nx_site_lock_gate.nx source

1import "nx_gate_gn.nx" 2// nx_site_lock_gate.nx -- hermetic gate for the data-driven multi-level lock resolver. Builds fixture 3// registries in memory (no file I/O) and proves the load-bearing access-control properties: 4// T1 AREA lock: nishifamily /wiki/board.html -> LOCKED realm=WikiAdmin level=3 5// T2 AREA prefix: /wiki/board/sub.html -> LOCKED level=3 (segment-boundary '/') 6// T3 (NEG) PUBLIC-by-default: /wiki/charter.html -> PUBLIC (no rule => public; charter stays open) 7// T4 (NEG) boundary safety: /wiki/boardroom.html -> PUBLIC ("board" must NOT lock "boardroom") 8// T5 SITE lock: andelinwest /index.html -> LOCKED realm=AWAdmin level=2 (whole site) 9// T6 (NEG) per-site isolation: a nishifamily area rule must NOT lock a different site 10// T7 most-specific-wins: with a MULTI rule present, /wiki/board.html still resolves to the AREA (3) 11// T8 MULTI breadth: with MULTI present, /wiki/charter.html resolves to the multi lock (level 1) 12// Sovereign: imports nx_syscalls + the lib only. license_tier: ORIGINAL 13import "nx_syscalls.nx" 14import "nx_site_lock_lib.nx" 15 16func gp(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 17func g_app(buf: *u8, off: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { buf[off + i] = s[i]; i = i + 1 } return off + i } 18func g_row(buf: *u8, off: i64, scope: *u8, pat: *u8, realm: *u8, lvl: *u8) -> i64 { 19 var o: i64 = g_app(buf, off, scope); buf[o] = 9 as u8; o = o + 1 20 o = g_app(buf, o, pat); buf[o] = 9 as u8; o = o + 1 21 o = g_app(buf, o, realm); buf[o] = 9 as u8; o = o + 1 22 o = g_app(buf, o, lvl); buf[o] = 10 as u8; o = o + 1 23 return o 24} 25 26func main(argc: i64, argv: *i64) -> i64 { 27 gp("=== nx_site_lock_gate (data-driven multi/site/area access-control lock) ===\n" as *u8) 28 let realm: *u8 = sys_mmap(128) 29 let lvl: *i64 = sys_mmap(8) as *i64 30 var pass: i64 = 0 31 var fail: i64 = 0 32 33 let site_nf: *u8 = "nishifamily" as *u8 34 let site_aw: *u8 = "andelinwest" as *u8 35 let site_other: *u8 = "othersite" as *u8 36 37 // ---- fixture A: area + site locks, NO multi (so unnamed paths are PUBLIC) ---- 38 let regA: *u8 = sys_mmap(4096); var an: i64 = 0 39 an = g_row(regA, an, "area" as *u8, "nishifamily/wiki/board" as *u8, "WikiAdmin" as *u8, "3" as *u8) 40 an = g_row(regA, an, "area" as *u8, "nishifamily/wiki/admin" as *u8, "WikiAdmin" as *u8, "3" as *u8) 41 an = g_row(regA, an, "site" as *u8, "andelinwest" as *u8, "AWAdmin" as *u8, "2" as *u8) 42 43 // T1: AREA lock hit 44 let p_board: *u8 = "/wiki/board.html" as *u8 45 var lk: i64 = slk_resolve(regA, an, site_nf, slk_slen(site_nf), p_board, slk_slen(p_board), realm, 128, lvl) 46 var t1: i64 = 0 47 if lk == 1 { if lvl[0] == 3 { if slk_eq(realm, slk_slen(realm), "WikiAdmin" as *u8, 9) == 1 { t1 = 1 } } } 48 if t1 == 1 { pass = pass + 1; gp(" T1 area-lock board->LOCKED L3 WikiAdmin PASS\n" as *u8) } else { fail = fail + 1; gp(" T1 FAIL lk=" as *u8); gn(lk); gp(" lvl=" as *u8); gn(lvl[0]); gp("\n" as *u8) } 49 50 // T2: AREA prefix with '/' boundary 51 let p_sub: *u8 = "/wiki/board/sub.html" as *u8 52 lk = slk_resolve(regA, an, site_nf, slk_slen(site_nf), p_sub, slk_slen(p_sub), realm, 128, lvl) 53 var t2: i64 = 0 54 if lk == 1 { if lvl[0] == 3 { t2 = 1 } } 55 if t2 == 1 { pass = pass + 1; gp(" T2 area-prefix sub->LOCKED L3 PASS\n" as *u8) } else { fail = fail + 1; gp(" T2 FAIL\n" as *u8) } 56 57 // T3 (NEG): public-by-default 58 let p_charter: *u8 = "/wiki/charter.html" as *u8 59 lk = slk_resolve(regA, an, site_nf, slk_slen(site_nf), p_charter, slk_slen(p_charter), realm, 128, lvl) 60 if lk == 0 { pass = pass + 1; gp(" T3 charter->PUBLIC (default) PASS\n" as *u8) } else { fail = fail + 1; gp(" T3 FAIL charter locked\n" as *u8) } 61 62 // T4 (NEG): boundary safety -- boardroom != board 63 let p_room: *u8 = "/wiki/boardroom.html" as *u8 64 lk = slk_resolve(regA, an, site_nf, slk_slen(site_nf), p_room, slk_slen(p_room), realm, 128, lvl) 65 if lk == 0 { pass = pass + 1; gp(" T4 boardroom->PUBLIC (boundary) PASS\n" as *u8) } else { fail = fail + 1; gp(" T4 FAIL boardroom matched board\n" as *u8) } 66 67 // T5: SITE lock covers any path 68 let p_idx: *u8 = "/index.html" as *u8 69 lk = slk_resolve(regA, an, site_aw, slk_slen(site_aw), p_idx, slk_slen(p_idx), realm, 128, lvl) 70 var t5: i64 = 0 71 if lk == 1 { if lvl[0] == 2 { if slk_eq(realm, slk_slen(realm), "AWAdmin" as *u8, 7) == 1 { t5 = 1 } } } 72 if t5 == 1 { pass = pass + 1; gp(" T5 site-lock andelinwest->LOCKED L2 AWAdmin PASS\n" as *u8) } else { fail = fail + 1; gp(" T5 FAIL\n" as *u8) } 73 74 // T6 (NEG): per-site isolation -- nishifamily's area rule must NOT lock othersite's same path 75 lk = slk_resolve(regA, an, site_other, slk_slen(site_other), p_board, slk_slen(p_board), realm, 128, lvl) 76 if lk == 0 { pass = pass + 1; gp(" T6 cross-site isolation othersite->PUBLIC PASS\n" as *u8) } else { fail = fail + 1; gp(" T6 FAIL nishifamily rule bled to othersite\n" as *u8) } 77 78 // ---- fixture B: area board + a MULTI base lock (everything >= L1) ---- 79 let regB: *u8 = sys_mmap(4096); var bn: i64 = 0 80 bn = g_row(regB, bn, "area" as *u8, "nishifamily/wiki/board" as *u8, "WikiAdmin" as *u8, "3" as *u8) 81 bn = g_row(regB, bn, "multi" as *u8, "*" as *u8, "BaseGate" as *u8, "1" as *u8) 82 83 // T7: most-specific-wins (area 3 beats multi 1) 84 lk = slk_resolve(regB, bn, site_nf, slk_slen(site_nf), p_board, slk_slen(p_board), realm, 128, lvl) 85 var t7: i64 = 0 86 if lk == 1 { if lvl[0] == 3 { if slk_eq(realm, slk_slen(realm), "WikiAdmin" as *u8, 9) == 1 { t7 = 1 } } } 87 if t7 == 1 { pass = pass + 1; gp(" T7 most-specific board->L3 (beats multi) PASS\n" as *u8) } else { fail = fail + 1; gp(" T7 FAIL lvl=" as *u8); gn(lvl[0]); gp("\n" as *u8) } 88 89 // T8: multi breadth (charter now caught by multi at L1) 90 lk = slk_resolve(regB, bn, site_nf, slk_slen(site_nf), p_charter, slk_slen(p_charter), realm, 128, lvl) 91 var t8: i64 = 0 92 if lk == 1 { if lvl[0] == 1 { if slk_eq(realm, slk_slen(realm), "BaseGate" as *u8, 8) == 1 { t8 = 1 } } } 93 if t8 == 1 { pass = pass + 1; gp(" T8 multi-breadth charter->L1 BaseGate PASS\n" as *u8) } else { fail = fail + 1; gp(" T8 FAIL\n" as *u8) } 94 95 gp("RESULT pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail) 96 if fail == 0 { gp(" verdict=GREEN\n" as *u8); sys_exit(0); return 0 } 97 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1 98}