nx_log_category_test.nx source

1// nx_log_category_test.nx -- smoke for system-vs-people enforcement. 2// 3// expect_exit: 0 4// 5// license_tier: ORIGINAL 6 7import "nx_syscalls_x86_64.nx" 8import "nx_log_category.nx" 9 10func bytes_eq(a: *u8, b: *u8, n: i64) -> i64 { 11 var i: i64 = 0 12 while i < n { 13 if a[i] != b[i] { return 0 } 14 i = i + 1 15 } 16 return 1 17} 18 19func main() -> i64 { 20 // ---- Category enum gates ---- 21 if nxlc_category_is_valid(NXLC_SYSTEM_STATE) != 1 { return 1 } 22 if nxlc_category_is_valid(NXLC_PEOPLE_PII) != 1 { return 2 } 23 if nxlc_category_is_valid(NXLC_CATEGORY_N) != 0 { return 3 } 24 if nxlc_category_is_valid(-1) != 0 { return 4 } 25 26 // ---- Names + lengths ---- 27 if bytes_eq(nxlc_category_name(NXLC_SYSTEM_STATE), 28 "SYSTEM_STATE" as *u8, 12) != 1 { return 10 } 29 if bytes_eq(nxlc_category_name(NXLC_SYSTEM_PERF), 30 "SYSTEM_PERF" as *u8, 11) != 1 { return 11 } 31 if bytes_eq(nxlc_category_name(NXLC_SYSTEM_ERROR), 32 "SYSTEM_ERROR" as *u8, 12) != 1 { return 12 } 33 if bytes_eq(nxlc_category_name(NXLC_SYSTEM_CONFIG), 34 "SYSTEM_CONFIG" as *u8, 13) != 1 { return 13 } 35 if bytes_eq(nxlc_category_name(NXLC_SYSTEM_SECURITY), 36 "SYSTEM_SECURITY" as *u8, 15) != 1 { return 14 } 37 if bytes_eq(nxlc_category_name(NXLC_PEOPLE_PII), 38 "PEOPLE_PII" as *u8, 10) != 1 { return 15 } 39 if bytes_eq(nxlc_category_name(NXLC_PEOPLE_BEHAVIOR), 40 "PEOPLE_BEHAVIOR" as *u8, 15) != 1 { return 16 } 41 if bytes_eq(nxlc_category_name(NXLC_PEOPLE_LOCATION), 42 "PEOPLE_LOCATION" as *u8, 15) != 1 { return 17 } 43 44 // ---- Family predicates ---- 45 if nxlc_is_system(NXLC_SYSTEM_STATE) != 1 { return 20 } 46 if nxlc_is_system(NXLC_SYSTEM_PERF) != 1 { return 21 } 47 if nxlc_is_system(NXLC_SYSTEM_ERROR) != 1 { return 22 } 48 if nxlc_is_system(NXLC_SYSTEM_CONFIG) != 1 { return 23 } 49 if nxlc_is_system(NXLC_SYSTEM_SECURITY) != 1 { return 24 } 50 if nxlc_is_system(NXLC_PEOPLE_PII) != 0 { return 25 } 51 if nxlc_is_system(NXLC_PEOPLE_BEHAVIOR) != 0 { return 26 } 52 if nxlc_is_system(NXLC_PEOPLE_LOCATION) != 0 { return 27 } 53 54 if nxlc_is_people(NXLC_SYSTEM_STATE) != 0 { return 30 } 55 if nxlc_is_people(NXLC_PEOPLE_PII) != 1 { return 31 } 56 if nxlc_is_people(NXLC_PEOPLE_BEHAVIOR) != 1 { return 32 } 57 if nxlc_is_people(NXLC_PEOPLE_LOCATION) != 1 { return 33 } 58 59 // ---- Verdict enum ---- 60 if nxlc_verdict_is_valid(NXLC_OK) != 1 { return 40 } 61 if nxlc_verdict_is_valid(NXLC_REFUSED_NO_OVERRIDE) != 1 { return 41 } 62 if nxlc_verdict_is_valid(NXLC_VERDICT_N) != 0 { return 42 } 63 if bytes_eq(nxlc_verdict_name(NXLC_REFUSED_NO_OVERRIDE), 64 "REFUSED_NO_OVERRIDE" as *u8, 19) != 1 { return 43 } 65 66 // ---- SYSTEM categories: gate always OK ---- 67 if nx_log_category_gate(NXLC_SYSTEM_STATE, 68 0 as *u8, 0, 69 0 as *u8, 0) != NXLC_OK { return 50 } 70 if nx_log_category_gate(NXLC_SYSTEM_PERF, 71 0 as *u8, 0, 72 0 as *u8, 0) != NXLC_OK { return 51 } 73 if nx_log_category_gate(NXLC_SYSTEM_ERROR, 74 0 as *u8, 0, 75 0 as *u8, 0) != NXLC_OK { return 52 } 76 if nx_log_category_gate(NXLC_SYSTEM_CONFIG, 77 0 as *u8, 0, 78 0 as *u8, 0) != NXLC_OK { return 53 } 79 if nx_log_category_gate(NXLC_SYSTEM_SECURITY, 80 0 as *u8, 0, 81 0 as *u8, 0) != NXLC_OK { return 54 } 82 83 // ---- PEOPLE categories: REFUSED without override ---- 84 if nx_log_category_gate(NXLC_PEOPLE_PII, 85 0 as *u8, 0, 86 0 as *u8, 0) != NXLC_REFUSED_NO_OVERRIDE { return 60 } 87 if nx_log_category_gate(NXLC_PEOPLE_BEHAVIOR, 88 0 as *u8, 0, 89 0 as *u8, 0) != NXLC_REFUSED_NO_OVERRIDE { return 61 } 90 if nx_log_category_gate(NXLC_PEOPLE_LOCATION, 91 0 as *u8, 0, 92 0 as *u8, 0) != NXLC_REFUSED_NO_OVERRIDE { return 62 } 93 94 // ---- PEOPLE category: BAD_OVERRIDE for wrong token ---- 95 let bad_token: *u8 = "wrong-token-here" as *u8 96 if nx_log_category_gate(NXLC_PEOPLE_PII, 97 bad_token, 16, 98 "any cite" as *u8, 8) != NXLC_BAD_OVERRIDE { return 70 } 99 100 // ---- PEOPLE category: BAD_OVERRIDE for wrong length ---- 101 let short_token: *u8 = "privacy-overrid" as *u8 // 15 not 16 102 if nx_log_category_gate(NXLC_PEOPLE_PII, 103 short_token, 15, 104 "any cite" as *u8, 8) != NXLC_BAD_OVERRIDE { return 71 } 105 106 // ---- PEOPLE category: BAD_OVERRIDE for empty cite ---- 107 let valid_token: *u8 = "privacy-override" as *u8 108 if nx_log_category_gate(NXLC_PEOPLE_PII, 109 valid_token, 16, 110 "" as *u8, 0) != NXLC_BAD_OVERRIDE { return 72 } 111 112 // ---- PEOPLE category: OK with valid override + cite ---- 113 let cite: *u8 = "GDPR Art. 6(1)(b) -- session bound, deletes after logout" as *u8 114 if nx_log_category_gate(NXLC_PEOPLE_PII, 115 valid_token, 16, 116 cite, 56) != NXLC_OK { return 73 } 117 118 // ---- BAD_CATEGORY for invalid enum ---- 119 if nx_log_category_gate(99, 0 as *u8, 0, 0 as *u8, 0) != NXLC_BAD_CATEGORY { return 80 } 120 if nx_log_category_gate(-1, 0 as *u8, 0, 0 as *u8, 0) != NXLC_BAD_CATEGORY { return 81 } 121 122 // ---- Audit helper: count NXLC_PEOPLE_ tokens in a buffer ---- 123 let src: *u8 = sys_mmap(256) 124 // "this code uses NXLC_PEOPLE_PII and also NXLC_PEOPLE_BEHAVIOR" 125 let s: *u8 = "this code uses NXLC_PEOPLE_PII and also NXLC_PEOPLE_BEHAVIOR" as *u8 126 var i: i64 = 0 127 while i < 60 { src[i] = s[i]; i = i + 1 } 128 let count: i64 = nx_log_count_people_overrides_in_buf(src, 60) 129 if count != 2 { return 90 } 130 131 // Buffer without people overrides 132 let s2: *u8 = "this code uses NXLC_SYSTEM_STATE only" as *u8 133 var j: i64 = 0 134 while j < 37 { src[j] = s2[j]; j = j + 1 } 135 let count2: i64 = nx_log_count_people_overrides_in_buf(src, 37) 136 if count2 != 0 { return 91 } 137 138 return 0 139}