nx_shard_rbac_gate.nx source

1import "nx_gate_gn.nx" 2// nx_shard_rbac_gate.nx -- PROOF of the s-class-exceed cross-shard federation (R2), the model that RETIRES the 3// dual-realm hack. It composes exactly what ma_level_of will wire: resolve a request's shard -> that shard's roles 4// file (nx_shard_registry.sr_roles_of) -> the session's level in it (nx_access_lib.ag_uid_to_level). ONE identity 5// realm; authority is scoped by PER-SHARD roles files. Proven with negative controls: 6// T1 operator manages shard A (level 3) T2 operator manages shard B too (level 3, one login spans shards) 7// T3 tenant owner manages THEIR shard (3) T4 (NEG) tenant owner CANNOT manage another shard (0) -- isolation 8// T5 (NEG) unknown session -> 0 everywhere (deny-by-default) 9// This is AWS delegated-admin / GCP folder-scoped IAM expressed as one TSV row per shard, no cross-realm validation. 10// Sovereign: nx_syscalls + nx_shard_registry + nx_access_lib. license_tier: ORIGINAL expect_exit: 0 11import "nx_syscalls.nx" 12import "nx_shard_registry.nx" 13import "nx_access_lib.nx" 14 15func gp(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 16func g_app(buf: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { buf[off + i] = s[i]; i = i + 1 } return off + i } 17func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 18func g_write_file(path: *u8, buf: *u8, n: i64) -> i64 { 19 let fd: i64 = sys_openat_wr(path, 0x1a4) 20 if fd < 0 { return 0 - 1 } 21 sys_write(fd, buf, n); sys_close(fd) 22 return n 23} 24func g_shard(buf: *u8, off: i64, id: *u8, dom: *u8, svc: *u8, port: *u8, realm: *u8, keys: *u8, store: *u8, roles: *u8, health: *u8) -> i64 { 25 var o: i64 = g_app(buf, off, id); buf[o]=9 as u8; o=o+1 26 o = g_app(buf, o, dom); buf[o]=9 as u8; o=o+1 27 o = g_app(buf, o, svc); buf[o]=9 as u8; o=o+1 28 o = g_app(buf, o, port); buf[o]=9 as u8; o=o+1 29 o = g_app(buf, o, realm); buf[o]=9 as u8; o=o+1 30 o = g_app(buf, o, keys); buf[o]=9 as u8; o=o+1 31 o = g_app(buf, o, store); buf[o]=9 as u8; o=o+1 32 o = g_app(buf, o, roles); buf[o]=9 as u8; o=o+1 33 o = g_app(buf, o, health); buf[o]=10 as u8; o=o+1 34 return o 35} 36 37// the R2 composition, verbatim what ma_level_of does: shard-id -> that shard's roles file -> the session's level. 38func resolve(reg: *u8, rn: i64, idx_path: *u8, uid: *u8, uidn: i64, shard: *u8, slen: i64) -> i64 { 39 let roles: *u8 = sys_mmap(256) 40 if sr_roles_of(reg, rn, shard, slen, roles, 256) <= 0 { return 0 } // no such shard -> deny 41 return ag_uid_to_level(uid, uidn, idx_path, roles) 42} 43 44func main(argc: i64, argv: *i64) -> i64 { 45 gp("=== nx_shard_rbac_gate (PROVE cross-shard federation: one realm, per-shard roles, isolation) ===\n" as *u8) 46 47 // fixture uid->handle index: uid 0xAA -> elderwesto (operator), 0xBB -> adw_owner (a tenant owner) 48 let idx: *u8 = sys_mmap(256); var ix: i64 = 0 49 ix = g_app(idx, ix, "aa" as *u8); idx[ix]=9 as u8; ix=ix+1; ix = g_app(idx, ix, "elderwesto" as *u8); idx[ix]=10 as u8; ix=ix+1 50 ix = g_app(idx, ix, "bb" as *u8); idx[ix]=9 as u8; ix=ix+1; ix = g_app(idx, ix, "adw_owner" as *u8); idx[ix]=10 as u8; ix=ix+1 51 g_write_file("/tmp/sr_idx.tsv" as *u8, idx, ix) 52 53 // per-shard roles: nishifamily has ONLY the operator; andelinwest has the operator AND its owner. 54 let rnf: *u8 = sys_mmap(128); var rnfn: i64 = 0 55 rnfn = g_app(rnf, rnfn, "elderwesto" as *u8); rnf[rnfn]=9 as u8; rnfn=rnfn+1; rnf[rnfn]=51 as u8; rnfn=rnfn+1; rnf[rnfn]=10 as u8; rnfn=rnfn+1 56 g_write_file("/tmp/sr_roles_nf.tsv" as *u8, rnf, rnfn) 57 let radw: *u8 = sys_mmap(128); var radwn: i64 = 0 58 radwn = g_app(radw, radwn, "elderwesto" as *u8); radw[radwn]=9 as u8; radwn=radwn+1; radw[radwn]=51 as u8; radwn=radwn+1; radw[radwn]=10 as u8; radwn=radwn+1 59 radwn = g_app(radw, radwn, "adw_owner" as *u8); radw[radwn]=9 as u8; radwn=radwn+1; radw[radwn]=51 as u8; radwn=radwn+1; radw[radwn]=10 as u8; radwn=radwn+1 60 g_write_file("/tmp/sr_roles_adw.tsv" as *u8, radw, radwn) 61 62 // fixture shards registry pointing each shard at its per-shard roles file 63 let reg: *u8 = sys_mmap(4096); var rn: i64 = 0 64 rn = g_shard(reg, rn, "nishifamily-mgmt" as *u8, "nishifamily.com" as *u8, "mgmt" as *u8, "18098" as *u8, "nishi_site_admin" as *u8, "k" as *u8, "s" as *u8, "/tmp/sr_roles_nf.tsv" as *u8, "api" as *u8) 65 rn = g_shard(reg, rn, "andelinwest-portal" as *u8, "andelinwest.com" as *u8, "docportal" as *u8, "18456" as *u8, "andelinwest_docportal" as *u8, "k" as *u8, "s" as *u8, "/tmp/sr_roles_adw.tsv" as *u8, "andelinwest" as *u8) 66 67 let uid_op: *u8 = sys_mmap(8); uid_op[0]=0xaa as u8 // operator session uid 68 let uid_tn: *u8 = sys_mmap(8); uid_tn[0]=0xbb as u8 // tenant-owner session uid 69 let uid_gh: *u8 = sys_mmap(8); uid_gh[0]=0xcc as u8 // unknown session uid 70 let SM: *u8 = "nishifamily-mgmt" as *u8; let SMn: i64 = g_slen(SM) 71 let SA: *u8 = "andelinwest-portal" as *u8; let SAn: i64 = g_slen(SA) 72 let IDX: *u8 = "/tmp/sr_idx.tsv" as *u8 73 var pass: i64 = 0; var fail: i64 = 0 74 75 let a1: i64 = resolve(reg, rn, IDX, uid_op, 1, SM, SMn) 76 if a1 == 3 { pass=pass+1; gp(" T1 operator manages nishifamily-mgmt (lvl 3) PASS\n" as *u8) } else { fail=fail+1; gp(" T1 FAIL lvl=" as *u8); gn(a1); gp("\n" as *u8) } 77 78 let a2: i64 = resolve(reg, rn, IDX, uid_op, 1, SA, SAn) 79 if a2 == 3 { pass=pass+1; gp(" T2 operator manages andelinwest-portal too (one login spans shards, lvl 3) PASS\n" as *u8) } else { fail=fail+1; gp(" T2 FAIL lvl=" as *u8); gn(a2); gp("\n" as *u8) } 80 81 let a3: i64 = resolve(reg, rn, IDX, uid_tn, 1, SA, SAn) 82 if a3 == 3 { pass=pass+1; gp(" T3 tenant owner manages THEIR shard (lvl 3) PASS\n" as *u8) } else { fail=fail+1; gp(" T3 FAIL lvl=" as *u8); gn(a3); gp("\n" as *u8) } 83 84 let a4: i64 = resolve(reg, rn, IDX, uid_tn, 1, SM, SMn) 85 if a4 == 0 { pass=pass+1; gp(" T4 tenant owner CANNOT manage nishifamily (lvl 0 -- cross-shard ISOLATION) PASS\n" as *u8) } else { fail=fail+1; gp(" T4 FAIL lvl=" as *u8); gn(a4); gp("\n" as *u8) } 86 87 let a5: i64 = resolve(reg, rn, IDX, uid_gh, 1, SA, SAn) 88 if a5 == 0 { pass=pass+1; gp(" T5 unknown session -> 0 (deny-by-default) PASS\n" as *u8) } else { fail=fail+1; gp(" T5 FAIL lvl=" as *u8); gn(a5); gp("\n" as *u8) } 89 90 gp("RESULT pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 91 if fail == 0 { gp(" verdict=GREEN (federation proven: one realm, per-shard authority, isolation)\n" as *u8); sys_exit(0); return 0 } 92 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 93}