nx_iot_hub_tenant_gate.nx source
↩ module page · 68 lines · 4146 B
1// nx_iot_hub_tenant_gate.nx -- proves IoT multi-tenancy is the NISHI HR SPINE, not a bespoke store:
2// - HR level -> IoT tier mapping (owner/family/deny)
3// - per-HOUSE isolation BY CONSTRUCTION: enroll owner of house_b; resolved against house_a -> DENY
4// (same handle, different realm = different cred = level 0) -- the key sharding proof
5// - level drives the tier: house_a owner=OWNER, house_a family=FAMILY, stranger=DENY, suspended=DENY
6// - the DENY render leaks NO devices + NO control forms; FAMILY/OWNER do; OWNER alone gets /home/manage
7// Uses a fresh temp HR store (unlinked first for determinism). expect_exit: 0 license_tier: ORIGINAL
8import "nx_iot_hub_tenant.nx"
9
10const TG_STORE: *u8 = "/tmp/iot_hr_tenant_gate.store"
11
12func tg_find(h: *u8, n: i64, pat: *u8) -> i64 {
13 var pl: i64 = 0
14 while pat[pl] != (0 as u8) { pl = pl + 1 }
15 return cp_find(h, n, pat, pl)
16}
17
18func main() -> i64 {
19 // fresh store (unlinkat AT_FDCWD) so the append-only directory is deterministic per run
20 __syscall(263, AT_FDCWD, TG_STORE as i64, 0, 0, 0, 0)
21
22 let cred: *u8 = sys_mmap(96)
23 // enroll: house_a owner alice(3), house_a family bob(1), house_b owner carol(3)
24 if hr_enroll(TG_STORE, "house_a" as *u8, 7, "alice" as *u8, 5, 3, "west" as *u8, 1, "test" as *u8, cred) != 0 { return 1 }
25 if hr_enroll(TG_STORE, "house_a" as *u8, 7, "bob" as *u8, 3, 1, "west" as *u8, 2, "test" as *u8, cred) != 0 { return 2 }
26 if hr_enroll(TG_STORE, "house_b" as *u8, 7, "carol" as *u8, 5, 3, "east" as *u8, 3, "test" as *u8, cred) != 0 { return 3 }
27
28 // tier resolution via HR
29 if iot_hub_viewer_access(TG_STORE, "house_a" as *u8, 7, "alice" as *u8, 5) != IOT_OWNER { return 10 }
30 if iot_hub_viewer_access(TG_STORE, "house_a" as *u8, 7, "bob" as *u8, 3) != IOT_FAMILY { return 11 }
31 if iot_hub_viewer_access(TG_STORE, "house_b" as *u8, 7, "carol" as *u8, 5) != IOT_OWNER { return 12 }
32 // unknown handle in house_a -> DENY
33 if iot_hub_viewer_access(TG_STORE, "house_a" as *u8, 7, "stranger" as *u8, 8) != IOT_DENY { return 13 }
34 // *** ISOLATION BY CONSTRUCTION ***: carol owns house_b, but in house_a she is a stranger -> DENY
35 if iot_hub_viewer_access(TG_STORE, "house_a" as *u8, 7, "carol" as *u8, 5) != IOT_DENY { return 14 }
36 // and alice (house_a owner) is NOT in house_b -> DENY there
37 if iot_hub_viewer_access(TG_STORE, "house_b" as *u8, 7, "alice" as *u8, 5) != IOT_DENY { return 15 }
38
39 // suspend bob -> DENY (lifecycle takes effect through HR)
40 let bcred: *u8 = sys_mmap(96)
41 let bclen: i64 = hr_cred_id("house_a" as *u8, 7, "bob" as *u8, 3, bcred)
42 if bclen <= 0 { return 16 }
43 if hr_suspend(TG_STORE, bcred, "bob" as *u8, "west" as *u8, 4, "test" as *u8) != 0 { return 17 }
44 if iot_hub_viewer_access(TG_STORE, "house_a" as *u8, 7, "bob" as *u8, 3) != IOT_DENY { return 18 }
45
46 // ---- render gating ----
47 let h: *u8 = sys_mmap(262144)
48 // DENY render: no devices, no control forms, but a denial notice; still zero-JS
49 let dn: i64 = iot_tenant_render(h, "house_a" as *u8, IOT_DENY)
50 if tg_find(h, dn, "<script" as *u8) != (0 - 1) { return 20 }
51 if tg_find(h, dn, "192.168.10.166" as *u8) != (0 - 1) { return 21 } // NO device leak
52 if tg_find(h, dn, "action=\"/home/cmd\"" as *u8) != (0 - 1) { return 22 } // NO controls
53 if tg_find(h, dn, "Access denied" as *u8) < 0 { return 23 }
54
55 // FAMILY render: devices + on/off controls, but NO manage route
56 let fn: i64 = iot_tenant_render(h, "house_a" as *u8, IOT_FAMILY)
57 if tg_find(h, fn, "192.168.10.166" as *u8) < 0 { return 30 }
58 if tg_find(h, fn, "action=\"/home/cmd\"" as *u8) < 0 { return 31 }
59 if tg_find(h, fn, "action=\"/home/manage\"" as *u8) != (0 - 1) { return 32 } // family CANNOT manage
60
61 // OWNER render: devices + controls + the manage route
62 let on: i64 = iot_tenant_render(h, "house_a" as *u8, IOT_OWNER)
63 if tg_find(h, on, "action=\"/home/cmd\"" as *u8) < 0 { return 40 }
64 if tg_find(h, on, "action=\"/home/manage\"" as *u8) < 0 { return 41 } // owner CAN manage
65
66 __syscall(263, AT_FDCWD, TG_STORE as i64, 0, 0, 0, 0)
67 return 0
68}