nx_vault_auth_test.nx source

1// nx_vault_auth_test.nx -- AUTHGATE: proves multi-auth methods end-to-end. Principals: a token, a userpass 2// user, an approle role -- each mapped to a policy. GREEN iff: each method logs in to its correct policy; 3// wrong secret / wrong method / unknown id all DENY; and the issued session is BOTH lease-bound (valid in 4// ttl, expired after -- composes nx_vault_lease) AND policy-bound (its ACL policy actually gates a path -- 5// composes nx_vault_acl). exit 0 on 7/7. 6import "nx_vault_auth.nx" 7import "nx_vault_acl.nx" 8import "nx_syscalls.nx" 9 10func ug_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 } 11func ug_num(v: i64) -> i64 { let b: *u8 = sys_mmap(28); var m: i64=v; if m<0 {m=0-m;sys_write(1,"-" as *u8,1)}; let t: *u8 = sys_mmap(28); var k: i64=0; if m==0 {t[0]=48;k=1}; while m>0 {t[k]=48+(m%10); m=m/10; k=k+1}; var i: i64=0; while i<k {b[i]=t[k-1-i]; i=i+1}; sys_write(1,b,k); return 0 } 12 13func main() -> i64 { 14 ug_puts("=== SOVEREIGN MULTI-AUTH (token / userpass / approle -> policy+lease-bound session) ===\n" as *u8) 15 let n: i64 = 3 16 let methods: *i64 = sys_mmap(24) as *i64 17 let id_h: *i64 = sys_mmap(24) as *i64 18 let sec_h: *i64 = sys_mmap(24) as *i64 19 let policy: *i64 = sys_mmap(24) as *i64 20 methods[0] = AM_TOKEN; id_h[0] = 0; sec_h[0] = 700001; policy[0] = 10 21 methods[1] = AM_USERPASS; id_h[1] = 800002; sec_h[1] = 800003; policy[1] = 20 22 methods[2] = AM_APPROLE; id_h[2] = 900004; sec_h[2] = 900005; policy[2] = 30 23 24 let lt: i64 = auth_login(methods, id_h, sec_h, policy, n, AM_TOKEN, 0, 700001) // token ok -> 10 25 let lu: i64 = auth_login(methods, id_h, sec_h, policy, n, AM_USERPASS, 800002, 800003) // userpass ok -> 20 26 let la: i64 = auth_login(methods, id_h, sec_h, policy, n, AM_APPROLE, 900004, 900005) // approle ok -> 30 27 let bad_sec: i64 = auth_login(methods, id_h, sec_h, policy, n, AM_USERPASS, 800002, 999999) // wrong pass -> -1 28 let bad_mth: i64 = auth_login(methods, id_h, sec_h, policy, n, AM_APPROLE, 800002, 800003) // userpass creds as approle -> -1 29 let bad_id: i64 = auth_login(methods, id_h, sec_h, policy, n, AM_USERPASS, 111111, 800003) // unknown user -> -1 30 31 // session for the token login: issued 2000, ttl 50 32 let sv_mid: i64 = auth_session_valid(2030, 2000, 50) // within ttl 33 let sv_exp: i64 = auth_session_valid(2100, 2000, 50) // after ttl 34 35 // policy 10 (the token's policy) ruleset: grants READ on kv/ -> prove the session's policy gates a path 36 let p10p: *i64 = sys_mmap(8) as *i64 37 let p10l: *i64 = sys_mmap(8) as *i64 38 let p10d: *i64 = sys_mmap(8) as *i64 39 let p10c: *i64 = sys_mmap(8) as *i64 40 p10p[0] = ("kv/" as *u8) as i64; p10l[0] = 3; p10d[0] = 0; p10c[0] = CAP_READ 41 let acl_read: i64 = acl_eval(p10p, p10l, p10d, p10c, 1, "kv/secret" as *u8, 9, CAP_READ) // allow 42 let acl_write: i64 = acl_eval(p10p, p10l, p10d, p10c, 1, "kv/secret" as *u8, 9, CAP_WRITE) // deny 43 44 ug_puts(" token->" as *u8); ug_num(lt); ug_puts(" userpass->" as *u8); ug_num(lu); ug_puts(" approle->" as *u8); ug_num(la) 45 ug_puts(" | wrong_sec=" as *u8); ug_num(bad_sec); ug_puts(" wrong_method=" as *u8); ug_num(bad_mth); ug_puts(" unknown_id=" as *u8); ug_num(bad_id) 46 ug_puts(" | session valid@2030=" as *u8); ug_num(sv_mid); ug_puts(" @2100=" as *u8); ug_num(sv_exp); ug_puts("\n" as *u8) 47 48 let r: *i64 = sys_mmap(8*8) as *i64 49 r[0] = 0; if lt == 10 { r[0] = 1 } // token -> its policy 50 r[1] = 0; if lu == 20 { r[1] = 1 } // userpass -> its policy 51 r[2] = 0; if la == 30 { r[2] = 1 } // approle -> its policy 52 r[3] = 0; if bad_sec == (0 - 1) { r[3] = 1 } // wrong secret denied 53 r[4] = 0; if bad_mth == (0 - 1) { r[4] = 1 } // wrong method denied 54 r[5] = 0; if bad_id == (0 - 1) { r[5] = 1 } // unknown id denied 55 r[6] = 0; if sv_mid == 1 { if sv_exp == 0 { if acl_read == 1 { if acl_write == 0 { r[6] = 1 } } } } // session lease+policy bound 56 57 var pass: i64 = 0; var i: i64 = 0 58 while i < 7 { pass = pass + r[i]; i = i + 1 } 59 ug_puts("----\n passed " as *u8); ug_num(pass); ug_puts("/7\n" as *u8) 60 if pass == 7 { 61 ug_puts("AUTHGATE methods=token+userpass+approle policy_bound=1 lease_bound=1 wrong_secret_denied=1 wrong_method_denied=1 unknown_id_denied=1 exceed[sovereign auth methods -> session bound to ACL policy (nx_vault_acl) + lease (nx_vault_lease) = HashiCorp auth-methods-class; prod hashes via nx_sha256] verdict=GREEN\n" as *u8) 62 sys_exit(0); return 0 63 } 64 ug_puts("AUTHGATE verdict=RED\n" as *u8); sys_exit(1); return 1 65}