nx_session_ttl_gate.nx source
↩ module page · 41 lines · 2745 B
1// nx_session_ttl_gate.nx -- KAT for session idle/absolute timeout. Asserts the timeout boundaries, that the
2// absolute cap beats idle, the issue/touch/verify lifecycle, and that an ACTIVE session slides past the idle
3// window yet still dies at the absolute cap. exit 0 = pass, N = assertion N failed.
4import "nx_session_ttl.nx"
5import "nx_assert.nx"
6
7func main() -> i64 {
8 let IDLE: i64 = SESS_IDLE_TTL_MS
9 let ABS: i64 = SESS_ABS_TTL_MS
10 let t0: i64 = 1000000000
11
12 // --- pure boundary checks ---
13 if sess_check(t0, t0, t0, IDLE, ABS) != SESS_VALID { return 1 } // fresh
14 if sess_check(t0, t0, t0 + IDLE, IDLE, ABS) != SESS_EXPIRED_IDLE { return 2 } // idle hit (>=)
15 if sess_check(t0, t0, t0 + IDLE - 1, IDLE, ABS) != SESS_VALID { return 3 } // idle just under
16 if sess_check(t0, t0 + ABS, t0 + ABS, IDLE, ABS) != SESS_EXPIRED_ABS { return 4 } // abs hit even if active
17 if sess_check(t0, t0 + ABS - 1, t0 + ABS - 1, IDLE, ABS)!= SESS_VALID { return 5 } // abs just under
18 if sess_check(t0, t0, t0 + ABS, IDLE, ABS) != SESS_EXPIRED_ABS { return 6 } // abs beats idle (both blown)
19
20 // --- lifecycle: issue / verify(slides) / touch ---
21 let rec: *u8 = sys_mmap(64)
22 sess_issue(rec, t0)
23 if sess_issued(rec) != t0 { return 7 }
24 if sess_lastseen(rec) != t0 { return 8 }
25 if sess_verify(rec, t0 + 100) != SESS_VALID { return 9 }
26 if sess_lastseen(rec) != t0 + 100 { return 10 } // VALID verify slid the idle window
27 if sess_verify(rec, t0 + 100 + IDLE) != SESS_EXPIRED_IDLE { return 11 } // idle since last_seen(t0+100)
28
29 // --- an ACTIVE session slides past IDLE but dies at the ABS cap ---
30 sess_issue(rec, t0)
31 if sess_verify(rec, t0 + IDLE - 1) != SESS_VALID { return 12 } // active -> slide
32 if sess_verify(rec, t0 + 2 * (IDLE - 1)) != SESS_VALID { return 13 } // past IDLE total, still alive (slid)
33 nx_puts_err("active session slid past idle: last_seen="); nx_puti_err(sess_lastseen(rec))
34 sess_issue(rec, t0); sess_touch(rec, t0 + ABS - 1) // recently active...
35 if sess_verify(rec, t0 + ABS) != SESS_EXPIRED_ABS { return 14 } // ...but absolute cap still kills it
36
37 nx_puts_err("--- vs PHP session.gc_maxlifetime / Django SESSION_COOKIE_AGE / express-session ---\n" as *u8)
38 nx_puts_err("idle + absolute timeout + rotation-on-login = PARITY (gap was: NO timeout, cookie valid till restart). EXCEEDS: deterministic (caller `now` -> replayable lifecycle), abs-cap-over-idle, + already constant-time compare & HttpOnly/SameSite/Secure.\n" as *u8)
39 nx_puts_err("nx_session_ttl_gate verdict=GREEN pass=14\n" as *u8)
40 return 0
41}