code wiki / _hdl_build / nx_studio_tier_endpoint_gate.nx
nx_studio_tier_endpoint_gate.nx source
↩ module page · 78 lines · 6474 B
1// nx_studio_tier_endpoint_gate.nx -- gate for the governed tier-aware endpoint se_build_tier (nx_studio_tiers).
2// Proves the daemon can forward a raw POST body: an optional first line `tier|<guided|block|freeform>` selects
3// the capability tier (default/unknown -> block), the rest is that tier's input, and the result is always a
4// governed build through the sovereign engine. Positive + negative + graceful-fallback controls. Appends a
5// CMSGATE row to knowledge/status/cms_gate.log on all-pass. license_tier: ORIGINAL
6import "nx_studio_tiers.nx"
7import "nx_syscalls.nx"
8
9func ew(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
10func enm(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 }
11func ecat(dst: *u8, off: i64, s: *u8) -> i64 { var o: i64=off; var k: i64=0; while s[k]!=(0 as u8){dst[o]=s[k];o=o+1;k=k+1} return o }
12func ecatnum(dst: *u8, off: i64, v: i64) -> i64 { var o: i64=off; let t: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; var k: i64=0; if m==0{t[0]=48 as u8;k=1}; while m>0{t[k]=(48+(m%10)) as u8;m=m/10;k=k+1}; var i: i64=0; while i<k{dst[o]=t[k-1-i];o=o+1;i=i+1} return o }
13func erow(id: i64, ok: i64, what: *u8) -> i64 { ew("EPROW " as *u8); enm(id); ew(" " as *u8); if ok==1 { ew("PASS " as *u8) } else { ew("FAIL " as *u8) } ew(what); ew("\n" as *u8); return ok }
14func elen(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
15func econtains(hay: *u8, hn: i64, needle: *u8) -> i64 {
16 var nl: i64=0; while needle[nl]!=(0 as u8){nl=nl+1}
17 if nl==0 { return 1 } if nl>hn { return 0 }
18 let last: i64=hn-nl; var i: i64=0
19 while i<=last { var j: i64=0; var hit: i64=1; while j<nl { if (hay[i+j] as i64)!=(needle[j] as i64){hit=0;j=nl} if hit==1{j=j+1} } if hit==1 { return 1 } i=i+1 }
20 return 0
21}
22func ebuild(payload: *u8, out: *u8, cap: i64) -> i64 { return se_build_tier(payload, elen(payload), out, cap) }
23
24func main() -> i64 {
25 let out: *u8 = sys_mmap(262144)
26 var rows: i64 = 0
27 var pass: i64 = 0
28 var ok: i64 = 0
29
30 // R0: tier|guided -> governed guided page
31 let l0: i64 = ebuild("tier|guided\nbrand|BrandCo\ncta|Free consult\ncta_href|#c\nheadline|We help Utah families\nsub|Talk today\nsearch|/s\ncard_title|Family Law\ncard_body|We help.\nstep1|Call\nstep2|We act\ntrust|Utah Bar\nfooter|BrandCo\n" as *u8, out, 262143)
32 ok = 0; if l0>0 { if econtains(out,l0,"BrandCo" as *u8)==1 { if econtains(out,l0,"We help Utah families" as *u8)==1 { ok=1 } } }
33 rows=rows+1; pass=pass+erow(0, ok, "endpoint tier|guided -> governed guided page" as *u8)
34
35 // R1: tier|block -> governed block page
36 let l1: i64 = ebuild("tier|block\ntitle|Pet\nheader|PetCo|Book now|#b\nhero|Happy pets|We care|Book|#b\nsearch|/f|Find\ncards|S\ncard|Grooming|Full.\nsteps|S\nstep|a\nstep|b\ntrust|\nsig|Vets\nfooter|PetCo\n" as *u8, out, 262143)
37 ok = 0; if l1>0 { if econtains(out,l1,"Grooming" as *u8)==1 { ok=1 } }
38 rows=rows+1; pass=pass+erow(1, ok, "endpoint tier|block -> governed block page" as *u8)
39
40 // R2: tier|freeform -> the canvas profile (free placement honored, escaped)
41 let l2: i64 = ebuild("tier|freeform\ntitle|FF Canvas\nel|heading|30|40|400|Free Heading|\nel|button|30|200|180|Go now|#go\n" as *u8, out, 262143)
42 ok = 0; if l2>0 { if econtains(out,l2,"Free Heading" as *u8)==1 { if econtains(out,l2,"left:30px;top:40px;width:400px" as *u8)==1 { if econtains(out,l2,"href=\"#go\"" as *u8)==1 { ok=1 } } } }
43 rows=rows+1; pass=pass+erow(2, ok, "endpoint tier|freeform -> canvas profile (free placement honored)" as *u8)
44
45 // R3: NO tier line (raw .site) -> defaults to block, builds (backward-compatible)
46 let l3: i64 = ebuild("title|Raw\nheader|RawCo|Go|#r\nhero|RawHead|sub|Go|#r\nsearch|/s|q\ncards|C\ncard|RawCard|b\nsteps|S\nstep|1\nstep|2\ntrust|\nsig|T\nfooter|Raw\n" as *u8, out, 262143)
47 ok = 0; if l3>0 { if econtains(out,l3,"RawHead" as *u8)==1 { ok=1 } }
48 rows=rows+1; pass=pass+erow(3, ok, "endpoint no tier line -> defaults to block, builds (backward-compat)" as *u8)
49
50 // R4 (NEG): hostile field via the guided endpoint -> escaped
51 let l4: i64 = ebuild("tier|guided\nbrand|<script>alert(9)</script>\ncta|C\ncta_href|#c\nheadline|H\nsub|S\nsearch|/s\ncard_title|A\ncard_body|b\nstep1|1\nstep2|2\ntrust|T\nfooter|F\n" as *u8, out, 262143)
52 ok = 0; if l4>0 { if econtains(out,l4,"<script>alert(9)" as *u8)==0 { if econtains(out,l4,"<script>alert(9)" as *u8)==1 { ok=1 } } }
53 rows=rows+1; pass=pass+erow(4, ok, "NEG: hostile field via guided endpoint is escaped" as *u8)
54
55 // R5 (NEG): incomplete block via endpoint -> refused
56 let l5: i64 = ebuild("tier|block\nfooter|just a footer\n" as *u8, out, 262143)
57 ok = 0; if l5==0 { ok=1 }
58 rows=rows+1; pass=pass+erow(5, ok, "NEG: incomplete block via endpoint REFUSED (publish-gate holds)" as *u8)
59
60 // R6 (graceful): unknown tier name -> falls back to block, builds
61 let l6: i64 = ebuild("tier|bogus\ntitle|U\nheader|UCo|Go|#u\nhero|UHead|sub|Go|#u\nsearch|/s|q\ncards|C\ncard|UnknownTierCard|b\nsteps|S\nstep|1\nstep|2\ntrust|\nsig|T\nfooter|U\n" as *u8, out, 262143)
62 ok = 0; if l6>0 { if econtains(out,l6,"UnknownTierCard" as *u8)==1 { ok=1 } }
63 rows=rows+1; pass=pass+erow(6, ok, "graceful: unknown tier name -> falls back to block, builds" as *u8)
64
65 ew("NX-STUDIO-TIER-ENDPOINT-GATE rows=" as *u8); enm(rows); ew(" pass=" as *u8); enm(pass); ew("\n" as *u8)
66 if pass == rows {
67 let line: *u8 = sys_mmap(256)
68 var off: i64 = ecat(line, 0, "CMSGATE row=nx_studio_tier_endpoint capability-tier-endpoint rows=" as *u8)
69 off = ecatnum(line, off, rows); off = ecat(line, off, " pass=" as *u8); off = ecatnum(line, off, pass)
70 off = ecat(line, off, " verdict=PASS (se_build_tier governs guided/block/freeform from one POST body)\n" as *u8)
71 let gf: i64 = sys_openat_append("knowledge/status/cms_gate.log" as *u8, 0x1a4)
72 if gf >= 0 { sys_write(gf, line, off); sys_close(gf) }
73 ew("NX-STUDIO-TIER-ENDPOINT-GATE verdict=PASS -- governed tier-aware endpoint ready for the daemon route\n" as *u8)
74 sys_exit(0); return 0
75 }
76 ew("NX-STUDIO-TIER-ENDPOINT-GATE verdict=FAIL -- NOT recorded (no fake-green)\n" as *u8)
77 sys_exit(1); return 1
78}