nx_room_key_gate.nx source

1import "nx_gate_base.nx" 2// nx_room_key_gate.nx -- adversarial gate for room capability tokens. Determinism, lane-strip, query 3// parsing, list matching, hostile refusal. license_tier: ORIGINAL 4import "nx_syscalls.nx" 5import "nx_room_key.nx" 6 7func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 8" as *u8); return ok } 9func gn(v: i64) -> i64 { 10 let b: *u8=sys_mmap(28); var m: i64=v; if m<0{sys_write(1,"-" as *u8,1);m=0-m} 11 let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1} while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1} 12 var i: i64=0; while i<k{b[i]=t[k-1-i];i=i+1} sys_write(1,b,k); return 0 } 13func ck(name: *u8, ok: i64, p: *i64, t: *i64) -> i64 { 14 t[0]=t[0]+1 15 gw(" " as *u8); gw(name) 16 if ok==1 { gw(" PASS\n" as *u8); p[0]=p[0]+1 } else { gw(" FAIL\n" as *u8) } 17 return 0 } 18func eqn(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i]{return 0} i=i+1 } return 1 } 19 20func main() -> i64 { 21 gw("=== nx_room_key_gate ===\n" as *u8) 22 let p: *i64 = sys_mmap(16) as *i64; let t: *i64 = sys_mmap(16) as *i64 23 var ok: i64 = 1 24 25 // T1 token: deterministic, room-sensitive, secret-sensitive, 16 lowercase-hex chars. 26 let o1: *u8 = sys_mmap(64); let o2: *u8 = sys_mmap(64); let o3: *u8 = sys_mmap(64); let o4: *u8 = sys_mmap(64) 27 rk_token("vault" as *u8, 5, "s3cr3t" as *u8, 6, o1) 28 rk_token("vault" as *u8, 5, "s3cr3t" as *u8, 6, o2) 29 rk_token("vault2" as *u8, 6, "s3cr3t" as *u8, 6, o3) 30 rk_token("vault" as *u8, 5, "OTHER" as *u8, 5, o4) 31 if eqn(o1, o2, 16) != 1 { ok = 0 } 32 if eqn(o1, o3, 16) == 1 { ok = 0 } 33 if eqn(o1, o4, 16) == 1 { ok = 0 } 34 var hx: i64 = 1 35 var i: i64 = 0 36 while i < 16 { 37 var c: i64 = o1[i] & 0xff 38 var good: i64 = 0 39 if c >= 48 { if c <= 57 { good = 1 } } 40 if c >= 97 { if c <= 102 { good = 1 } } 41 if good == 0 { hx = 0 } 42 i = i + 1 43 } 44 if hx != 1 { ok = 0 } 45 ck("T1 token deterministic + input-sensitive + hex16 \x00" as *u8, ok, p, t) 46 47 // T2 lane-strip: one key covers vault, vault#1, vault#2. 48 ok = 1 49 if rk_base_len("vault" as *u8, 5) != 5 { ok = 0 } 50 if rk_base_len("vault#1" as *u8, 7) != 5 { ok = 0 } 51 if rk_base_len("vault#2" as *u8, 7) != 5 { ok = 0 } 52 let o5: *u8 = sys_mmap(64) 53 rk_token("vault#1" as *u8, rk_base_len("vault#1" as *u8, 7), "s3cr3t" as *u8, 6, o5) 54 if eqn(o1, o5, 16) != 1 { ok = 0 } 55 ck("T2 lane suffix stripped: one key, all lanes \x00" as *u8, ok, p, t) 56 57 // T3 query parse: ?k= extracted; identity excludes query; missing/empty -> -1. 58 ok = 1 59 let pth: *u8 = "/signal/vault?k=abc123" as *u8 60 let ko: *u8 = sys_mmap(64) 61 if rk_parse_k(pth, 22, ko, 32) != 6 { ok = 0 } 62 if eqn(ko, "abc123" as *u8, 6) != 1 { ok = 0 } 63 if rk_path_no_query(pth, 22) != 13 { ok = 0 } 64 if rk_path_no_query("/signal/open" as *u8, 12) != 12 { ok = 0 } 65 if rk_parse_k("/signal/open" as *u8, 12, ko, 32) != (0-1) { ok = 0 } 66 if rk_parse_k("/signal/x?k=" as *u8, 12, ko, 32) != (0-1) { ok = 0 } 67 ck("T3 query parse + identity excludes query \x00" as *u8, ok, p, t) 68 69 // T4 protected list: exact-line match, CRLF-tolerant, no substring false-positives. 70 ok = 1 71 let lst: *u8 = "family\r\nvault\nops\n" as *u8 72 if rk_protected(lst, 18, "vault" as *u8, 5) != 1 { ok = 0 } 73 if rk_protected(lst, 18, "family" as *u8, 6) != 1 { ok = 0 } 74 if rk_protected(lst, 18, "ops" as *u8, 3) != 1 { ok = 0 } 75 if rk_protected(lst, 18, "vaul" as *u8, 4) != 0 { ok = 0 } 76 if rk_protected(lst, 18, "vaultx" as *u8, 6) != 0 { ok = 0 } 77 if rk_protected(lst, 18, "am" as *u8, 2) != 0 { ok = 0 } 78 if rk_protected(lst, 0, "vault" as *u8, 5) != 0 { ok = 0 } // empty list = everything open 79 ck("T4 protected list exact-match, CRLF, no-substr \x00" as *u8, ok, p, t) 80 81 gw("ROOM-KEY: " as *u8); gn(p[0]); gw("/" as *u8); gn(t[0]) 82 if p[0]==t[0] { gw(" ALL GREEN\n" as *u8); return 0 } 83 gw(" RED\n" as *u8) 84 return 1 }