nx_shard_registry_gate.nx source

1import "nx_gate_gn.nx" 2// nx_shard_registry_gate.nx -- hermetic gate for CAP-SHARD-REGISTRY (the cross-shard control-plane SSOT reader). 3// Builds a fixture shards registry in memory (tab-delimited, like roles.tsv) and proves the addressing + the 4// PER-SHARD ROLES SCOPING that retires the dual-realm hack: two shards resolve to DIFFERENT roles files under ONE 5// realm, so the operator (level-3 everywhere) manages all while a tenant owner is confined to their shard's file. 6// T1 count = 3 T2 find-by-id hit T3 port-of = 18098 T4 roles-of shard A 7// T5 roles-of shard B (DIFFERENT path -> per-shard scoping) T6 (NEG) unknown id -> -1 T7 (NEG) port-of unknown = 0 8// Sovereign: nx_syscalls + nx_shard_registry. license_tier: ORIGINAL expect_exit: 0 9import "nx_syscalls.nx" 10import "nx_shard_registry.nx" 11 12func gp(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 13func g_app(buf: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { buf[off + i] = s[i]; i = i + 1 } return off + i } 14// one 9-field tab-delimited shard row + newline. 15func g_shard(buf: *u8, off: i64, id: *u8, dom: *u8, svc: *u8, port: *u8, realm: *u8, keys: *u8, store: *u8, roles: *u8, health: *u8) -> i64 { 16 var o: i64 = g_app(buf, off, id); buf[o]=9 as u8; o=o+1 17 o = g_app(buf, o, dom); buf[o]=9 as u8; o=o+1 18 o = g_app(buf, o, svc); buf[o]=9 as u8; o=o+1 19 o = g_app(buf, o, port); buf[o]=9 as u8; o=o+1 20 o = g_app(buf, o, realm); buf[o]=9 as u8; o=o+1 21 o = g_app(buf, o, keys); buf[o]=9 as u8; o=o+1 22 o = g_app(buf, o, store); buf[o]=9 as u8; o=o+1 23 o = g_app(buf, o, roles); buf[o]=9 as u8; o=o+1 24 o = g_app(buf, o, health); buf[o]=10 as u8; o=o+1 25 return o 26} 27func g_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 28func g_streq(a: *u8, b: *u8) -> i64 { var i: i64 = 0; while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 } if b[i] == (0 as u8) { return 1 } return 0 } 29 30func main(argc: i64, argv: *i64) -> i64 { 31 gp("=== nx_shard_registry_gate (cross-shard SSOT: address by id, scope RBAC per shard, one realm) ===\n" as *u8) 32 let reg: *u8 = sys_mmap(8192); var rn: i64 = 0 33 rn = g_shard(reg, rn, "nishifamily-mgmt" as *u8, "nishifamily.com" as *u8, "mgmt" as *u8, "18098" as *u8, "nishi_site_admin" as *u8, "opaque_keys.bin" as *u8, "opaque_store.log" as *u8, "/roles/nishifamily.tsv" as *u8, "api" as *u8) 34 rn = g_shard(reg, rn, "nishifamily-hub" as *u8, "nishifamily.com" as *u8, "hub" as *u8, "18792" as *u8, "nishi_site_admin" as *u8, "opaque_keys.bin" as *u8, "opaque_store.log" as *u8, "/roles/nishifamily.tsv" as *u8, "hub" as *u8) 35 rn = g_shard(reg, rn, "andelinwest-portal" as *u8, "andelinwest.com" as *u8, "docportal" as *u8, "18456" as *u8, "andelinwest_docportal" as *u8, "adw_keys" as *u8, "adw_store" as *u8, "/roles/andelinwest.tsv" as *u8, "andelinwest" as *u8) 36 37 var pass: i64 = 0; var fail: i64 = 0 38 let lebox: *i64 = sys_mmap(8) 39 let buf: *u8 = sys_mmap(256) 40 41 // T1 count 42 let c: i64 = sr_count(reg, rn) 43 if c == 3 { pass = pass + 1; gp(" T1 count=3 PASS\n" as *u8) } else { fail = fail + 1; gp(" T1 FAIL count=" as *u8); gn(c); gp("\n" as *u8) } 44 45 // T2 find-by-id hit 46 let ls: i64 = sr_find_by_id(reg, rn, "nishifamily-mgmt" as *u8, g_slen("nishifamily-mgmt" as *u8), lebox) 47 if ls >= 0 { pass = pass + 1; gp(" T2 find-by-id(nishifamily-mgmt) HIT PASS\n" as *u8) } else { fail = fail + 1; gp(" T2 FAIL miss\n" as *u8) } 48 49 // T3 port-of 50 let p: i64 = sr_port_of(reg, rn, "nishifamily-mgmt" as *u8, g_slen("nishifamily-mgmt" as *u8)) 51 if p == 18098 { pass = pass + 1; gp(" T3 port-of(nishifamily-mgmt)=18098 PASS\n" as *u8) } else { fail = fail + 1; gp(" T3 FAIL port=" as *u8); gn(p); gp("\n" as *u8) } 52 53 // T4 roles-of shard A 54 sr_roles_of(reg, rn, "nishifamily-mgmt" as *u8, g_slen("nishifamily-mgmt" as *u8), buf, 256) 55 if g_streq(buf, "/roles/nishifamily.tsv" as *u8) == 1 { pass = pass + 1; gp(" T4 roles-of(nishifamily-mgmt)=/roles/nishifamily.tsv PASS\n" as *u8) } else { fail = fail + 1; gp(" T4 FAIL roles=" as *u8); gp(buf); gp("\n" as *u8) } 56 57 // T5 roles-of shard B -- DIFFERENT file = per-shard scoping (the federation, no dual-realm) 58 let buf2: *u8 = sys_mmap(256) 59 sr_roles_of(reg, rn, "andelinwest-portal" as *u8, g_slen("andelinwest-portal" as *u8), buf2, 256) 60 if g_streq(buf2, "/roles/andelinwest.tsv" as *u8) == 1 { pass = pass + 1; gp(" T5 roles-of(andelinwest-portal)=/roles/andelinwest.tsv (per-shard scope) PASS\n" as *u8) } else { fail = fail + 1; gp(" T5 FAIL roles=" as *u8); gp(buf2); gp("\n" as *u8) } 61 62 // T6 (NEG) unknown id 63 let miss: i64 = sr_find_by_id(reg, rn, "no-such-shard" as *u8, g_slen("no-such-shard" as *u8), lebox) 64 if miss < 0 { pass = pass + 1; gp(" T6 unknown-id -> -1 (no false match) PASS\n" as *u8) } else { fail = fail + 1; gp(" T6 FAIL matched\n" as *u8) } 65 66 // T7 (NEG) port-of unknown 67 let p0: i64 = sr_port_of(reg, rn, "no-such-shard" as *u8, g_slen("no-such-shard" as *u8)) 68 if p0 == 0 { pass = pass + 1; gp(" T7 port-of(unknown)=0 PASS\n" as *u8) } else { fail = fail + 1; gp(" T7 FAIL\n" as *u8) } 69 70 gp("RESULT pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 71 if fail == 0 { gp(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 72 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 73}