nx_tools_api_recovery_handler_gate_v3_t316.nx source
↩ module page · 45 lines · 3285 B
1import "nx_tools_api_recovery_candidate_v3_t316.nx"
2func rc_has(b:*u8,n:i64,s:*u8)->i64{if ta_indexof(b,n,s)>=0{return 1};return 0}
3func rc_fixture(kind:i64,want:*u8,action:*u8,message:*u8)->i64{
4 let req:*u8=sys_mmap(4096);var rn:i64=ta_cat(req,0,"POST /mcp HTTP/1.1\r\n")
5 let body:*u8=sys_mmap(4096);var bn:i64=ta_cat(body,0,"{\"name\":\"nx_txtscan\"")
6 if kind!=0{
7 let sl:*i64=sys_mmap(16) as *i64;let secret:*u8=ta_load_cap_secret(sl)
8 let cap:*u8=sys_mmap(1024);var scope:*u8="nx_txtscan";var exp:i64=sys_now_realtime_sec()+60;var nonce:i64=18
9 if kind==4 || kind==6{scope="other_tool"};if kind==3{exp=sys_now_realtime_sec()-1};if kind==5{nonce=17}
10 var cn:i64=capt_issue(secret,sl[0],scope,ta_slen(scope),exp,nonce,cap,1024);if cn<=0{return 1}
11 if kind==2{cap[0]=88 as u8}
12 rn=ta_cat(req,rn,"X-Nishi-Cap: ");rn=ta_catb(req,rn,cap,cn);rn=ta_cat(req,rn,"\r\n")
13 if kind==6{bn=ta_cat(body,bn,",\"_cap\":\"invalid-first-presenter\"")}
14 }
15 rn=ta_cat(req,rn,"\r\n");bn=ta_cat(body,bn,"}")
16 let out:*u8=sys_mmap(1048576);let start:i64=ta_cat(out,0,"{\"jsonrpc\":\"2.0\",\"id\":");var at:i64=ta_catn(out,start,kind)
17 let n:i64=ta_mcp_call(TA_TOOLPFX,req,rn,body,bn,out,at)
18 sys_write(1,out,n);sys_write(1,"\n",1)
19 if kind==1{if rc_has(out,n,"-32001")==1{return 1};if rc_has(out,n,"capability-authorized")!=1{return 1};return 0}
20 if rc_has(out,n,want)!=1 || rc_has(out,n,action)!=1 || rc_has(out,n,message)!=1{return 1}
21 if rc_has(out,n,"\"dispatched\":false")!=1{return 1}
22 if kind==4{if rc_has(out,n,"/api/cap/mint")!=1{return 1}}else{if rc_has(out,n,"/api/cap/mint")==1{return 1}}
23 if kind==6{if rc_has(out,n,"\"presenter_count\":2")!=1{return 1};if rc_has(out,n,"first-presenter-failure")!=1{return 1}}
24 else{if kind!=0{if rc_has(out,n,"single-presenter")!=1{return 1}}}
25 if rc_has(out,n,"invalid-first-presenter")==1{return 1}
26 return 0
27}
28func main()->i64{
29 let path:*u8=sys_mmap(256);var pn:i64=ta_cat(path,0,"/tmp/nishi-auth-recovery-t316-");pn=ta_catn(path,pn,sys_now_ms());path[pn]=0 as u8
30 if sys_mkdir(path,448)!=0{return 2};if sys_chdir(path)!=0{return 2}
31 if ta_append_revoked(17)!=0{return 3}
32 var fails:i64=0
33 fails=fails+rc_fixture(0,"capability-absent","present-existing-authorized-credential","No capability was presented")
34 fails=fails+rc_fixture(2,"signature-or-format-invalid","correct-presentation-check-provenance","invalid signature or format")
35 fails=fails+rc_fixture(3,"capability-expired","obtain-valid-credential-under-renewal-policy","has expired")
36 fails=fails+rc_fixture(4,"tool-not-granted","review-exact-tool-grant-policy","lacks this tool grant")
37 fails=fails+rc_fixture(5,"capability-revoked","investigate-revocation-before-reauthorization","was revoked")
38 fails=fails+rc_fixture(6,"signature-or-format-invalid","inspect-all-presenter-failures","Multiple credentials")
39 fails=fails+rc_fixture(1,"","","")
40 let out:*u8=sys_mmap(8192);let start:i64=ta_cat(out,0,"{\"jsonrpc\":\"2.0\",\"id\":12")
41 let n:i64=ta_cap_deny(out,start,"nx_txtscan",10,0-12,1);sys_write(1,out,n);sys_write(1,"\n",1)
42 if rc_has(out,n,"inspect-verifier")!=1 || rc_has(out,n,"unclassified reason")!=1 || rc_has(out,n,"/api/cap/mint")==1{fails=fails+1}
43 if fails==0{sys_write(1,"RECOVERY-GATE PASS 8 cases\n",27);return 0}
44 sys_write(1,"RECOVERY-GATE FAIL\n",19);return 1
45}