code wiki / _hdl_build / nx_route_table_gate.nx
nx_route_table_gate.nx source
↩ module page · 70 lines · 5289 B
1// nx_route_table_gate.nx -- PURE gate for the data-driven route matcher. Proves the SOTA semantics the hardcoded
2// cascade lacked: the GALLERY route is just a DATA ROW (no recompile to add/fix a route), exact-host beats '*',
3// LONGEST path-prefix wins, and BOUNDARY-SAFETY (/gen never matches /generated). GREEN iff T1..T10.
4// Sovereign: nx_route_table + nx_syscalls. license_tier: ORIGINAL
5import "nx_route_table.nx"
6import "nx_syscalls.nx"
7
8func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
9func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
10func g_row(name: *u8, ok: i64) -> i64 {
11 if ok == 1 { g_w(" PASS " as *u8) } else { g_w(" FAIL " as *u8) }
12 g_w(name); g_w("\n" as *u8)
13 return ok
14}
15
16// match host/path against the table; assert matched + port + mode. host/path are null-terminated literals.
17func g_match(rt: *u8, n: i64, host: *u8, path: *u8, want_match: i64, want_port: i64, want_mode: i64) -> i64 {
18 let pb: *i64 = sys_mmap(8) as *i64
19 let mb: *i64 = sys_mmap(8) as *i64
20 pb[0] = 0
21 mb[0] = 0
22 let m: i64 = rt_match(rt, n, host, g_len(host), path, g_len(path), pb, mb)
23 if m != want_match { return 0 }
24 if want_match == 0 { return 1 }
25 if pb[0] != want_port { return 0 }
26 if mb[0] != want_mode { return 0 }
27 return 1
28}
29
30func main() -> i64 {
31 g_w("route-table gate (DATA-DRIVEN routing: exact-host>*, longest-prefix, boundary-safe -- no hardcoding)\n" as *u8)
32 let rt: *u8 = "# data-driven routes -- adding/fixing a route is a CONFIG ROW, not a recompile\nnishifamily.com /gallery 18190 stream\nnishifamily.com /gen 18794 gated\nnishifamily.com /torrent 18793 stream\nnishifamily.com /library 8791 buffered\nnishifamily.com /library/admin 7777 gated\n* /gallery 8888 buffered\n* /pub 9000 buffered\n" as *u8
33 let n: i64 = g_len(rt)
34 var pass: i64 = 0
35
36 // ★ T1: the GALLERY route is just data -> matched (the fix; no recompile to route /gallery)
37 pass = pass + g_row("T1 /gallery -> 18190 stream (gallery is a DATA ROW, the fix)\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/gallery" as *u8, 1, 18190, RT_STREAM))
38 // T2: prefix boundary -> /gallery/vid/0 still routes to the gallery backend
39 pass = pass + g_row("T2 /gallery/vid/0 -> 18190 (boundary prefix matches sub-paths)\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/gallery/vid/0" as *u8, 1, 18190, RT_STREAM))
40 // ★ T3: BOUNDARY-SAFE -- /generated must NOT match /gen (and matches no other route) -> no match
41 pass = pass + g_row("T3 /generated -> NO match (boundary-safe: /gen != /generated)\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/generated" as *u8, 0, 0, 0))
42 // T4: /gen exact -> gated
43 pass = pass + g_row("T4 /gen -> 18794 gated\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/gen" as *u8, 1, 18794, RT_GATED))
44 // T5: wildcard host serves when no exact host -> other.com /gallery hits the '*' row
45 pass = pass + g_row("T5 other.com /gallery -> 8888 (wildcard '*' host)\x00" as *u8, g_match(rt, n, "other.com" as *u8, "/gallery" as *u8, 1, 8888, RT_BUFFERED))
46 // ★ T6: EXACT host beats '*' -- nishifamily.com /gallery is 18190, NOT the '*' 8888 (already asserted in T1; here explicit)
47 var t6: i64 = 0
48 if g_match(rt, n, "nishifamily.com" as *u8, "/gallery" as *u8, 1, 18190, RT_STREAM) == 1 { if g_match(rt, n, "other.com" as *u8, "/gallery" as *u8, 1, 8888, RT_BUFFERED) == 1 { t6 = 1 } }
49 pass = pass + g_row("T6 exact host (18190) beats wildcard (8888) for the SAME path\x00" as *u8, t6)
50 // ★ T7: LONGEST prefix wins -- /library/admin/x -> 7777 (the longer /library/admin), not /library 8791
51 pass = pass + g_row("T7 /library/admin/x -> 7777 gated (longest-prefix wins)\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/library/admin/x" as *u8, 1, 7777, RT_GATED))
52 // T8: shorter prefix when the longer doesn't match -- /library/books -> 8791
53 pass = pass + g_row("T8 /library/books -> 8791 buffered (falls to the shorter /library)\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/library/books" as *u8, 1, 8791, RT_BUFFERED))
54 // T9: unknown path -> no match (fail-closed; the caller serves its own 404, not a wrong backend)
55 pass = pass + g_row("T9 /nonexistent -> NO match (fail-closed)\x00" as *u8, g_match(rt, n, "nishifamily.com" as *u8, "/nonexistent" as *u8, 0, 0, 0))
56 // T10: per-route MODE preserved (gated/stream/buffered all distinct)
57 var t10: i64 = 0
58 if g_match(rt, n, "nishifamily.com" as *u8, "/torrent" as *u8, 1, 18793, RT_STREAM) == 1 { if g_match(rt, n, "nishifamily.com" as *u8, "/library" as *u8, 1, 8791, RT_BUFFERED) == 1 { t10 = 1 } }
59 pass = pass + g_row("T10 per-route mode preserved (stream/gated/buffered)\x00" as *u8, t10)
60
61 if pass == 10 {
62 let lg: i64 = sys_openat_append("knowledge/status/route_table_gate.log" as *u8, 0x1a4)
63 if lg >= 0 { sys_write(lg, "ROUTE-TABLE-GATE pass=10/10 verdict=GREEN\n" as *u8, 41); sys_close(lg) }
64 g_w("ROUTE-TABLE GATE GREEN 10/10 (data-driven routing: gallery=a row, boundary-safe, exact>*, longest-prefix)\n" as *u8)
65 sys_exit(0)
66 }
67 g_w("ROUTE-TABLE GATE RED\n" as *u8)
68 sys_exit(1)
69 return 1
70}