code wiki / _hdl_build / nx_status_daemon_gate.nx
nx_status_daemon_gate.nx source
↩ module page · 161 lines · 7814 B
1// nx_status_daemon_gate.nx -- SOVEREIGN in-process referee for the modern-auth status daemon. NO socket,
2// NO curl, NO shell -- it arms a realm + registers an admin via the real Modern Auth, then feeds crafted
3// HTTP request BYTES straight into the pure router sd_handle and asserts the response bytes. The whole
4// login -> token -> gated-content -> deny flow, proven inside one Nishi organ.
5// T1 GET /status -> 200 + SPA shell (public)
6// T2 POST /status/login ok -> 200 + {"token":...} (mint a real no-cookie token)
7// T3 GET /content WITH tok -> 200 + the gated body marker
8// T4 GET /content NO tok -> 401 (default-deny)
9// T5 POST /login WRONG pw -> 401 (and same shape as unknown-handle)
10// T6 GET /content BAD tok -> 401 (forged token rejected)
11// GREEN iff T1..T6 hold. Sovereign: nx_status_daemon + nx_modern_auth_flow + nx_syscalls. license_tier: ORIGINAL
12import "nx_status_daemon.nx"
13import "hub/nx_modern_auth_flow.nx"
14import "nx_syscalls.nx"
15
16func g_w(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
17func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
18func g_row(name: *u8, ok: i64) -> i64 {
19 if ok == 1 { g_w(" PASS " as *u8) }
20 if ok != 1 { g_w(" FAIL " as *u8) }
21 g_w(name)
22 g_w("\n" as *u8)
23 return ok
24}
25func g_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i }
26func g_cat_n(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n }
27func g_trunc(path: *u8) -> i64 { let fd: i64 = sys_openat_wr(path, 0x180); if fd >= 0 { sys_close(fd) } return 0 }
28
29// response starts with status line s?
30func g_starts(buf: *u8, n: i64, s: *u8) -> i64 {
31 let sn: i64 = g_len(s)
32 if n < sn { return 0 }
33 var i: i64 = 0
34 while i < sn { if (buf[i] as i64) != (s[i] as i64) { return 0 } i = i + 1 }
35 return 1
36}
37// substring search
38func g_contains(hay: *u8, n: i64, needle: *u8) -> i64 {
39 let nn: i64 = g_len(needle)
40 var i: i64 = 0
41 while i + nn <= n {
42 var m: i64 = 1
43 var j: i64 = 0
44 while j < nn { if (hay[i + j] as i64) != (needle[j] as i64) { m = 0; j = nn } else { j = j + 1 } }
45 if m == 1 { return 1 }
46 i = i + 1
47 }
48 return 0
49}
50// copy the base64 token out of {"token":"<b64>"} into out; returns length (0 if absent).
51func g_extract_token(resp: *u8, n: i64, out: *u8) -> i64 {
52 let key: *u8 = "{\"token\":\"" as *u8
53 let kn: i64 = 10
54 var start: i64 = 0 - 1
55 var i: i64 = 0
56 while i + kn <= n {
57 var m: i64 = 1
58 var j: i64 = 0
59 while j < kn { if (resp[i + j] as i64) != (key[j] as i64) { m = 0; j = kn } else { j = j + 1 } }
60 if m == 1 { start = i + kn; i = n }
61 i = i + 1
62 }
63 if start < 0 { return 0 }
64 var w: i64 = 0
65 var k: i64 = start
66 var done: i64 = 0
67 while done == 0 {
68 if k >= n { done = 1 }
69 if done == 0 { if (resp[k] as i64) == 34 { done = 1 } }
70 if done == 0 { out[w] = resp[k]; w = w + 1; k = k + 1 }
71 }
72 return w
73}
74
75func main() -> i64 {
76 g_w("status-daemon SOVEREIGN in-process gate (no socket/curl/shell -- sd_handle bytes-in/bytes-out)\n" as *u8)
77 let store_path: *u8 = "/tmp/nx_sd_gate_store.log" as *u8
78 let keys_path: *u8 = "/tmp/nx_sd_gate_keys.log" as *u8
79 let stf: *u8 = "/tmp/nx_sd_gate_status.html" as *u8
80 g_trunc(store_path)
81 g_trunc(keys_path)
82
83 // ---- write the status fixture via syscalls (NOT a shell) ----
84 let sfd: i64 = sys_openat_wr(stf, 0x180)
85 if sfd < 0 { g_w("FIXTURE FAIL\n" as *u8); sys_exit(1) }
86 let fixture: *u8 = "<h3>STATUSMARK all systems nominal</h3>" as *u8
87 sys_write(sfd, fixture, g_len(fixture))
88 sys_close(sfd)
89
90 // ---- arm a realm + register an admin via the real Modern Auth ----
91 let oprf_seed: *u8 = sys_mmap(32)
92 let akp: *u8 = sys_mmap(32)
93 let akb: *u8 = sys_mmap(33)
94 let edp: *u8 = sys_mmap(32)
95 let edb: *u8 = sys_mmap(32)
96 if nx_uas_server_keys_load_or_init(keys_path, oprf_seed, akp, akb, edp, edb) != NX_UAS_OK { g_w("KEYS FAIL\n" as *u8); sys_exit(1) }
97 let realm: *u8 = "nishi_status_adm" as *u8
98 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext
99 if nx_auth_context_init(ctx, realm, 16, realm, 16, store_path as i64, oprf_seed, edp, edb, 900, 8192, 1, 1, 5, 1) != NX_MAUTH_OK { g_w("CTX FAIL\n" as *u8); sys_exit(1) }
100 let mn: *u8 = sys_mmap(512)
101 let mn_n: *i64 = sys_mmap(16) as *i64
102 if nx_modern_auth_register(ctx, "elder" as *u8, 5, "correct horse battery staple" as *u8, 28, mn, 512, mn_n) != NX_MAUTH_OK { g_w("REGISTER FAIL\n" as *u8); sys_exit(1) }
103
104 let req: *u8 = sys_mmap(8192)
105 let out: *u8 = sys_mmap(SD_OUTCAP)
106 var pass: i64 = 0
107
108 // ---- T1: GET /status -> 200 + shell ----
109 var n1: i64 = g_cat(req, 0, "GET /status HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
110 let o1: i64 = sd_handle(ctx, req, n1, stf, out)
111 var t1: i64 = 0
112 if g_starts(out, o1, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, o1, "id=login" as *u8) == 1 { t1 = 1 } }
113 pass = pass + g_row("T1 GET /status -> 200 + SPA shell\x00" as *u8, t1)
114
115 // ---- T2: POST /status/login (correct) -> 200 + token ----
116 var n2: i64 = g_cat(req, 0, "POST /status/login HTTP/1.1\r\nHost: x\r\n\r\nhandle=elder&passphrase=correct+horse+battery+staple" as *u8)
117 let o2: i64 = sd_handle(ctx, req, n2, stf, out)
118 var t2: i64 = 0
119 let tokbuf: *u8 = sys_mmap(256)
120 var tok_n: i64 = 0
121 if g_starts(out, o2, "HTTP/1.1 200" as *u8) == 1 {
122 tok_n = g_extract_token(out, o2, tokbuf)
123 if tok_n > 0 { t2 = 1 }
124 }
125 pass = pass + g_row("T2 POST /login ok -> 200 + token\x00" as *u8, t2)
126
127 // ---- T3: GET /status/content WITH token -> 200 + gated body ----
128 var n3: i64 = g_cat(req, 0, "GET /status/content HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8)
129 n3 = g_cat_n(req, n3, tokbuf, tok_n)
130 n3 = g_cat(req, n3, "\r\n\r\n" as *u8)
131 let o3: i64 = sd_handle(ctx, req, n3, stf, out)
132 var t3: i64 = 0
133 if g_starts(out, o3, "HTTP/1.1 200" as *u8) == 1 { if g_contains(out, o3, "STATUSMARK" as *u8) == 1 { t3 = 1 } }
134 pass = pass + g_row("T3 GET /content WITH token -> 200 + gated body\x00" as *u8, t3)
135
136 // ---- T4: GET /status/content WITHOUT token -> 401 ----
137 var n4: i64 = g_cat(req, 0, "GET /status/content HTTP/1.1\r\nHost: x\r\n\r\n" as *u8)
138 let o4: i64 = sd_handle(ctx, req, n4, stf, out)
139 var t4: i64 = 0
140 if g_starts(out, o4, "HTTP/1.1 401" as *u8) == 1 { t4 = 1 }
141 pass = pass + g_row("T4 GET /content NO token -> 401 (default-deny)\x00" as *u8, t4)
142
143 // ---- T5: POST /status/login (wrong pw) -> 401 ----
144 var n5: i64 = g_cat(req, 0, "POST /status/login HTTP/1.1\r\nHost: x\r\n\r\nhandle=elder&passphrase=wrong+passphrase\x00" as *u8)
145 let o5: i64 = sd_handle(ctx, req, n5, stf, out)
146 var t5: i64 = 0
147 if g_starts(out, o5, "HTTP/1.1 401" as *u8) == 1 { t5 = 1 }
148 pass = pass + g_row("T5 POST /login WRONG pw -> 401\x00" as *u8, t5)
149
150 // ---- T6: GET /status/content BAD token -> 401 ----
151 var n6: i64 = g_cat(req, 0, "GET /status/content HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: AAAAAAAA\r\n\r\n" as *u8)
152 let o6: i64 = sd_handle(ctx, req, n6, stf, out)
153 var t6: i64 = 0
154 if g_starts(out, o6, "HTTP/1.1 401" as *u8) == 1 { t6 = 1 }
155 pass = pass + g_row("T6 GET /content BAD token -> 401 (forged rejected)\x00" as *u8, t6)
156
157 if pass == 6 { g_w("STATUS-DAEMON GATE verdict=GREEN 6/6 (full login->token->gated-content->deny, sovereign in-process)\n" as *u8); sys_exit(0) }
158 g_w("STATUS-DAEMON GATE RED\n" as *u8)
159 sys_exit(1)
160 return 1
161}