nx_realm_isolation_gate.nx source

1// nx_realm_isolation_gate.nx -- PROVES per-site OPAQUE realm isolation (operator 2026-06-17: "don't allow 2// andelinwest.com to share the same as nishifamily.com -- each site a SEPARATE opaque login"). Arms TWO 3// realms with SEPARATE keys + stores + realm_ids (nishifamily, andelinwest), registers + logs in a user in 4// each via the REAL Modern Auth (OPAQUE-3DH), then CROSS-VALIDATES: a token minted for one realm MUST be 5// rejected by the other. This is the multi-tenant separation property: no token crosses site boundaries. 6// T1 nishifamily token on nishifamily ctx -> OK 7// T2 nishifamily token on andelinwest ctx -> DENY (isolation: a family token is useless on the law firm) 8// T3 andelinwest token on andelinwest ctx -> OK 9// T4 andelinwest token on nishifamily ctx -> DENY (isolation: a client/lawyer token is useless on the family hub) 10// Sovereign: nx_modern_auth_flow + nx_syscalls. license_tier: ORIGINAL 11import "hub/nx_modern_auth_flow.nx" 12import "nx_syscalls.nx" 13 14func ri_w(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 15func ri_len(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 16func ri_row(name: *u8, ok: i64) -> i64 { if ok==1 { ri_w(" PASS " as *u8) } else { ri_w(" FAIL " as *u8) } ri_w(name); ri_w("\n" as *u8); return ok } 17func ri_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 } 18 19// arm a realm (own keys+store), register the user, log in -> token. returns 1 on success (ctx + tok filled). 20func ri_arm(keys: *u8, store: *u8, realm: *u8, handle: *u8, pass: *u8, ctx: *NxAuthContext, tok: *u8, tokn: *i64) -> i64 { 21 let realm_n: i64 = ri_len(realm) 22 let h_n: i64 = ri_len(handle) 23 let p_n: i64 = ri_len(pass) 24 let oprf: *u8 = sys_mmap(32) 25 let akp: *u8 = sys_mmap(32) 26 let akb: *u8 = sys_mmap(33) 27 let edp: *u8 = sys_mmap(32) 28 let edb: *u8 = sys_mmap(32) 29 if nx_uas_server_keys_load_or_init(keys, oprf, akp, akb, edp, edb) != NX_UAS_OK { return 0 } 30 if nx_auth_context_init(ctx, realm, realm_n, realm, realm_n, store as i64, oprf, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { return 0 } 31 let mn: *u8 = sys_mmap(512) 32 let mnn: *i64 = sys_mmap(8) as *i64 33 if nx_modern_auth_register(ctx, handle, h_n, pass, p_n, mn, 512, mnn) != NX_MAUTH_OK { return 0 } 34 tokn[0] = 0 35 if nx_modern_auth_login(ctx, handle, h_n, pass, p_n, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tokn) != NX_MAUTH_OK { return 0 } 36 return 1 37} 38 39func ri_validate(ctx: *NxAuthContext, tok: *u8, tok_n: i64, now_s: i64) -> i64 { 40 let uh: *i64 = sys_mmap(8) as *i64 41 uh[0] = 0 42 return nx_modern_auth_validate_session(ctx, tok, tok_n, now_s, 0 as *u8, 0, uh) 43} 44 45func main() -> i64 { 46 ri_w("realm-isolation gate: separate OPAQUE realms per site (nishifamily vs andelinwest)\n" as *u8) 47 ri_trunc("/tmp/nx_ri_nf_keys.log" as *u8) 48 ri_trunc("/tmp/nx_ri_nf_store.log" as *u8) 49 ri_trunc("/tmp/nx_ri_aw_keys.log" as *u8) 50 ri_trunc("/tmp/nx_ri_aw_store.log" as *u8) 51 52 let ctx_nf: *NxAuthContext = sys_mmap(256) as *NxAuthContext 53 let tok_nf: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES) 54 let tokn_nf: *i64 = sys_mmap(8) as *i64 55 if ri_arm("/tmp/nx_ri_nf_keys.log" as *u8, "/tmp/nx_ri_nf_store.log" as *u8, "nishifamily" as *u8, "elder" as *u8, "nishifamily-secret-passphrase" as *u8, ctx_nf, tok_nf, tokn_nf) != 1 { ri_w("ARM nishifamily FAIL\n" as *u8); sys_exit(1) } 56 57 let ctx_aw: *NxAuthContext = sys_mmap(256) as *NxAuthContext 58 let tok_aw: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES) 59 let tokn_aw: *i64 = sys_mmap(8) as *i64 60 if ri_arm("/tmp/nx_ri_aw_keys.log" as *u8, "/tmp/nx_ri_aw_store.log" as *u8, "andelinwest" as *u8, "lawyer" as *u8, "andelinwest-secret-passphrase" as *u8, ctx_aw, tok_aw, tokn_aw) != 1 { ri_w("ARM andelinwest FAIL\n" as *u8); sys_exit(1) } 61 62 let now_s: i64 = sys_now_realtime_sec() 63 var pass: i64 = 0 64 65 let v1: i64 = ri_validate(ctx_nf, tok_nf, tokn_nf[0], now_s) 66 var t1: i64 = 0; if v1 == NX_MAUTH_OK { t1 = 1 } 67 pass = pass + ri_row("T1 nishifamily token on nishifamily realm -> OK\x00" as *u8, t1) 68 69 let v2: i64 = ri_validate(ctx_aw, tok_nf, tokn_nf[0], now_s) 70 var t2: i64 = 0; if v2 != NX_MAUTH_OK { t2 = 1 } 71 pass = pass + ri_row("T2 nishifamily token on andelinwest realm -> DENY (isolation)\x00" as *u8, t2) 72 73 let v3: i64 = ri_validate(ctx_aw, tok_aw, tokn_aw[0], now_s) 74 var t3: i64 = 0; if v3 == NX_MAUTH_OK { t3 = 1 } 75 pass = pass + ri_row("T3 andelinwest token on andelinwest realm -> OK\x00" as *u8, t3) 76 77 let v4: i64 = ri_validate(ctx_nf, tok_aw, tokn_aw[0], now_s) 78 var t4: i64 = 0; if v4 != NX_MAUTH_OK { t4 = 1 } 79 pass = pass + ri_row("T4 andelinwest token on nishifamily realm -> DENY (isolation)\x00" as *u8, t4) 80 81 if pass == 4 { 82 let line: *u8 = "CMSGATE row=nx_realm_isolation per-site-opaque-realms rows=4 pass=4 verdict=PASS\n" as *u8 83 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4) 84 if gf >= 0 { sys_write(gf, line, ri_len(line)); sys_close(gf) } 85 ri_w("REALM-ISOLATION GATE GREEN 4/4 (each site a separate OPAQUE realm; no token crosses site boundaries)\n" as *u8) 86 sys_exit(0) 87 } 88 ri_w("REALM-ISOLATION GATE RED\n" as *u8) 89 sys_exit(1) 90 return 1 91}