nx_mcp_route_archive_gate_t160.nx source
↩ module page · 58 lines · 4553 B
1// nx_mcp_route_auth_read_gate_t1.nx -- Validates and configures route authorization policies for the Nishi sovereign ecosystem.
2import "nx_mcp_route.nx"
3import "nx_gate_verdict.nx"
4
5func mrg_case(plan: *i64, c: *i64, label: *u8, body: *u8, expected: i64, argc: i64, argv: *i64) -> i64 {
6 return gv_plan_check(plan, label, mr_select(body, mr_len(body), argc, argv, 1, 0) == expected, c)
7}
8
9func main() -> i64 {
10 let argc: i64 = 3
11 let argv: *i64 = sys_mmap(32) as *i64
12 argv[0] = "route-gate" as *u8 as i64
13 argv[1] = "nx_mgmt" as *u8 as i64
14 argv[2] = "admin.cap" as *u8 as i64
15 if argc != 3 { return 2 }
16 if mr_config(argc, argv, 1) != 1 { return 2 }
17 let c: *i64 = gv_ctr()
18 let p: *i64 = gv_plan_new("management\nordinary\ninitialize\nnested-decoy\nduplicate-method\nduplicate-params\nduplicate-name\nescaped-key\nmissing-name\nnonstring-name\ntrailing-data\narray-root\nodd-config\n" as *u8)
19 mrg_case(p,c,"management" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_mgmt\"}}" as *u8,2,argc,argv)
20 mrg_case(p,c,"ordinary" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_fs\"}}" as *u8,0,argc,argv)
21 mrg_case(p,c,"initialize" as *u8,"{\"method\":\"initialize\",\"params\":{\"name\":\"nx_mgmt\"}}" as *u8,0,argc,argv)
22 mrg_case(p,c,"nested-decoy" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_fs\",\"arguments\":{\"name\":\"nx_mgmt\"}}}" as *u8,0,argc,argv)
23 mrg_case(p,c,"duplicate-method" as *u8,"{\"method\":\"tools/call\",\"method\":\"initialize\"}" as *u8,-1,argc,argv)
24 mrg_case(p,c,"duplicate-params" as *u8,"{\"method\":\"tools/call\",\"params\":{},\"params\":{\"name\":\"nx_mgmt\"}}" as *u8,-1,argc,argv)
25 mrg_case(p,c,"duplicate-name" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_mgmt\",\"name\":\"nx_fs\"}}" as *u8,-1,argc,argv)
26 mrg_case(p,c,"escaped-key" as *u8,"{\"method\":\"tools/call\",\"params\":{\"na\\u006de\":\"nx_mgmt\"}}" as *u8,-1,argc,argv)
27 mrg_case(p,c,"missing-name" as *u8,"{\"method\":\"tools/call\",\"params\":{}}" as *u8,-1,argc,argv)
28 mrg_case(p,c,"nonstring-name" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":7}}" as *u8,-1,argc,argv)
29 mrg_case(p,c,"trailing-data" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_mgmt\"}} {}" as *u8,-1,argc,argv)
30 mrg_case(p,c,"array-root" as *u8,"[]" as *u8,-1,argc,argv)
31 gv_plan_check(p,"odd-config" as *u8,mr_config(argc - 1,argv,1)==0,c)
32 gv_plan_finish(p,c)
33 let routes: *i64 = sys_mmap(80) as *i64
34 routes[0] = "default.cap" as *u8 as i64
35 routes[1] = "nx_services" as *u8 as i64; routes[2] = "read.cap" as *u8 as i64
36 routes[3] = "nishi_search" as *u8 as i64; routes[4] = "read.cap" as *u8 as i64
37 routes[5] = "nishi_doc" as *u8 as i64; routes[6] = "read.cap" as *u8 as i64
38 routes[7] = "nx_status" as *u8 as i64; routes[8] = "read.cap" as *u8 as i64
39 gv_check("four explicit read routes valid",mr_config(9,routes,1)==1,c)
40 let service: *u8 = "{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_services\"}}" as *u8
41 gv_check("services selects scoped file",mr_select(service,mr_len(service),9,routes,1,0)==2,c)
42 let fsreq: *u8 = "{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_fs\"}}" as *u8
43 gv_check("existing grant remains on default",mr_select(fsreq,mr_len(fsreq),9,routes,1,0)==0,c)
44 routes[7] = "nx_services" as *u8 as i64
45 gv_check("duplicate route refused",mr_config(9,routes,1)==0,c)
46
47 let scoped: *i64 = sys_mmap(64) as *i64
48 scoped[0] = "default.cap" as *u8 as i64
49 scoped[1] = "nx_wfcost" as *u8 as i64; scoped[2] = "scoped.cap" as *u8 as i64
50 scoped[3] = "nx_bundle_ingest" as *u8 as i64; scoped[4] = "scoped.cap" as *u8 as i64
51 scoped[5] = "nx_bundle_ingest_gate" as *u8 as i64; scoped[6] = "scoped.cap" as *u8 as i64
52 gv_check("archive and accounting route configuration valid",mr_config(7,scoped,1)==1,c)
53 gv_check("nx_wfcost selects scoped credential",mr_select("{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_wfcost\"}}" as *u8,53,7,scoped,1,0)==2,c)
54 gv_check("nx_bundle_ingest selects scoped credential",mr_select("{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_bundle_ingest\"}}" as *u8,60,7,scoped,1,0)==4,c)
55 gv_check("nx_bundle_ingest_gate selects scoped credential",mr_select("{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_bundle_ingest_gate\"}}" as *u8,65,7,scoped,1,0)==6,c)
56
57 return gv_verdict("MCP-ROUTE-GATE" as *u8,c,"Routing selection only; no credential contents or network calls." as *u8)
58}