code wiki / hub / nx_admin_login_flow.nx

nx_admin_login_flow.nx

buildroot/runtime/hub/nx_admin_login_flow.nx

24400 B538 linesdepth 3pulls 8 transitivereach 2 importersview sourcekind library
docsdependenciesstructsconstsfunctions

about

nx_admin_login_flow.nx -- composable admin-login state machine. COMPOSES (per NISHI_SMALL_SHARP_COMPOSABLE_STANDARD §4.1 M7): nx_basic_auth challenge + verify (RFC 7617) nx_http_session opaque-token + Set-Cookie / Cookie I/O nx_kv_store session storage (caller-allocated; FNV-1a indexed) nx_hash_facade password hash + compare (V1 non-cryptographic; V2 upgrade per honest-stub discipline below) COMPOSED BY (suggested wirings; each ~50-100 lines per site): wiki/nx_wiki_admin_wiring.nx /wiki/admin route (future) obd-config/nx_obd_admin_wiring.nx (future) sprinkler-config/nx_spk_admin_wiring.nx (future) any operator-built site needing admin login Status: V1 SEED. 2026-05-27. SITE-AGNOSTIC HUB PRIMITIVE per NISHI_SMALL_SHARP_COMPOSABLE_STANDARD §4.1 M3. No wiki / OBD / sensor assumption baked in; the flow is reusable for any site the operator wants to build admin login for. WINNER-TIER: BASELINE-C provisional (V1 hash is non-cryptographic by deliberate scope limit per honest-stub discipline; V2 promotes to WINNER-S after argon2id NishiLang impl ships) INCUMBENTS: Devise (Ruby), Passport.js (Node), Spring Security (Java), django.contrib.auth (Python), Flask-Login, Authlib (Python OAuth-bias) NUMBERS: V1 ships the flow + state machine; paired login- latency bench vs Flask-Login + Devise pending real user-flow fixture GAP: all incumbents include password reset / 2FA / role-based ACL / OAuth-callback handlers in V1; this flow ships JUST the admin-login state machine (V1 single-admin; V2 multi-user; V3 reset/2FA). Trade-off: small + sharp + composable per the standard vs framework-style bundle PLAN: M-next: argon2id NishiLang impl (replaces FNV-1a password hash); add session-cleanup-cron + 2FA when operator needs them EXEMPTION REASON: n/a; provisional pending measurement

dependencies 5 imports · 2 importers

nx_syscalls.nx nx_basic_auth.nx nx_http_session.nx nx_kv_store.nx nx_hash_facade.nx nx_admin_login_flow.nx nx_wiki_https_daemon.nx nx_wiki_main.nx

imports: nx_syscalls.nxnx_basic_auth.nxnx_http_session.nxnx_kv_store.nxnx_hash_facade.nx

imported by: nx_wiki_https_daemon.nxnx_wiki_main.nx

structs

111struct NxAdminLoginConfig {
157struct NxAdminLoginRequest {
183struct NxAdminLoginResponse {

consts

67const NX_ALOGIN_OK: i64 = 0
68const NX_ALOGIN_BAD_CONFIG: i64 = 1000
69const NX_ALOGIN_BAD_REQUEST: i64 = 1001
70const NX_ALOGIN_BUF_OVERFLOW: i64 = 1002
71const NX_ALOGIN_HASH_FAILED: i64 = 1003
72const NX_ALOGIN_KV_OOM: i64 = 1004
73const NX_ALOGIN_WEAK_HASH_WARNING: i64 = 1005
74const NX_ALOGIN_NOT_IMPLEMENTED: i64 = 1006
77const NX_ALOGIN_STATE_ALLOW: i64 = 0 // valid session; allow protected access
78const NX_ALOGIN_STATE_CHALLENGE: i64 = 1 // no creds / no session; emit 401 + WWW-Authenticate
79const NX_ALOGIN_STATE_DENY: i64 = 2 // bad creds; emit 401 (no challenge to avoid info leak)
80const NX_ALOGIN_STATE_SESSION_NEW: i64 = 3 // creds verified; new session created (caller emits Set-Cookie + 200)
81const NX_ALOGIN_STATE_LOGOUT_OK: i64 = 4 // session invalidated (caller emits Set-Cookie expire + 200)
82const NX_ALOGIN_STATE_N_KINDS: i64 = 5
91const NX_ALOGIN_MAX_USERNAME_LEN: i64 = 64
92const NX_ALOGIN_MAX_PASSWORD_LEN: i64 = 256
93const NX_ALOGIN_MAX_REALM_LEN: i64 = 128
94const NX_ALOGIN_SESSION_TOKEN_LEN: i64 = 32 // hex chars per nx_http_session
95const NX_ALOGIN_SESSION_TOKEN_RAW_BYTES: i64 = 16 // 128-bit entropy
96const NX_ALOGIN_MAX_AUTH_HEADER_LEN: i64 = 1024
97const NX_ALOGIN_MAX_COOKIE_HEADER_LEN: i64 = 4096
98const NX_ALOGIN_DEFAULT_SESSION_MAX_AGE_S: i64 = 1800 // 30 min per nx_http_session default
99const NX_ALOGIN_SESSION_VALUE_BYTES: i64 = 64 // session-record payload (timestamp + user-id + flags)
102const NX_ALOGIN_ASCII_LF: i64 = 0x0A
103const NX_ALOGIN_ASCII_CR: i64 = 0x0D
104const NX_ALOGIN_ASCII_SP: i64 = 0x20
225const NX_ALOGIN_REC_OFF_CREATED: i64 = 0
226const NX_ALOGIN_REC_OFF_EXPIRES: i64 = 8
227const NX_ALOGIN_REC_OFF_USER_HASH: i64 = 16
228const NX_ALOGIN_REC_RESERVED_BYTES: i64 = 40
397const NX_ALOGIN_COOKIE_NAME: *u8 = "nishi_sess" as *u8
398const NX_ALOGIN_COOKIE_NAME_N: i64 = 10

functions

84func nx_alogin_state_is_valid(s: i64) -> i64 {
129func nx_admin_login_config_init(cfg: *NxAdminLoginConfig,
called by 2: mainmain
206func nx_alogin_bytes_eq(a: *u8, a_n: i64, b: *u8, b_n: i64) -> i64 {
called by 1: nx_alogin_verify_credentials
230func nx_alogin_session_encode(out: *u8, out_cap: i64,
called by 1: nx_alogin_create_session calls 1: nxkv_put_i64_be
246func nx_alogin_session_decode_expires(rec: *u8, rec_n: i64) -> i64 {
called by 1: nx_alogin_validate_session calls 1: nxkv_get_i64_be
255func nx_alogin_emit_challenge(cfg: *NxAdminLoginConfig,
called by 1: nx_admin_login_handle
292func nx_alogin_verify_credentials(cfg: *NxAdminLoginConfig,
called by 1: nx_admin_login_handle calls 5: sys_mmapbasic_auth_decodenx_alogin_bytes_eqnx_hash_facade_compute_bytesnx_hash_facade_compare
334func nx_alogin_create_session(cfg: *NxAdminLoginConfig,
called by 1: nx_admin_login_handle calls 6: sys_mmapnx_http_session_token_from_bytesnx_hash_facade_compute_bytesnx_alogin_session_encodenx_kv_store_putnx_http_session_emit_set_cookie_default
400func nx_alogin_validate_session(cfg: *NxAdminLoginConfig,
called by 1: nx_admin_login_handle calls 5: sys_mmapnx_http_session_parse_cookienxss_validate_token_hexnx_kv_store_getnx_alogin_session_decode_expires
483func nx_admin_login_handle(cfg: *NxAdminLoginConfig,
calls 5: nx_alogin_emit_logout_cookienx_alogin_validate_sessionnx_alogin_emit_challengenx_alogin_verify_credentialsnx_alogin_create_session