nx_compare_bindings_gate.nx source
↩ module page · 68 lines · 4578 B
1// Isolated native fixture; production policy and artifacts are never written.
2import "nx_compare_serve.nx"
3import "nx_gate_verdict.nx"
4const CSG_PRIVATE_MODE: i64 = 448
5const CSG_FILE_MODE: i64 = 384
6const CSG_OPENAT: i64 = 257
7const CSG_AT_FDCWD: i64 = 0 - 100
8const CSG_EXCLUSIVE_WRITE: i64 = 193
9func csg_finish(ctr: *i64) -> i64 {
10 let rc: i64 = gv_verdict("COMPARE-BINDINGS" as *u8, ctr, "public policy and complete reads verified in fresh isolated storage; real published manifests require integration verification" as *u8)
11 sys_exit(rc); return rc
12}
13func csg_write(path: *u8, data: *u8) -> i64 {
14 let fd: i64 = __syscall(CSG_OPENAT, CSG_AT_FDCWD, path as i64, CSG_EXCLUSIVE_WRITE, CSG_FILE_MODE, 0, 0)
15 if fd < 0 { return 0 }
16 let n: i64 = cg_slen(data); var o: i64 = 0
17 while o < n { let w: i64 = sys_write(fd, ((data as i64)+o) as *u8, n-o); if w <= 0 { sys_close(fd); return 0 }; o = o+w }
18 return sys_close(fd) == 0
19}
20func main() -> i64 {
21 let ctr: *i64 = gv_ctr(); gv_head("COMPARE-BINDINGS" as *u8)
22 let dir: *u8 = sys_mmap(SYS_PATH_MAX); let cwd: *u8 = sys_mmap(SYS_PATH_MAX)
23 var o: i64 = cg_cat(dir, 0, "/tmp/nx-compare-bindings-" as *u8)
24 o = cg_catnum(dir, o, sys_now_ms()); dir[o] = 0 as u8
25 let made: i64 = sys_mkdir(dir, CSG_PRIVATE_MODE)
26 gv_check("fresh private fixture created" as *u8, made == 0, ctr)
27 if made != 0 { return csg_finish(ctr) }
28 let moved: i64 = sys_chdir(dir)
29 gv_check("fixture chdir succeeds" as *u8, moved == 0, ctr)
30 if moved != 0 { return csg_finish(ctr) }
31 var isolated: i64 = 0
32 if sys_getcwd(cwd, SYS_PATH_MAX) > 0 { isolated = streq(dir, cwd) }
33 gv_check("canonical cwd proves isolation" as *u8, isolated, ctr)
34 if isolated != 1 { return csg_finish(ctr) }
35 gv_check("missing policy denies public domain" as *u8, cs_public("charsim" as *u8) == 0, ctr)
36 let knowledge: i64 = sys_mkdir("knowledge" as *u8, CSG_PRIVATE_MODE)
37 let compare: i64 = sys_mkdir("knowledge/compare" as *u8, CSG_PRIVATE_MODE)
38 gv_check("fixture policy directories created" as *u8, (knowledge + compare) == 0, ctr)
39 if knowledge != 0 { return csg_finish(ctr) }; if compare != 0 { return csg_finish(ctr) }
40 let policy: *u8 = "default|public\ndomain|hidden|operator\ndomain|viewer|viewer\ndomain|member|member\ndomain|typo|bogus\ndomain|later|public\ndomain|later|operator\n" as *u8
41 let written: i64 = csg_write("knowledge/compare/access.conf" as *u8, policy)
42 gv_check("isolated policy exclusively written" as *u8, written, ctr)
43 if written != 1 { return csg_finish(ctr) }
44 gv_check("default public eligible" as *u8, cs_public("charsim" as *u8) == 1, ctr)
45 gv_check("operator denied" as *u8, cs_public("hidden" as *u8) == 0, ctr)
46 gv_check("viewer denied without HR context" as *u8, cs_public("viewer" as *u8) == 0, ctr)
47 gv_check("member denied without HR context" as *u8, cs_public("member" as *u8) == 0, ctr)
48 gv_check("unknown access denies" as *u8, cs_public("typo" as *u8) == 0, ctr)
49 gv_check("later private override denies" as *u8, cs_public("later" as *u8) == 0, ctr)
50 gv_check("valid existing domain syntax" as *u8, san_ok("gameengine" as *u8) == 1, ctr)
51 gv_check("path traversal denied" as *u8, san_ok("../hidden" as *u8) == 0, ctr)
52 gv_check("empty identity denied" as *u8, san_ok("" as *u8) == 0, ctr)
53 gv_check("uppercase identity denied" as *u8, san_ok("Gameengine" as *u8) == 0, ctr)
54 gv_check("identity max boundary accepted" as *u8, san_ok("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as *u8) == 1, ctr)
55 gv_check("identity beyond max denied" as *u8, san_ok("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" as *u8) == 0, ctr)
56 let size: *i64 = sys_mmap(8) as *i64
57 let body: *u8 = cs_complete("knowledge/compare/access.conf" as *u8, size)
58 var same: i64 = 0
59 if (body as i64) > 0 { if size[0] == cg_slen(policy) { same = cg_sl_eq(body, 0, size[0], policy) }; sys_munmap(body, size[0]+1) }
60 gv_check("complete policy bytes and exact size" as *u8, same, ctr)
61 gv_check("absent artifact refused" as *u8, (cs_complete("absent.json" as *u8, size) as i64) == 0, ctr)
62 gv_check("empty fixture created" as *u8, csg_write("empty.json" as *u8, "" as *u8), ctr)
63 gv_check("empty artifact refused" as *u8, (cs_complete("empty.json" as *u8, size) as i64) == 0, ctr)
64 let small: *u8 = sys_mmap(8)
65 gv_check("capacity-filled read refuses prefix" as *u8, cgo_read("knowledge/compare/access.conf" as *u8, small, 8) < 0, ctr)
66 sys_munmap(small, 8); sys_munmap(size as *u8, 8)
67 return csg_finish(ctr)
68}