nx_dev_api_live_check.nx source
↩ module page · 64 lines · 3902 B
1// nx_dev_api_live_check.nx -- sovereign LIVE check of nishifamily.com/api/dev via our own TLS (publish-loop proof,
2// clone of nx_synth_live_check). The dev/CI API is GATED (server-side code exec), so an unauth GET is either the
3// index (200 + "nishi-dev" marker = daemon serving directly) or a fail-closed /login redirect (route live +
4// auth-fenced). Either == the route reached the edge and resolved. A 502/504/000/connection-refused == daemon
5// down or route not active. license_tier: ORIGINAL expect_exit: 0
6import "nx_syscalls.nx"
7import "nx_x509_trust_store.nx"
8import "nx_trust_store_load_from_certdata.nx"
9import "nx_https_fetch_follow.nx"
10const K_MAGIC_4194304: i64 = 4194304
11const K_MAGIC_1048576: i64 = 1048576
12
13func lw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
14func ln(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)} let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1} sys_write(1,bb,k); return 0 }
15func lfind(buf: *u8, n: i64, needle: *u8) -> i64 {
16 var nl: i64 = 0
17 while needle[nl] != (0 as u8) { nl = nl + 1 }
18 if nl == 0 { return 0 }
19 var i: i64 = 0
20 while i + nl <= n {
21 var j: i64 = 0; var ok: i64 = 1
22 while j < nl { if (buf[i+j]&0xff) != (needle[j]&0xff) { ok = 0; j = nl } else { j = j + 1 } }
23 if ok == 1 { return i }
24 i = i + 1
25 }
26 return 0 - 1
27}
28
29func main() -> i64 {
30 let r: i64 = nx_trust_store_load_from_certdata("data/mozilla_certdata.txt" as *u8, 512, K_MAGIC_4194304)
31 if r <= 0 { lw("DEVAPI-CHECK: certdata load failed\n"); sys_exit(1); return 1 }
32 let store: *TrustStore = r as *TrustStore
33 let cap: i64 = K_MAGIC_1048576
34 let out: *u8 = sys_mmap(cap)
35 let status: *i64 = sys_mmap(8) as *i64
36
37 // CALIBRATION: /synth is public (control), /finance + /gen are LIVE gated routes (known-up backends) -- if they
38 // return the same status as /api/dev, then status=0 is just how gated-unauth looks through the fetch, not a fault.
39 let a: i64 = nx_https_fetch_follow("https://nishifamily.com/synth" as *u8, store, out, cap, 6, status)
40 lw("/synth (public) status="); ln(status[0]); lw(" bytes="); ln(a); lw("\n")
41 let b: i64 = nx_https_fetch_follow("https://nishifamily.com/finance" as *u8, store, out, cap, 6, status)
42 lw("/finance (gated) status="); ln(status[0]); lw(" bytes="); ln(b); lw("\n")
43 let g: i64 = nx_https_fetch_follow("https://nishifamily.com/gen" as *u8, store, out, cap, 6, status)
44 lw("/gen (gated) status="); ln(status[0]); lw(" bytes="); ln(g); lw("\n")
45 let n: i64 = nx_https_fetch_follow("https://nishifamily.com/api/dev" as *u8, store, out, cap, 6, status)
46 lw("/api/dev (gated) status="); ln(status[0]); lw(" bytes="); ln(n); lw("\n")
47
48 // daemon serving the index directly (gated allowed the GET)
49 if status[0] == 200 { if lfind(out, n, "nishi-dev" as *u8) >= 0 {
50 lw("DEVAPI-LIVE GREEN -- /api/dev serves the dev-API index over the live edge (daemon UP + routed)\n")
51 sys_exit(0); return 0
52 } }
53 // fail-closed auth fence: nx_https_fetch_follow followed the 302 to /login (no dev marker, login page instead)
54 if status[0] == 200 { if lfind(out, n, "nishi-dev" as *u8) < 0 { if lfind(out, n, "login" as *u8) >= 0 {
55 lw("DEVAPI-LIVE GREEN(gated) -- /api/dev route LIVE + auth-fenced (edge redirected to /login); daemon behind the gate\n")
56 sys_exit(0); return 0
57 } } }
58 if status[0] == 302 {
59 lw("DEVAPI-LIVE GREEN(gated) -- /api/dev route LIVE + auth-fenced (302); daemon behind the gate\n")
60 sys_exit(0); return 0
61 }
62 lw("DEVAPI-LIVE RED -- unexpected status="); ln(status[0]); lw(" (daemon down or route not active yet)\n")
63 sys_exit(1); return 1
64}