`nx_fsops_gate.nx` source

↩ module page · 170 lines · 10018 B
1// nx_fsops_gate.nx -- gates the consolidated fs tool on synthetic fixtures, asserting RETURN VALUES:
2// exact byte-count read, MARKED truncation, secret DENY (compiled default), DATA-DRIVEN deny toggled
3// ON->OFF via fs_read_deny.conf (both directions = discriminating), absent-path grace, dir listing count.
4// Runner must clean /tmp/fsgate first. The conf is written in CWD (prod lookup path) and REMOVED after.
5// Exit 0 only on all-PASS. license_tier: ORIGINAL  expect_exit: 0
6import "nx_fsops_lib.nx"
7import "nx_fio.nx"          // fio_unlink -- conf lifecycle cleanup
8import "nx_seg_store.nx"    // ss_writefile -- fixture author
9
10const GATE_CHECKS: i64 = 23
11const DIR_MODE: i64 = 0x1ed     // 0755
12const FIX_BYTES: i64 = 9        // len("hello-fs\n")
13const SMALL_CAP: i64 = 4        // forces the truncation path
14const FIX_ENTRIES: i64 = 3      // files authored into the fixture dir
15const FG_RB_CAP: i64 = 256      // read-back buffer for write/edit content assertions
16
17// read path into a NUL-terminated buffer and compare to expect (1 = byte-identical)
18func fg_readback_eq(path: *u8, expect: *u8) -> i64 {
  let b: *u8 = sys_mmap(FG_RB_CAP)
  let n: i64 = vw_read(path, b, FG_RB_CAP - 1)
  if n < 0 { return 0 }
  b[n] = 0 as u8
  return fsx_seq(b, expect)
24}
25
26func fg_check(name: *u8, ok: i64, pass: *i64) -> i64 {
  fsx_puts("T " as *u8); fsx_puts(name); fsx_puts(" -> " as *u8)
  if ok == 1 { fsx_puts("PASS\n" as *u8); pass[0] = pass[0] + 1 } else { fsx_puts("FAIL\n" as *u8) }
  return 0
30}
31func fg_write(path: *u8, body: *u8) -> i64 {
  var n: i64 = 0
  while body[n] != (0 as u8) { n = n + 1 }
  return ss_writefile(path, body, n)
35}
36// write via the tool-under-test with the length computed (no magic byte counts in checks)
37func fg_put(path: *u8, body: *u8) -> i64 { return fsx_write(path, body, vw_slen(body)) }
38
39func main(argc: i64, argv: *i64) -> i64 {
  let pass: *i64 = sys_mmap(16) as *i64
  pass[0] = 0
  sys_mkdir("/tmp/fsgate" as *u8, DIR_MODE)
  // IDEMPOTENCY (rule 10), fixed 2026-07-31. /tmp/fsgate PERSISTS between runs and the LATER tests
  // author w.txt / blockw.txt / d.txt / e.txt / lines.txt into it, so ls-entry-count saw 8 entries
  // instead of FIX_ENTRIES=3. This gate therefore PASSED EXACTLY ONCE, on a clean machine, and has
  // FAILED EVERY RUN SINCE -- a verdict that depends on whether the gate has run before is not
  // measuring the code under test. Reset every path this gate ever authors, not just the 3 fixtures.
  fio_unlink("/tmp/fsgate/normal.txt" as *u8)
  fio_unlink("/tmp/fsgate/mysecret_key.bin" as *u8)
  fio_unlink("/tmp/fsgate/blockme.txt" as *u8)
  fio_unlink("/tmp/fsgate/w.txt" as *u8)
  fio_unlink("/tmp/fsgate/blockw.txt" as *u8)
  fio_unlink("/tmp/fsgate/d.txt" as *u8)
  fio_unlink("/tmp/fsgate/e.txt" as *u8)
  fio_unlink("/tmp/fsgate/lines.txt" as *u8)
  fg_write("/tmp/fsgate/normal.txt" as *u8, "hello-fs\n" as *u8)
  fg_write("/tmp/fsgate/mysecret_key.bin" as *u8, "SHOULD-NEVER-PRINT\n" as *u8)
  fg_write("/tmp/fsgate/blockme.txt" as *u8, "hello-fs\n" as *u8)
59
  // T1 exact read
  fg_check("read-exact-bytes" as *u8, (fsx_read("/tmp/fsgate/normal.txt" as *u8, 0) == FIX_BYTES) as i64, pass)
  // T2 bounded read hits the cap (truncation path, MARKED)
  fg_check("read-truncation-marked" as *u8, (fsx_read("/tmp/fsgate/normal.txt" as *u8, SMALL_CAP) == SMALL_CAP) as i64, pass)
  // T3 compiled deny needle ("key") refuses secret material
  fg_check("deny-default-key" as *u8, (fsx_read("/tmp/fsgate/mysecret_key.bin" as *u8, 0) == 0 - (2 as i64)) as i64, pass)
  // T4 DATA-DRIVEN deny ON: conf needle blocks an otherwise-fine file
  fg_write("fs_read_deny.conf" as *u8, "blockme\n" as *u8)
  fg_check("deny-conf-on" as *u8, (fsx_read("/tmp/fsgate/blockme.txt" as *u8, 0) == 0 - (2 as i64)) as i64, pass)
  // T5 DATA-DRIVEN deny OFF: removing the conf restores the read (proves the conf DRIVES the policy)
  fio_unlink("fs_read_deny.conf" as *u8)
  fg_check("deny-conf-off" as *u8, (fsx_read("/tmp/fsgate/blockme.txt" as *u8, 0) == FIX_BYTES) as i64, pass)
  // T6 absent path is graceful
  fg_check("read-absent-graceful" as *u8, (fsx_read("/tmp/fsgate/nope.txt" as *u8, 0) == (0 - 1)) as i64, pass)
  // T7 ls counts the 3 fixture entries (. and .. skipped)
  fg_check("ls-entry-count" as *u8, (fsx_ls("/tmp/fsgate" as *u8) == FIX_ENTRIES) as i64, pass)
76
  // ==== write/edit half (nx_fs_write) ==== (lengths computed with vw_slen -- no magic byte counts)
  // T8 atomic write + byte-identical read-back
  var wr: i64 = fg_put("/tmp/fsgate/w.txt" as *u8, "alpha beta gamma\n" as *u8)
  var ok8: i64 = 0
  if wr == vw_slen("alpha beta gamma\n" as *u8) { ok8 = fg_readback_eq("/tmp/fsgate/w.txt" as *u8, "alpha beta gamma\n" as *u8) }
  fg_check("write-roundtrip" as *u8, ok8, pass)
  // T9 overwrite lands whole (atomic replace, not append/partial)
  wr = fg_put("/tmp/fsgate/w.txt" as *u8, "second\n" as *u8)
  var ok9: i64 = 0
  if wr == vw_slen("second\n" as *u8) { ok9 = fg_readback_eq("/tmp/fsgate/w.txt" as *u8, "second\n" as *u8) }
  fg_check("write-overwrite-whole" as *u8, ok9, pass)
  // T10 write DENIED on secret-needle path AND nothing created (negative control)
  var ok10: i64 = 0
  if fg_put("/tmp/fsgate/deploy.pem" as *u8, "x" as *u8) == 0 - (2 as i64) {
      let probe: *u8 = sys_mmap(FG_RB_CAP)
      if vw_read("/tmp/fsgate/deploy.pem" as *u8, probe, FG_RB_CAP - 1) < 0 { ok10 = 1 }
  }
  fg_check("write-deny-secret-nocreate" as *u8, ok10, pass)
  // T11 write DENIED in the OS device namespace (rule 26 never-brick, seam-enforced)
  fg_check("write-deny-devns" as *u8, (fg_put("/dev/null" as *u8, "x" as *u8) == 0 - (2 as i64)) as i64, pass)
  // T12 data-driven WRITE deny: conf ON blocks, then conf OFF restores (both directions discriminate)
  fg_write("fs_write_deny.conf" as *u8, "blockw\n" as *u8)
  var ok12: i64 = 0
  if fg_put("/tmp/fsgate/blockw.txt" as *u8, "x\n" as *u8) == 0 - (2 as i64) {
      fio_unlink("fs_write_deny.conf" as *u8)
      if fg_put("/tmp/fsgate/blockw.txt" as *u8, "x\n" as *u8) == vw_slen("x\n" as *u8) { ok12 = 1 }
  }
  fg_check("write-deny-conf-both-ways" as *u8, ok12, pass)
  // T13 edit UNIQUE match replaces and preserves the rest
  fg_put("/tmp/fsgate/e.txt" as *u8, "alpha beta gamma\n" as *u8)
  var ok13: i64 = 0
  if fsx_edit("/tmp/fsgate/e.txt" as *u8, "beta" as *u8, "BETA" as *u8, 0) == vw_slen("alpha BETA gamma\n" as *u8) {
      ok13 = fg_readback_eq("/tmp/fsgate/e.txt" as *u8, "alpha BETA gamma\n" as *u8)
  }
  fg_check("edit-unique-replaces" as *u8, ok13, pass)
  // T14 edit NOMATCH leaves the file untouched
  var ok14: i64 = 0
  if fsx_edit("/tmp/fsgate/e.txt" as *u8, "zeta" as *u8, "x" as *u8, 0) == 0 - FSX_RC_NOMATCH {
      ok14 = fg_readback_eq("/tmp/fsgate/e.txt" as *u8, "alpha BETA gamma\n" as *u8)
  }
  fg_check("edit-nomatch-unchanged" as *u8, ok14, pass)
  // T15 edit AMBIGUOUS without `all` refuses and leaves the file untouched
  fg_put("/tmp/fsgate/d.txt" as *u8, "dup dup\n" as *u8)
  var ok15: i64 = 0
  if fsx_edit("/tmp/fsgate/d.txt" as *u8, "dup" as *u8, "x" as *u8, 0) == 0 - FSX_RC_AMBIG {
      ok15 = fg_readback_eq("/tmp/fsgate/d.txt" as *u8, "dup dup\n" as *u8)
  }
  fg_check("edit-ambiguous-unchanged" as *u8, ok15, pass)
  // T16 edit `all` replaces every occurrence
  var ok16: i64 = 0
  if fsx_edit("/tmp/fsgate/d.txt" as *u8, "dup" as *u8, "x" as *u8, 1) == vw_slen("x x\n" as *u8) {
      ok16 = fg_readback_eq("/tmp/fsgate/d.txt" as *u8, "x x\n" as *u8)
  }
  fg_check("edit-all-replaces-every" as *u8, ok16, pass)
131
  // T17 lines returns the EXACT requested window (line-addressed read: grep's file:LINE now composes)
  fg_write("/tmp/fsgate/lines.txt" as *u8, "L1\nL2\nL3\nL4\nL5\n" as *u8)
  var ok17: i64 = 0
  if fsx_read_lines("/tmp/fsgate/lines.txt" as *u8, 2, 2) == vw_slen("L2\nL3\n" as *u8) { ok17 = 1 }
  fg_check("lines-exact-window" as *u8, ok17, pass)
  // T18 lines BEYOND EOF fails LOUD (0 bytes + explicit banner) -- never a silent empty window
  var ok18: i64 = 0
  if fsx_read_lines("/tmp/fsgate/lines.txt" as *u8, 99, 5) == 0 { ok18 = 1 }
  fg_check("lines-beyond-eof-loud" as *u8, ok18, pass)
  // T19 lines INHERITS the secret deny-list -- a NEW read path must never become a key-theft primitive
  var ok19: i64 = 0
  if fsx_read_lines("/tmp/fsgate/mysecret_key.bin" as *u8, 1, 5) == 0 - (2 as i64) { ok19 = 1 }
  fg_check("lines-inherits-secret-deny" as *u8, ok19, pass)
145
  // T20-T23 COMPARE-AND-SWAP, and T20 is the whole point (seq1422): the CAS
  // guard shipped REFUSING every correct expectation because only its refusal
  // path had ever been driven. ★LAW: A GUARD'S SUCCESS PATH MUST BE TESTED,
  // NOT JUST ITS REFUSAL PATH -- an always-refusing guard is not safety, it is
  // a bypass generator (it drove authors to raw scp/ssh, the unguarded write
  // path that destroyed shipped work in seq1439/seq1392).
  var ok20: i64 = 0
  if fsx_cas_ok(5986, "expect=5986" as *u8) == 1 { ok20 = 1 }
  fg_check("cas-correct-expect-ALLOWS" as *u8, ok20, pass)
  var ok21: i64 = 0
  if fsx_cas_ok(5986, "expect=42" as *u8) == 0 { ok21 = 1 }
  fg_check("cas-stale-expect-REFUSES" as *u8, ok21, pass)
  var ok22: i64 = 0
  if fsx_cas_ok(5986, "expect=any" as *u8) == 1 { ok22 = 1 }
  fg_check("cas-any-is-the-declared-escape-hatch" as *u8, ok22, pass)
  // a token carrying no digits must REFUSE, never silently read as 0 == size
  var ok23: i64 = 0
  if fsx_cas_ok(0, "expect=" as *u8) == 0 { ok23 = 1 }
  fg_check("cas-empty-value-REFUSES-not-zero-match" as *u8, ok23, pass)
165
  fsx_puts("FSOPS-GATE pass=" as *u8); fsx_putn(pass[0]); fsx_puts("/" as *u8); fsx_putn(GATE_CHECKS); fsx_puts(" verdict=" as *u8)
  if pass[0] == GATE_CHECKS { fsx_puts("GREEN\n" as *u8); return 0 }
  fsx_puts("RED\n" as *u8)
  return 1
170}
nx_fsops_gate.nx source

`nx_fsops_gate.nx` source
