code wiki / _hdl_build / nx_mgmt_authz_gate.nx
nx_mgmt_authz_gate.nx source
↩ module page · 53 lines · 3466 B
1// nx_mgmt_authz_gate.nx -- PURE isolation gate for the management AUTHORIZATION tier (nx_mgmt_authz).
2// The headline is T5: a VALID but NON-admin session (today's library reader) is FORBIDDEN (403) from a privileged
3// route -- the exact privilege-escalation the bare ma_authed allows. Negative controls T5/T11/T12 keep it honest.
4// No IO/socket/exec/auth. GREEN iff every rule holds. Sovereign: nx_mgmt_authz + nx_syscalls. license_tier: ORIGINAL
5import "nx_mgmt_authz.nx"
6import "nx_syscalls.nx"
7
8func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
9func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
10func g_row(name: *u8, ok: i64) -> i64 {
11 if ok == 1 { g_w(" PASS " as *u8) } else { g_w(" FAIL " as *u8) }
12 g_w(name); g_w("\n" as *u8)
13 return ok
14}
15func g_eq(name: *u8, got: i64, want: i64) -> i64 { var ok: i64 = 0; if got == want { ok = 1 } return g_row(name, ok) }
16
17func mz_cls(s: *u8) -> i64 { return mz_route_class(s, g_len(s)) }
18func mz_adm(allow: *u8, h: *u8) -> i64 { return mz_is_admin_in(allow, g_len(allow), h, 0, g_len(h)) }
19
20func main() -> i64 {
21 g_w("mgmt-authz PURE gate -- route privilege + least-privilege decision + admin allowlist (closes the escalation)\n" as *u8)
22 var pass: i64 = 0
23 let total: i64 = 12
24
25 // ---- route classification (mirrors ma_handle's route set) ----
26 pass = pass + g_eq("T1 /api/deploy -> PRIV(2)\x00" as *u8, mz_cls("/api/deploy" as *u8), MZ_PRIV)
27 pass = pass + g_eq("T2 /api/health -> READ(1)\x00" as *u8, mz_cls("/api/health" as *u8), MZ_READ)
28 pass = pass + g_eq("T3 /api -> PUBLIC(0)\x00" as *u8, mz_cls("/api" as *u8), MZ_PUBLIC)
29 pass = pass + g_eq("T4 /api/login -> PUBLIC(0)\x00" as *u8, mz_cls("/api/login" as *u8), MZ_PUBLIC)
30
31 // ---- the decision (200 allow / 401 unauth / 403 authenticated-not-admin) ----
32 pass = pass + g_eq("T5 NEG privileged + valid + NOT-admin -> 403 (THE escalation fix)\x00" as *u8, mz_status(MZ_PRIV, 1, 0), 403)
33 pass = pass + g_eq("T6 privileged + valid + admin -> 200\x00" as *u8, mz_status(MZ_PRIV, 1, 1), 200)
34 pass = pass + g_eq("T7 privileged + no session -> 401\x00" as *u8, mz_status(MZ_PRIV, 0, 0), 401)
35 pass = pass + g_eq("T8 read + any valid session -> 200\x00" as *u8, mz_status(MZ_READ, 1, 0), 200)
36 pass = pass + g_eq("T9 public + no session -> 200 (login/index reachable)\x00" as *u8, mz_status(MZ_PUBLIC, 0, 0), 200)
37
38 // ---- admin allowlist (data-driven; '#' comments tolerated) ----
39 let allow: *u8 = "# mgmt admins -- one handle per line\nelderwesto\nopsadmin\n" as *u8
40 pass = pass + g_eq("T10 'elderwesto' is in the admin allowlist -> 1\x00" as *u8, mz_adm(allow, "elderwesto" as *u8), 1)
41 pass = pass + g_eq("T11 NEG a plain library user 'libreader' is NOT admin -> 0\x00" as *u8, mz_adm(allow, "libreader" as *u8), 0)
42 pass = pass + g_eq("T12 NEG a comment word 'mgmt' is NOT an admin entry -> 0\x00" as *u8, mz_adm(allow, "mgmt" as *u8), 0)
43
44 if pass == total {
45 let lg: i64 = sys_openat_append("knowledge/status/mgmt_authz_gate.log" as *u8, 0x1a4)
46 if lg >= 0 { sys_write(lg, "MGMT-AUTHZ-GATE pass=12/12 verdict=GREEN\n" as *u8, 40); sys_close(lg) }
47 g_w("MGMT-AUTHZ GATE GREEN 12/12 (privileged routes now require admin; valid-but-not-admin -> 403)\n" as *u8)
48 sys_exit(0)
49 }
50 g_w("MGMT-AUTHZ GATE RED\n" as *u8)
51 sys_exit(1)
52 return 1
53}