nx_gen_authz_gate.nx source

1// nx_gen_authz_gate.nx -- proves the AREA-APPROVAL authZ (operator 2026-06-24: "use my nishifamily login + OPAQUE 2// allows access to NEW areas they're approved on"). REUSES the existing entitlement engine (nx_hr_entitle): grant 3// /gen to a handle via he_ent_put (the rollout/approval action), then he_has_access gates per-area. NO new auth realm. 4// GREEN iff: granted->access, NOT-granted->denied (deny-by-default), public "*"->all, owner(super)->all, unknown-area->denied. 5// license_tier: ORIGINAL 6import "nx_hr_entitle.nx" 7import "nx_syscalls.nx" 8import "nx_gate_verdict.nx" 9 10const GA_ENT: *u8 = "knowledge/status/gen_authz_test_ent-" 11 12func ga_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 13func ga_pn(v: i64) -> i64 { 14 let bb: *u8=sys_mmap(28); let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0 15 if m==0 { t[0]=48 as u8; k=1 } 16 while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } 17 var i: i64=0; while i<k { bb[i]=t[k-1-i]; i=i+1 } 18 sys_write(1, bb, k); return 0 19} 20 21func main() -> i64 { 22 ga_p("=== nx_gen_authz_gate: area-approval authZ (single nishifamily login + approve-by-area) ===\n" as *u8) 23 // ROLL OUT + APPROVE: grant the new /gen area to the operator (idempotent he_ent_put = the approval action). 24 he_ent_put(GA_ENT, "*" as *u8, "Wiki" as *u8, "/wiki" as *u8) 25 he_ent_put(GA_ENT, "elderwesto" as *u8, "AI Studio" as *u8, "/gen" as *u8) 26 // per-area gate checks (super=0 = a normal logged-in user; super=1 = the owner) 27 let t1: i64 = he_has_access(0, "elderwesto" as *u8, 10, GA_ENT, "/gen" as *u8) 28 let t2: i64 = he_has_access(0, "guest" as *u8, 5, GA_ENT, "/gen" as *u8) 29 let t3: i64 = he_has_access(0, "guest" as *u8, 5, GA_ENT, "/wiki" as *u8) 30 let t4: i64 = he_has_access(1, "anyone" as *u8, 6, GA_ENT, "/gen" as *u8) 31 let t5: i64 = he_has_access(0, "elderwesto" as *u8, 10, GA_ENT, "/nosucharea" as *u8) 32 ga_p(" approved(/gen, elderwesto)=" as *u8); ga_pn(t1) 33 ga_p(" denied(/gen, guest)=" as *u8); ga_pn(t2) 34 ga_p(" public(/wiki, guest)=" as *u8); ga_pn(t3) 35 ga_p(" owner(/gen, super)=" as *u8); ga_pn(t4) 36 ga_p(" unknown(/nosucharea, elderwesto)=" as *u8); ga_pn(t5) 37 ga_p("\n" as *u8) 38 // REPAIRED 2026-09-04. nx_gate_dry_apply's D001 "minimal form" left the gv_verdict call INSIDE 39 // `if pass==1 {`, consumed that block's closing brace, and deleted the RED emission outright -- 40 // so this file could not compile at all, and had it compiled it would have printed NOTHING when 41 // the gate failed. THE LOUD HALF OF THAT DEFECT IS WHAT STOPPED THE SILENT HALF FROM SHIPPING. 42 // Migrated by hand onto PER-TOOTH gv_check, because the machine form set ctr[0]=pass, ctr[1]=1 -- 43 // a one-state judge reports `passed 1/1` and cannot say WHICH conjunct dropped, which is exactly 44 // what gv_ctr exists to prevent. The two deny cases are named neg-control- so the L2 census can 45 // see them: a control nobody can find is a control nobody maintains. 46 let ctr: *i64 = gv_ctr() 47 gv_check("approved-handle-reaches-granted-area" as *u8, (t1 == 1) as i64, ctr) 48 gv_check("neg-control-unapproved-handle-denied" as *u8, (t2 == 0) as i64, ctr) 49 gv_check("public-star-area-open-to-all" as *u8, (t3 == 1) as i64, ctr) 50 gv_check("owner-super-reaches-every-area" as *u8, (t4 == 1) as i64, ctr) 51 gv_check("neg-control-unknown-area-denied" as *u8, (t5 == 0) as i64, ctr) 52 gv_values_head() 53 gv_kv("access_approved_handle" as *u8, t1) 54 gv_kv("access_unapproved_handle" as *u8, t2) 55 gv_kv("access_public_star" as *u8, t3) 56 gv_kv("access_owner_super" as *u8, t4) 57 gv_kv("access_unknown_area" as *u8, t5) 58 let rc: i64 = gv_verdict("GEN-AUTHZ-GATE" as *u8, ctr, "area-approval authZ over the existing entitlement engine -- no new auth realm" as *u8) 59 sys_exit(rc) 60 return rc 61}