nx_gallery_auth_research_fetch.nx source
↩ module page · 141 lines · 6607 B
1// nx_onsite_research_fetch.nx -- SOVEREIGN onsite-search WORLD-CLASS research fetch.
2//
3// Rung S-RESEARCH-1 of the reusable onsite-search arc: ground the S-class exceed
4// census on REAL sourced facts about the world-class open-source onsite search
5// engines (global Rule 4 -- no assumptions; every census cell must cite a real
6// fetch, not memory). Reuses the team's OWN proven sovereign HTTPS stack
7// (nx_tls13_client_session_run + nx_https_get_complete; no browser/node/curl),
8// validated against the real Mozilla CA store -- the IDENTICAL path proven live
9// in nx_library_fetch (the lib_* corpus fetched 2026-06-16).
10//
11// Fetches the fact-dense OPEN pages (en.wikipedia.org, static, NishiBot allowed,
12// canonical/parens-free titles -> no redirect) for the engines we measure against:
13// /wiki/Apache_Lucene -> srch_lucene.raw (Apache: the OSS IR library)
14// /wiki/Apache_Solr -> srch_solr.raw (Apache: Lucene-based search server)
15// /wiki/Elasticsearch -> srch_elastic.raw (the dominant OSS/commercial engine)
16// /wiki/Learning_to_rank -> srch_ltr.raw (the relevance frontier beyond BM25)
17// /wiki/Full-text_search -> srch_fulltext.raw (the onsite-search capability frame)
18//
19// expect_exit: 0
20// license_tier: ORIGINAL (clone of nx_library_fetch; only the URLs differ)
21
22import "nx_syscalls.nx"
23import "nx_x509_trust_store.nx"
24import "nx_trust_store_load_from_certdata.nx"
25import "nx_tls13_client_validate_certificate.nx"
26import "nx_tls13_client_session_run.nx"
27import "nx_csprng.nx" // SEV-9 1785970852: real per-connection handshake entropy
28import "nx_https_url_for_fetch.nx"
29import "nx_https_url_connect.nx"
30import "nx_https_get.nx"
31import "nx_https_get_complete.nx"
32import "nx_http_response_parse.nx"
33const K_MAGIC_4194304: i64 = 4194304
34
35func sf_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
36func sf_putn(v: i64) -> i64 {
37 let bb: *u8 = sys_mmap(28); var m: i64 = v
38 if m < 0 { m = 0 - m; sys_write(1, "-" as *u8, 1) }
39 let t: *u8 = sys_mmap(28); var k: i64 = 0
40 if m == 0 { t[0] = 48 as u8; k = 1 }
41 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
42 var i: i64 = 0; while i < k { bb[i] = t[k - 1 - i]; i = i + 1 } sys_write(1, bb, k); return 0
43}
44func sf_strlen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
45
46// Fetch one page over the sovereign TLS1.3 client, save the raw response.
47// Returns the HTTP status (200 ok), or a negative error code.
48func fetch_page(store: *TrustStore, full_url: *u8, path: *u8, path_len: i64, out_path: *u8) -> i64 {
49 sf_puts("--- fetch "); sf_puts(full_url); sf_puts("\n")
50
51 // SEV-9 FIX 2026-08-05 (debt 1785970852, CWE-330). This one mattered most of the set: it is an
52 // AUTHENTICATED fetch, so credentials rode a session whose ephemeral key was a fleet-wide constant.
53 let cr: *u8 = sys_mmap(32)
54 var i: i64 = 0
55 nx_csprng_fill(cr, 32)
56 let priv: *u8 = sys_mmap(32)
57 i = 0
58 nx_csprng_fill(priv, 32)
59
60 let url_p: *NxUrl = nx_url_new()
61 let target_raw: *u8 = sys_mmap(32)
62 let target: *NxHttpsTarget = target_raw as *NxHttpsTarget
63 target.url = url_p
64 target.port = 0
65 if nx_https_url_for_fetch(full_url, target) != NX_HTTPS_URL_OK { return 0 - 41 }
66
67 let fd_p: *i64 = sys_mmap(16) as *i64
68 if nx_https_url_connect(target, full_url, sys_now_realtime_sec(), fd_p) != NX_HTTPS_CONNECT_OK { return 0 - 42 }
69 let fd: i64 = *fd_p
70
71 let val_ctx_raw: *u8 = sys_mmap(64)
72 let val_ctx: *TlsValidationContext = val_ctx_raw as *TlsValidationContext
73 val_ctx.store = store
74 val_ctx.sni_host = full_url + target.url.host_off
75 val_ctx.sni_host_len = target.url.host_len
76 val_ctx.now_epoch = sys_now_realtime_sec()
77
78 let sr: i64 = nx_tls13_client_session_run(
79 fd, full_url + target.url.host_off, target.url.host_len,
80 cr, priv, val_ctx
81 )
82 if sr <= 0 { sys_close(fd); return 0 - (200 + (0 - sr)) }
83
84 let session: *Tls13ClientSession = sr as *Tls13ClientSession
85 let buf: *u8 = sys_mmap(K_MAGIC_4194304)
86 let gc: i64 = nx_https_get_complete(
87 session, fd, path, path_len,
88 full_url + target.url.host_off, target.url.host_len,
89 buf, K_MAGIC_4194304
90 )
91 sys_close(fd)
92 if gc < 0 { return 0 - (100 + (0 - gc)) }
93
94 let rs: *i64 = sys_mmap(128) as *i64
95 nx_http_response_parse(buf, gc, rs)
96 let status: i64 = rs[1]
97
98 let ofd: i64 = sys_openat_wr(out_path, 0x1A4)
99 if ofd <= 0 { return 0 - 70 }
100 sys_write(ofd, buf, gc)
101 sys_close(ofd)
102
103 sf_puts(" ST="); sf_putn(status); sf_puts(" GC="); sf_putn(gc); sf_puts(" -> "); sf_puts(out_path); sf_puts("\n")
104 return status
105}
106
107func main() -> i64 {
108 let cpath: *u8 = "/tmp/mozilla_certdata.txt\x00"
109 let r: i64 = nx_trust_store_load_from_certdata(cpath, 512, K_MAGIC_4194304)
110 if r <= 0 { sf_puts("SRCH-FETCH: certdata load failed\n"); return 1 }
111 let store: *TrustStore = r as *TrustStore
112 let n: i64 = trust_store_count(store)
113 if n < 50 { sf_puts("SRCH-FETCH: too few CAs\n"); return 3 }
114 sf_puts("CA="); sf_putn(n); sf_puts("\n")
115
116 var ok: i64 = 0
117
118 let u1: *u8 = "https://en.wikipedia.org/wiki/Service_worker\x00"
119 let p1: *u8 = "/wiki/Service_worker\x00"
120 if fetch_page(store, u1, p1, sf_strlen(p1), "knowledge/fetched/gauth_sw_wiki.raw\x00" as *u8) == 200 { ok = ok + 1 }
121
122 let u2: *u8 = "https://en.wikipedia.org/wiki/HTTP_cookie\x00"
123 let p2: *u8 = "/wiki/HTTP_cookie\x00"
124 if fetch_page(store, u2, p2, sf_strlen(p2), "knowledge/fetched/gauth_cookie_wiki.raw\x00" as *u8) == 200 { ok = ok + 1 }
125
126 let u3: *u8 = "https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API\x00"
127 let p3: *u8 = "/en-US/docs/Web/API/Service_Worker_API\x00"
128 if fetch_page(store, u3, p3, sf_strlen(p3), "knowledge/fetched/gauth_sw_mdn.raw\x00" as *u8) == 200 { ok = ok + 1 }
129
130 let u4: *u8 = "https://en.wikipedia.org/wiki/Cross-site_request_forgery\x00"
131 let p4: *u8 = "/wiki/Cross-site_request_forgery\x00"
132 if fetch_page(store, u4, p4, sf_strlen(p4), "knowledge/fetched/gauth_csrf_wiki.raw\x00" as *u8) == 200 { ok = ok + 1 }
133
134 let u5: *u8 = "https://developer.mozilla.org/en-US/docs/Web/API/FetchEvent\x00"
135 let p5: *u8 = "/en-US/docs/Web/API/FetchEvent\x00"
136 if fetch_page(store, u5, p5, sf_strlen(p5), "knowledge/fetched/gauth_fetchevent_mdn.raw\x00" as *u8) == 200 { ok = ok + 1 }
137
138 sf_puts("SRCH-SOVEREIGN-FETCH-OK pages_200="); sf_putn(ok); sf_puts("/5\n")
139 if ok < 1 { return 51 }
140 return 0
141}