, "\r\n" as *u8) }
61 o = wg_cat(req, o, "Connection: close\r\n\r\n" as *u8)
62 return o
63}
64func wg_post(req: *u8, path: *u8, tok: *u8, toklen: i64, body: *u8) -> i64 {
65 let blen: i64 = wg_len(body)
66 var o: i64 = wg_cat(req, 0, "POST " as *u8); o = wg_cat(req, o, path)
67 o = wg_cat(req, o, " HTTP/1.1\r\nHost: 127.0.0.1\r\n" as *u8)
68 if toklen > 0 { o = wg_cat(req, o, "Cookie: nsess=" as *u8); o = wg_catn(req, o, tok, toklen); o = wg_cat(req, o, "\r\n" as *u8) }
69 o = wg_cat(req, o, "Content-Type: text/plain\r\nContent-Length: " as *u8); o = wg_num(req, o, blen)
70 o = wg_cat(req, o, "\r\nConnection: close\r\n\r\n" as *u8); o = wg_catn(req, o, body, blen)
71 return o
72}
73
74func main() -> i64 {
75 // credential + all four studio assets, written sovereignly
76 let pwp: *u8 = sys_mmap(512); var po: i64 = wg_cat(pwp, 0, W_SITE); po = wg_cat(pwp, po, "/admin_pw.sha256" as *u8); pwp[po] = 0 as u8
77 wg_setpw(pwp, "studio-dev-2026" as *u8)
78 let arp: *u8 = sys_mmap(512); var ao: i64 = wg_cat(arp, 0, W_SITE); ao = wg_cat(arp, ao, "/admin_pw.ar2" as *u8); arp[ao] = 0 as u8
79 __syscall(263, AT_FDCWD, arp, 0, 0, 0, 0)
80 let sdir: *u8 = sys_mmap(512); var so: i64 = wg_cat(sdir, 0, W_SITE); so = wg_cat(sdir, so, "/_studio" as *u8); sdir[so] = 0 as u8
81 sys_mkdir(sdir, 0x1ed)
82 let cbuf: *u8 = sys_mmap(262144)
83 wg_copy("editor_pick.html" as *u8, cbuf, 262143)
84 wg_copy("editor.html" as *u8, cbuf, 262143)
85 wg_copy("editor_guided.html" as *u8, cbuf, 262143)
86 wg_copy("editor_freeform.html" as *u8, cbuf, 262143)
87
88 let pid: i64 = sys_fork()
89 if pid == 0 {
90 let argv: *i64 = sys_mmap(64) as *i64
91 argv[0] = W_ADMIN as i64; argv[1] = "8092" as *u8 as i64; argv[2] = W_SITE as i64; argv[3] = "200" as *u8 as i64; argv[4] = 0
92 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
93 sys_execve(W_ADMIN, argv, envp)
94 sys_exit(127)
95 }
96 let resp: *u8 = sys_mmap(262144)
97 let req: *u8 = sys_mmap(16384)
98 let nul: *u8 = sys_mmap(8)
99
100 var tries: i64 = 0
101 while tries < 400 { let g: i64 = wg_send(req, wg_get(req, "/" as *u8, nul, 0), resp, 262143); if g > 0 { tries = 400 } else { tries = tries + 1 } }
102
103 var pass: i64 = 0
104 var rows: i64 = 0
105 var ok: i64 = 0
106
107 // R0: GET /webdev with NO session -> blocked
108 let n0: i64 = wg_send(req, wg_get(req, "/webdev" as *u8, nul, 0), resp, 262143)
109 ok = 0; if wg_has(resp, n0, "login required" as *u8) == 1 { if wg_has(resp, n0, "How do you want to build" as *u8) == 0 { ok = 1 } }
110 rows=rows+1; pass=pass+wg_row(0, ok, "GET /webdev no session -> BLOCKED (login required)" as *u8)
111
112 // R1: POST /admin/login -> session
113 let body: *u8 = "pw=studio-dev-2026" as *u8
114 var r1: i64 = wg_cat(req, 0, "POST /admin/login HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 18\r\nConnection: close\r\n\r\n" as *u8)
115 r1 = wg_cat(req, r1, body)
116 let n1: i64 = wg_send(req, r1, resp, 262143)
117 let cpos: i64 = wg_find(resp, n1, "nsess=" as *u8, 6)
118 ok = 0; if cpos >= 0 { ok = 1 }
119 rows=rows+1; pass=pass+wg_row(1, ok, "POST /admin/login -> session issued (nsess)" as *u8)
120 let tok: *u8 = sys_mmap(40)
121 if cpos >= 0 { var ti: i64 = 0; while ti < 32 { tok[ti] = resp[cpos + 6 + ti]; ti = ti + 1 } tok[32] = 0 as u8 }
122
123 // R2: GET /webdev WITH session -> the PICKER front door
124 let n2: i64 = wg_send(req, wg_get(req, "/webdev" as *u8, tok, 32), resp, 262143)
125 ok = 0; if wg_has(resp, n2, "How do you want to build" as *u8) == 1 { if wg_has(resp, n2, "/freeform" as *u8) == 1 { ok = 1 } }
126 rows=rows+1; pass=pass+wg_row(2, ok, "GET /webdev session -> PICKER front door (behind login)" as *u8)
127
128 // R3: GET /webdev/guided WITH session -> the guided wizard
129 let n3: i64 = wg_send(req, wg_get(req, "/webdev/guided" as *u8, tok, 32), resp, 262143)
130 ok = 0; if wg_has(resp, n3, "id=\"brand\"" as *u8) == 1 { if wg_has(resp, n3, "tier|guided" as *u8) == 1 { ok = 1 } }
131 rows=rows+1; pass=pass+wg_row(3, ok, "GET /webdev/guided session -> guided wizard surface" as *u8)
132
133 // R4: GET /webdev/freeform WITH session -> the canvas
134 let n4: i64 = wg_send(req, wg_get(req, "/webdev/freeform" as *u8, tok, 32), resp, 262143)
135 ok = 0; if wg_has(resp, n4, "pointerdown" as *u8) == 1 { if wg_has(resp, n4, "data-add=\"heading\"" as *u8) == 1 { ok = 1 } }
136 rows=rows+1; pass=pass+wg_row(4, ok, "GET /webdev/freeform session -> free-form canvas surface" as *u8)
137
138 // R5: POST /webdev/build with NO session -> forbidden
139 let n5: i64 = wg_send(req, wg_post(req, "/webdev/build" as *u8, nul, 0, "tier|guided\nbrand|x\n" as *u8), resp, 262143)
140 ok = 0; if wg_has(resp, n5, "forbidden" as *u8) == 1 { ok = 1 }
141 rows=rows+1; pass=pass+wg_row(5, ok, "POST /webdev/build no session -> forbidden (neg control)" as *u8)
142
143 // R6: POST /webdev/build session tier|guided -> governed guided page
144 let n6: i64 = wg_send(req, wg_post(req, "/webdev/build" as *u8, tok, 32, "tier|guided\nbrand|WD Brand\ncta|Go\ncta_href|#g\nheadline|WD Headline\nsub|s\nsearch|/s\ncard_title|A\ncard_body|b\nstep1|1\nstep2|2\ntrust|T\nfooter|F\n" as *u8), resp, 262143)
145 ok = 0; if wg_has(resp, n6, "WD Brand" as *u8) == 1 { if wg_has(resp, n6, "width=device-width" as *u8) == 1 { ok = 1 } }
146 rows=rows+1; pass=pass+wg_row(6, ok, "POST /webdev/build session tier|guided -> governed guided page" as *u8)
147
148 // R7: POST /webdev/build session tier|freeform -> governed canvas, placement honored
149 let n7: i64 = wg_send(req, wg_post(req, "/webdev/build" as *u8, tok, 32, "tier|freeform\ntitle|WD\nel|heading|30|40|400|WD Canvas|\n" as *u8), resp, 262143)
150 ok = 0; if wg_has(resp, n7, "WD Canvas" as *u8) == 1 { if wg_has(resp, n7, "left:30px;top:40px;width:400px" as *u8) == 1 { ok = 1 } }
151 rows=rows+1; pass=pass+wg_row(7, ok, "POST /webdev/build session tier|freeform -> governed canvas" as *u8)
152
153 // R8: POST /webdev/build session raw .site (no tier line) -> block build (backward-compat)
154 let n8: i64 = wg_send(req, wg_post(req, "/webdev/build" as *u8, tok, 32, "title|T\nheader|A|Go|#g\nhero|H|s|Go|#g\nsearch|/s|f\ncards|C\ncard|x|y\nsteps|S\nstep|one\ntrust|\nsig|z\nfooter|F\n" as *u8), resp, 262143)
155 ok = 0; if wg_has(resp, n8, "width=device-width" as *u8) == 1 { ok = 1 }
156 rows=rows+1; pass=pass+wg_row(8, ok, "POST /webdev/build session raw .site -> block build (backward-compat)" as *u8)
157
158 __syscall(129, pid, 9, 0, 0, 0, 0) // rv64 kill=129; raw x86 62 is an RV64 KEY translated to lseek(8) -- the kill never happened (debt idx 2277)
159
160 wg_w("NX-CMS-WEBDEV-GATE rows=" as *u8); let rb: *u8=sys_mmap(8); rb[0]=(48+rows) as u8; sys_write(1,rb,1); wg_w(" pass=" as *u8); let pb: *u8=sys_mmap(8); pb[0]=(48+pass) as u8; sys_write(1,pb,1); wg_w("\n" as *u8)
161 if pass == rows {
162 let line: *u8 = sys_mmap(160); var lo: i64 = wg_cat(line, 0, "CMSGATE row=nx_cms_webdev webdev-login-multitier rows=9 pass=9 verdict=PASS\n" as *u8)
163 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4)
164 if gf >= 0 { sys_write(gf, line, lo); sys_close(gf) }
165 wg_w("NX-CMS-WEBDEV-GATE verdict=PASS -- capability-adaptive studio behind the CMS login, recorded\n" as *u8)
166 sys_exit(0); return 0
167 }
168 wg_w("NX-CMS-WEBDEV-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
169 sys_exit(1); return 1
170}