nx_torrent_authn_gate.nx source

1// nx_torrent_authn_gate.nx -- referee for the R3 session->level resolver (real OPAQUE, synthetic realm). 2// Stands up a LIGHT-argon test realm; registers operator/family/stranger. PROVISIONS the roles registry BY 3// HANDLE via tau_cred_id (operator=3, family=1; stranger ABSENT) -- the derive-from-handle path. Then logs 4// each in to mint REAL Ed25519 tokens and drives tau_level. The crucial property: the id derived from a 5// HANDLE (provisioning) equals the id a LOGIN TOKEN resolves to (runtime) -- so a by-handle-provisioned row 6// actually grants the level at runtime. PROVES deny-by-default end to end: 7// operator token -> 3 family token -> 1 no token -> 0 garbage -> 0 8// VALID token w/ NO provisioned role (stranger) -> 0 (leak-check) operator via ngs COOKIE -> 3 9// GREEN iff every row matches. Prints verdict=GREEN to STDOUT *and* returns the exit code. 10// Durable -> knowledge/status/torrent_authn_gate.log. license_tier: ORIGINAL 11import "nx_torrent_authn.nx" 12import "nx_opaque_login.nx" 13import "nx_syscalls.nx" 14 15func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 16func g_num(v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(1,bb,k); return 0 } 17func g_w(fd: i64, s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(fd,s,n); return 0 } 18func g_wn(fd: i64, v: i64) -> i64 { let bb: *u8=sys_mmap(28); var m: i64=v; if m<0{m=0-m}; let t: *u8=sys_mmap(28); var k: i64=0; if m==0{t[0]=(48 as u8);k=1}; while m>0{t[k]=((48+(m%10)) as u8);m=m/10;k=k+1}; var i: i64=0; while i<k{bb[i]=t[k-1-i];i=i+1}; sys_write(fd,bb,k); return 0 } 19func rput(dst: *u8, off: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ dst[off+i]=s[i]; i=i+1 } return off+i } 20func rlen(s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){i=i+1} return i } 21func gwrite(path: *u8, s: *u8, n: i64) -> i64 { let fd: i64 = sys_openat_wr(path, 0x1a4); if fd<0 { return 0 } if n>0 { sys_write(fd, s, n) } sys_close(fd); return 0 } 22func chk(got: i64, want: i64, label: *u8) -> i64 { 23 g_puts(" "); g_puts(label); g_puts(" got="); g_num(got); g_puts(" want="); g_num(want) 24 if got == want { g_puts(" PASS\n"); return 1 } 25 g_puts(" FAIL\n"); return 0 26} 27// mint a token for handle into tok (NUL-terminated). returns login status. 28func mint(ctx: *NxAuthContext, handle: *u8, hn: i64, pw: *u8, pwn: i64, tok: *u8) -> i64 { 29 let tn: *i64 = sys_mmap(16) as *i64; tn[0] = 0 30 let rc: i64 = olg_login(ctx, handle, hn, pw, pwn, tok, 1023, tn) 31 tok[tn[0]] = 0 as u8 32 return rc 33} 34 35func main() -> i64 { 36 g_puts("=== TORRENT AUTHN GATE (R3: OPAQUE session -> roles level, deny-by-default) ===\n" as *u8) 37 var pass: i64=0 38 var rows: i64=0 39 40 let keys: *u8 = "/tmp/nx_tauG_keys" as *u8 41 let store: *u8 = "/tmp/nx_tauG_store" as *u8 42 let roles: *u8 = "/tmp/nx_tauG_roles" as *u8 43 let realm: *u8 = "nishi_hub_test" as *u8 44 let realm_n: i64 = 14 45 let pw: *u8 = "hub-pass-123456" as *u8; let pwn: i64 = 15 46 47 gwrite(store, "" as *u8, 0) // fresh account store (idempotent re-runs) 48 49 let ctx: *NxAuthContext = sys_mmap(256) as *NxAuthContext 50 rows=rows+1; pass=pass+chk(olg_ctx_setup(ctx, keys, store, realm, realm_n, realm, realm_n, 8192, 1, 1), 0, "ctx setup (light argon)" as *u8) 51 52 let mn: *u8 = sys_mmap(1024); let mnn: *i64 = sys_mmap(16) as *i64 53 rows=rows+1; pass=pass+chk(olg_register(ctx, "operator" as *u8, 8, pw, pwn, mn, 1023, mnn), NX_MAUTH_OK, "register operator" as *u8) 54 rows=rows+1; pass=pass+chk(olg_register(ctx, "family" as *u8, 6, pw, pwn, mn, 1023, mnn), NX_MAUTH_OK, "register family" as *u8) 55 rows=rows+1; pass=pass+chk(olg_register(ctx, "stranger" as *u8, 8, pw, pwn, mn, 1023, mnn), NX_MAUTH_OK, "register stranger" as *u8) 56 57 // PROVISION via NISHI HR (the user-management SSOT) BY HANDLE: enroll operator=3 + family=1; stranger NOT enrolled. 58 gwrite(roles, "" as *u8, 0) // fresh HR store (the "roles" path is now the HR directory) 59 let op_hex: *u8 = sys_mmap(160); let fam_hex: *u8 = sys_mmap(160) 60 rows=rows+1; pass=pass+chk(hr_enroll(roles, realm, realm_n, "operator" as *u8, 8, 3, "hub" as *u8, 1, "gate" as *u8, op_hex), 0, "HR enroll operator(3)" as *u8) 61 rows=rows+1; pass=pass+chk(hr_enroll(roles, realm, realm_n, "family" as *u8, 6, 1, "hub" as *u8, 1, "gate" as *u8, fam_hex), 0, "HR enroll family(1)" as *u8) 62 63 // mint REAL login tokens (runtime path). 64 let tok_op: *u8 = sys_mmap(1024); rows=rows+1; pass=pass+chk(mint(ctx, "operator" as *u8, 8, pw, pwn, tok_op), NX_MAUTH_OK, "login operator -> token" as *u8) 65 let tok_fam: *u8 = sys_mmap(1024); rows=rows+1; pass=pass+chk(mint(ctx, "family" as *u8, 6, pw, pwn, tok_fam), NX_MAUTH_OK, "login family -> token" as *u8) 66 let tok_str: *u8 = sys_mmap(1024); rows=rows+1; pass=pass+chk(mint(ctx, "stranger" as *u8, 8, pw, pwn, tok_str), NX_MAUTH_OK, "login stranger -> token" as *u8) 67 68 let tsb: *i64 = sys_mmap(16) as *i64; tsb[0]=0; sys_clock_gettime_real(tsb); let now: i64 = tsb[0] 69 70 // operator token (header) -> 3 (proves derive-by-handle id == login-token id) 71 let rq: *u8 = sys_mmap(2048); var n: i64 = rput(rq, 0, "GET /torrent/api/add HTTP/1.1\r\nHost: x\r\nX-Nishi-Session: " as *u8); n = rput(rq, n, tok_op); n = rput(rq, n, "\r\n\r\n" as *u8) 72 rows=rows+1; pass=pass+chk(tau_level(rq, n, keys, store, roles, realm, realm_n, now), 3, "operator token (header) -> 3 OWNER" as *u8) 73 74 let rq2: *u8 = sys_mmap(2048); var n2: i64 = rput(rq2, 0, "GET /torrent/api/add HTTP/1.1\r\nX-Nishi-Session: " as *u8); n2 = rput(rq2, n2, tok_fam); n2 = rput(rq2, n2, "\r\n\r\n" as *u8) 75 rows=rows+1; pass=pass+chk(tau_level(rq2, n2, keys, store, roles, realm, realm_n, now), 1, "family token (header) -> 1 FAMILY" as *u8) 76 77 let rq3: *u8 = sys_mmap(512); let n3: i64 = rput(rq3, 0, "GET /torrent/api/add HTTP/1.1\r\nHost: x\r\n\r\n" as *u8) 78 rows=rows+1; pass=pass+chk(tau_level(rq3, n3, keys, store, roles, realm, realm_n, now), 0, "NO token -> 0 ANON (deny)" as *u8) 79 80 let rq4: *u8 = sys_mmap(512); let n4: i64 = rput(rq4, 0, "GET /t HTTP/1.1\r\nX-Nishi-Session: not-a-real-token!!\r\n\r\n" as *u8) 81 rows=rows+1; pass=pass+chk(tau_level(rq4, n4, keys, store, roles, realm, realm_n, now), 0, "garbage token -> 0 (deny)" as *u8) 82 83 let rq5: *u8 = sys_mmap(2048); var n5: i64 = rput(rq5, 0, "GET /t HTTP/1.1\r\nX-Nishi-Session: " as *u8); n5 = rput(rq5, n5, tok_str); n5 = rput(rq5, n5, "\r\n\r\n" as *u8) 84 rows=rows+1; pass=pass+chk(tau_level(rq5, n5, keys, store, roles, realm, realm_n, now), 0, "VALID token, NO provisioned role -> 0 (LEAK-CHECK)" as *u8) 85 86 let rq6: *u8 = sys_mmap(2048); var n6: i64 = rput(rq6, 0, "GET /torrent/stream/x HTTP/1.1\r\nCookie: sid=abc; ngs=" as *u8); n6 = rput(rq6, n6, tok_op); n6 = rput(rq6, n6, "; foo=bar\r\n\r\n" as *u8) 87 rows=rows+1; pass=pass+chk(tau_level(rq6, n6, keys, store, roles, realm, realm_n, now), 3, "operator token via ngs COOKIE -> 3 (media transport)" as *u8) 88 89 g_puts("----\nTORRENT-AUTHN-GATE rows=" as *u8); g_num(rows); g_puts(" pass=" as *u8); g_num(pass) 90 if pass==rows { g_puts(" verdict=GREEN\n" as *u8) } else { g_puts(" verdict=RED\n" as *u8) } 91 let lg: i64=sys_openat_append("knowledge/status/torrent_authn_gate.log" as *u8, 0x1a4) 92 if lg>=0 { 93 g_w(lg, "TORRENT-AUTHN-GATE rows=" as *u8); g_wn(lg, rows); g_w(lg, " pass=" as *u8); g_wn(lg, pass) 94 if pass==rows { g_w(lg, " verdict=GREEN\n" as *u8) } else { g_w(lg, " verdict=RED\n" as *u8) } 95 sys_close(lg) 96 } 97 if pass==rows { sys_exit(0); return 0 } 98 sys_exit(1); return 1 99}