nx_mcp_route_auth_read_gate_t1.nx source
↩ module page · 48 lines · 3611 B
1// nx_mcp_route_auth_read_gate_t1.nx -- Validates and configures route authorization policies for the Nishi sovereign ecosystem.
2import "nx_mcp_route_auth_read_t1.nx"
3import "nx_gate_verdict.nx"
4
5func mrg_case(plan: *i64, c: *i64, label: *u8, body: *u8, expected: i64, argc: i64, argv: *i64) -> i64 {
6 return gv_plan_check(plan, label, mr_select(body, mr_len(body), argc, argv, 1, 0) == expected, c)
7}
8
9func main() -> i64 {
10 let argc: i64 = 3
11 let argv: *i64 = sys_mmap(32) as *i64
12 argv[0] = "route-gate" as *u8 as i64
13 argv[1] = "nx_mgmt" as *u8 as i64
14 argv[2] = "admin.cap" as *u8 as i64
15 if argc != 3 { return 2 }
16 if mr_config(argc, argv, 1) != 1 { return 2 }
17 let c: *i64 = gv_ctr()
18 let p: *i64 = gv_plan_new("management\nordinary\ninitialize\nnested-decoy\nduplicate-method\nduplicate-params\nduplicate-name\nescaped-key\nmissing-name\nnonstring-name\ntrailing-data\narray-root\nodd-config\n" as *u8)
19 mrg_case(p,c,"management" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_mgmt\"}}" as *u8,2,argc,argv)
20 mrg_case(p,c,"ordinary" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_fs\"}}" as *u8,0,argc,argv)
21 mrg_case(p,c,"initialize" as *u8,"{\"method\":\"initialize\",\"params\":{\"name\":\"nx_mgmt\"}}" as *u8,0,argc,argv)
22 mrg_case(p,c,"nested-decoy" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_fs\",\"arguments\":{\"name\":\"nx_mgmt\"}}}" as *u8,0,argc,argv)
23 mrg_case(p,c,"duplicate-method" as *u8,"{\"method\":\"tools/call\",\"method\":\"initialize\"}" as *u8,-1,argc,argv)
24 mrg_case(p,c,"duplicate-params" as *u8,"{\"method\":\"tools/call\",\"params\":{},\"params\":{\"name\":\"nx_mgmt\"}}" as *u8,-1,argc,argv)
25 mrg_case(p,c,"duplicate-name" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_mgmt\",\"name\":\"nx_fs\"}}" as *u8,-1,argc,argv)
26 mrg_case(p,c,"escaped-key" as *u8,"{\"method\":\"tools/call\",\"params\":{\"na\\u006de\":\"nx_mgmt\"}}" as *u8,-1,argc,argv)
27 mrg_case(p,c,"missing-name" as *u8,"{\"method\":\"tools/call\",\"params\":{}}" as *u8,-1,argc,argv)
28 mrg_case(p,c,"nonstring-name" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":7}}" as *u8,-1,argc,argv)
29 mrg_case(p,c,"trailing-data" as *u8,"{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_mgmt\"}} {}" as *u8,-1,argc,argv)
30 mrg_case(p,c,"array-root" as *u8,"[]" as *u8,-1,argc,argv)
31 gv_plan_check(p,"odd-config" as *u8,mr_config(argc - 1,argv,1)==0,c)
32 gv_plan_finish(p,c)
33 let routes: *i64 = sys_mmap(80) as *i64
34 routes[0] = "default.cap" as *u8 as i64
35 routes[1] = "nx_services" as *u8 as i64; routes[2] = "read.cap" as *u8 as i64
36 routes[3] = "nishi_search" as *u8 as i64; routes[4] = "read.cap" as *u8 as i64
37 routes[5] = "nishi_doc" as *u8 as i64; routes[6] = "read.cap" as *u8 as i64
38 routes[7] = "nx_status" as *u8 as i64; routes[8] = "read.cap" as *u8 as i64
39 gv_check("four explicit read routes valid",mr_config(9,routes,1)==1,c)
40 let service: *u8 = "{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_services\"}}" as *u8
41 gv_check("services selects scoped file",mr_select(service,mr_len(service),9,routes,1,0)==2,c)
42 let fsreq: *u8 = "{\"method\":\"tools/call\",\"params\":{\"name\":\"nx_fs\"}}" as *u8
43 gv_check("existing grant remains on default",mr_select(fsreq,mr_len(fsreq),9,routes,1,0)==0,c)
44 routes[7] = "nx_services" as *u8 as i64
45 gv_check("duplicate route refused",mr_config(9,routes,1)==0,c)
46
47 return gv_verdict("MCP-ROUTE-GATE" as *u8,c,"Routing selection only; no credential contents or network calls." as *u8)
48}