nx_mgmt_session_mint_gate.nx source
↩ module page · 90 lines · 4678 B
1// nx_mgmt_session_mint_gate.nx -- proves the session minter: a token minted by msm_mint_raw (loading ed_priv from a
2// real nx_uas key bundle) VALIDATES against the canonical nx_ncs_validate_token (the exact check the daemon runs),
3// resolves to the correct uid_hash, and FAILS closed on expiry / tamper / wrong-realm. The is_admin resolution is
4// proven separately by the live /api/services test (needs the NAS roles+index). license_tier: ORIGINAL expect_exit: 0
5import "nx_session_mint_lib.nx" // msm_mint_raw, msm_load_edpriv
6import "hub/nx_user_account_store.nx" // nx_uas_server_keys_load_or_init (generates a fresh test bundle)
7import "nx_gate.nx"
8
9func mg_eqbytes(a: *u8, b: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { if a[i] != b[i] { return 0 } i = i + 1 } return 1 }
10func mg_expect(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64 {
11 tot[0] = tot[0] + 1
12 if cond == 1 { pass[0] = pass[0] + 1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
13 gw(label); gw("\n" as *u8)
14 return 0
15}
16
17func main() -> i64 {
18 gw("=== nx_mgmt_session_mint_gate: mint -> canonical M5 validate roundtrip + fail-closed ===\n" as *u8)
19 let pb: *i64 = sys_mmap(16) as *i64; pb[0] = 0
20 let tb: *i64 = sys_mmap(16) as *i64; tb[0] = 0
21
22 let realm: *u8 = "nishi_site_admin" as *u8
23 let rn: i64 = 16
24 let handle: *u8 = "elderwesto" as *u8
25 let hn: i64 = 10
26 let ttl: i64 = 3600
27 let now: i64 = 1800000000
28
29 // generate a fresh test key bundle (load_or_init writes it); msm loads ed_priv from the same file @200.
30 let oprf: *u8 = sys_mmap(32); let akp: *u8 = sys_mmap(32); let akb: *u8 = sys_mmap(33); let edp: *u8 = sys_mmap(32); let edb: *u8 = sys_mmap(32)
31 let krc: i64 = nx_uas_server_keys_load_or_init("/tmp/msm_test_keys.bin" as *u8, oprf, akp, akb, edp, edb)
32 var t0: i64 = 0
33 if krc == NX_UAS_OK { t0 = 1 }
34 mg_expect(t0, pb, tb, "T0 test key bundle generated (NX_UAS_OK)" as *u8)
35
36 // msm loads ed_priv independently from the same file -> must equal load_or_init's edp
37 let edp2: *u8 = sys_mmap(32)
38 let lrc: i64 = msm_load_edpriv("/tmp/msm_test_keys.bin" as *u8, edp2)
39 var t1: i64 = 0
40 if lrc == 0 { if mg_eqbytes(edp, edp2, 32) == 1 { t1 = 1 } }
41 mg_expect(t1, pb, tb, "T1 msm_load_edpriv @200 == load_or_init ed_priv (byte-identical)" as *u8)
42
43 // mint a raw token
44 let tok: *u8 = sys_mmap(152)
45 let mrc: i64 = msm_mint_raw("/tmp/msm_test_keys.bin" as *u8, realm, rn, handle, hn, now, ttl, tok)
46 var t2: i64 = 0
47 if mrc == 0 { t2 = 1 }
48 mg_expect(t2, pb, tb, "T2 msm_mint_raw returns 0 (token minted)" as *u8)
49
50 // canonical validation (the daemon's exact check) with the matching pubkey + realm hash
51 let realm_hash: *u8 = sys_mmap(32)
52 nx_ncs_derive_realm_id_hash(realm, rn, realm_hash)
53 let uidout: *u8 = sys_mmap(32)
54 let vrc: i64 = nx_ncs_validate_token(edb, tok, now, realm_hash, uidout)
55 var t3: i64 = 0
56 if vrc == NX_NCS_OK { t3 = 1 }
57 mg_expect(t3, pb, tb, "T3 nx_ncs_validate_token(now) == NX_NCS_OK (valid signature + realm + not expired)" as *u8)
58
59 // uid resolves to SHA256(realm|||handle)
60 let uidexp: *u8 = sys_mmap(32)
61 nx_ncs_derive_user_id_hash(realm, rn, handle, hn, uidexp)
62 mg_expect(mg_eqbytes(uidout, uidexp, 32), pb, tb, "T4 token uid_hash == SHA256(nishi_site_admin|||elderwesto)" as *u8)
63
64 // NEG: expired
65 let ve: i64 = nx_ncs_validate_token(edb, tok, now + ttl + 10, realm_hash, uidout)
66 var t5: i64 = 0
67 if ve == 0 - NX_NCS_EXPIRED { t5 = 1 }
68 mg_expect(t5, pb, tb, "T5 NEG expired -> NX_NCS_EXPIRED" as *u8)
69
70 // NEG: tamper a signature byte
71 let sb: i64 = tok[100] as i64
72 tok[100] = (sb ^ 0xFF) as u8
73 let vt: i64 = nx_ncs_validate_token(edb, tok, now, realm_hash, uidout)
74 var t6: i64 = 0
75 if vt == 0 - NX_NCS_VERIFY_FAILED { t6 = 1 }
76 mg_expect(t6, pb, tb, "T6 NEG tampered signature -> NX_NCS_VERIFY_FAILED" as *u8)
77 tok[100] = sb as u8 // restore
78
79 // NEG: wrong realm
80 let wrong_rh: *u8 = sys_mmap(32)
81 nx_ncs_derive_realm_id_hash("some_other_realm" as *u8, 16, wrong_rh)
82 let vw: i64 = nx_ncs_validate_token(edb, tok, now, wrong_rh, uidout)
83 var t7: i64 = 0
84 if vw == 0 - NX_NCS_MALFORMED { t7 = 1 }
85 mg_expect(t7, pb, tb, "T7 NEG wrong realm -> NX_NCS_MALFORMED (realm-bound)" as *u8)
86
87 gw("\n=== nx_mgmt_session_mint_gate " as *u8); gn(pb[0]); gw("/" as *u8); gn(tb[0]); gw(" ===\n" as *u8)
88 if pb[0] == tb[0] { gw("SESSION-MINT GREEN -- minted token passes the canonical M5 validator; fail-closed on expiry/tamper/realm\n" as *u8); sys_exit(0); return 0 }
89 gw("SESSION-MINT RED\n" as *u8); sys_exit(1); return 1
90}