nx_api_edge.nx

buildroot/runtime/nx_api_edge.nx

13025 B230 linesdepth 9pulls 24 transitivereach 1 importersview sourcekind tooltopic api

docs dependencies structs consts functions

about

nx_api_edge.nx -- the REAL s-class hardening edge for the live agent-facing API (nx_tools_api on :18096, public as <domain>/api/tools + /mcp). WIRES the API-hardening capabilities that existed only as unwired island primitives + a hardcoded-secret DRAFT gateway (nx_api_gateway) into ONE real HTTP middleware that wraps ta_handle. NON-BREAKING by construction: it does NOT touch the cap-token execution auth (capt_verify still guards tools/call) nor block the open read-only catalog -- it ADDS, per request: * CORS deny-by-default (OPTIONS preflight -> 204; Access-Control-* only for allowlisted origins) * security headers on every response (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, HSTS) * a REAL token-bucket rate limit (monotonic-clock refill; 429 problem+json over budget) = DoS guard * RFC 9457 application/problem+json for edge errors (429, 413) This is the composition the apistack gates proved in isolation, now on the LIVE request path. license_tier: ORIGINAL genealogy_id: international-research-sources/ietf/rfc_6454_cors + rfc_9457_problem

dependencies 2 imports · 1 importers

imports: nx_syscalls.nxnx_tools_api.nx

imported by: nx_tools_api_serve.nx

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

structs

none

consts

14	const EDGE_MAGIC_1000000000: i64 = 1000000000
15	const EDGE_MAGIC_1000000: i64 = 1000000
17	const EDGE_RESP_CAP: i64 = 1048576
18	const EDGE_REQ_MAX: i64 = 65535 // matches the serve loop's read cap; >= this = truncated -> 413
22	const TB_CAP_MILLI: i64 = 300000 // 300 tokens * 1000
23	const TB_RATE_PER_S: i64 = 30 // sustained refill tokens/second

functions

27	func edge_now_ns() -> i64 called by 1: edge_tb_allow calls 1: sys_mmap
34	func edge_tb_allow() -> i64 called by 1: nx_api_edge_handle calls 1: edge_now_ns
48	func edge_cpy(dst: u8, doff: i64, src: u8, n: i64) -> i64 { var i: i64 = 0; while i < n { dst[doff + i] = src[i]; i = i + 1 } return doff + n } called by 2: edge_origin_allowed nx_api_edge_handle
52	func edge_find_header(req: u8, req_n: i64, name: u8, name_len: i64, vo: *i64) -> i64 called by 1: edge_origin_allowed
74	func edge_origin_allowed(req: u8, req_n: i64, vo: i64) -> i64 called by 1: nx_api_edge_handle calls 5: edge_find_header ta_streq_n ta_cat ta_catn edge_cpy
85	func edge_sec_headers(out: *u8, o: i64) -> i64
94	func edge_inject(resp: u8, resp_len: i64, out: u8, req: *u8, req_n: i64) -> i64 called by 2: main tsv_serve_one calls 8: sys_mmap ta_reqline ta_streq_n ta_cat edge_origin_allowed edge_cpy+2
114	func edge_problem(out: u8, status_line: u8, ptype: u8, title: u8, status: i64, detail: *u8) -> i64
131	func nx_api_edge_handle(req: u8, req_n: i64, out: u8) -> i64
169	func edge_w(s: *u8) -> i64 { sys_write(1, s, ta_slen(s)); return 0 }
170	func edge_row(name: u8, ok: i64) -> i64 { if ok == 1 { edge_w(" PASS " as u8) } else { edge_w(" FAIL " as u8) } edge_w(name); edge_w("\n" as u8); return ok }
172	func edge_has(hay: u8, hn: i64, needle: u8) -> i64
185	func main() -> i64