nx_gen_authz_gate.nx source

1// nx_gen_authz_gate.nx -- proves the AREA-APPROVAL authZ (operator 2026-06-24: "use my nishifamily login + OPAQUE 2// allows access to NEW areas they're approved on"). REUSES the existing entitlement engine (nx_hr_entitle): grant 3// /gen to a handle via he_ent_put (the rollout/approval action), then he_has_access gates per-area. NO new auth realm. 4// GREEN iff: granted->access, NOT-granted->denied (deny-by-default), public "*"->all, owner(super)->all, unknown-area->denied. 5// license_tier: ORIGINAL 6import "nx_hr_entitle.nx" 7import "nx_syscalls.nx" 8import "nx_gate_verdict.nx" 9 10const GA_ENT: *u8 = "knowledge/status/gen_authz_test_ent-" 11 12func ga_p(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 13func ga_pn(v: i64) -> i64 { 14 let bb: *u8=sys_mmap(28); let t: *u8=sys_mmap(28); var m: i64=v; var k: i64=0 15 if m==0 { t[0]=48 as u8; k=1 } 16 while m>0 { t[k]=(48+(m%10)) as u8; m=m/10; k=k+1 } 17 var i: i64=0; while i<k { bb[i]=t[k-1-i]; i=i+1 } 18 sys_write(1, bb, k); return 0 19} 20 21func main() -> i64 { 22 ga_p("=== nx_gen_authz_gate: area-approval authZ (single nishifamily login + approve-by-area) ===\n" as *u8) 23 // ROLL OUT + APPROVE: grant the new /gen area to the operator (idempotent he_ent_put = the approval action). 24 he_ent_put(GA_ENT, "*" as *u8, "Wiki" as *u8, "/wiki" as *u8) 25 he_ent_put(GA_ENT, "elderwesto" as *u8, "AI Studio" as *u8, "/gen" as *u8) 26 // per-area gate checks (super=0 = a normal logged-in user; super=1 = the owner) 27 let t1: i64 = he_has_access(0, "elderwesto" as *u8, 10, GA_ENT, "/gen" as *u8) 28 let t2: i64 = he_has_access(0, "guest" as *u8, 5, GA_ENT, "/gen" as *u8) 29 let t3: i64 = he_has_access(0, "guest" as *u8, 5, GA_ENT, "/wiki" as *u8) 30 let t4: i64 = he_has_access(1, "anyone" as *u8, 6, GA_ENT, "/gen" as *u8) 31 let t5: i64 = he_has_access(0, "elderwesto" as *u8, 10, GA_ENT, "/nosucharea" as *u8) 32 ga_p(" approved(/gen, elderwesto)=" as *u8); ga_pn(t1) 33 ga_p(" denied(/gen, guest)=" as *u8); ga_pn(t2) 34 ga_p(" public(/wiki, guest)=" as *u8); ga_pn(t3) 35 ga_p(" owner(/gen, super)=" as *u8); ga_pn(t4) 36 ga_p(" unknown(/nosucharea, elderwesto)=" as *u8); ga_pn(t5) 37 ga_p("\n" as *u8) 38 var pass: i64 = 0 39 if t1==1 { if t2==0 { if t3==1 { if t4==1 { if t5==0 { pass=1 } } } } } 40 if pass==1 { 41 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 42 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 43 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 44 let ctr__dry: *i64 = gv_ctr() 45 ctr__dry[0] = pass 46 ctr__dry[1] = 1 47 let rc__dry: i64 = gv_verdict("GEN-AUTHZ-GATE" as *u8, ctr__dry, "per-area approval gates correctly: approve->access, deny-by-default, public-*, owner-all, unknown-denied)" as *u8) 48 sys_exit(rc__dry) 49 return rc__dry 50}