code wiki / _hdl_build / nx_search_profile_registry_canonical_gate_t330.nx
nx_search_profile_registry_canonical_gate_t330.nx source
↩ module page · 44 lines · 3396 B
1import "nx_mgmt_api.nx"
2import "nx_gate_verdict.nx"
3func sc_req(csv:*u8,expiry:i64)->*u8{
4 let prefix:*u8="POST /api/cap/mint HTTP/1.1\r\nHost: fixture\r\n\r\nallow="
5 let b:*u8=sys_mmap(fi_len(prefix)+fi_len(csv)+128);var n:i64=sd_cat(b,0,prefix)
6 n=sd_cat(b,n,csv);n=sd_cat(b,n,"&exp=");n=sd_catn(b,n,expiry);n=sd_cat(b,n,"&nonce=330&confirm=yes");return b
7}
8func sc_call(csv:*u8,expiry:i64,out:*u8)->i64{
9 let r:*u8=sc_req(csv,expiry);return ma_do_cap_mint_at(r,fi_len(r),out,SD_OUTCAP,"fixture.key","audit.log")
10}
11func main()->i64{
12 let c:*i64=gv_ctr();gv_head("Existing ELF and HTTP registry capability composition")
13 let root:*u8=sys_mmap(128);var n:i64=sd_cat(root,0,"/tmp/nishi-search-cap-t330-");n=sd_catn(root,n,sys_now_ms())
14 if sys_mkdir(root,MODE_0755)!=0 || sys_chdir(root)!=0{return 3}
15 let key:*u8="fixture-search-registry-key-not-production-330"
16 let elf:*u8="existingtool\t/tmp/fixture.elf\tGREEN\n"
17 if dp_writefile("fixture.key",key,fi_len(key))!=0 || dp_writefile("tool_allowlist.conf",elf,fi_len(elf))!=0{return 3}
18 let out:*u8=sys_mmap(SD_OUTCAP);let now:i64=sys_now_realtime_sec();let expiry:i64=now+CM_SECS_PER_DAY
19 let only:i64=sc_call("existingtool",expiry,out)
20 gv_check("existing ELF-only mint without backend registry",only>0 && dp_contains(out,only,"MINTED")==1,c)
21 let unavailable:i64=sc_call("nishi_search",expiry,out)
22 gv_check("missing backend registry refuses without token",unavailable>0 && dp_contains(out,unavailable,"503 Service Unavailable")==1 && dp_contains(out,unavailable,"token_emitted")==1,c)
23 if sys_mkdir("knowledge",MODE_0755)!=0{return 3}
24 let backend:*u8="nishi_search\tGET\t127.0.0.1\t18456\t/api/search\tq\n"
25 if dp_writefile("knowledge/tool_backends.conf",backend,fi_len(backend))!=0{return 3}
26 let solo:i64=sc_call("nishi_search",expiry,out)
27 gv_check("registered HTTP-only grant minted",solo>0 && dp_contains(out,solo,"MINTED")==1,c)
28 let mixed:i64=sc_call("existingtool,nishi_search",expiry,out)
29 gv_check("mixed exact union minted",mixed>0 && dp_contains(out,mixed,"MINTED")==1,c)
30 let p:i64=ma_find(out,mixed,"\"cap\":\"");if p<0{return 3}
31 let token:*u8=out+p+7;var tn:i64=0;while p+7+tn<mixed && token[tn]!=34 as u8{tn=tn+1}
32 gv_check("existing grant cryptographically preserved",capt_verify(key,fi_len(key),token,tn,"existingtool",12,now)==CAPT_OK,c)
33 gv_check("new search grant cryptographically verifies",capt_verify(key,fi_len(key),token,tn,"nishi_search",12,now)==CAPT_OK,c)
34 gv_check("unrequested backend grant denied",capt_verify(key,fi_len(key),token,tn,"nishi_doc",9,now)==CAPT_DENY_TOOL,c)
35 let expect:*u8=sys_mmap(64);var x:i64=sd_cat(expect,0,"~");x=sd_catn(expect,x,expiry);x=sd_cat(expect,x,"~")
36 gv_check("absolute expiry preserved exactly",dp_contains(token,tn,expect)==1,c)
37 let unknown:i64=sc_call("existingtool,ghosttool",expiry,out)
38 gv_check("unknown mixed grant refused400",unknown>0 && dp_contains(out,unknown,"400 Bad Request")==1 && dp_contains(out,unknown,"token_emitted")==1,c)
39 let prefix:i64=sc_call("nishi_searc",expiry,out)
40 gv_check("backend prefix cannot authorize",prefix>0 && dp_contains(out,prefix,"400 Bad Request")==1,c)
41 let wildcard:i64=sc_call("*",expiry,out)
42 gv_check("wildcard remains refused",wildcard>0 && dp_contains(out,wildcard,"400 Bad Request")==1,c)
43 return gv_verdict("search-profile-registry",c,"Actual mint handler with isolated fixture key; no production capability emitted")
44}