nx_galx_authz_gate.nx source

1// nx_galx_authz_gate.nx -- proves the gallery access model on the REAL catalog (galx_vid_rules.tsv + real paths): 2// the cam recordings (r) and the NSFW reddit/tumblr/redgifs (v) are OWNER-ONLY (only elder, from anywhere); SFW 3// media (m) maps to family. Uses the actual rules file + real example paths from galx_vid_paths.tsv. The SFW 4// movie library (Zatoichi/Mr Bean) is a SEPARATE area (nx_media_server) served at family level. license_tier: ORIGINAL 5import "nx_galx_authz.nx" 6import "nx_syscalls.nx" 7 8func zw(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 9func zslen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 10func zrow(id: i64, ok: i64, what: *u8) -> i64 { zw("GZROW " as *u8); let b: *u8=sys_mmap(8); b[0]=(48+id) as u8; sys_write(1,b,1); zw(" " as *u8); if ok==1 { zw("PASS " as *u8) } else { zw("FAIL " as *u8) } zw(what); zw("\n" as *u8); return ok } 11 12func main() -> i64 { 13 zw("galx authz gate: recordings + NSFW (reddit/tumblr) are OWNER-ONLY; SFW media -> family (real catalog rules)\n" as *u8) 14 15 let box: *i64 = sys_mmap(16) as *i64 16 let rb: *u8 = sys_read_file("knowledge/status/galx_vid_rules.tsv" as *u8, box) 17 let rsz: i64 = box[0] 18 if (rb as i64) == 0 { zw("RULES MISSING\n" as *u8); sys_exit(1) } 19 20 let beanco: *u8 = "/mnt/nas_logging/beanco_/beanco__2025-10-20_22-51-12_681.ts" as *u8 21 let redg: *u8 = "/mnt/nas_logging/Redgifs/duke_stat0sphere/GiantFlashyJumpingbean.mp4" as *u8 22 let other: *u8 = "/mnt/nas_logging/somecam/clip_2025.ts" as *u8 23 24 var rows: i64 = 0 25 var pass: i64 = 0 26 var ok: i64 = 0 27 28 // R0: a cam recording categorizes as 'r' (recordings) 29 ok = 0; if galx_cat_of(beanco, 0, zslen(beanco), rb, rsz) == 114 { ok = 1 } 30 rows=rows+1; pass=pass+zrow(0, ok, "cam recording (beanco) -> category 'r' (recordings)" as *u8) 31 32 // R1: a Redgifs path categorizes as 'v' (NSFW) 33 ok = 0; if galx_cat_of(redg, 0, zslen(redg), rb, rsz) == 118 { ok = 1 } 34 rows=rows+1; pass=pass+zrow(1, ok, "Redgifs/reddit/tumblr -> category 'v' (NSFW)" as *u8) 35 36 // R2: category -> level mapping (m=family, r+v=owner-only) 37 ok = 0; if galx_cat_level(109) == GALX_FAMILY { if galx_cat_level(114) == GALX_OWNER { if galx_cat_level(118) == GALX_OWNER { ok = 1 } } } 38 rows=rows+1; pass=pass+zrow(2, ok, "category->level: m=family, r=owner, v=owner" as *u8) 39 40 // R3: FAMILY level is DENIED the recordings (owner-only) 41 ok = 0; if galx_can_view(GALX_FAMILY, beanco, 0, zslen(beanco), rb, rsz) == 0 { ok = 1 } 42 rows=rows+1; pass=pass+zrow(3, ok, "family DENIED the cam recordings (owner-only: nobody but you)" as *u8) 43 44 // R4: FAMILY level is DENIED the NSFW (owner-only) 45 ok = 0; if galx_can_view(GALX_FAMILY, redg, 0, zslen(redg), rb, rsz) == 0 { ok = 1 } 46 rows=rows+1; pass=pass+zrow(4, ok, "family DENIED the NSFW reddit/tumblr (owner-only)" as *u8) 47 48 // R5: the OWNER can view BOTH recordings + NSFW (from anywhere) 49 ok = 0; if galx_can_view(GALX_OWNER, beanco, 0, zslen(beanco), rb, rsz) == 1 { if galx_can_view(GALX_OWNER, redg, 0, zslen(redg), rb, rsz) == 1 { ok = 1 } } 50 rows=rows+1; pass=pass+zrow(5, ok, "OWNER (you) sees recordings + NSFW, from anywhere" as *u8) 51 52 // R6: an uncategorized path falls to the safe floor -- 'r' (owner-only), family denied 53 ok = 0; if galx_cat_of(other, 0, zslen(other), rb, rsz) == 114 { if galx_can_view(GALX_FAMILY, other, 0, zslen(other), rb, rsz) == 0 { ok = 1 } } 54 rows=rows+1; pass=pass+zrow(6, ok, "deny-by-default: uncategorized -> recordings/owner-only (safe floor)" as *u8) 55 56 zw("NX-GALX-AUTHZ-GATE rows=" as *u8); let rbz: *u8=sys_mmap(8); rbz[0]=(48+rows) as u8; sys_write(1,rbz,1); zw(" pass=" as *u8); let pbz: *u8=sys_mmap(8); pbz[0]=(48+pass) as u8; sys_write(1,pbz,1); zw("\n" as *u8) 57 if pass == rows { 58 let line: *u8 = "CMSGATE row=nx_galx_authz gallery-recordings+nsfw-owner-only rows=7 pass=7 verdict=PASS\n" as *u8 59 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 60 if gf >= 0 { sys_write(gf, line, zslen(line)); sys_close(gf) } 61 zw("NX-GALX-AUTHZ-GATE GREEN 7/7 (recordings + NSFW owner-only on the real catalog; SFW media -> family)\n" as *u8) 62 sys_exit(0); return 0 63 } 64 zw("NX-GALX-AUTHZ-GATE RED\n" as *u8) 65 sys_exit(1); return 1 66}