nx_hr_visitor_gate.nx source

1// nx_hr_visitor_gate.nx -- referee for NISHI HR visitor module (the front desk). PROVES: a normal visitor is 2// NEUTRAL (served); a wanted/business visitor is WELCOME; a blocklisted, abusive-rate, or bot visitor is BLOCK; 3// bot-UA + rate heuristics work; and the SECURITY PRIORITY -- a WELCOMED visitor who turns abusive is still 4// BLOCKED. GREEN iff every row matches. Prints verdict=GREEN to STDOUT *and* returns the exit code. 5// Durable -> knowledge/status/hr_visitor_gate.log. license_tier: ORIGINAL 6import "nx_hr_visitor.nx" 7import "nx_g_puts_lib.nx" 8import "nx_syscalls.nx" 9 10func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 11func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 12func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 13func rput(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ dst[off+i]=s[i]; i=i+1 } return off+i } 14func gwrite(path: *u8, s: *u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } if n>0 { sys_write(fd, s, n) } sys_close(fd); return 0 } 15func chk(got: i64, want: i64, label: *u8) -> i64 { 16 g_puts(" "); g_puts(label); g_puts(" got="); g_num(got); g_puts(" want="); g_num(want) 17 if got == want { g_puts(" PASS\n"); return 1 } 18 g_puts(" FAIL\n"); return 0 19} 20 21func main() -> i64 { 22 g_puts("=== NISHI HR VISITOR GATE (front desk: welcome business / block hostile + bots by behavior) ===\n" as *u8) 23 var pass: i64=0 24 var rows: i64=0 25 let block: *u8 = "/tmp/nx_hv_block" as *u8 26 let welc: *u8 = "/tmp/nx_hv_welcome" as *u8 27 28 let bb: *u8 = sys_mmap(256); var bo: i64 = rput(bb,0,"1.2.3.4" as *u8); bb[bo]=10 as u8; bo=bo+1; bo=rput(bb,bo,"5.6.7.8" as *u8); bb[bo]=10 as u8; bo=bo+1 29 gwrite(block, bb, bo) 30 let wb: *u8 = sys_mmap(256); var wo: i64 = rput(wb,0,"biz.example" as *u8); wb[wo]=10 as u8; wo=wo+1 31 gwrite(welc, wb, wo) 32 33 let moz: *u8 = "Mozilla/5.0 (Windows NT 10.0)" as *u8 34 rows=rows+1; pass=pass+chk(hv_classify("9.9.9.9" as *u8, 7, 5, 60, moz, block, welc), HV_NEUTRAL, "normal visitor -> NEUTRAL (served)" as *u8) 35 rows=rows+1; pass=pass+chk(hv_classify("1.2.3.4" as *u8, 7, 5, 60, moz, block, welc), HV_BLOCK, "blocklisted -> BLOCK (kicked)" as *u8) 36 rows=rows+1; pass=pass+chk(hv_classify("biz.example" as *u8, 11, 5, 60, moz, block, welc), HV_WELCOME, "business visitor -> WELCOME" as *u8) 37 rows=rows+1; pass=pass+chk(hv_classify("9.9.9.9" as *u8, 7, 1000, 60, moz, block, welc), HV_BLOCK, "abusive rate (1000/60s) -> BLOCK" as *u8) 38 rows=rows+1; pass=pass+chk(hv_classify("9.9.9.9" as *u8, 7, 5, 60, "python-requests/2.31" as *u8, block, welc), HV_BLOCK, "bot UA -> BLOCK" as *u8) 39 rows=rows+1; pass=pass+chk(hv_is_bot("Googlebot/2.1 (+http://google.com/bot.html)" as *u8), 1, "is_bot(Googlebot)=1" as *u8) 40 rows=rows+1; pass=pass+chk(hv_is_bot(moz), 0, "is_bot(real browser)=0" as *u8) 41 rows=rows+1; pass=pass+chk(hv_rate_abusive(1000, 60), 1, "rate_abusive(1000,60)=1" as *u8) 42 rows=rows+1; pass=pass+chk(hv_rate_abusive(5, 60), 0, "rate_abusive(5,60)=0" as *u8) 43 rows=rows+1; pass=pass+chk(hv_classify("biz.example" as *u8, 11, 1000, 60, moz, block, welc), HV_BLOCK, "WELCOMED but ABUSIVE -> BLOCK (security priority)" as *u8) 44 45 g_puts("----\nNISHI-HR-VISITOR-GATE rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass) 46 if pass==rows { g_puts(" verdict=GREEN\n" as *u8) } else { g_puts(" verdict=RED\n" as *u8) } 47 let lg: i64=sys_openat_append("knowledge/status/hr_visitor_gate.log" as *u8, 0x1a4) 48 if lg>=0 { 49 g_w(lg, "NISHI-HR-VISITOR-GATE rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass) 50 if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 51 sys_close(lg) 52 } 53 if pass==rows { sys_exit(0); return 0 } 54 sys_exit(1); return 1 55}