nx_site_auth_gate.nx source

1// nx_site_auth_gate.nx -- REFEREE for the ONE shared access gate (nx_sa_validate) against the REAL 2// canonical Modern Auth. Security code MUST prove it rejects: a wall that can't deny is no wall. 3// Arms a realm exactly like production (load-or-init server keys -> nx_auth_context_init), provisions 4// an admin (nx_modern_auth_register), logs in for a genuine 152B no-cookie token, base64-encodes it 5// into an X-Nishi-Session header, then drives nx_sa_validate four ways: 6// T1 valid X-Nishi-Session -> ALLOW (NX_MAUTH_OK) 7// T2 NO session header -> DENY (NO_SESSION) <- default-deny 8// T3 tampered token (1 b64 char flipped) -> DENY (INVALID_SESSION) <- Ed25519 sig catches it 9// T4 valid token, clock past TTL -> DENY (EXPIRED) <- session actually expires 10// GREEN iff T1..T4 hold. Sovereign: nx_site_auth + nx_modern_auth_flow + nx_base64 + nx_syscalls. license_tier: ORIGINAL 11import "nx_site_auth.nx" 12import "hub/nx_modern_auth_flow.nx" 13import "nx_base64.nx" 14import "nx_syscalls.nx" 15 16func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 17func g_row(name: *u8, ok: i64) -> i64 { 18 if ok == 1 { g_w(" PASS " as *u8) } 19 if ok != 1 { g_w(" FAIL " as *u8) } 20 g_w(name) 21 g_w("\n" as *u8) 22 return ok 23} 24func g_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 } 25 26// build "GET /status HTTP/1.1\r\nHost: ...\r\n[X-Nishi-Session: <b64>\r\n]\r\n" into req; return length. 27func g_build_req(req: *u8, b64: *u8, b64_n: i64, with_session: i64) -> i64 { 28 var o: i64 = 0 29 let pre: *u8 = "GET /status HTTP/1.1\r\nHost: nishifamily.com\r\n" as *u8 30 var i: i64 = 0 31 while pre[i] != (0 as u8) { req[o] = pre[i]; o = o + 1; i = i + 1 } 32 if with_session == 1 { 33 let h: *u8 = "X-Nishi-Session: " as *u8 34 var j: i64 = 0 35 while h[j] != (0 as u8) { req[o] = h[j]; o = o + 1; j = j + 1 } 36 var k: i64 = 0 37 while k < b64_n { req[o] = b64[k]; o = o + 1; k = k + 1 } 38 req[o] = 13 as u8; o = o + 1 39 req[o] = 10 as u8; o = o + 1 40 } 41 req[o] = 13 as u8; o = o + 1 42 req[o] = 10 as u8; o = o + 1 43 return o 44} 45 46func main() -> i64 { 47 g_w("site-auth shared gate -- the ONE access wall every site composes -- vs REAL Modern Auth\n" as *u8) 48 let store_path: *u8 = "/tmp/nishi_siteauth_gate_store.log" as *u8 49 let keys_path: *u8 = "/tmp/nishi_siteauth_gate_keys.log" as *u8 50 g_trunc(store_path) 51 g_trunc(keys_path) 52 53 // ---- arm a realm context exactly like the production access wall will ---- 54 let oprf_seed: *u8 = sys_mmap(32) 55 let akp: *u8 = sys_mmap(32) 56 let akb: *u8 = sys_mmap(33) 57 let edp: *u8 = sys_mmap(32) 58 let edb: *u8 = sys_mmap(32) 59 if nx_uas_server_keys_load_or_init(keys_path, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { g_w("KEYS FAIL\n" as *u8); sys_exit(1) } 60 let realm: *u8 = "nishi_status_adm" as *u8 61 let disp: *u8 = "Nishi status adm" as *u8 62 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 63 if nx_auth_context_init(ctx, realm, 16, disp, 16, store_path as i64, oprf_seed, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { g_w("CTX FAIL\n" as *u8); sys_exit(1) } 64 65 // ---- provision an admin + log in for a genuine no-cookie token ---- 66 let handle: *u8 = "elder" as *u8 67 let pw: *u8 = "correct horse battery staple" as *u8 68 let pw_n: i64 = 28 69 let mn: *u8 = sys_mmap(512) 70 let mn_n: *i64 = sys_mmap(16) as *i64 71 if nx_modern_auth_register(ctx, handle, 5, pw, pw_n, mn, 512, mn_n) != NX_MAUTH_OK { g_w("REGISTER FAIL\n" as *u8); sys_exit(1) } 72 let tok: *u8 = sys_mmap(NX_MAUTH_SESSION_TOKEN_BYTES) 73 let tok_n: *i64 = sys_mmap(16) as *i64 74 if nx_modern_auth_login(ctx, handle, 5, pw, pw_n, tok, NX_MAUTH_SESSION_TOKEN_BYTES, tok_n) != NX_MAUTH_OK { g_w("LOGIN FAIL\n" as *u8); sys_exit(1) } 75 76 let b64: *u8 = sys_mmap(256) 77 let b64_n: i64 = b64_encode(tok, NX_MAUTH_SESSION_TOKEN_BYTES, b64) 78 let now_s: i64 = sys_now_realtime_sec() 79 let req: *u8 = sys_mmap(4096) 80 var pass: i64 = 0 81 82 // ---- T1: valid no-cookie token -> ALLOW ---- 83 let n1: i64 = g_build_req(req, b64, b64_n, 1) 84 var t1: i64 = 0 85 if nx_sa_validate(ctx, req, n1, now_s) == NX_MAUTH_OK { t1 = 1 } 86 pass = pass + g_row("T1 valid X-Nishi-Session -> ALLOW\x00" as *u8, t1) 87 88 // ---- T2: no session header -> DENY (NO_SESSION) ---- 89 let n2: i64 = g_build_req(req, b64, b64_n, 0) 90 var t2: i64 = 0 91 if nx_sa_validate(ctx, req, n2, now_s) == (0 - NX_MAUTH_NO_SESSION) { t2 = 1 } 92 pass = pass + g_row("T2 no session header -> DENY (NO_SESSION)\x00" as *u8, t2) 93 94 // ---- T3: tampered token (flip 1 base64 char in the body) -> DENY (INVALID_SESSION) ---- 95 let b64t: *u8 = sys_mmap(256) 96 var ci: i64 = 0 97 while ci < b64_n { b64t[ci] = b64[ci]; ci = ci + 1 } 98 if (b64t[40] as i64) == 65 { b64t[40] = 66 as u8 } 99 if (b64t[40] as i64) != 66 { b64t[40] = 65 as u8 } 100 let n3: i64 = g_build_req(req, b64t, b64_n, 1) 101 var t3: i64 = 0 102 if nx_sa_validate(ctx, req, n3, now_s) == (0 - NX_MAUTH_INVALID_SESSION) { t3 = 1 } 103 pass = pass + g_row("T3 tampered token -> DENY (INVALID_SESSION)\x00" as *u8, t3) 104 105 // ---- T4: valid token but clock past the 900s TTL -> DENY (EXPIRED) ---- 106 let n4: i64 = g_build_req(req, b64, b64_n, 1) 107 var t4: i64 = 0 108 if nx_sa_validate(ctx, req, n4, now_s + 901) == (0 - NX_MAUTH_EXPIRED) { t4 = 1 } 109 pass = pass + g_row("T4 valid token, past TTL -> DENY (EXPIRED)\x00" as *u8, t4) 110 111 if pass == 4 { g_w("SITE-AUTH GATE GREEN 4/4 (one shared gate: allows valid, denies missing/tampered/expired -- canonical Modern Auth)\n" as *u8); sys_exit(0) } 112 g_w("SITE-AUTH GATE RED\n" as *u8) 113 sys_exit(1) 114 return 1 115}