nx_docportal_admin_gate.nx source

1// nx_docportal_admin_gate.nx -- MEASURED gate for the admin.<domain> document-portal handler. Self-contained 2// (nx_status_daemon pattern: craft HTTP request byte-buffers, call da_handle directly, assert the response bytes 3// AND the real side effects in the sovereign store -- no socket, no fork, deterministic). Proves the admin 4// capability the operator asked for: authenticated per-domain upload with public/private classification + RBAC 5// deny-by-default. 6// T1 authed client upload (level 1) -> 200 OK + UPLOADED, and the doc is in the domain's PUBLIC shard 7// T2 anonymous upload (level 0) -> 401 Unauthorized, and NOTHING is ingested (deny-by-default) 8// T3 private upload routing -> lands in the PRIVATE shard, not the public one 9// T4 per-domain isolation -> the upload is not readable from another domain's shard 10// T5 unknown route -> 404 11// GREEN iff 5/5. Appends knowledge/status/docportal_admin_gate.log. license_tier: ORIGINAL 12import "nx_docportal_admin_lib.nx" 13import "nx_g_puts_lib.nx" 14 15func g_num(v: i64) -> i64 { 16 let bb: *u8 = sys_mmap(28); var m: i64 = v 17 if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) } 18 let t: *u8 = sys_mmap(28); var k: i64 = 0 19 if m == 0 { t[0] = 48 as u8; k = 1 } 20 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 21 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, bb, k); return 0 22} 23func g_w(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 } 24func g_wn(fd: i64, v: i64) -> i64 { 25 let bb: *u8 = sys_mmap(28); var m: i64 = v; if m < 0 { m = 0 - m } 26 let t: *u8 = sys_mmap(28); var k: i64 = 0; if m == 0 { t[0] = 48 as u8; k = 1 } 27 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 } 28 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(fd, bb, k); return 0 29} 30func g_contains(hay: *u8, n: i64, ndl: *u8) -> i64 { 31 var nl: i64 = 0; while ndl[nl] != (0 as u8) { nl = nl + 1 } 32 if nl == 0 { return 0 } 33 var i: i64 = 0 34 while i + nl <= n { var j: i64 = 0; var hit: i64 = 1; while j < nl { if hay[i + j] != ndl[j] { hit = 0; j = nl } else { j = j + 1 } } if hit == 1 { return 1 } i = i + 1 } 35 return 0 36} 37// build a request: head (request line + headers + CRLFCRLF) followed by body bytes; returns total length 38func g_mkreq(out: *u8, head: *u8, body: *u8, blen: i64) -> i64 { 39 var o: i64 = 0; var i: i64 = 0 40 while head[i] != (0 as u8) { out[o] = head[i]; o = o + 1; i = i + 1 } 41 var j: i64 = 0; while j < blen { out[o] = body[j]; o = o + 1; j = j + 1 } 42 return o 43} 44func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 45 46func main() -> i64 { 47 g_puts("=== DOCPORTAL ADMIN GATE (admin.<domain> upload + RBAC deny-by-default; per-domain public/private) ===\n" as *u8) 48 let ctx0: *DaCtx = sys_mmap(16) as *DaCtx; ctx0.user_level = 0 49 let ctx1: *DaCtx = sys_mmap(16) as *DaCtx; ctx1.user_level = 1 50 let ctx2: *DaCtx = sys_mmap(16) as *DaCtx; ctx2.user_level = 2 51 52 let req: *u8 = sys_mmap(8192) 53 let out: *u8 = sys_mmap(8192) 54 let body1: *u8 = "Public legal guide about wills and probate in Utah." as *u8 55 let body2: *u8 = "Should not be stored because the uploader is anonymous." as *u8 56 let body3: *u8 = "CONFIDENTIAL client privileged retainer agreement." as *u8 57 let cid1: i64 = dp_cid(body1, g_slen(body1)) 58 let cid2: i64 = dp_cid(body2, g_slen(body2)) 59 let cid3: i64 = dp_cid(body3, g_slen(body3)) 60 let pq: *i64 = sys_mmap(16) as *i64; let lq: *i64 = sys_mmap(16) as *i64 61 var pass: i64 = 0 62 63 // ---- T1: authed client (level 1) public upload -> 200 + stored ---- 64 let h1: *u8 = "POST /admin/upload?domain=daadmin&visibility=public HTTP/1.1\r\nContent-Length: 51\r\n\r\n" as *u8 65 let n1: i64 = g_mkreq(req, h1, body1, g_slen(body1)) 66 let o1: i64 = da_handle(ctx1, req, n1, out) 67 var t1: i64 = 0 68 if g_contains(out, o1, "200 OK" as *u8) == 1 { if g_contains(out, o1, "UPLOADED" as *u8) == 1 { if dp_read("daadmin" as *u8, DP_VIS_PUBLIC, cid1, pq, lq) == 1 { t1 = 1 } } } 69 pass = pass + t1 70 g_puts(" T1 authed upload stored: "); if t1 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 71 72 // ---- T2: anonymous (level 0) upload denied -> 401 + nothing ingested ---- 73 let h2: *u8 = "POST /admin/upload?domain=daadmin&visibility=public HTTP/1.1\r\nContent-Length: 55\r\n\r\n" as *u8 74 let n2: i64 = g_mkreq(req, h2, body2, g_slen(body2)) 75 let o2: i64 = da_handle(ctx0, req, n2, out) 76 var t2: i64 = 0 77 let denied: i64 = g_contains(out, o2, "401" as *u8) 78 let leaked: i64 = dp_read("daadmin" as *u8, DP_VIS_PUBLIC, cid2, pq, lq) 79 if denied == 1 { if leaked == 0 { t2 = 1 } } 80 pass = pass + t2 81 g_puts(" T2 anon upload denied+not-stored (401="); g_num(denied); g_puts(" leaked="); g_num(leaked); g_puts("): ") 82 if t2 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 83 84 // ---- T3: private upload routes to the private shard only ---- 85 let h3: *u8 = "POST /admin/upload?domain=daadmin&visibility=private HTTP/1.1\r\nContent-Length: 50\r\n\r\n" as *u8 86 let n3: i64 = g_mkreq(req, h3, body3, g_slen(body3)) 87 da_handle(ctx1, req, n3, out) 88 var t3: i64 = 0 89 let in_prv: i64 = dp_read("daadmin" as *u8, DP_VIS_PRIVATE, cid3, pq, lq) 90 let in_pub: i64 = dp_read("daadmin" as *u8, DP_VIS_PUBLIC, cid3, pq, lq) 91 if in_prv == 1 { if in_pub == 0 { t3 = 1 } } 92 pass = pass + t3 93 g_puts(" T3 private routed (prv="); g_num(in_prv); g_puts(" pub="); g_num(in_pub); g_puts("): ") 94 if t3 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 95 96 // ---- T4: per-domain isolation -- daadmin's doc not readable from daother ---- 97 var t4: i64 = 0 98 if dp_read("daother" as *u8, DP_VIS_PUBLIC, cid1, pq, lq) == 0 { t4 = 1 } 99 pass = pass + t4 100 g_puts(" T4 per-domain isolation: "); if t4 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 101 102 // ---- T5: unknown route -> 404 ---- 103 let h5: *u8 = "GET /admin/nope HTTP/1.1\r\n\r\n" as *u8 104 let n5: i64 = g_mkreq(req, h5, "" as *u8, 0) 105 let o5: i64 = da_handle(ctx2, req, n5, out) 106 var t5: i64 = 0 107 if g_contains(out, o5, "404" as *u8) == 1 { t5 = 1 } 108 pass = pass + t5 109 g_puts(" T5 unknown route 404: "); if t5 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 110 111 // ---- T6: the owner FLAGS usage at upload (ai_blog ON via the request) ---- 112 let body6: *u8 = "Public estate planning FAQ the firm cleared for AI blog use." as *u8 113 let cid6: i64 = dp_cid(body6, g_slen(body6)) 114 let h6: *u8 = "POST /admin/upload?domain=daadmin&visibility=public&pub_search=1&ai_blog=1 HTTP/1.1\r\nContent-Length: 60\r\n\r\n" as *u8 115 let n6: i64 = g_mkreq(req, h6, body6, g_slen(body6)) 116 let o6: i64 = da_handle(ctx1, req, n6, out) 117 var t6: i64 = 0 118 if g_contains(out, o6, "200 OK" as *u8) == 1 { if dp_may("daadmin" as *u8, DP_VIS_PUBLIC, cid6, DP_USE_AI_BLOG) == 1 { t6 = 1 } } 119 pass = pass + t6 120 g_puts(" T6 upload-with-flags sets ai_blog ON: "); if t6 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 121 122 // ---- T7: the owner AMENDS via POST /admin/policy (withdraw ai_blog) -> enforced live ---- 123 let req7: *u8 = sys_mmap(512); var q7: i64 = 0 124 let h7: *u8 = "POST /admin/policy?domain=daadmin&visibility=public&cid=" as *u8 125 var ci: i64 = 0; while h7[ci] != (0 as u8) { req7[q7] = h7[ci]; q7 = q7 + 1; ci = ci + 1 } 126 let dd: *u8 = sys_mmap(28); var mm: i64 = cid6; var kk: i64 = 0; if mm == 0 { dd[0] = 48 as u8; kk = 1 } else { while mm > 0 { dd[kk] = (48 + (mm % 10)) as u8; mm = mm / 10; kk = kk + 1 } } 127 var zz: i64 = 0; while zz < kk { req7[q7] = dd[kk - 1 - zz]; q7 = q7 + 1; zz = zz + 1 } 128 let tail7: *u8 = "&pub_search=1 HTTP/1.1\r\n\r\n" as *u8 129 var ti: i64 = 0; while tail7[ti] != (0 as u8) { req7[q7] = tail7[ti]; q7 = q7 + 1; ti = ti + 1 } 130 let o7: i64 = da_handle(ctx1, req7, q7, out) 131 var t7: i64 = 0 132 if g_contains(out, o7, "POLICY-UPDATED" as *u8) == 1 { if dp_may("daadmin" as *u8, DP_VIS_PUBLIC, cid6, DP_USE_AI_BLOG) == 0 { t7 = 1 } } 133 pass = pass + t7 134 g_puts(" T7 amend policy via endpoint (withdraw ai_blog): "); if t7 == 1 { g_puts("PASS\n" as *u8) } else { g_puts("FAIL\n" as *u8) } 135 136 g_puts("----\nDOCPORTAL-ADMIN rows=7 pass="); g_num(pass); g_puts("\n" as *u8) 137 let lg: i64 = sys_openat_append("knowledge/status/docportal_admin_gate.log" as *u8, 0x1a4) 138 if lg >= 0 { 139 g_w(lg, "DOCPORTAL-ADMIN authed_upload="); g_wn(lg, t1); g_w(lg, " anon_denied="); g_wn(lg, t2) 140 g_w(lg, " private_routed="); g_wn(lg, t3); g_w(lg, " per_domain_iso="); g_wn(lg, t4); g_w(lg, " unknown_404="); g_wn(lg, t5) 141 g_w(lg, " flag_at_upload="); g_wn(lg, t6); g_w(lg, " amend_endpoint="); g_wn(lg, t7) 142 g_w(lg, " rows=7 pass="); g_wn(lg, pass) 143 if pass == 7 { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 144 sys_close(lg) 145 } 146 if pass == 7 { g_puts("DOCPORTAL-ADMIN GREEN (authed per-domain public/private upload + owner usage flags, deny-by-default -- measured)\n" as *u8); sys_exit(0); return 0 } 147 g_puts("DOCPORTAL-ADMIN RED\n" as *u8); sys_exit(1); return 1 148}