nx_mgmt_private_canonical_gate_t189.nx source
↩ module page · 44 lines · 2919 B
1import "nx_mgmt_private_response.nx"
2import "nx_gate_verdict.nx"
3func i189_run(av:*i64,log:*u8)->i64{
4 let fd:i64=sys_openat_wr(log,MODE_0600);if fd<0{return fd}
5 let env:*i64=sys_mmap(8) as *i64;env[0]=0
6 let status:*i64=sys_mmap(8) as *i64;let pid:i64=sys_fork()
7 if pid==0{
8 if sys_chdir("/volume1/homes/elderwesto/nishihost")!=0{sys_exit(124)}
9 if sys_dup3(fd,1,0)<0||sys_dup3(fd,2,0)<0{sys_exit(125)}
10 sys_execve(av[0] as *u8,av,env);sys_exit(127)
11 }
12 var waited:i64=0-1;if pid>0{waited=sys_wait4(pid,status,0)};sys_close(fd)
13 if pid<=0||waited!=pid{return 0-1};return wait_status_rc(status[0])
14}
15func i189_has(b:*u8,n:i64,s:*u8)->i64{
16 let sn:i64=mpr_len(s);var i:i64=0;while i+sn<=n{
17 var j:i64=0;while j<sn&&b[i+j]==s[j]{j=j+1};if j==sn{return 1};i=i+1
18 };return 0
19}
20func main()->i64{
21 let c:*i64=gv_ctr();let av:*i64=sys_mmap(56) as *i64
22 av[0]="/volume1/homes/elderwesto/nishihost/buildroot/_build/nx_mgmt_call.sov.elf" as i64
23 av[1]="GET" as i64;av[2]="/api/release_identity" as i64;av[3]="" as i64;av[4]="--response-file" as i64
24 av[5]="buildroot/knowledge/gates/private-response-fixture-t189/live-identity.json" as i64;av[6]=0
25 let log:*u8="knowledge/gates/private-response-live-stdout-t189.log"
26 let rc:i64=i189_run(av,log);let n:*i64=sys_mmap(8) as *i64;var b:*u8=sys_read_file(log,n)
27 if *n>0{sys_write(1,b,*n)}
28 gv_check("actual authenticated readonly200 uses private sink",rc==0,c)
29 gv_check("stdout contains metadata and no upstreamidentity body",i189_has(b,*n,"\"upstream_status\":200")==1&&i189_has(b,*n,"running-executable")==0&&i189_has(b,*n,"9b480c8df08a")==0,c)
30 let file:*u8="knowledge/gates/private-response-fixture-t189/live-identity.json"
31 let body:*u8=sys_read_file(file,n)
32 gv_check("complete actual identity privately retained",*n>0&&i189_has(body,*n,"\"basis\":\"running-executable\"")==1&&i189_has(body,*n,"9b480c8df08af0741b371b324e0b6e05af3176c8d73ee31939002535e52bf435")==1,c)
33 let stat:*u8=sys_mmap(NX_STAT_X64_BYTES)
34 gv_check("actual output owner-only",sys_fstatat(file,stat)==0&&sys_stat_permissions(stat)==MODE_0600,c)
35 let repeat:i64=i189_run(av,log);b=sys_read_file(log,n);if *n>0{sys_write(1,b,*n)}
36 gv_check("actual destination collision refuses before upstreamrequest",repeat!=0&&i189_has(b,*n,"\"request_sent\":0")==1,c)
37 fio_unlink(file)
38 av[2]="/api/private-response-nonexistent-t189" as i64
39 let denied:i64=i189_run(av,log);b=sys_read_file(log,n);if *n>0{sys_write(1,b,*n)}
40 gv_check("actual404 is status-preserved metadata only",denied!=0&&i189_has(b,*n,"\"upstream_status\":404")==1&&i189_has(b,*n,"\"visible\":0")==1,c)
41 gv_check("actual404 does not publish body",mpr_absent(file)==0,c)
42 gv_check("actual404 releases private pending file",mpr_absent("knowledge/gates/private-response-fixture-t189/live-identity.json.pending")==0,c)
43 return gv_verdict("private-response-connected",c,"Actual authenticated200 and404; no credentials or mint response generated")
44}