nx_modauth_probe.nx source

1// nx_modauth_probe.nx -- POST-ARMING smoke test: prove an armed admin actually LOGS IN before any deploy. 2// Loads the SAME server-key bundle + realm context the daemon will use, reads a passphrase from a staged 3// file (leading-BOM + trailing-CR/LF tolerant, identical to nx_modauth_arm so a round-trip is exact), and 4// attempts nx_modern_auth_login. Prints "PROBE OK" + token length on success, "PROBE FAIL" on rejection. 5// Login does NOT mutate the store (read-only verification). Run this after nx_modauth_arm to confirm the 6// credential is good BEFORE flipping the access wall live -- fail here, never in production. 7// argv: [1]=keysfile [2]=storefile [3]=realm [4]=handle [5]=passphrase-file 8// Sovereign: nx_modern_auth_flow + nx_syscalls. license_tier: ORIGINAL 9import "hub/nx_modern_auth_flow.nx" 10import "nx_syscalls.nx" 11const K_MAGIC_8192: i64 = 8192 12 13func pr_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 14func pr_w(s: *u8) -> i64 { sys_write(1, s, pr_len(s)); return 0 } 15 16func main(argc: i64, argv: *i64) -> i64 { 17 if argc < 6 { sys_write(2, "usage: nx_modauth_probe <keysfile> <storefile> <realm> <handle> <passphrase-file>\n" as *u8, 82); return 1 } 18 let keysfile: *u8 = argv[1] as *u8 19 let storefile: *u8 = argv[2] as *u8 20 let realm: *u8 = argv[3] as *u8 21 let handle: *u8 = argv[4] as *u8 22 let pwfile: *u8 = argv[5] as *u8 23 let realm_n: i64 = pr_len(realm) 24 let handle_n: i64 = pr_len(handle) 25 26 let pwlen: *i64 = sys_mmap(16) as *i64 27 pwlen[0] = 0 28 let pwbuf: *u8 = sys_read_file(pwfile, pwlen) 29 if (pwbuf as i64) == 0 { pr_w("PROBE FAIL: cannot read passphrase file\n" as *u8); return 2 } 30 var pw_start: i64 = 0 31 if pwlen[0] >= 3 { if (pwbuf[0] as i64) == 239 { if (pwbuf[1] as i64) == 187 { if (pwbuf[2] as i64) == 191 { pw_start = 3 } } } } 32 var pw_n: i64 = pwlen[0] 33 var trimming: i64 = 1 34 while trimming == 1 { 35 trimming = 0 36 if pw_n > pw_start { 37 let c: i64 = pwbuf[pw_n - 1] as i64 38 if c == 10 { pw_n = pw_n - 1; trimming = 1 } 39 if c == 13 { pw_n = pw_n - 1; trimming = 1 } 40 } 41 } 42 let pw_ptr: *u8 = ((pwbuf as i64) + pw_start) as *u8 43 let pw_eff: i64 = pw_n - pw_start 44 if pw_eff < 1 { pr_w("PROBE FAIL: passphrase file empty\n" as *u8); return 2 } 45 46 let oprf_seed: *u8 = sys_mmap(32) 47 let akp: *u8 = sys_mmap(32) 48 let akb: *u8 = sys_mmap(33) 49 let edp: *u8 = sys_mmap(32) 50 let edb: *u8 = sys_mmap(32) 51 if nx_uas_server_keys_load_or_init(keysfile, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { pr_w("PROBE FAIL: server-key bundle\n" as *u8); return 3 } 52 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 53 if nx_auth_context_init(ctx, realm, realm_n, realm, realm_n, storefile as i64, oprf_seed, edp, edb, 900, K_MAGIC_8192, 1, 1, 5, 1) != NX_MAUTH_OK { pr_w("PROBE FAIL: context init\n" as *u8); return 4 } 54 55 let tok: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES) 56 let tok_n: *i64 = sys_mmap(16) as *i64 57 tok_n[0] = 0 58 let rc: i64 = nx_modern_auth_login(ctx, handle, handle_n, pw_ptr, pw_eff, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tok_n) 59 if rc == NX_MAUTH_OK { 60 if tok_n[0] == NX_MAUTH_SESSION_TOKEN_BYTES { 61 pr_w("PROBE OK: admin logs in -- minted a 152B no-cookie session token. Credential verified; safe to deploy.\n" as *u8) 62 sys_exit(0) 63 } 64 } 65 pr_w("PROBE FAIL: login rejected (wrong passphrase, or realm/handle mismatch vs the armed store).\n" as *u8) 66 sys_exit(1) 67 return 1 68}